Free Paloalto Networks SSE-Engineer Practice Exam with Questions & Answers | Set: 2

With the IPSec tunnel already established, the underlying transport connectivity is confirmed to be working correctly, which narrows the troubleshooting focus specifically to the BGP session parameters themselves rather than network reachability. Two configuration values are the most common and immediate causes of a BGP peer failing to come up even over a healthy tunnel: the MD5 authentication secret, if BGP authentication is enabled on either side, must match exactly between Prisma Access and the customer ' s CPE, since any mismatch causes the peer session to be silently rejected during the initial OPEN message exchange, matching option A. Equally critical is the Peer AS Number — if the AS number configured on either the Prisma Access side or the CPE side does not match what the other side expects for that specific peering relationship, the BGP session will never successfully establish, regardless of how correctly every other setting is configured, matching option C. MRAI (Minimum Route Advertisement Interval) timers, referenced in option B, govern how frequently route updates are sent once a BGP session is already established and exchanging routes — they have no bearing on whether the initial peer session comes up in the first place, making them irrelevant to this specific symptom. The Advertise Default Route checkbox (option D) controls whether Prisma Access advertises a 0.0.0.0/0 route once peering is functional; it is a route-advertisement behavior setting, not a prerequisite for the BGP peer session itself to establish.

The reported symptom — traffic intermittently falling through to the bottom Catch-All Deny rule, bypassing the HIP-based policy that should be matching first, and being resolved simply by refreshing the VPN connection — is a classic signature of stale or lost user-to-IP mapping combined with expired HIP state, rather than a fundamental policy configuration error, which is why refreshing the session (forcing re-authentication and a fresh HIP report) restores correct behavior. If user mapping for the connected session is being learned or refreshed from a source other than the gateway ' s own authentication event (for example, User-ID redistribution or another mapping source with different timing or reliability characteristics than the gateway ' s native session state), that mapping can become inconsistent with the live GlobalProtect session, causing the HIP-enforced rule ' s user-based match criteria to intermittently fail — this is option B. Separately, the firewall periodically expects HIP report checks from the connected endpoint to keep its HIP-based match state current; if a report check is missed due to a client-side timing issue or transient connectivity blip, the firewall can lose the HIP match state for that session even though the tunnel itself remains up, causing subsequent traffic to fail HIP-based rule matching and fall through to the deny-all rule — this is option C. " Collect HIP data " not being enabled (option A) would cause a total, consistent failure to match HIP-based policy from the outset, not the intermittent pattern described. A time-of-day schedule on the HIP rule (option D) would produce a predictable, not intermittent and refresh-resolved, pattern of denial.

Certificate pinning is a well-documented, expected source of SSL decryption failures on any inline TLS proxy, including the Prisma Access decryption engine. When an application (in this case, one interacting with google.com endpoints) has pinned the exact certificate or public key it expects from the origin server, it will reject the substitute certificate that Prisma Access presents during man-in-the-middle SSL Forward Proxy decryption, even though that substitute certificate is validly signed by the organization ' s trusted forward-trust CA. This produces the decrypt error log entries referencing the failed hostname, and the server-side certificate pinning behavior is the root cause described in option C. Because pinning cannot be bypassed by adjusting client trust stores or firewall decryption profiles, the only supported remediation is a policy-based exception: creating a Do Not Decrypt rule scoped to the affected hostname, google.com in this scenario, so that traffic to that specific destination bypasses SSL decryption entirely and the application ' s pinning check succeeds against the real origin certificate. Client misconfiguration (option A) is not supported by log entries that clearly attribute the failure to certificate validation against a known-pinning application. The certificates.godaddy.com reference in the log is incidental to the underlying trust chain being validated, not the actual site the user is browsing to, so a decrypt exclusion should be scoped to google.com, not to the CA hostname, making option D incorrect.

In a Prisma Access mobile user deployment using SAML through the Cloud Identity Engine, the Cloud Identity Engine — not Strata Cloud Manager directly — is the SAML service provider entity that actually exchanges metadata and assertions with the customer ' s IdP; Strata Cloud Manager ' s role is to reference the authentication profile the Cloud Identity Engine has already established, not to independently hold the SAML relationship with the IdP. The error message explicitly names " CIE-SAML " as the point of failure, which is a strong, direct indicator that the misconfiguration lives in the metadata exchange between the Cloud Identity Engine and the IdP specifically, rather than anywhere downstream in Strata Cloud Manager itself. A 400 Bad Request returned to the portal after IdP authentication typically points to a malformed or mismatched SAML assertion, entity ID, or ACS URL between these two specific parties, making a targeted review of CIE-to-IdP metadata (option C) the correct, root-cause-focused action, since the question also states that " URLs and certificates are correctly configured " from the general check already performed in option A ' s framing — pointing the investigation toward CIE specifically. Reviewing Security policy rules (option B) addresses network-layer reachability, not SAML protocol-level metadata errors, and would not explain a 400 Bad Request occurring after successful IdP login. Reviewing Authentication logs (option D) is a reasonable general diagnostic step but does not, by itself, identify the root cause the way directly verifying the CIE-to-IdP metadata configuration does.

Strata Logging Service retains logs independently of whether or not an external forwarding destination was reachable at the time they were generated, so no log data is actually lost during a syslog server outage — it simply was never forwarded during the disruption window. The mechanism designed to reconcile this gap is a replay profile: an administrator specifies the affected time range and associates that replay configuration with the relevant syslog server profile, and Strata Logging Service then resends every log that falls within that window to the external destination, effectively backfilling the outage period without requiring any manual export or reconstruction of the log set. This makes option A the correct, purpose-built remediation. Deleting and recreating the syslog server profile (option B) does nothing to recover the logs generated during the outage; it only affects the configuration used for logs going forward, and any pending backlog would still need to be replayed by other means. Manually exporting and importing logs (option C) is operationally burdensome, error-prone at scale, and unnecessary given that a native replay capability exists specifically to automate this exact recovery scenario. A log filter (option D) narrows which log types or attributes are forwarded going forward — it is a scoping mechanism, not a retransmission mechanism, and configuring one does not cause any historical, unforwarded logs to be resent.

Single sign-on for PAB users accessing public cloud SaaS applications is centrally brokered through the Cloud Identity Engine, which serves as the identity integration point between the organization ' s corporate IdP — Azure AD/Entra ID in this scenario — and the applications and services users access through PAB, rather than being handled by any browser-native or per-application mechanism. Establishing this Cloud Identity Engine-to-IdP integration is what allows the corporate authentication session and identity attributes to be recognized consistently and passed through automatically as the user navigates to sanctioned SaaS applications like Microsoft 365 via PAB, delivering the seamless SSO experience described in the question, which makes option D the essential, correct integration. There is no PAB feature involving direct integration with Microsoft ' s own Conditional Access policy engine as the SSO enablement mechanism (option A); Conditional Access is a Microsoft Entra-native capability that can complement an SSO deployment but is not itself the integration point that establishes SSO through PAB. A " browser-specific SSO extension " (option B) is not the documented architecture for how PAB delivers SSO to cloud applications — SSO is achieved through the identity broker relationship with Cloud Identity Engine, not through a separate extension component layered on top. Manually configuring individual user authentication tokens within the PAB profile (option C) is neither how SSO is designed to function nor a scalable or supported approach; it would defeat the purpose of automated, centrally managed single sign-on entirely.

The scenario deliberately asks for a control that balances two competing goals: real protection against a compromised or malicious BYOD endpoint, and minimal disruption to the legitimate user ' s day-to-day workflow, which is exactly the trade-off data masking and watermarking are designed to solve. Rather than outright blocking access to sensitive applications on unmanaged devices — an approach that satisfies the security goal but badly damages usability and productivity — PAB can permit the user to continue working normally inside the isolated browser session while dynamically masking sensitive on-screen data fields or overlaying a visible or forensic watermark tied to the user ' s identity. This preserves functional access (protecting the user experience) while still substantially reducing the value of any data captured through screenshots, screen-sharing, or a compromised endpoint, and it deters and traces leakage even when it cannot be entirely prevented. This makes option D the best-fit answer for " protect while minimizing user-experience impact. " Blocking file exchange (option A) and blocking elements like screen scrapers (option C) are legitimate, harder-line data-loss-prevention controls, but they represent an access-restriction posture that directly works against the " minimize impact on the user experience " requirement stated in the question, since users lose functionality outright. Session recording (option B) is a monitoring and forensic capability, not a preventive protection against data exposure in the moment, and does not itself reduce risk to the organization the way masking or watermarking does.

SSH is fundamentally different from a standard HTTP/HTTPS-based internal web application, since it is a non-web, terminal-based protocol, and PAB accommodates protocols like SSH and RDP through a distinct capability generally referred to as Remote Connections rather than the standard internal web application publishing workflow. Enabling Remote Connections is the prerequisite platform capability that allows PAB to broker non-web protocol sessions such as SSH at all, making option B a necessary first configuration step. Once that capability is enabled, the administrator must define the actual target system as a Remote Connection Application entry — specifying the internal host, port, and protocol (SSH in this case) the contractor needs to reach — and then build an Access & Data Control policy that authorizes the specific contractor or contractor group to reach that defined Remote Connection application entry, which is exactly what option C describes and is the configuration pairing that actually grants and governs the access. Option A describes " Internal Application entries " rather than " Remote Connection Application entries " — internal (web) application entries are the construct used for standard HTTP/HTTPS internal application publishing, not SSH, so this pairing misapplies the wrong application object type to a non-web protocol use case. Option D references " Internal Connections " as a toggle, which is not the correctly named capability for enabling non-web protocol brokering in PAB; the documented feature and terminology for SSH/RDP-style access is Remote Connections, not " Internal Connections. "

Embargo rules are a purpose-built, pre-defined Security policy rule construct in Prisma Access that lets an organization block inbound connection attempts — most commonly authentication attempts against the GlobalProtect portal, Explicit Proxy, or Remote Networks entry points — that originate from specific countries or regions, using Palo Alto Networks ' geolocation-based source address matching. Their defining behavior is unconditional blocking (a Drop action) of the specified source countries, which makes option C the accurate general description of their purpose; they exist to reduce attack surface against brute-force and credential-stuffing attempts by preventing connection attempts before normal identity-based Security policy would even be evaluated, since embargo rules are enforced as top-of-stack pre-rules using the reserved tag PA_predefined_embargo_rule. Option A is incorrect because embargo rules are a binary block mechanism, not a rate-limiting or throttling control — there is no partial-restriction behavior involved. Option B inverts the logic entirely; embargo rules are not an allow-list mechanism restricting traffic to only a permitted set of countries, they are a deny-list mechanism for specific countries while leaving all other geographies unaffected. Option D is too narrow and factually incorrect as a generalization: embargo rules are configurable for any country or region the organization chooses to specify, and are frequently used for the broader set of countries subject to export or sanctions restrictions, not a fixed three-country list.

Strata Cloud Manager ' s posture-based security checks are specifically designed to proactively enforce compliance at the point of configuration rather than after the fact: an administrator defines the compliance standards a policy must meet, and by setting the enforcement action on non-compliant checks to " deny, " SCM will actively prevent a junior engineer from committing or pushing a policy that violates those standards in the first place, functioning as a real-time guardrail rather than a retrospective audit. This directly satisfies the requirement to let junior engineers work independently while structurally preventing security-gap-introducing policies, making option A the correct, purpose-built mechanism. Option B describes a manual, workflow-heavy approach relying entirely on a senior engineer ' s diligence to catch every issue before enabling a rule; it is operationally viable but is a process control, not a platform-enforced compliance mechanism, and does not scale as well or as reliably as automated posture checks. Option C ' s auto-tagging-and-review-workflow approach is reactive rather than preventive — a policy tagged for review can still be committed and take effect before a senior engineer ever examines it, which does not prevent the security gap from existing, only flags it after the fact. There is no supported " proxy tagging methodology " feature for policy compliance enforcement in Strata Cloud Manager, making option D a fabricated and incorrect answer choice.