Palo Alto Networks Security Service Edge Engineer (SSE-Engineer) Free Practice Test

Question 1

When configuring Remote Browser Isolation (RBI) with Prisma Access (Managed by Strata Cloud Manager), which element is required to define the protected URLs for mobile users?

A. A URL access management profile with site access set to "Isolate" applied to a Security policy

B. A Security policy with the target URL categories and set the action to "Isolate"

C. A DNS Security profile applied to a Security policy with the action of "Isolate" for the target remote browser DNS categories

D. An RBI profile applied to the URL access management profile

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

All mobile users are unable to authenticate to Prisma Access (Managed by Strata Cloud Manager) using SAML authentication through the Cloud Identity Engine. Users report that after entering their credentials on the Identity Provider (IdP) login page, they are redirected to the Prisma Access portal without successful authentication, and they receive this error message:
Error: Prisma Access Portal Authentication Failed using CIE-SAML with message "400 Bad Request" Which action will identify the root cause of this error?

A. Verify the SAML metadata configuration in both the Cloud Identity Engine and the IdP portal to confirm that the endpoint URLs and certificates are correctly configured.

B. Review the Authentication logs in Strata Cloud Manager to check for any SAML error messages or authentication failures.

C. Verify the SAML metadata configuration in both Strata Cloud Manager and the IdP portal to confirm that the endpoint URLs and certificates are correctly configured.

D. Examine the Security policy rules in Prisma Access to ensure that traffic from the IdP is allowed and not blocked.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

An engineer deploys a new branch connected to Prisma Access. From the customer premises equipment (CPE) device at the branch, Phase 1 on the tunnel is established, but Phase 2-encrypted packets are not coming back from Prisma Access.
Which Strata Logging Service log facility should the engineer review to determine why Phase 2-encrypted traffic is not being received?

A. Traffic logs

B. System logs

C. Decrypt logs

D. Tunnel logs

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

How can an engineer verify that only the intended changes will be applied when modifying Prisma Access policy configuration in Strata Cloud Manager (SCM)?

A. Select the most recent job under Operations > Push Status to view the pending changes that would apply to Prisma Access.

B. Review the SCM portal for blue circular indicators next to each configuration menu item and ensure only the intended areas of configuration have this indicator.

C. Compare the candidate configuration and the most recent version under "Config Version Snapshots/

D. Open the push dialogue in SCM to preview all changes which would be pushed to Prisma Access.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

Strata Logging Service is configured to forward logs to an external syslog server; however, a month later, there is a disruption on the syslog server.
Which action will send the missing logs to the external syslog server?

A. Export the logs from Strata Logging Service, and then manually import them to the syslog server.

B. Delete the affected syslog server profile and create a new one.

C. Configure a log filter under the syslog server profile with the affected time range.

D. Configure a replay profile with the affected time range and associate it with the affected syslog server profile.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

How can a senior engineer use Strata Cloud Manager (SCM) to ensure that junior engineers are able to create compliant policies while preventing the creation of policies that may result in security gaps?

A. Use security checks under posture settings and set the action to "deny" for all checks that do not meet the compliance standards.

B. Run a Best Practice Assessment (BPA) at regular intervals and manually revert any policies not meeting company compliance standards.

C. Configure role-based access controls (RBACs) for all junior engineers to limit them to creating policies in a disabled state, manually review the policies, and enable them using a senior engineer role.

D. Configure an auto tagging rule in SCM to trigger a Security policy review workflow based on a security rule tag, then instruct junior engineers to use this tag for all new Security policies.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Palo Alto Networks Security Service Edge Engineer (SSE-Engineer) Free Practice Test