Palo Alto Networks PAN-SSEE Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-SSEE Online Questions & Answers

• Question 1:

  How can a network security team be granted full administrative access to a tenant's configuration while restricting access to other tenants by using role-based access control (RBAC) for Panorama Managed Prisma Access in a multitenant environment?

  A. Create an Access Domain and restrict access to only the Device Groups and Templates for the Target Tenant.
  B. Create a custom role enabling all privileges within the specific tenant's scope and assign it to the security team's user accounts.
  C. Create a custom role with Device Group and Template privileges and assign it to the security team's user accounts.
  D. Set the administrative accounts for the security team to the "Superuser" role.
  A. Create an Access Domain and restrict access to only the Device Groups and Templates for the Target Tenant.

  ---

  Explanation

  In a Panorama Managed Prisma Access multitenant environment Access Domains , provide granular role- based access control (RBAC) . By defining an Access Domain , the network security team can be granted full administrative privileges for a specific tenant's configuration while ensuring they cannot access or modify other tenants . This method enforces proper segmentation and ensures compliance with multitenant security policies .

• Question 2:

  An engineer deploys a new branch connected to Prisma Access. From the customer premises equipment (CPE) device at the branch, Phase 1 on the tunnel is established, but Phase 2-encrypted packets are not coming back from Prisma Access.

  Which Strata Logging Service log facility should the engineer review to determine why Phase 2-encrypted traffic is not being received?

  A. Decrypt logs
  B. System logs
  C. Traffic logs
  D. Tunnel logs
  D. Tunnel logs

  ---

  Explanation

  Since Phase 1 of the IPSec tunnel is established but Phase 2 traffic is not being received , the Tunnel logs in Strata Logging Service should be reviewed. Tunnel logs provide visibility into IPSec tunnel establishment, Phase 2 negotiation , and any errors or dropped packets related to encrypted traffic. This will help identify whetherESP (Encapsulating Security Payload) traffic is being blocked, mismatched security associations (SAs) exist, or if there are other issues with Prisma Access responding to Phase 2-encrypted packets.

• Question 3:

  Which feature ensures that sanctioned SaaS applications remain available even if the default cloud IP ranges change?

  A. Egress IP API automation
  B. Dynamic IP Pooling
  C. Cloud DNS Steering
  D. Geo-based Routing
  A. Egress IP API automation

  ---

  Explanation

  Egress IP API automation keeps SaaS allowlists up-to-date automatically by synchronizing IP changes from Prisma Access cloud regions.

• Question 4:

  What is the impact of selecting the "Disable Server Response Inspection" checkbox after confirming that a Security policy rule has a threat protection profile configured?

  A. Only HTTP traffic from the server to the client will bypass threat inspection.
  B. The threat protection profile will override the 'Disable Server Response Inspection1 only for HTTP traffic from the server to the client.
  C. All traffic from the server to the client will bypass threat inspection.
  D. The threat protection profile will override the 'Disable Server Response Inspection1 for all traffic from the server to the client.
  C. All traffic from the server to the client will bypass threat inspection.

  ---

  Explanation

  Selecting the "Disable Server Response Inspection" checkbox means that traffic flowing from the server to the client will not be inspected for threats, even if a threat protection profile is applied to the Security policy rule. This setting can reduce processing overhead but may expose the network to threats embedded in server responses, such as malware or exploits.

• Question 5:

  A large retailer has deployed all of its stores with the same IP address subnet. An engineer is onboarding these stores as Remote Networks in Prisma Access. While onboarding each store, the engineer selects the "Overlapping Subnets" checkbox.

  Which Remote Network flow is supported after onboarding in this scenario?

  A. To private applications
  B. To the internet
  C. To remote network
  D. To mobile users
  A. To private applications

  ---

  Explanation

  When the "Overlapping Subnets" checkbox is selected during the Remote Network onboarding process in Prisma Access, the deployment enables Private Application access using Prisma Access for Users(ZTNA or Private Access). This feature is designed to handle scenarios where multiple sites use the same IP subnet by leveraging NAT (Network Address Translation) and segmentation to avoid conflicts.

  Since overlapping subnets can create routing challenges for direct remote network-to-remote network communication, Prisma Access does not support Remote Network-to-Remote Network or Mobile User communication in this case. Private application access is supported as Prisma Access correctly routes requests based on application-layer intelligence rather than IP-based routing.

• Question 6:

  A company has four branch offices between Canada Central and Canada East which use the same IPSec termination node and have QoS configured with customized bandwidth per site. An engineer wants to onboard a new branch office on the same IPSec termination node.

  What is the QoS behavior for the new branch office?

  A. Automatically distributed to 25% for each site
  B. Unallocated until manually assigned
  C. Automatically distributed to 20% for each site
  D. Cannot be added to existing QoS configuration
  B. Unallocated until manually assigned

  ---

  Explanation

  When onboarding a new branch office to an existing IPSec termination node Prisma Access in , the QoS bandwidth is not automatically assigned . Instead, the newly added branch remains unallocated until the administrator manually assigns bandwidth within the QoS configuration settings . This ensures that customized bandwidth per site remains intact and allows for fine-tuned traffic management based on business needs.

• Question 7:

  Which Prisma Access feature allows secure connection for developers to internal APIs hosted in private data centers?

  A. ZTNA Connector
  B. Remote Networks
  C. App Acceleration
  D. DNS Security
  A. ZTNA Connector

  ---

  Explanation

  The ZTNA Connector establishes secure, identity-aware access to private applications or APIs without traditional VPNs, ensuring zero-trust access for developers.

• Question 8:

  How can role-based access control (RBAC) for Prisma Access (Managed by Strata Cloud Manager) be used to grant each member of a security team full administrative access to manage the Security policy in a single tenant while restricting access to other tenants in a multitenant deployment?

  A. Add the team to the Parent Tenant, select the Prisma Access Configuration Scope, and set the role to Security Administrator.
  B. Add the team to the Child Tenant, select All Apps and Services, and set the role to Security Administrator.
  C. Add the team to the Parent Tenant, select Prisma Access and NGFW Configuration, and set the role to Security Administrator.
  D. Add the team to the Child Tenant, select Prisma Access and NGFW Configuration, and set the role to Security Administrator.
  D. Add the team to the Child Tenant, select Prisma Access and NGFW Configuration, and set the role to Security Administrator.

  ---

  Explanation

  In a multitenant deployment , access control must be configured at the Child Tenant level to ensure that security administrators have full control over Security policy only within their assigned tenant while restricting access to other tenants. By selecting Prisma Access and NGFW Configuration , the assigned users gain full administrative access only for security policy management within the designated tenant, aligning with RBAC best practices for controlled access in Prisma Access Managed by Strata Cloud Manager .

• Question 9:

  In addition to creating a Security policy, how can an AI Access Security be used to prevent users from uploading financial information to ChatGPT?

  A. Apply File Blocking to stop file uploads containing financial information.
  B. Configure an Enterprise DLP rule to block uploads containing financial information.
  C. Add the ChatGPT domains using URL Filtering to block uploads containing financial information.
  D. Apply a vulnerability profile to stop attempts to exploit system flaws or gain unauthorized access to financial systems.
  B. Configure an Enterprise DLP rule to block uploads containing financial information.

  ---

  Explanation

  Palo Alto Networks AI Access Security integrates with Enterprise Data Loss Prevention (DLP) capabilities to control sensitive data within AI applications like ChatGPT. The most effective way to prevent users from uploading financial

  information is to:

  Define an Enterprise DLP rule:This rule would be configured to identify content that matches patterns or keywords associated with financial information (e.g., credit card numbers, bank account details, tax identifiers, financial statements).

  Apply the DLP rule to the AI Access Security policy:This policy would be specifically configured to inspect traffic to and from ChatGPT. When the DLP rule detects a user attempting to upload content containing financial information, it can take

  a defined action, such as blocking the upload.

  Let's analyze why the other options are incorrect based on official documentation:

  A. Apply File Blocking to stop file uploads containing financial information.While File Blocking can prevent the upload of certain file types, it is not content-aware. It cannot inspect the content of a file to determine if it contains financial information. Therefore, it's not a granular or effective solution for this specific requirement.

  C. Add the ChatGPT domains using URL Filtering to block uploads containing financial information.URL Filtering controls access to specific websites or categories of websites. While you could potentially block access to ChatGPT entirely, it does not provide the capability to inspect the content being uploaded to a permitted domain and prevent the transfer of sensitive financial data.

  D. Apply a vulnerability profile to stop attempts to exploit system flaws or gain unauthorized access to financial systems.Vulnerability profiles are designed to detect and prevent attempts to exploit known security vulnerabilities in systems. They are not designed to inspect the content of user uploads for sensitive data like financial information. While importantfor overall security, they do not directly address the requirement of preventing financial data uploads to ChatGPT.

  Therefore, configuring an Enterprise DLP rule within AI Access Security is the correct and most effective method to prevent users from uploading financial information to ChatGPT by inspecting the content of the uploads.

• Question 10:

  Which advanced AI-powered functionality does Strata Copilot provide to enhance the capabilities of Prisma Access security teams?

  A. Real-time traffic analysis for automated threat prevention
  B. Initial configuration of Prisma Access using a natural language interface
  C. Customized guidance for resolving issues through recommended next steps
  D. Automated remediation of misconfigured security policies
  C. Customized guidance for resolving issues through recommended next steps

  ---

  Explanation

  Strata Copilotenhances the capabilities of Prisma Access security teams by providing AI-powered insights and recommendations to help resolve security issues efficiently. It analyzes security events, misconfigurations, and alerts and offers contextual guidance with recommended next steps for troubleshooting and improving security posture. This assists teams inquickly identifying and addressing security challenges without requiring deep manual investigation.