I85PREP
⌘ K
SSE Engineer study materials
SSE Engineer study resources

SSE Engineer practice questions

One question at a time. Build your SSE Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Service Edge Fundamentals

In a Security Service Edge architecture, which capability is primarily responsible for inspecting TLS-encrypted traffic and enforcing data-loss-prevention policy on SaaS uploads?

  1. Firewall-as-a-service (FWaaS)
  2. Secure web gateway (SWG)
  3. Cloud access security broker (CASB) Correct answer.
  4. Zero trust network access (ZTNA)

Explanation

A CASB sits between users and cloud services, providing visibility and control over SaaS usage, including inline TLS inspection and DLP enforcement on uploads. The SWG focuses on web traffic filtering, ZTNA brokers application access, and FWaaS delivers Layer 3/4 filtering.

Question 2Security Service Edge Fundamentals

Which statement best describes how ZTNA differs from a traditional VPN concentrator?

  1. ZTNA relies on static IP allowlists to authorize user sessions
  2. ZTNA grants access to individual applications after per-request identity and device checks Correct answer.
  3. ZTNA encrypts all traffic from the endpoint to the data center network
  4. ZTNA tunnels the entire corporate subnet to the remote device

Explanation

ZTNA applies identity- and context-based policy per application, so users reach only the apps they are entitled to rather than the whole network. A VPN concentrator typically places the device on the corporate network, enabling broad lateral reach.

Question 3Security Service Edge Fundamentals

A security team wants to block access to newly registered domains and known phishing sites for all branch offices without deploying on-premises appliances. Which SSE capability fulfills this requirement?

  1. Cloud access security broker with API-mode scanning
  2. ZTNA application connector
  3. Data loss prevention policy engine
  4. Secure web gateway with real-time URL categorization Correct answer.

Explanation

An SWG enforces acceptable-use and threat policy on web requests, using URL categorization and reputation feeds to block malicious or risky destinations in the cloud. API-mode CASB scans data at rest, ZTNA connectors publish internal apps, and DLP inspects content rather than destination reputation.

Question 4Security Service Edge Fundamentals

What is the primary purpose of a cloud access security broker operating in forward-proxy (inline) mode?

  1. To inspect traffic between users and cloud services in real time and apply policy inline Correct answer.
  2. To broker identity federation between the IdP and SaaS providers
  3. To discover shadow IT by reading provider audit logs after the fact
  4. To encrypt data at rest within the SaaS provider's storage

Explanation

Inline CASB intercepts sessions in real time, enabling blocking, coaching, and content inspection before data reaches the cloud service. API-mode CASB uses provider logs for retrospective discovery, and identity federation is handled by the IdP.

Question 5Security Service Edge Fundamentals

Which element is the core policy decision point in a zero trust architecture that evaluates user identity, device posture, and context before granting access?

  1. Policy engine (control plane) Correct answer.
  2. SD-WAN edge router
  3. Identity provider (IdP)
  4. Policy enforcement point (data plane)

Explanation

The policy engine evaluates signals such as identity, device health, and context to render an access decision. The enforcement point merely applies that decision to the traffic flow, while the IdP supplies authentication assertions.

Question 6Security Service Edge Fundamentals

Which deployment model keeps sensitive traffic inspection within a provider's cloud while allowing a customer's remote users to reach it from anywhere without backhauling to a data center?

  1. Hub-and-spoke VPN concentrator
  2. Cloud-native SSE service edge Correct answer.
  3. Air-gapped inspection appliance
  4. On-premises proxy with split tunneling

Explanation

Cloud-native SSE places inspection and policy enforcement at globally distributed service edges, so remote users connect directly without data-center backhaul. On-premises and hub-and-spoke designs force traffic through centralized appliances.

Question 7Security Service Edge Fundamentals

Which data is most useful for a CASB to detect unsanctioned SaaS usage when the organization cannot intercept user traffic?

  1. Switch port mirroring captures inside the data center
  2. DNS zone transfer records
  3. SaaS provider audit and activity logs collected via API Correct answer.
  4. Endpoint disk encryption status

Explanation

When inline interception is unavailable, API-based CASB integrations pull provider audit and activity logs to enumerate which SaaS apps are in use and by whom. Endpoint encryption, internal port mirroring, and DNS zone transfers do not reveal SaaS consumption.

Question 8Security Service Edge Fundamentals

In SSE terminology, what does the term 'single-pass architecture' refer to?

  1. Applying multiple security functions to a traffic flow in one inspection pass Correct answer.
  2. Rotating encryption keys after each session
  3. Requiring users to authenticate once per application
  4. Sending each packet through a separate dedicated appliance

Explanation

A single-pass architecture decodes a flow once and runs SWG, CASB, DLP, and threat inspection on the same decoded stream, reducing latency and avoiding repeated decryption. It is unrelated to authentication frequency or key rotation.

Question 9Security Service Edge Fundamentals

An administrator wants to prevent corporate users from uploading files containing credit card numbers to any unsanctioned cloud storage service. Which combination of SSE controls is most appropriate?

  1. CASB inline control with DLP content inspection and app categorization Correct answer.
  2. FWaaS rules blocking outbound TCP port 443
  3. ZTNA policy requiring device posture for storage apps
  4. SWG URL filtering alone using a blocklist of storage domains

Explanation

The requirement needs both recognition of the app category (unsanctioned storage) and content classification of the file, so inline CASB with DLP is the right pairing. URL filtering alone cannot inspect content, and port blocking would break all HTTPS.

Question 10Security Service Edge Fundamentals

A user's device fails a posture check because its disk encryption is disabled. Under zero trust principles, what should the policy engine do?

  1. Allow access but log the posture failure for later review
  2. Redirect the user to a public internet proxy
  3. Deny or restrict access according to the posture policy for the requested resource Correct answer.
  4. Grant full access because the user's password was correct

Explanation

Zero trust evaluates device posture as part of every request, so a failed posture check results in denial or reduced access per policy. Authentication alone does not override device trust requirements, and logging without enforcement defeats the control.

Question 11Security Service Edge Fundamentals

Why does TLS interception in an SSE platform require a certificate authority that endpoints trust?

  1. The provider needs the CA to sign user authentication assertions
  2. The CA enables DNS resolution of internal applications
  3. The service edge must present a certificate the client trusts to terminate and re-originate TLS Correct answer.
  4. The CA is required to encrypt data at rest in the provider cloud

Explanation

To inspect encrypted traffic, the service edge terminates the client TLS session and opens a new one to the destination, which requires a certificate issued by a CA the endpoint trusts. The CA is unrelated to authentication assertions, data-at-rest encryption, or DNS.

Question 12Security Service Edge Fundamentals

Which scenario best justifies adding a remote browser isolation capability to an SSE deployment?

  1. Users must reach uncategorized or risky sites while risky content is rendered away from the endpoint Correct answer.
  2. The security team wants to replace its endpoint detection and response tool
  3. Administrators need to enforce disk encryption on contractor laptops
  4. The organization wants to reduce the number of identity providers it supports

Explanation

Remote browser isolation renders potentially malicious web content in a disposable remote browser, delivering only a safe rendering stream to the user, which suits risky or uncategorized destinations. It does not consolidate IdPs, enforce disk encryption, or replace EDR.

Question 13Security Service Edge Fundamentals

A CASB reports that a sanctioned SaaS app is being accessed by personal (unmanaged) devices. Which control most directly addresses the risk of data exfiltration from those devices?

  1. Session policies that block download or restrict features for unmanaged devices Correct answer.
  2. Enabling DNS-over-HTTPS on managed endpoints
  3. Increasing password complexity requirements for all users
  4. Shortening the lifetime of the SaaS API token

Explanation

Conditional session policies can detect unmanaged devices and apply restrictions such as blocking downloads or limiting app features. Password complexity and token lifetime affect authentication, not post-authentication data handling on unmanaged devices.

Question 14Security Service Edge Fundamentals

Which identity signal is most characteristic of continuous, risk-based authentication in an SSE context?

  1. A one-time password delivered by SMS at login
  2. A username and password stored in the browser
  3. Session risk score recalculated from behavior and context during the session Correct answer.
  4. A static shared secret embedded in the client configuration

Explanation

Risk-based authentication continuously reassesses signals such as behavior, location, and device during a session and can step up or revoke access. Static credentials and one-time codes validate identity at a point in time but do not provide continuous evaluation.

Question 15Security Service Edge Fundamentals

An SWG must avoid breaking business-critical SaaS applications while still blocking phishing sites. Which configuration approach best balances this?

  1. Block all categories except a small allowlist of known-good domains
  2. Disable TLS inspection entirely to avoid application breakage
  3. Apply the strictest policy to all users regardless of application
  4. Use SSL inspection bypass lists for certified business apps and inspect the rest Correct answer.

Explanation

Selective bypass for certified business apps preserves compatibility where interception breaks pinned or sensitive applications, while inspection continues for general web traffic. Disabling inspection or blanket blocking creates either blind spots or excessive business disruption.

Question 16Security Service Edge Fundamentals

In an SSE architecture, what is the role of a connector (sometimes called an app connector) in ZTNA?

  1. It stores SaaS API tokens for CASB scanning
  2. It assigns IP addresses to remote endpoints
  3. It terminates user TLS sessions for web filtering
  4. It establishes outbound tunnels from internal applications to the SSE fabric without inbound firewall holes Correct answer.

Explanation

ZTNA connectors make internal applications reachable by initiating outbound connections to the service edge, eliminating the need for inbound ports on the corporate firewall. TLS termination for web filtering, token storage, and DHCP are different functions.

Question 17Security Service Edge Fundamentals

Which practice best supports least-privilege enforcement when publishing internal applications through ZTNA?

  1. Defining per-application access policies tied to user groups and device posture Correct answer.
  2. Publishing the entire internal subnet as a single application
  3. Relying on network segmentation alone without identity policy
  4. Granting access to all employees by default and auditing later

Explanation

Least privilege in ZTNA comes from scoping each published application to specific groups and posture conditions, so users reach only what they need. Publishing whole subnets or granting broad default access recreates the flat network ZTNA aims to replace.

Question 18Security Service Edge Fundamentals

A DLP policy flags documents containing source code patterns being uploaded to a personal cloud account. Which SSE component combination is needed to enforce this inline?

  1. CASB inline proxy plus a DLP profile with a source-code classifier Correct answer.
  2. SWG plus a URL category blocklist for cloud storage
  3. ZTNA plus device posture checks
  4. FWaaS plus geolocation blocking

Explanation

Inline enforcement requires the CASB proxy to see the upload and a DLP profile that recognizes the content type, here source code. URL blocklists, posture checks, and geolocation rules do not classify file content.

Question 19Security Service Edge Fundamentals

Why is API-based CASB scanning alone insufficient to block a data exfiltration attempt in real time?

  1. It only works with on-premises applications
  2. It cannot read provider audit logs
  3. It requires TLS interception of endpoint traffic
  4. It inspects data after it has already reached the SaaS provider Correct answer.

Explanation

API-mode CASB polls provider APIs and evaluates content that is already stored, so the upload has occurred before policy acts. Real-time blocking needs an inline path; API mode is retrospective and does not intercept the transfer.

Question 20Security Service Edge Fundamentals

Which factor makes a cloud-native SSE more resilient to a single data-center outage than a centralized on-premises proxy?

  1. All sessions are pinned to one primary appliance for consistency
  2. Encryption keys are stored only in the headquarters data center
  3. Traffic is served by multiple geographically distributed service edges Correct answer.
  4. Policy is cached indefinitely on endpoints

Explanation

Distributed service edges let traffic fail over to another location when one edge or region is unavailable. Pinning sessions to a single appliance or centralizing keys creates the very single point of failure being avoided.

Question 21Security Service Edge Fundamentals

An organization wants to apply consistent DLP policy to data at rest in a sanctioned SaaS app and to data in motion from the same app. Which SSE design achieves this?

  1. Use only ZTNA for both at-rest and in-motion data
  2. Use only an SWG for both at-rest and in-motion data
  3. Use only FWaaS for both at-rest and in-motion data
  4. Combine API-mode CASB for at-rest scanning with inline CASB for in-motion control Correct answer.

Explanation

At-rest data in SaaS is reached through provider APIs, while in-motion traffic is inspected inline, so a complete design uses both CASB modes. SWG, ZTNA, and FWaaS do not scan stored SaaS content.

Question 22Security Service Edge Fundamentals

A zero trust policy must decide access to a finance application based on several signals. Which combination reflects a context-aware decision rather than a static rule?

  1. A shared service account used by the whole department
  2. A permanent exception granted to the finance director
  3. User group, device compliance, geolocation, and time-of-day risk evaluated together Correct answer.
  4. A fixed IP allowlist for the finance subnet

Explanation

Context-aware policy combines identity, device, location, and behavioral signals to reach a decision for each request. Static allowlists, shared accounts, and permanent exceptions do not adapt to changing context.

Question 23Security Service Edge Fundamentals

An SSE platform must inspect traffic to a SaaS application that uses certificate pinning. What is the most accurate operational consequence?

  1. Pinning is resolved by disabling the endpoint trust store
  2. TLS interception will likely break the app, so a bypass with compensating API-based controls is appropriate Correct answer.
  3. Pinning only affects UDP traffic and can be ignored
  4. The platform can decrypt pinned traffic without any configuration change

Explanation

Certificate pinning causes the client to reject the service edge's re-signed certificate, so interception breaks the session. The practical response is a targeted bypass plus compensating controls such as API-mode CASB monitoring.

Question 24Security Service Edge Fundamentals

A security architect must reconcile a requirement for full inline inspection with a privacy rule forbidding inspection of employee health-portal traffic. Which design satisfies both?

  1. Define a category-based bypass for health sites with logging of bypass events for audit Correct answer.
  2. Inspect all traffic and delete the logs afterward
  3. Disable inspection for all categories to guarantee privacy
  4. Route health traffic through a separate unmanaged ISP link

Explanation

A scoped bypass for the protected category honors the privacy rule while inspection continues elsewhere, and logging bypass decisions preserves auditability. Blanket disabling creates blind spots, and post-hoc log deletion does not prevent inspection.

Question 25Security Service Edge Fundamentals

In a single-pass SSE pipeline, why must decryption occur before both DLP and threat inspection rather than after?

  1. DLP can classify encrypted payloads using only packet headers
  2. Content-based engines need plaintext to classify files and detect malicious payloads Correct answer.
  3. Decryption after inspection improves throughput without affecting detection
  4. Threat engines rely on TLS record sizes to identify malware

Explanation

DLP classifiers and malware engines examine file contents and payloads, which are unreadable while encrypted, so decryption must precede them in the pipeline. Headers and record sizes carry insufficient information for content classification.

Question 26Security Service Edge Fundamentals

In SSE terminology, which capability is primarily responsible for applying inline policy to web traffic from managed endpoints regardless of user location?

  1. Secure web gateway Correct answer.
  2. Cloud access security broker
  3. Remote browser isolation
  4. Zero trust network access

Explanation

A secure web gateway sits inline on the traffic path and enforces URL filtering, malware inspection, and acceptable-use policy for web destinations. It works the same whether the user is on-premises or remote because traffic is steered to the cloud service. CASB, ZTNA, and RBI address different control points.

Question 27Security Service Edge Fundamentals

Which statement best describes how a cloud access security broker provides visibility when traffic cannot be proxied?

  1. It inspects packets at the endpoint network stack
  2. It decrypts TLS sessions on the endpoint before forwarding
  3. It uses vendor APIs to pull activity logs from sanctioned SaaS tenants Correct answer.
  4. It relies on DNS query logs alone to reconstruct user actions

Explanation

API-based CASB mode connects to the SaaS provider with authorized credentials and ingests audit and activity events directly from the tenant. This out-of-band approach works for sanctioned apps even when user traffic never traverses the SSE platform. It delivers discovery and policy alerts, though not real-time blocking of the traffic itself.

Question 28Security Service Edge Fundamentals

A ZTNA deployment must connect users to an internal application hosted in a private subnet with no public IP address. Which component initiates the outbound connection that makes this possible?

  1. The application connector deployed near the app Correct answer.
  2. The public DNS resolver for the tenant
  3. The endpoint's split-tunnel VPN adapter
  4. The identity provider's policy engine

Explanation

An app connector is deployed inside the private network and dials out to the SSE cloud, creating a tunnel that requires no inbound firewall openings. Users reach the application through the broker, which forwards traffic over that established tunnel. This outbound-only pattern is what lets private apps be published without exposing them to the internet.

Question 29Security Service Edge Fundamentals

What distinguishes a single-vendor SSE platform from a set of separately purchased security tools?

  1. It converges SWG, CASB, ZTNA, and DLP behind a shared policy engine and data path Correct answer.
  2. It guarantees that no traffic ever leaves the corporate network
  3. It removes the need for any endpoint agent
  4. It replaces the identity provider for authentication

Explanation

Convergence is the defining property of SSE: several security services share one cloud edge, one policy framework, and often one inspection pass. That shared context reduces policy gaps and avoids routing traffic through multiple independent proxies. It does not eliminate agents, keep traffic on-premises, or substitute for an IdP.

Question 30Security Service Edge Fundamentals

An organization wants malware in downloaded files scanned before the file reaches the user device. Which placement of the inspection engine satisfies this requirement?

  1. On the endpoint only, after the file is written to disk
  2. Out-of-band, receiving a copy of traffic after delivery
  3. Inline on the traffic path between the user and the internet Correct answer.
  4. At the SaaS provider's own native antivirus layer

Explanation

Preventing a malicious file from reaching the device requires the inspection engine to sit inline so it can hold and then block the transfer. Out-of-band copies arrive after delivery and cannot stop the original. Endpoint scanning and provider-native controls act after or independent of the network path.

Question 31Security Service Edge Fundamentals

Which element of a zero trust access decision describes the device's patch level, disk encryption state, and EDR health?

  1. Device posture Correct answer.
  2. Network location
  3. Session risk score
  4. Identity assurance level

Explanation

Device posture is the collected set of endpoint attributes that a policy engine evaluates before granting access. Patch status, encryption, and endpoint detection health are classic posture signals. Identity assurance concerns who the user is, while network location and session risk are separate contextual inputs.

Question 32Security Service Edge Fundamentals

A CASB dashboard shows employees uploading files to an unsanctioned storage service. The organization cannot proxy this traffic because the users are on unmanaged networks. Which action most directly reduces the exposure?

  1. Increase the DLP pattern library for credit card formats
  2. Enable API scanning of the sanctioned file-sharing tenant
  3. Block the unsanctioned service by category at the DNS and firewall layer Correct answer.
  4. Require MFA for the identity provider

Explanation

When inline proxying is unavailable, coarse controls at DNS and firewall layers can still deny resolution or connectivity to the unsanctioned service. That directly removes the upload path rather than merely observing it. API scanning and DLP tuning act on other channels, and MFA hardens authentication without addressing the destination.

Question 33Security Service Edge Fundamentals

Why do SSE providers publish regional points of presence for traffic steering?

  1. To let customers bypass inspection during peak hours
  2. To keep the inspection path short so added latency stays low Correct answer.
  3. To ensure each customer's data is stored in its home country
  4. To avoid the need for TLS interception certificates

Explanation

Because cloud-delivered SSE backhauls user traffic to the provider's edge, the distance to the nearest PoP strongly influences round-trip latency. A broad PoP footprint lets users connect to a nearby inspection point instead of a distant data center. Data residency, load shedding, and certificate handling are separate concerns.

Question 34Security Service Edge Fundamentals

A DLP policy must block a file upload to a sanctioned SaaS app in real time. Which traffic path makes this possible?

  1. Endpoint agent scanning of the local file system
  2. API-based CASB polling of the tenant's audit log
  3. Inline proxy inspection of the upload request Correct answer.
  4. SIEM correlation of the tenant's sharing events

Explanation

Real-time blocking requires the request to pass through an inline enforcement point that can terminate or reject it before the data leaves. Inline proxy inspection provides exactly that control over the upload stream. API polling, local scanning, and SIEM correlation all observe activity after the fact or outside the request path.

Question 35Security Service Edge Fundamentals

Which identity context is most useful for an SSE policy that must distinguish a corporate-managed laptop from a personal phone logging in with the same user credentials?

  1. The device identifier and its registration state Correct answer.
  2. The user's group membership in the directory
  3. The geolocation of the source IP address
  4. The time of day of the access request

Explanation

When the same user account is used on multiple devices, the device identifier and whether it is registered or managed become the discriminating signal. Policy can then require a compliant managed device for sensitive applications. Group membership, geolocation, and time are useful context but do not separate the two devices in this scenario.

Question 36Security Service Edge Fundamentals

An SSE platform performs TLS interception for outbound web traffic. What must be distributed to endpoints so that users do not see certificate warnings?

  1. The SaaS tenant's API key
  2. Each user's personal client certificate
  3. A shared secret used for SAML signing
  4. The provider's public signing certificate installed as a trusted root Correct answer.

Explanation

Interception works by having the platform present a certificate minted by its own internal authority for each destination. Endpoints must trust that authority, so its certificate is deployed to the device trust store. Client certificates, API keys, and SAML secrets serve authentication and integration purposes, not trust in the interception chain.

Question 37Security Service Edge Fundamentals

A regulated workload must never have its payload decrypted by the SSE provider. Which design choice respects that constraint while still applying access control?

  1. Route the workload through the standard inline proxy with DLP enabled
  2. Exclude the workload from TLS interception and enforce policy on metadata such as destination and identity Correct answer.
  3. Disable certificate validation on the client for that workload
  4. Rely on the SaaS provider's native logging only

Explanation

When payload inspection is prohibited, the platform can still enforce policy using the outer connection attributes, including user identity, destination category, and device posture. Excluding the workload from interception keeps content encrypted end to end while preserving coarse-grained control. Sending it through decryption would violate the constraint.

Question 38Security Service Edge Fundamentals

In a single-pass inspection pipeline, why must decryption occur before both DLP and threat scanning?

  1. Because DLP engines can read ciphertext directly
  2. Because encrypted payloads reveal neither content patterns nor malicious signatures Correct answer.
  3. Because threat engines only inspect headers
  4. Because decryption is cheaper when performed first

Explanation

DLP matches content patterns and threat engines match file or payload signatures, and neither can evaluate ciphertext. Decryption must therefore happen upstream so both engines receive plaintext in the same pass. Cost, direct ciphertext reading, and header-only scanning do not describe how these engines work.

Question 39Security Service Edge Fundamentals

Which outcome indicates that a CASB is operating in inline mode rather than API mode for a particular SaaS application?

  1. The platform lists users who accessed the app last quarter
  2. The console shows historical sharing events from the tenant
  3. The platform reports the number of files stored in the tenant
  4. The platform can block a user's upload to the app as it happens Correct answer.

Explanation

Inline mode places the platform on the traffic path, so it can enforce decisions synchronously, including blocking an upload in progress. API mode reads tenant records and therefore reports on activity after it occurs. Historical events, stored-file counts, and past access lists are all hallmarks of out-of-band visibility.

Question 40Security Service Edge Fundamentals

A security team must ensure that a contractor can reach one internal HR application but no other corporate resource. Which SSE control most directly enforces this?

  1. A URL filtering rule that blocks the HR category
  2. A posture check that requires disk encryption
  3. An application-specific ZTNA policy scoped to the contractor's identity group Correct answer.
  4. A DLP rule that inspects HR documents in transit

Explanation

ZTNA authorizes access per application, so a policy bound to the contractor's identity group can permit the HR app and deny everything else by default. This is the least-privilege model that replaces broad network access. URL filtering, DLP, and posture checks address other control objectives.

Question 41Prisma Access Configuration and Deployment

In a Prisma Access deployment, which component is responsible for enforcing security policy on traffic that remote users send to the internet from a branch office?

  1. The on-premises firewall that terminates the IPSec tunnel
  2. The corporate DNS forwarder configured in the data center
  3. The service connection security processing node Correct answer.
  4. The globalprotect portal hosted in the mobile user location

Explanation

Prisma Access processes traffic at security processing nodes (SPNs), and service connections bring branch traffic into the infrastructure where that processing occurs. The SPN applies the security policy stack before traffic exits to the internet. Remote user portals handle authentication and configuration, not internet-bound branch enforcement.

Question 42Prisma Access Configuration and Deployment

Which Prisma Access deployment mode keeps all user traffic, including internet-bound traffic, inside the Prisma Access infrastructure rather than backhauling it to a data center?

  1. Service connection with a dedicated egress path to the internet Correct answer.
  2. Service connection with local breakout at the branch
  3. Mobile user deployment with traffic forwarded to a corporate proxy
  4. Remote network with a hub-and-spoke tunnel to the data center

Explanation

Service connections establish the link between Prisma Access and your infrastructure, and egress to the internet happens directly from the Prisma Access cloud. This avoids backhauling internet-bound traffic through the data center. Local breakout at the branch is a separate design that bypasses Prisma Access for that traffic.

Question 43Prisma Access Configuration and Deployment

An administrator is configuring a service connection and needs to specify which infrastructure subnet is reachable through it. Which configuration element accomplishes this?

  1. A DNS proxy rule in the mobile user location
  2. A security policy rule with an application dependency
  3. A globalprotect split-tunnel access route
  4. A static route advertised over the service connection Correct answer.

Explanation

Service connections rely on routing to define which internal destinations are reachable from Prisma Access. Static routes advertised across the service connection tell the cloud infrastructure where to send traffic destined for internal subnets. Split tunneling and security policy do not define reachability of internal networks.

Question 44Prisma Access Configuration and Deployment

Which statement accurately describes the role of the mobile user location in a Prisma Access configuration?

  1. It hosts the globalprotect portal and gateway that remote users connect to Correct answer.
  2. It provides the IPSec termination point for branch offices
  3. It defines the physical data center where the corporate firewall cluster resides
  4. It stores the configuration backups for the entire tenant

Explanation

The mobile user location is the Prisma Access construct that serves remote users; it hosts the globalprotect portal and gateways that clients connect to. Branch termination is handled by remote network or service connection constructs, not the mobile user location. Configuration storage is a separate management concern.

Question 45Prisma Access Configuration and Deployment

When configuring a remote network connection for a branch office, which value must match between the branch firewall and the Prisma Access configuration for the IPSec tunnel to come up?

  1. The administrative password of the branch firewall
  2. The content update schedule of the branch firewall
  3. The pre-shared key and IKE identity parameters Correct answer.
  4. The DNS suffix used by branch endpoints

Explanation

IPSec tunnels require matching pre-shared keys and compatible IKE identities and proposals on both peers. Without agreement on these parameters, phase 1 negotiation fails and the tunnel never establishes. Administrative credentials and update schedules are unrelated to tunnel negotiation.

Question 46Prisma Access Configuration and Deployment

A security administrator wants remote users to reach internal applications without sending all their internet traffic through Prisma Access. Which feature should be configured?

  1. A security policy rule that denies all internet applications
  2. A service connection with a default route to the branch
  3. A remote network tunnel with no static routes
  4. Split tunneling with the internal subnets in the include list Correct answer.

Explanation

Split tunneling determines which destinations a GlobalProtect client sends through the tunnel versus directly to the internet. Listing internal subnets in the include list routes only that traffic to Prisma Access, while other traffic egresses locally. Denying internet applications would break access rather than optimize the path.

Question 47Prisma Access Configuration and Deployment

Which Prisma Access component is used to define the authentication profile and client configuration that GlobalProtect users receive?

  1. The service connection
  2. The mobile user location Correct answer.
  3. The corporate DNS server
  4. The remote network

Explanation

The mobile user location holds the portal and gateway settings, including authentication profiles and client configuration delivered to endpoints. Service connections and remote networks handle site-to-site connectivity rather than endpoint client settings. A DNS server has no role in GlobalProtect client provisioning.

Question 48Prisma Access Configuration and Deployment

An engineer needs to verify that traffic from a specific branch is being inspected by Prisma Access. Which log source in the Prisma Access tenant would show the security policy verdict for that traffic?

  1. The traffic log in the Prisma Access logging service Correct answer.
  2. The GlobalProtect client log stored on the endpoint
  3. The IKE debug log on the branch firewall
  4. The system log of the branch router

Explanation

Prisma Access forwards session logs to its logging service, where traffic logs record the security policy verdict for inspected sessions. Endpoint and router logs do not contain the cloud-enforced policy decision. IKE debug output covers tunnel negotiation only.

Question 49Prisma Access Configuration and Deployment

Which configuration object in Prisma Access determines which source users and applications are permitted through the cloud infrastructure?

  1. The security policy rulebase applied to the relevant scope Correct answer.
  2. The service connection static route table
  3. The DNS proxy cache settings
  4. The globalprotect client configuration profile

Explanation

Security policy rules define the match criteria and action for traffic traversing Prisma Access, and the rulebase is applied according to scope such as mobile users or remote networks. Routes and client profiles influence path and endpoint behavior but do not permit or deny sessions. DNS cache settings are unrelated to access control.

Question 50Prisma Access Configuration and Deployment

A company wants branch offices to use Prisma Access for internet security while keeping traffic to the data center on the private WAN. Which design element supports this requirement?

  1. Routing all traffic through the service connection to the data center
  2. Removing the service connection so no internal routes are advertised
  3. Advertising only internet-bound traffic to Prisma Access while keeping data center routes local Correct answer.
  4. Configuring split tunneling on the branch firewall's management interface

Explanation

Selective routing lets the branch send only internet-bound traffic to Prisma Access while internal data center traffic continues over the private WAN. This is achieved by controlling which routes point to the cloud versus the local WAN. Removing the service connection would eliminate the cloud path for internal traffic but does not by itself achieve selective internet security.