Free SSE-Engineer: Palo Alto Networks Security Service Edge Engineer Exam Questions and Answers

An administrator pushed a configuration change from Strata Cloud Manager that unintentionally blocked access to a SaaS application. The administrator wants to find what changed and return to the previous state. Which two actions can the administrator take? (Choose two.)

Select 2 answers.

• AA. Compare the current running version with an earlier version in the configuration version snapshots
• BB. Load the last known good version from the configuration version snapshots and push it
• CC. Run a force commit to restore the previous version from the Prisma Access cloud nodes
• DD. Export the running configuration as an XML file and import it as a named configuration snapshot

A vendor's engineers need RDP and SSH access to servers in a data center. They use unmanaged devices on which no agent can be installed, and the security team requires every session to be recorded for audit. Which solution meets the requirements?

• AA. Deploy a ZTNA Connector and allow the vendor through GlobalProtect with App-ID rules
• BB. Enable Privileged Remote Access and define the RDP and SSH servers as privileged applications
• CC. Configure Remote Browser Isolation with an isolation profile for the server URLs
• DD. Enable traffic replication to a recording server for TCP 3389 and TCP 22

Users at a branch in Auckland report slow application response. ADEM shows round-trip latency of about 280 ms between the branch and Prisma Access, and the tunnel is stable with no packet loss. The Remote Network was onboarded with the UK South location. What should the engineer do?

• AA. Enable hot potato routing for the Remote Network
• BB. Increase the licensed bandwidth for the Remote Network
• CC. Apply a QoS profile that prioritizes the affected applications
• DD. Change the Remote Network to the Prisma Access location closest to Auckland

A company must give contractors browser-based RDP and SSH access to specific data center servers without installing a client on the contractor laptops. Security requires that every session be recorded for audit. Which Prisma Access capability meets the requirement?

• AA. Privileged Remote Access with session recording enabled for the target servers
• BB. GlobalProtect per-app tunneling configured for the RDP and SSH applications
• CC. ZTNA Connector with an FQDN-based application target for each data center server
• DD. Remote Browser Isolation with an isolation profile that blocks clipboard use for the server URLs

An engineer manages Prisma Access with Panorama and needs a Best Practice Assessment report for the deployment. What should the engineer provide to the BPA tool on the Customer Support Portal?

• AA. A tech support file generated from Panorama
• BB. The candidate configuration exported from a remote network node
• CC. A report exported from the Command Center dashboard
• DD. A log archive downloaded from Strata Logging Service

SSL Forward Proxy decryption is enabled for mobile users through a single rule that decrypts all outbound traffic. Compliance now requires that traffic to the health-and-medicine and financial-services URL categories not be decrypted. What should the engineer do?

• AA. Create a No Decrypt rule for those categories below the existing decrypt rule
• BB. Create a Security policy rule that allows those categories with no profiles attached
• CC. Create a No Decrypt rule for those categories above the existing decrypt rule
• DD. Change the existing decrypt rule to SSL Inbound Inspection and add those categories

A branch office has two ISP circuits and a CPE device that can terminate two IPSec tunnels to the same Prisma Access remote network location. An engineer needs traffic to and from the branch to be load balanced across both tunnels at the same time. What should the engineer configure?

• AA. ECMP load balancing on the site, with BGP advertising the branch prefixes over both tunnels
• BB. Two separate remote network sites, each advertising the same branch subnet over its own tunnel
• CC. A larger bandwidth allocation for the compute location so the second tunnel is used automatically
• DD. Secondary WAN on the site, with static routes at a higher metric for the second ISP tunnel

Which two actions can be set on a rule in a Vulnerability Protection profile? (Choose two.)

Select 2 answers.

• AA. Continue
• BB. Block IP
• CC. Sinkhole
• DD. Reset both client and server

An engineer manages Prisma Access with Strata Cloud Manager (SCM) and wants to review the current configuration against Palo Alto Networks best practices and track the percentage of recommended checks passed over time. The engineer does not want to generate or upload any files. What should the engineer use?

• AA. Upload a tech support file to the Best Practice Assessment tool on the Customer Support Portal
• BB. Run a custom report in Activity Insights filtered on Security policy rules
• CC. Open the Best Practices dashboard in Strata Cloud Manager
• DD. Review the tenant health score displayed in Command Center

Several mobile users working from home report slow access to Microsoft 365. ADEM shows low experience scores for these users but not for users in the office. An engineer needs to determine whether the degradation originates on the user side of the connection rather than inside Prisma Access or at the application. Which two ADEM metrics should the engineer review? (Choose two.)

Select 2 answers.

• AA. Wi-Fi signal strength and device CPU and memory utilization reported by the endpoint
• BB. HTTP connection latency measured between the Prisma Access location and the application
• CC. Latency and packet loss on the segment between the endpoint and the Prisma Access location
• DD. Application response time measured from the Prisma Access location to Microsoft 365