SSE-Engineer Practice Questions

Certificate pinning is a well-documented, expected source of SSL decryption failures on any inline TLS proxy, including the Prisma Access decryption engine. When an application (in this case, one interacting with google.com endpoints) has pinned the exact certificate or public key it expects from the origin server, it will reject the substitute certificate that Prisma Access presents during man-in-the-middle SSL Forward Proxy decryption, even though that substitute certificate is validly signed by the organization ' s trusted forward-trust C

A.  

C.  

Regardless of which client experience is used to reach a private application — full-tunnel GlobalProtect, PAB, or another connection method — the actual pathway from the Prisma Access cloud infrastructure into a customer ' s private data center resources is built using one of two purpose-built private-access connectivity components: Service Connections, the traditional IPSec-tunnel-based method that joins the data center network directly to the Prisma Access backbone, and the ZTNA Connector, a more modern, outbound-initiated, brokered-tunnel alternative that avoids the need for a traditional IPSec peer or inbound firewall exposure. Both are explicitly documented as valid mechanisms for establishing reachability to internal, private application resources, and PAB itself relies on whichever of these has been configured to actually reach the backend application once user access is authorized — making options B and D the correct pair. Explicit Proxy (option A) is a mobile-user connection method for redirecting outbound internet and SaaS traffic through Prisma Access; it is not an infrastructure component used to establish inbound reachability to private data center applications, and conflating the two would be an architectural mismatch. Privileged Remote Access (option C) is not a standard Prisma Access infrastructure connectivity component in this context; it does not appear as a documented mechanism for establishing the backbone-to-data-center pathway that PAB depends on for reaching private applications.

With the IPSec tunnel already established, the underlying transport connectivity is confirmed to be working correctly, which narrows the troubleshooting focus specifically to the BGP session parameters themselves rather than network reachability. Two configuration values are the most common and immediate causes of a BGP peer failing to come up even over a healthy tunnel: the MD5 authentication secret, if BGP authentication is enabled on either side, must match exactly between Prisma Access and the customer ' s CPE, since any mismatch causes the peer session to be silently rejected during the initial OPEN message exchange, matching option

A.  

C.  

Prisma Access egress and public IP addresses can change as a result of autoscaling or infrastructure upgrades, so any allow-list dependent on those addresses (SaaS tenant restrictions, partner firewalls, third-party services) needs a reliable way to stay current. Palo Alto Networks addresses this with two complementary mechanisms. First, an Egress IP Notification URL — the webhook referenced in option A — can be configured under Infrastructure Settings so that Prisma Access sends an HTTP POST a few seconds before a new IP address becomes active, giving downstream automation advance warning to update firewall or SaaS allow-lists before the change takes effect. Second, retrieving the actual address list requires authenticating to the Egress/Public IP retrieval API using an API key that is generated and copied from the service infrastructure settings, as described in option B; this key is passed in the request header when calling the retrieval endpoint. There is no separate " enable the Egress IP API endpoint " toggle, since the retrieval API is available by default once a key is generated — making option C incorrect. Authentication to this API is strictly key-based, not certificate-based, so downloading a client certificate (option D) is not a supported or required step. Together, the webhook and API key form the complete automation loop: notify, then retrieve and apply.

Prisma Access ' s automatic gateway selection logic follows a defined fallback hierarchy specifically designed to keep mobile users connected even when they travel to a country without an onboarded, in-country Prisma Access location. If a user cannot connect to an in-country location, the GlobalProtect app first attempts a regional fallback location — a nearby, same-theater location the organization has onboarded (for example, users elsewhere in Asia, Australia, and Japan falling back to a regional hub such as Hong Kong, Singapore, or Japan Central) — which keeps latency reasonable by staying within the same broad geography. If no suitable regional location is available or reachable, the client falls further back to one of a small, fixed set of global fallback locations (including Hong Kong, Netherlands Central, and US Northwest) that are specifically designated to accept client connections from anywhere in the world, guaranteeing a connection path of last resort regardless of where the traveling user is located. This two-tiered regional-then-global fallback behavior is exactly what makes options B and C the correct pair. " Backup " (option A) is not the term used for this automatic gateway-selection fallback behavior in GlobalProtect ' s Prisma Access location logic. " Local zone " (option D) does not describe a fallback gateway category at all — it is not part of the documented regional/global fallback location terminology and does not apply to a traveling user with no in-country location available.

The reported symptom — traffic intermittently falling through to the bottom Catch-All Deny rule, bypassing the HIP-based policy that should be matching first, and being resolved simply by refreshing the VPN connection — is a classic signature of stale or lost user-to-IP mapping combined with expired HIP state, rather than a fundamental policy configuration error, which is why refreshing the session (forcing re-authentication and a fresh HIP report) restores correct behavior. If user mapping for the connected session is being learned or refreshed from a source other than the gateway ' s own authentication event (for example, User-ID redistribution or another mapping source with different timing or reliability characteristics than the gateway ' s native session state), that mapping can become inconsistent with the live GlobalProtect session, causing the HIP-enforced rule ' s user-based match criteria to intermittently fail — this is option

B.  

C.  

Because the on-premises firewall is redistributing User-ID information into Prisma Access over the service connection, the redistribution agent object must be configured within the template that actually governs the service connection ' s dataplane — the Service_Conn_Template — not the Remote_Network_Template, which applies to a different set of nodes entirely and would leave the redistribution agent unreachable from the path the data is actually traversing. Selecting the wrong template is a common and easily overlooked misconfiguration that silently prevents the mapping information from being ingested at all, which is why validating the Service_Conn_Template assignment (option D) is essential. Equally important is the Collector Pre-Shared Key: User-ID redistribution uses this shared secret to authenticate the connection between the redistributing firewall and the receiving collector, and any mismatch between the value configured on the on-premises firewall and the value configured in Prisma Access will cause the redistribution session to fail silently or be rejected, leaving remote network traffic unmapped even though the configuration otherwise looks complete — this is option

C.