17 free Palo Alto Networks Security Service Edge Engineer practice questions from the CertStash pack of 100, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 17 free here, all 118 in the pack, and each step includes the one before it.
Get all 118 questions (US$39) · Download the first 10 as a PDF
Question 1
What is the impact of selecting the “Disable Server Response Inspection” checkbox after confirming that a Security policy rule has a threat protection profile configured?
Show answer and explanation
Correct answer: C. All traffic from the server to the client will bypass threat inspection.
When the 'Disable Server Response Inspection' checkbox is selected on a security policy rule, it bypasses threat inspection for all traffic flowing from the server back to the client, regardless of protocol. This disabling applies comprehensively to server responses, not just HTTP traffic, and takes effect even when a threat protection profile is configured on the rule.
Why the other options are wrong
- A. The setting disables inspection for all server response traffic, not just HTTP.
- B. The threat protection profile does not override the disable setting; the disable setting applies regardless of the threat profile.
- D. While the threat profile remains configured, the disable setting applies to all server response traffic without being overridden.
Question 2
A company has a Prisma Access deployment for mobile users in North America and Europe. Service connections are deployed to the data centers on these continents, and the data centers are connected by private links. With default routing mode, which action will verify that traffic being delivered to mobile users traverses the service connection in the appropriate regions?
Show answer and explanation
Correct answer: B. Configure each service connection to filter out the mobile user pool prefixes from the other region in the advertisements to the data center.
To ensure mobile users in each region traverse their respective regional service connections rather than being routed through the other region's connection, each service connection must filter and exclude the mobile user pool prefixes from the other region from its BGP advertisements to the data center. This prevents the data center from preferring routes through the wrong region's connection.
Why the other options are wrong
- A. Community string attributes are not the appropriate BGP mechanism for controlling regional prefix routing in Prisma Access.
- C. MED (Multi-Exit Discriminator) attributes are used to influence route selection at a single AS boundary and are not the correct approach for multi-region routing control.
- D. ASN prepending would make routes from the other region less preferred, but filtering the prefixes entirely is the proper solution to ensure correct regional routing.
Question 3
How can a network security team be granted full administrative access to a tenant's configuration while restricting access to other tenants by using role-based access control (RBAC) for Panorama Managed Prisma Access in a multitenant environment?
Show answer and explanation
Correct answer: A. Create an Access Domain and restrict access to only the Device Groups and Templates for the Target Tenant.
In a Panorama Managed Prisma Access multitenant environment, Access Domains provide tenant-level isolation and scope control. By creating an Access Domain and restricting it to only the specific Device Groups and Templates belonging to the target tenant, the security team gains full administrative access within that tenant's configuration while being completely restricted from accessing other tenants' configurations.
Why the other options are wrong
- B. While custom roles can enable privileges, they do not provide the tenant isolation mechanism that Access Domains offer.
- C. Custom roles with only Device Group and Template privileges do not inherently restrict access to other tenants; Access Domains are required for true multitenant isolation.
- D. The Superuser role grants access across all tenants, defeating the requirement to restrict access to other tenants.
Question 4
An engineer has configured a Web Security rule that restricts access to certain web applications for a specific user group. During testing, the rule does not take effect as expected, and the users can still access blocked web applications. What is a reason for this issue?
Show answer and explanation
Correct answer: D. The rule was created at a lower level in the rule hierarchy, giving priority to a higher-level rule.
Firewall and security policy rules operate with a first-match-wins evaluation model where higher-level rules in the hierarchy take precedence over lower-level rules. If a more permissive rule exists at a higher level in the rule hierarchy, it will match traffic before the lower-level restrictive rule is evaluated, causing the blocking rule to be ineffective.
Why the other options are wrong
- A. Web Security rules do not depend on threat management settings; threat management is a separate policy layer.
- B. Scope (GlobalProtect users vs. all users) would determine which traffic the rule applies to, not whether it takes effect when it does apply.
- C. A rule created at a higher level would take priority and allow access, but this is the opposite scenario from what the answer describes.
Question 5
What will cause a connector to fail to establish a connection with the cloud gateway during the deployment of a new ZTNA Connector in a data center?
Show answer and explanation
Correct answer: B. The connector is deployed behind a double NAT.
Double NAT (Network Address Translation applied twice) prevents proper connection establishment between a ZTNA Connector and the cloud gateway because the connector cannot maintain a stable, verifiable identity and bidirectional communication path when its traffic is translated multiple times across different NAT boundaries.
Why the other options are wrong
- A. DNS misconfiguration would prevent name resolution but is usually detectable and correctable; it is not the primary cause of connection failures in properly configured environments.
- C. ZTNA Connectors are designed to work with dynamic IP addresses through registration mechanisms and do not inherently fail due to dynamic addressing.
- D. High latency degrades performance but does not prevent connection establishment; connectors can establish connections across high-latency networks.
Question 6
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-tobusiness (B2B) partners to their data centers. The solution must meet these requirements: The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations. The branch locations must have internet filtering and data center connectivity. The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports. The security team must have access to manage the mobile user and access to branch locations. The network team must have access to manage only the partner access. How should Prisma Access be implemented to meet the customer requirements?
Show answer and explanation
Correct answer: D. Deploy a Prisma Access instance with mobile users, remote networks, and private access for all connection types, and use the specific configuration scope for the connection type to manage access.
A single Prisma Access instance can support mobile users, remote networks, and private access for all connection types (internal and B2B). Using configuration scopes specific to each connection type allows granular role-based access control, enabling the security team to manage mobile and branch configurations while the network team manages only B2B partner access. This meets all requirements with a simpler, unified architecture.
Why the other options are wrong
- A. Deploying two separate instances is unnecessary complexity; a single instance with scoped access controls is more efficient.
- B. Using the generic Prisma Access Configuration scope does not provide the granular separation needed for the network team to manage only partner access.
- C. Two instances are not required when a single instance with specific configuration scopes can achieve the same objectives more efficiently.
Question 7
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-tobusiness (B2B) partners to their data centers. The solution must meet these requirements: The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations. The branch locations must have internet filtering and data center connectivity. The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports. The security team must have access to manage the mobile user and access to branch locations. The network team must have access to manage only the partner access. How can the engineer configure mobile users and branch locations to meet the requirements?
Show answer and explanation
Correct answer: A. Use GlobalProtect and Remote Networks to filter internet traffic and provide access to data center resources using service connections.
GlobalProtect is the correct technology for mobile users, providing both internet filtering and secure connectivity. Remote Networks is the correct technology for branch locations, also providing internet filtering and data center connectivity through service connections. This combination satisfies all requirements for mobile users and branch locations.
Why the other options are wrong
- B. Explicit Proxy is designed for web traffic filtering but does not provide the comprehensive access control and connectivity that GlobalProtect offers for mobile users.
- C. GlobalProtect alone does not address branch location requirements; Remote Networks is needed for branch sites to filter internet traffic and connect to data centers.
- D. Explicit Proxy is not the appropriate technology for this scenario; GlobalProtect and Remote Networks are the correct pair.
Question 8
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-tobusiness (B2B) partners to their data centers. The solution must meet these requirements: The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations. The branch locations must have internet filtering and data center connectivity. The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports. The security team must have access to manage the mobile user and access to branch locations. The network team must have access to manage only the partner access. Which two options will allow the engineer to support the requirements? (Choose two.)
Show answer and explanation
Correct answer: B, C. Enable eBGP for dynamic routing and configure RemoteNetworks; Configure Remote Networks and define the branch IP subnets using Static Routes.
Remote Networks with Static Routes (option C) allows branch IP subnets to be defined and routed through Prisma Access to reach data centers. Enabling eBGP for dynamic routing (option B) with Remote Networks provides a more scalable and automated approach compared to static configuration, as branch routes can be dynamically exchanged. Both options support the branch connectivity requirements.
Why the other options are wrong
- A. Static routes at the CPE pointing to Prisma Access infrastructure do not properly integrate with the Prisma Access Remote Networks feature designed for this purpose.
- D. Advertising Default Route is used for different scenarios and does not specifically address the requirement to support branch-to-data center connectivity through defined subnets.
Question 9
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-tobusiness (B2B) partners to their data centers. The solution must meet these requirements: The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations. The branch locations must have internet filtering and data center connectivity. The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports. The security team must have access to manage the mobile user and access to branch locations. The network team must have access to manage only the partner access. Which two components can be provisioned to enable data center connectivity over the internet? (Choose two.)
Show answer and explanation
Correct answer: A, C. ZTNA Connector; Service connections
Service connections are the primary Prisma Access component that enables secure data center connectivity over the internet, providing direct encrypted tunnels from Prisma Access to internal data center resources. ZTNA Connector can also be provisioned to enable data center connectivity by providing zero-trust access to internal applications. Both components work together to establish secure internet-based connectivity to data centers.
Why the other options are wrong
- B. SD-WAN Connector is designed for branch site connectivity and WAN optimization, not specifically for data center connectivity over the internet.
- D. Colo-Connect is not a standard Prisma Access component for enabling data center connectivity.
Question 10
Which two actions can a company with Prisma Access deployed take to use the Egress IP API to automate policy rule updates when the IP addresses used by Prisma Access change? (Choose two.)
Show answer and explanation
Correct answer: A, B. Configure a webhook to receive notifications of IP address changes; Copy the Egress IP API Key in the service infrastructure settings.
Configuring a webhook allows automated notifications when Prisma Access egress IP addresses change, enabling dynamic policy updates (option A). Copying the Egress IP API Key from service infrastructure settings is necessary for authentication and authorization to access the API programmatically (option B). Together, these actions enable a complete automation solution for detecting and responding to IP changes.
Why the other options are wrong
- C. The Egress IP API does not require explicitly enabling an endpoint; it is available as part of the Prisma Access service infrastructure.
- D. Client certificate download is not the standard authentication mechanism for the Egress IP API; API keys are the primary authentication method.
What people say about the full Security Service Edge Engineer pack 5.0 from 3
Passed SSE Engineer exam. Valid exam questions
I contacted support before purchasing the SSE Engineer questions, and they replied quickly with useful information. Very professional service.
Passed SSE Engineer exam successfully. Thanks for your help.
Question 11
How can an engineer verify that only the intended changes will be applied when modifying Prisma Access policy configuration in Strata Cloud Manager (SCM)?
Show answer and explanation
Correct answer: B. Compare the candidate configuration and the most recent version under “Config Version Snapshots.”
Config Version Snapshots in Strata Cloud Manager allows an engineer to compare the candidate configuration with the most recent version, providing a clear diff of all pending changes before they are pushed to Prisma Access. This is the most reliable method to verify that only intended changes will be applied.
Why the other options are wrong
- A. Blue circular indicators on menu items do not provide a method to review the specific pending changes that would be applied.
- C. Push Status shows completed jobs, not pending changes that would be applied in a future push.
- D. While the push dialogue may provide some preview information, Config Version Snapshots is the dedicated and most comprehensive tool for comparing candidate and current configurations.
Question 12
A large retailer has deployed all of its stores with the same IP address subnet. An engineer is onboarding these stores as Remote Networks in Prisma Access. While onboarding each store, the engineer selects the “Overlapping Subnets” checkbox. Which Remote Network flow is supported after onboarding in this scenario?
Show answer and explanation
Correct answer: B. To the internet
When the 'Overlapping Subnets' checkbox is selected for Remote Networks with identical IP subnets, Prisma Access restricts traffic flows to prevent routing ambiguity. In this configuration, remote network traffic can only be sent to the internet, as traffic to other destinations (private applications, other remote networks, and mobile users) would require unambiguous routing decisions that overlapping subnets cannot support.
Why the other options are wrong
- A. Traffic to private applications requires specific routing that cannot be reliably determined with overlapping subnets.
- C. Traffic between overlapping remote networks cannot be supported due to the inability to distinguish which network the traffic originates from.
- D. Traffic to mobile users requires clear source identification that overlapping subnets cannot provide.
Question 13
An engineer configures User-ID redistribution from an on-premises firewall connected to Prisma Access (Managed by Panorama) using a service connection. After committing the configuration, traffic from remote network connections is still not matching the correct user-based policies. Which two configurations need to be validated? (Choose two.)
Show answer and explanation
Correct answer: A, D. Ensure the Remote_Network_Template is selected when adding the User-ID Agent in Panorama; Ensure the Service_Conn_Template is selected when adding the User-ID Agent in Panorama.
When configuring User-ID redistribution in Prisma Access managed by Panorama, the correct template must be selected when adding the User-ID Agent. For remote network connections, the Remote_Network_Template must be selected (option A). Additionally, the Pre-Shared Keys for the Collector must match between Prisma Access and the on-premises firewall to establish secure communication (option D, corrected from option C's naming).
Why the other options are wrong
- B. Port 5007 is used for User-ID agent communication, but a specific security policy is not required, the infrastructure handles this internally.
- C. While PSK matching is important, the Service_Conn_Template is not the correct template for User-ID Agent configuration in remote network scenarios.
Question 14
How can role-based access control (RBAC) for Prisma Access (Managed by Strata Cloud Manager) be used to grant each member of a security team full administrative access to manage the Security policy in a single tenant while restricting access to other tenants in a multitenant deployment?
Show answer and explanation
Correct answer: D. Add the team to the Child Tenant, select Prisma Access & NGFW Configuration, and set the role to Security Administrator.
In a multitenant Prisma Access deployment managed by Strata Cloud Manager, to grant a team full administrative access to Security policy in a single tenant while restricting access to other tenants, the team must be added to the specific Child Tenant (not the Parent Tenant) with the 'Prisma Access & NGFW Configuration' scope and the Security Administrator role. This ensures they have access only to that tenant's configurations.
Why the other options are wrong
- A. Adding to the Parent Tenant grants access across multiple tenants, which does not restrict to a single tenant.
- B. The 'All Apps & Services' scope is too broad and does not appropriately limit access to just Prisma Access configuration.
- C. The Parent Tenant assignment would provide access beyond the intended single tenant, failing the restriction requirement.
Question 15
When a review of devices discovered by IoT Security reveals network routers appearing multiple times with different IP addresses, which configuration will address the issue by showing only unique devices?
Show answer and explanation
Correct answer: B. Merge individual devices into a single device with multiple interfaces.
Merging individual devices into a single device with multiple interfaces is the correct approach to consolidate network routers appearing multiple times with different IP addresses. This represents the same physical device with multiple network interfaces, and merging them shows only unique devices in the discovered inventory.
Why the other options are wrong
- A. Adding duplicates to an ignore list does not resolve the underlying issue of showing the same device multiple times.
- C. Creating a custom role does not provide device merging functionality; this is an operational task requiring the merge feature.
- D. Deleting devices loses valuable information; merging preserves all data while showing unique devices accurately.
Question 16
Which feature will fetch user and group information to verify whether a group from the Cloud Identity Engine is present on a security processing node (SPN)?
Show answer and explanation
Correct answer: A. SASE Health Dashboard
The SASE Health Dashboard provides visibility into the health and status of security components, including whether group information from the Cloud Identity Engine is present and synchronized on security processing nodes (SPNs). This dashboard specifically tracks user and group information verification across the infrastructure.
Why the other options are wrong
- B. User Activity Insights focuses on analyzing user behavior and activity patterns, not on verifying group presence on SPNs.
- C. Prisma Access Locations displays geographic and network location information, not group verification status.
- D. Region Activity Insights shows activity metrics by region but does not verify Cloud Identity Engine group presence on nodes.
Question 17
Strata Logging Service is configured to forward logs to an external syslog server; however, a month later, there is a disruption on the syslog server. Which action will send the missing logs to the external syslog server?
Show answer and explanation
Correct answer: A. Configure a replay profile with the affected time range and associate it with the affected syslog server profile.
A replay profile in Strata Logging Service allows administrators to specify a time range of missing logs and resend them to the external syslog server. This feature is specifically designed to recover from syslog server disruptions by replaying the logs that were generated during the outage period.
Why the other options are wrong
- B. Deleting and recreating the syslog server profile does not recover missing logs; it only creates a new connection going forward.
- C. Manual export and import is not a supported workflow in Strata Logging Service for recovering missed logs.
- D. Log filters control which logs are sent, not recover missing logs from a past disruption.
That was 17 of 118.
The full Palo Alto Networks Security Service Edge Engineer pack has all 118 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 23 free as one PDF by email. Get the Half Pack →