Based on the image below, which two statements describe the reason and action required to resolve the errors? (Choose two.)
Answer(s): B,C
The error messages indicate that Prisma Access is encountering certificate issues while attempting to decrypt traffic to "google.com." This suggests that the server has pinned certificates, meaning it does not allow man-in-the-middle (MITM) decryption by Prisma Access. Since pinned certificates prevent traffic decryption, a solution is to create a "do not decrypt" rule for the hostname "google.com." This will allow traffic to flow without triggering certificate errors while maintaining secure communication with Google's servers.
How can a network security team be granted full administrative access to a tenant's configuration while restricting access to other tenants by using role-based access control (RBAC) for Panorama Managed Prisma Access in a multitenant environment?
Answer(s): A
In a Panorama Managed Prisma Access multitenant environment, Access Domains provide granular role-based access control (RBAC). By defining an Access Domain, the network security team can be granted full administrative privileges for a specific tenant's configuration while ensuring they cannot access or modify other tenants. This method enforces proper segmentation and ensures compliance with multitenant security policies.
An engineer has configured a Web Security rule that restricts access to certain web applications for a specific user group. During testing, the rule does not take effect as expected, and the users can still access blocked web applications.What is a reason for this issue?
Answer(s): D
Prisma Access applies security rules in a hierarchical order, where rules at higher levels take precedence over those at lower levels. If a more permissive rule is placed higher in the hierarchy, it may allow traffic before the restrictive Web Security rule is evaluated. To resolve this, the engineer should reorder the rules to ensure the restrictive Web Security rule is positioned higher in the hierarchy so it is applied before any broader or conflicting rules.
What will cause a connector to fail to establish a connection with the cloud gateway during the deployment of a new ZTNA Connector in a data center?
Answer(s): B
A ZTNA Connector requires a stable and direct connection to the cloud gateway. When the connector is deployed behind a double NAT (Network Address Translation), it can cause issues with reachability and session establishment because the cloud gateway may not be able to properly identify and communicate with the connector. Double NAT can interfere with secure tunneling, IP address resolution, and authentication mechanisms, leading to connection failures. To resolve this, the connector should be placed in a network segment with a single NAT or a public IP assignment.
Which feature will fetch user and group information to verify whether a group from the Cloud Identity Engine is present on a security processing node (SPN)?
The SASE Health Dashboard provides visibility into user and group synchronization between the Cloud Identity Engine and the Security Processing Nodes (SPNs). It allows administrators to verify whether a group from the Cloud Identity Engine is properly fetched and available on the SPN for policy enforcement. This feature helps in troubleshooting identity-based access control issues and ensures that user group mappings are correctly applied within Prisma Access.
Post your Comments and Discuss Palo Alto Networks SSE-Engineer exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSE-Engineer content, but please register or login to continue.