An engineer configures User-ID redistribution from an on-premises firewall connected to Prisma Access (Managed by Panorama) using a service connection. After committing the configuration, traffic from remote network connections is still not matching the correct user-based policies. Which two configurations need to be validated? (Choose two.)
Answer(s): A,D
Ensuring that the Remote_Network_Template is selected when adding the User-ID Agent in Panorama is crucial because User-ID information must be associated with the correct Remote Network configuration for policies to apply properly. Additionally, the Service_Conn_Template must be selected when adding the User-ID Agent in Panorama, as the service connection is responsible for distributing User-ID mappings between the on-premises firewall and Prisma Access. If either of these configurations is incorrect, the user information will not be properly mapped, and traffic will not match user-based policies.
What is the purpose of embargo rules in Prisma Access?
Answer(s): C
Embargo rules in Prisma Access are designed to block traffic from specific countries that are subject to regulatory or policy-based restrictions. These rules help organizations enforce compliance by preventing inbound and outbound connections to or from regions that may pose security risks or are restricted due to legal or geopolitical reasons. They are commonly used to align with government sanctions and corporate security policies.
Strata Logging Service is configured to forward logs to an external syslog server; however, a month later, there is a disruption on the syslog server.Which action will send the missing logs to the external syslog server?
Answer(s): A
The Strata Logging Service allows log replay, which enables resending logs that were not successfully forwarded to an external syslog server due to disruptions. By configuring a replay profile with the affected time range and associating it with the syslog server profile, Prisma Access will resend the missing logs, ensuring that all relevant data is restored in the external logging system. This approach is the most efficient and automated way to recover missing logs.
A large retailer has deployed all of its stores with the same IP address subnet. An engineer is onboarding these stores as Remote Networks in Prisma Access. While onboarding each store, the engineer selects the "Overlapping Subnets" checkbox.Which Remote Network flow is supported after onboarding in this scenario?
When the "Overlapping Subnets" checkbox is selected during the Remote Network onboarding process in Prisma Access, the deployment enables Private Application access using Prisma Access for Users (ZTNA or Private Access). This feature is designed to handle scenarios where multiple sites use the same IP subnet by leveraging NAT (Network Address Translation) and segmentation to avoid conflicts.Since overlapping subnets can create routing challenges for direct remote network-to-remote network communication, Prisma Access does not support Remote Network-to-Remote Network or Mobile User communication in this case. Private application access is supported as Prisma Access correctly routes requests based on application-layer intelligence rather than IP-based routing.
An intern is tasked with changing the Anti-Spyware Profile used for security rules defined in the GlobalProtect folder. All security rules are using the Default Prisma Profile. The intern reports that the options are greyed out and cannot be modified when selecting the Default Prisma Profile.Based on the image below, which action will allow the intern to make the required modifications?
Palo Alto Networks best practices and the behavior of Strata Cloud Manager (SCM) dictate that predefined or default objects, including profile groups like "Default Prisma Profile," cannot be directly modified. These default objects serve as baseline configurations and are often locked to prevent accidental or unintended changes that could impact the overall security posture. The intern's experience of the options being greyed out when selecting "Default Prisma Profile" is a direct indication of this immutability of default objects.Therefore, the correct action is to:Create a new Profile Group: The intern should create a new profile group within the appropriate configuration scope (likely GlobalProtect, given the task). Configure the new Profile Group: In this new profile group, the intern can select the desired Anti- Spyware Profile (which might be an existing custom profile or a new one they create).Modify Security Rules: The security rules currently using the "Default Prisma Profile" in the GlobalProtect folder need to be modified to use this newly created profile group. Let's analyze why the other options are incorrect based on official documentation:A . Request edit access for the GlobalProtect scope. While having the correct scope permissions is necessary for making any changes within GlobalProtect, it will not override the inherent immutability of default objects like "Default Prisma Profile." Edit access will allow the intern to create new objects and modify rules, but not directly edit the default profile group. B . Change the configuration scope to Prisma Access and modify the profile group. The image shows that "Default Prisma Profile" has a "Location" of "Prisma Access." However, even within the Prisma Access scope, default profile groups are generally not directly editable. The issue is not the scope but the fact that it's a default object.D . Modify the existing anti-spyware profile, because best-practice profiles cannot be removed from a group. The question is about changing the profile group, not the individual Anti-Spyware Profile. While "best-practice" profiles might be part of default groups, the core issue is the inability to modify the default group itself. Creating a new group allows the intern to choose which Anti-Spyware Profile to include.In summary, the fundamental principle in Palo Alto Networks management is that default objects are typically read-only to ensure a consistent and predictable baseline. To make changes, you need to create custom objects.
Post your Comments and Discuss Palo Alto Networks SSE-Engineer exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSE-Engineer content, but please register or login to continue.