SSE Engineer 試験問題と解答 - 模擬練習 - 練習問題・模擬試験

Question No : 1
Secure Inbound Access has been configured to allow access to an RDP application at a branch location, as shown in the image below.

After a successful commit, return traffic from the application is not reaching the internet user.
What is causing the return traffic to fail?

A.The Remote Network Security policy source zone is configured as "Untrust."
B.Source NAT is enabled, but the branch location's CPE does not have a route back to the Service Endpoint Address of the Inbound Access Remote Network Node.
C.The "Allow inbound flows to other Remote Networks over the Prisma Access backbone" checkbox is selected.
D.Source NAT is enabled, but the branch location's CPE does not have a route back to the eBGP Router ID of the Inbound Access Remote Network Node.

正解:

Question No : 2
What is the network impact when a Prisma Access service connection is set as a dedicated service connection for traffic steering?

A.It maintains its zone as Trust and continues to participate in both internal and external BGP routing.
B.It changes its zone to Untrust. applies source NAT to forwarded traffic, and no longer participates in BGP routing.
C.It maintains its zone as Trust; however, it disables all Security policies, allowing unrestricted traffic flow through the dedicated service connection.
D.It applies destination NAT to forwarded traffic, maintains its BGP routing configurations, and allows traffic from both Trust and Untrust zones.

正解:

Question No : 3
An organization wants Prisma Access Browser (PAB) users to authenticate to public cloud services, such as Microsoft 365, using its existing corporate IdP (e.g., Azure AD).
Which integration is essential to enable this automated single sign-on (SSO) experience for public cloud applications accessed via PAB?

A.Direct integration of the browser with Microsoft's Conditional Access policies
B.Deployment of a browser-specific SSO extension
C.Configuration of individual user authentication tokens within the PAB profile
D.Cloud Identity Engine integration with the corporate IdP

正解:

Question No : 4
Which two Prisma Access Browser (PAB) configurations will provide a contractor SSH access to an internal system? (Choose two.)

A.Configure Internal Application entries, Configure Access & Data Control policy
B.Enable Remote Connections
C.Configure Remote Connection Application entries, Configure Access & Data Control policy
D.Enable Internal Connections

正解:

Question No : 5
What are two advantages the Prisma Access Browser (PAB) offers in providing consistent security for accessing web-based resources across corporate-managed laptops and personal devices, as well as contractors using devices issued by third parties? (Choose two.)

A.It enforces SSL Forward Proxy decryption to enable inspection of encrypted traffic, allowing for enhanced security and threat prevention capabilities.
B.It provides all users on any devices secure access to the internet with enhanced security and threat prevention capabilities for encrypted traffic.
C.It routes all traffic to Prisma Access to perform deep packet inspection of encrypted traffic, allowing for enhanced security and threat prevention capabilities.
D.It applies an encryption layer to protect all browser assets with a trusted encryption chain that is independent of the operating system.

正解:

Question No : 6
A company is using Prisma Access with Cloud Identity Engine for user-based policies.
Which two system configurations will dynamically grant users access to specific projects based on their group membership in Microsoft Entra ID? (Choose two.)

A.Configure Dynamic Privilege Access settings in Prisma Access and associate the user groups with the corresponding project IP address pools.
B.Create a custom application in Microsoft Entra ID representing each project and configure SSO with the Cloud Identity Engine.
C.Implement an authentication sequence in Prisma Access that prioritizes Cloud Identity Engine authentication for users belonging to project-specific groups.
D.In the Cloud Identity Engine, add the Microsoft Entra ID directory as an IdP and configure the required user group mappings for each project.

正解:

Question No : 7
An engineer is troubleshooting split-tunneling on a Palo Alto Networks VPN client. The local LAN interface is on the 192.168.1.0/24 network, and the Prisma Access Mobile User IP Pool is configured as 172.16.72.0/23 in Strata Cloud Manager (SCM).

Based on the image below, which statement regarding the split-tunneling configuration for the VPN client is valid?

A.9.9.9.9/32 has been explicitly configured as an include route.
B.192.168.5.95/32 has been explicitly configured as an exclude route.
C.10.10.10.10/32 has been explicitly configured as an include route.
D.172.16.73.1/32 has been explicitly configured as an exclude route.

正解:

Question No : 8
A financial institution needs to prevent employees from easily moving textual information from secure financial portals accessed using Prisma Access Browser (PAB) directly into other applications on their workstations.
The goal is to stop the practice of selecting data within the browser and then inserting that selected content into external documents or programs.
Which PAB control should be configured to disable this particular method of data transference?

A.Data loss prevention (DLP)
B.Data Transfer
C.Clipboard
D.Webpage Data Masking

正解:

Question No : 9
Which configuration change will allow an organization using Prisma Access (Managed by Panorama) to minimize the consumption of Strata Logging Service storage due to a high volume of asymmetric traffic flows on its data center?

A.Configure a log forwarding profile on the service connection to filter out asymmetric traffic.
B.Disable traffic logging on the service connection.
C.Disable the log forwarding profile for the service connection.
D.Reduce the log retention period for Strata Logging Service.

正解:

Question No : 10
An administrator is configuring a dedicated visitor sign-in kiosk in the main corporate office using Prisma Access Browser (PAB). A key security requirement is to ensure the device is locked down, which includes preventing users from creating paper copies of any on-screen information. The policy must specifically apply to this fixed-location kiosk.
Which two PAB match criteria will enforce these restrictions on the kiosk? (Choose two.)

A.Configuring the print control as the specific data control for the rule
B.Configuring the kiosk control, which prevents printing
C.Defining the policy scope based on location, specifying the location of the corporate offices
D.Defining the policy scope based on networks, specifying the corporate public IP range or CIDR

正解:

Question No : 11
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to-business (B2B) partners to its data centers.
The solution must meet these requirements:
• The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.
• The branch locations must have internet filtering and data center connectivity.
• The B2B partner connections must only have access to internally hosted proprietary applications running on non-standard ports.
• There are overlapping prefixes advertised by the B2B partners.
Which two actions will meet the customer requirements for the B2B connections? (Choose two.)

A.Advertise the corresponding network prefixes using eBGP or static routes.
B.Configure remote networks with NAT pools for each of the B2B connections.
C.Configure service connections for data center connectivity.
D.NAT the traffic at the customer premises equipment (CPE).

正解:

Question No : 12
A company is migrating from NGFW-hosted Global Protect to Prisma Access Mobile Users. The authentication method will change from LDAP with Windows Active Directory Domain Controllers to SAML with Microsoft Entra ID.
After configuring and applying the SAML Authentication Profile to the Mobile Users configuration, the migrated group-based Security policies are no longer functioning.
Which User-ID setting must be updated for the group-based Security policies to begin functioning?

A.Configure a redistribution profile to send user-to-group mapping from the Global Protect firewalls to Prisma Access.
B.Migrate group mapping to Cloud Identity Engine using an agent to query the Windows Active Directory Domain Controllers .
C.Modify the group mapping settings by updating the User Attributes to include "userPrincipalName."
D.Change the SAML Authentication profile Username Modifier to %USERDOMAIN%\%USERINPUT%.

正解:

Question No : 13
An administrator needs to enforce access to all applications via Prisma Access Browser (PAB) for unmanaged or non-compliant devices.
Configuration of which two enforcement actions will ensure all access to applications only happens through PAB? (Choose two.)

A.For SSO-enabled applications, configure Enforce SS
B.Use Account Protection for non SSO-enabled applications.
C.Use the PAB Extension to redirect traffic through Prisma Access.
D.Use Device Posture to allow or block traffic.

正解:

Question No : 14
A network administrator is enabling users, via Prisma Access Browser (PAB), to securely access internal web applications hosted exclusively within the organization's private data center.
Which two Prisma Access infrastructure components are primarily configured to establish the necessary connection pathways from Prisma Access to these internal data center resources? (Choose two.)

A.Explicit Proxy
B.ZTNA Connector
C.Privileged Remote Access
D.Service Connection

正解:

Question No : 15
An organization deploys the Prisma Access Browser (PAB) to secure web access from diverse endpoints, including personal devices where IT has limited control.
To maintain a strong and proactive security posture across these varied environments, why is the use of PAB device posture attributes, such as OS version, file system encryption, and device type, considered essential?

A.It permits PAB to function as a standalone endpoint detection and response (EDR) solution.
B.It provides the administrators of PAB the ability to enable disk encryption on all endpoints.
C.It allows administrators to identify and restrict access based on OS version and browser type on unmanaged devices.
D.It enables the administrators of PAB to independently perform OS and browser patching on unmanaged devices.

正解:

Paloalto Networks SSE Engineer 問題練習