sse-engineer Practice Questions

The Prisma Access Browser intelligently routes traffic. When a user tries to access a resource, PAB first checks against the list of configured private applications. If the destination FQDN matches a private app, traffic is tunneled through the ZTNA connection. If it does not match, it is treated as public traffic and is forwarded to the nearest Prisma Access Security Processing Node for standard security inspection.

True. Strata Cloud Manager Copilot is an AI-powered assistant that helps administrators manage their security posture. One of its key features is the ability to analyze traffic logs and existing policies to proactively suggest optimizations, such as tightening overly permissive rules, adding more specific applications, or identifying redundant policies.

Quality of Service (QoS) is the feature designed to manage and prioritize network traffic. An engineer would create a QoS profile that defines different traffic classes (e.g., high, medium, low priority) and then create a QoS policy rule that uses Application IDs to map applications like Zoom and Teams to the high-priority class, ensuring they receive preferential bandwidth treatment over less critical traffic.

For Prisma Access to enforce group-based policies, it relies on the Cloud Identity Engine (CIE) to synchronize user and group information from the identity provider (e.g., Azure AD). If the traffic logs show an IP address but no user or group information, it strongly indicates that the User-ID mapping is failing. This is most commonly caused by a communication issue between CIE and the directory server or a delay/failure in the synchronization process.

The correct method for ZTNA Connector high availability is to deploy multiple connectors (ideally on different hosts or in different failure domains) and organize them into a Connector Group. Prisma Access will automatically load balance traffic across the active connectors in the group and handle failover if one of the connectors becomes unavailable.

When using the Strata Logging Service, log forwarding is configured centrally within the SCM settings, not via security policy rules like in Panorama. The correct method is to navigate to the logging service configuration, create a specific rule for the desired log type (DNS), and direct it to the appropriate external destination (the SIEM). The other options describe methods used in Panorama-managed firewalls or are conceptually incorrect.

Prisma Access Browser (PAB) is the agentless solution designed for this use case. Remote Browser Isolation (RBI) streams a visual representation of the web application to the user's browser, completely isolating the session from the endpoint and internal network. Enterprise DLP policies applied within PAB can enforce granular controls like disabling copy-paste and printing, directly addressing the data exfiltration concern.

App Acceleration is a feature specifically designed to improve the performance of latency-sensitive applications, with pre-defined optimizations for common SaaS applications like Microsoft 365. It uses techniques on the Prisma Access backbone to reduce latency and improve the user experience. While QoS can prioritize traffic, App Acceleration provides a more direct and effective solution for performance optimization of supported applications.

Backbone routing is the mechanism that directs traffic between different Prisma Access locations (like from a Security Processing Node handling a remote network to another handling a service connection) over the high-speed, private Palo Alto Networks global backbone. This avoids transiting the public internet, providing better performance and security, which is exactly what the scenario requires.

True. The ZTNA Connector provides a simplified and secure way to connect private applications to Prisma Access without requiring traditional network-level connectivity like IPSec tunnels (service connections). The connector establishes an outbound-only TLS tunnel to the Prisma Access cloud, effectively replacing the need for a service connection for the specific applications it serves.