Palo Alto Networks SSE-Engineer Practice Test

SSE-Engineer practice test: what's covered

• Prisma Access Planning & Deployment
• Prisma Access Services
• Prisma Browser
• Administration & Operation
• Troubleshooting

Free SSE-Engineer sample questions

1. An engineer is designing Prisma Access for a company whose data centre hosts the ERP system that all branches and mobile users must reach. Which Prisma Access construct carries traffic to that data centre?

   • A. A remote network, which terminates the branch IPsec tunnel for internet breakout
   • B. A mobile user gateway, which anchors roaming GlobalProtect endpoints
   • C. A colo-connect link, which peers the tenant with a public cloud provider
   • D. A service connection, which links Prisma Access to the customer's private network
   Show answer

   Correct: D. Service connections exist specifically to reach customer-owned private resources such as data centres, directory services and internal applications. Remote networks connect branch sites into the service, mobile user gateways serve roaming endpoints, and neither of those provides the private-side path that ERP access requires.

2. During deployment planning an engineer must choose gateway locations for 4,000 mobile users spread across Europe and India. Which factor should drive that selection most strongly?

   • A. The number of remote networks already deployed in each candidate location
   • B. The bandwidth allocated to the service connection at the corporate data centre
   • C. Proximity of the gateway location to the users so latency to the service stays low
   • D. The alphabetical ordering of available locations within the tenant configuration
   Show answer

   Correct: C. Mobile users connect to the nearest enabled gateway, so choosing locations close to concentrations of users minimises added latency and preserves application experience. Alphabetical ordering is arbitrary, remote network counts describe branch connectivity, and service connection bandwidth affects private access rather than where users terminate.

3. An architect must connect a branch office with two independent internet circuits to Prisma Access with resilience. Select the TWO design elements that deliver that resilience. (Choose TWO)

   • A. Two mobile user gateways enabled in the same region as the branch office
   • B. A second service connection terminating at the branch office internet router
   • C. A primary and secondary IPsec tunnel from the branch device to the remote network
   • D. Tunnel monitoring so failure of the primary path triggers failover to the secondary
   • E. A single tunnel with a shorter IKE lifetime so rekeying happens more frequently
   Show answer

   Correct: C and D. Branch resilience requires a second tunnel over the alternate circuit plus a liveness mechanism that detects failure and moves traffic. Frequent rekeying does not help when a circuit is down, mobile user gateways serve endpoints rather than sites, and service connections are for private resources rather than branch internet paths.

4. An engineer must advertise the branch subnets behind a remote network into Prisma Access so that mobile users can reach them. Which routing option supports dynamic advertisement?

   • A. BGP peering between the remote network device and Prisma Access
   • B. OSPF area 0 adjacency formed across the IPsec tunnel to the service
   • C. RIP version 2 redistribution configured on the branch router interface
   • D. Proxy ARP on the Prisma Access gateway for each branch subnet
   Show answer

   Correct: A. Prisma Access supports BGP with remote networks and service connections so prefixes are exchanged dynamically as the branch changes. OSPF and RIP are not supported peering options with the service, and proxy ARP is a link-layer behaviour that cannot distribute routing information across the tunnel.

5. A customer requires that mobile users authenticate with the corporate identity provider before the tunnel is established. Which component supplies that authentication configuration to the agent?

   • A. The service connection, which validates the user credential against Active Directory
   • B. The Strata Logging Service, which records the authentication event for audit
   • C. The remote network, which authenticates the branch device using a pre-shared key
   • D. The GlobalProtect portal, which delivers the client configuration and authentication settings
   Show answer

   Correct: D. The portal is the first contact for the agent and delivers the configuration including the authentication profile and gateway list. Service connections carry traffic to private resources, the logging service records events after the fact, and remote network pre-shared keys authenticate site devices rather than users.

Last updated: 2026-09-23

SSE-Engineer practice test FAQ

Related practice tests

• Palo Alto Networks PCXSA practice test
• Palo Alto Networks XSOAR-ANALYST practice test
• Palo Alto Networks NetSec-Pro practice test
• Palo Alto Networks NGFW practice test
• Palo Alto PCCET practice test
• Palo Alto Networks PCCSE practice test