Prisma Access Quiz

31. How is DNS Security typically configured and applied in Prisma Access?

Via a dedicated DNS Security policy type.

As part of a URL Filtering profile.

Within an Anti-Spyware profile attached to a Security Policy rule.

By configuring DNS servers in the GlobalProtect client settings.

32. What is the purpose of the DNS Sinkhole action in DNS Security?

To block all DNS requests from compromised clients.

To redirect requests for malicious domains to a controlled IP address for identification.

To cache DNS responses locally for faster lookup.

To encrypt DNS traffic using DoH.

33. For Enterprise DLP to be most effective in inspecting file contents for sensitive data, what other Prisma Access feature should ideally be enabled?

QoS

Split Tunneling

SSL Decryption

BGP Routing

34. In which scenario might using Prisma Access Explicit Proxy be considered instead of the GlobalProtect client?

When HIP checks are mandatory for all users.

For securing non-web traffic like RDP or SSH.

For devices where GlobalProtect client installation is not feasible or desired (e.g., some servers, BYOD).

When Always On VPN is required.

35. What tool provides the primary dashboards for monitoring Prisma Access health, connectivity, and performance?

Panorama Task Manager

Cortex Data Lake Query Builder

Prisma Access Insights (via Hub or SASE UI)

GlobalProtect Client Logs

36. High latency reported in Prisma Access Insights for a specific Remote Network site most likely indicates an issue with...?

Prisma Access SPN processing overload.

The network path between the site and the Prisma Access PoP (e.g., local ISP link).

Incorrect BGP configuration.

Cortex Data Lake connection failure.

37. If a mobile user cannot connect to GlobalProtect and logs show "Authentication Failed", what is the LEAST likely cause?

Incorrect password or locked account.

Misconfigured SAML IdP integration.

Split tunnel configuration error.

Incorrect RADIUS shared secret.

38. What is the most common reason for an IPSec tunnel between a Remote Network and Prisma Access failing to establish Phase 1 (IKE SA)?

Incorrect BGP neighbor IP address.

Mismatched Pre-Shared Key or IKE Crypto Profile settings.

Split tunnel configuration preventing IKE traffic.

Insufficient bandwidth allocated to the site.

39. If traffic is allowed by a Security Policy rule but the application still doesn't work, checking which log type is LEAST likely to directly reveal the cause?

Traffic Logs (for Session End Reason)

Threat Logs (if a threat profile blocked a component)

URL Filtering Logs (if a web component was blocked)

Configuration Logs

40. Who is primarily responsible for updating the PAN-OS software running on the Prisma Access infrastructure (SPNs, CANs)?

The customer's Panorama administrator.

Palo Alto Networks SRE team (based on customer's selected version/schedule).

The GlobalProtect client via automatic updates.

Cortex Data Lake automatically pushes updates.

Prisma Access Quiz (Page 4 of 5)