SSE-Engineer: Palo Alto Networks Certified Security Service Edge Engineer Practice Exam

What the SSE-Engineer exam covers

• Prisma Access Planning and Deployment138 questions
• Prisma Access Services138 questions
• Prisma Browser138 questions
• Prisma Access Administration and Operation101 questions
• Prisma Access Troubleshooting113 questions

Free SSE-Engineer practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 628-question bank.

1. Question 1Prisma Access Planning and Deployment

   Contoso is mapping the Prisma Access data path for its security review. Traffic from mobile users reaches the data center through Prisma Access. Which Prisma Access node type connects Prisma Access to the data center?

   • AMobile User Security Processing Node (MU-SPN)
   • BZTNA Connector Tunnel Terminator node (ZTT)
   • CService Connection Corporate Access Node (SC-CAN)Correct
   • DRemote Network Security Processing Node (RN-SPN)
   ✓ Correct answer: C

   The Prisma Access overview describes how Palo Alto Networks encrypts data end to end across its nodes. Encryption runs between Mobile User Security Processing Nodes and Remote Network Security Processing Nodes, between SPNs and Service Connection Corporate Access Nodes, and between SC-CANs and the data center. So in Contoso's path, the mobile user's SPN hands traffic to an SC-CAN, which then connects to the data center. ZTNA Tunnel Terminators serve ZTNA Connector tunnels, not service connections.

   Why the other options are wrong

   • AThe MU-SPN secures mobile user traffic; it hands traffic to the SC-CAN rather than connecting to the data center itself.
   • BZTTs terminate ZTNA Connector IPSec tunnels; they are not the nodes behind service connections.
   • DThe RN-SPN secures remote network branch traffic, not the service connection side toward the data center.
2. Question 2Prisma Access Planning and Deployment

   Adatum wants its GlobalProtect portal to be vpn.adatum.com instead of a hostname under the default Prisma Access domain. What extra work does a custom domain require?

   • AObtain portal certificates, set an SSL/TLS profile and add a DNS CNAMECorrect
   • BOnly a DNS CNAME, since Prisma Access generates certificates for any domain
   • CRegister the domain with Palo Alto Networks support before onboarding
   • DHost the portal on a service connection so that DNS stays internal
   ✓ Correct answer: A

   The planning checklist describes the portal hostname options. With the default domain, .gpcloudservice.com, the service publishes the hostname to public DNS and handles all certificate generation. If you use your own company domain, you must obtain your own portal certificates and configure an SSL/TLS service profile that points to them before configuring the service. You must also configure your DNS servers to point to the portal DNS CNAME provided during configuration.

   Why the other options are wrong

   • BAutomatic certificates and DNS apply only to the default domain.
   • CNo registration with support is documented; certificates, a profile and a CNAME are needed.
   • DThe portal is a cloud service; hosting it on a service connection is not the requirement.
3. Question 3Prisma Access Planning and Deployment

   Proseware's Explicit Proxy users authenticate through the Cloud Identity Engine with a two-hour cookie lifetime. Users report large downloads failing partway and being asked to sign in again while working on one site. What does the guidance recommend?

   • AEnable SAML single logout on the IdP app
   • BSet the Cookie Lifetime to under one hour
   • CMove the users to Kerberos auth on port 8080
   • DSet the Cookie Lifetime to at least one dayCorrect
   ✓ Correct answer: D

   When setting up user authentication for Explicit Proxy with SAML and CIE, you specify a Cookie Lifetime for the cookie that stores the user's authentication state in the Authentication Cache Service. The page recommends at least one day, to prevent users being unable to download large files before the cookie expires, or the cookie expiring while they stay on one site for a long time. Users who hit an expiration can browse to a different site to re-authenticate and refresh the ACS cookie. Single logout is not supported for this flow.

   Why the other options are wrong

   • ASingle logout is not supported for this CIE authentication flow.
   • BA shorter lifetime makes expirations during long downloads more likely.
   • CKerberos uses port 8081 for Explicit Proxy, and changing method is not the documented fix.
4. Question 4Prisma Access Services

   Northwind wants AI Access Security to stop users from pasting customer data into sanctioned GenAI chat apps. For most GenAI apps, which kind of Enterprise DLP inspection applies?

   • AFile inspection, unless the app is listed as also supporting nonfile
   • BNonfile inspection, unless the app is listed as also supporting filesCorrect
   • COCR inspection only, since GenAI apps render prompts as images
   • DFile inspection only, since the prompts are sent as attached text files
   ✓ Correct answer: B

   The What's Supported page for AI Access Security explains that Enterprise DLP is the detection engine that prevents exfiltration of sensitive data to GenAI apps. It lists requirements, including PAN-OS 10.2.3 or later for NGFW, Panorama and the Prisma Access data plane. It states that all GenAI apps support only nonfile inspection unless otherwise specified in the list of supported GenAI apps. If Enterprise DLP doesn't support a particular GenAI app, you can block it if it is unsanctioned.

   Why the other options are wrong

   • AThe rule is the other way round: GenAI apps support only nonfile inspection unless the supported apps list says otherwise.
   • COCR applies to images in file-based traffic, not to GenAI prompts generally.
   • DPrompts are inspected as nonfile traffic for most GenAI apps, not as file uploads.
5. Question 5Prisma Access Services

   Litware plans a Strata Cloud Manager deployment and wants Prisma Access to share identity data with its data center firewall. What must exist for Prisma Access to act as the redistribution agent?

   • AA Master Device, which pushes group mappings to data center firewalls
   • BA service connection, which Prisma Access sets up for this automaticallyCorrect
   • CA ZTNA Connector group, which forwards identity data to the firewall
   • DA remote network per data center, since service connections can't do it
   ✓ Correct answer: B

   The Set Up Identity Redistribution steps start with confirming the service connection setup. A service connection is required for Prisma Access to share identity data across your environment. Prisma Access automatically enables service connections to work as redistribution agents, also called User-ID agents. A new service connection is ready when it has been assigned a User-ID agent address, which takes a few minutes.

   Why the other options are wrong

   • AA Master Device populates Panorama drop-downs; it is not the redistribution agent.
   • CZTNA Connector has its own User-ID option for source NAT, but the documented requirement is a service connection.
   • DService connections are the documented redistribution agents.
6. Question 6Prisma Browser

   At Contoso, two admins are editing Prisma Browser policy in the same draft. Admin A finished a new sign-in rule and wants to publish only that rule, while Admin B's half-finished Access and Data Control changes are still pending. What happens if Admin A publishes?

   • AThe publish is blocked until Admin B either publishes or discards the other changes
   • BEvery pending change is published together, including Admin B's unfinished workCorrect
   • CAdmin A is asked to pick which pending changes to include in the new version
   • DOnly the changes made by Admin A are published, and Admin B's stay in the draft
   ✓ Correct answer: B

   Draft Mode stores all modifications to rules, applications, application groups and device groups in one shared draft configuration. The draft mode page states that publishing commits all pending changes as a single, atomic operation and that you cannot publish a subset of changes. Its best practices add that publishing commits all pending changes from all administrators, so admins sharing a draft should coordinate. If Admin A publishes now, Admin B's incomplete work goes live with the new version.

   Why the other options are wrong

   • ANothing blocks the publish; it simply commits everything pending, which is why coordination is recommended.
   • CThere is no selection step; a subset of changes cannot be published.
   • DPublishing is not per admin; it commits all pending changes from all administrators at once.
7. Question 7Prisma Browser

   Litware uses Windows Roaming User Profiles for Prisma Browser in its call center. An agent leaves Prisma Browser open on one PC and signs in to Prisma Browser on a second PC. What happens?

   • AThe second PC opens a new empty profile and syncs it at logoff
   • BBoth sessions run, and changes merge back to the server at logoff
   • CThe first PC's session is closed and moved to the second PC
   • DThe second PC cannot use the profile, since it is locked in useCorrect
   ✓ Correct answer: D

   Prisma Browser stores user data in a portable profile.pb file within the Windows roaming profile, so the data follows the user between domain-joined PCs. The roaming profiles page lists important limitations. The first is that there are no simultaneous sessions: users cannot run Prisma Browser on two machines at the same time, because the profile file is locked during use. The agent must close the browser on the first PC before using it on the second.

   Why the other options are wrong

   • AThe documented behaviour is the lock on profile.pb, not a fresh profile on the second PC.
   • BSimultaneous sessions are not supported, because the profile file is locked during use.
   • CNothing moves the running session; the profile stays locked by the first PC.
8. Question 8Prisma Access Administration and Operation

   A push to Tailspin's Prisma Access caused a security disruption, and the admin chooses Revert in Strata Cloud Manager's push options. Which configuration can this revert return to?

   • AThe most recent running Prisma Access configuration onlyCorrect
   • BThe configuration from the tenant's very first successful push
   • CAny running configuration chosen from the last six months
   • DThe named snapshot most recently saved by any administrator
   ✓ Correct answer: A

   The Push Config page explains that if a configuration is pushed in error or causes disruption, you can revert the Prisma Access configuration to the most recent running configuration. This returns it to a configuration you know is functional. You do not have the option to select a specific running configuration. For older versions, you use Config Version Snapshots to restore or load.

   Why the other options are wrong

   • BThe revert target is the most recent running configuration, not the first push.
   • CYou can't select a specific running configuration with this revert; older versions use snapshots.
   • DNamed snapshots are loaded from the snapshot page, not through this revert.
9. Question 9Prisma Access Troubleshooting

   Fabrikam's Explicit Proxy users do not bypass the ACS FQDN in the PAC file. An engineer checks Explicit_Proxy_Device_Group traffic logs for a user's source IP. What source IP appears?

   • AThe ACS region's anycast IP address, shared by all five ACS regions
   • BThe user's own IP address, as seen by the proxy on the very first request
   • CThe GlobalProtect pool address assigned to the user by the gateway
   • DThe public IP of the proxy's cloud firewall that redirects to ACSCorrect
   ✓ Correct answer: D

   The Monitor and Troubleshoot Explicit Proxy page explains which IPs appear in logs. If mobile users bypass the ACS FQDN in the PAC file, the source IP in traffic and authentication logs is the user's own IP. If users do not bypass it, the source IP is the public IP address of the Explicit Proxy cloud firewall where redirects are going to ACS. The region shown likewise depends on the bypass.

   Why the other options are wrong

   • ANo shared anycast ACS address is described as the source.
   • BThe user's IP appears only when the ACS FQDN is bypassed in the PAC file.
   • CExplicit Proxy users don't receive GlobalProtect pool addresses.
10. Question 10Prisma Access Troubleshooting

    Adatum's forward proxy profile blocks sessions on certificate status check timeout, and many sessions are now blocked because OCSP responders are slow. What does the guidance suggest?

    • ARaise the Receive Timeout above the default of 5 secondsCorrect
    • BTurn off CRL checks so only OCSP is used for every check
    • CMove the checks to the security rule instead of decryption
    • DRaise the OCSP cache lifetime so answers are reused for longer
    ✓ Correct answer: A

    The Troubleshoot Revoked Certificates page describes enabling both OCSP and CRL checking. It notes that if you block sessions on certificate status check timeout in the forward proxy profile, and 5 seconds may not be enough and cause too many timeouts, you set the Receive Timeout to a longer time. This keeps revocation checking in place while reducing timeout blocks. Revocation errors then appear in the decryption logs.

    Why the other options are wrong

    • BThe guidance enables both OCSP and CRL checking.
    • CRevocation checks are decryption settings, not security rule settings.
    • DThe guidance for slow responders is a longer Receive Timeout, so fewer sessions are blocked by timeouts; no cache lifetime change is described.

Who this SSE-Engineer practice exam is for

This practice set is for anyone preparing for the SSE-Engineer: Palo Alto Networks Certified Security Service Edge Engineer exam at the intermediate level - from first-time candidates building a foundation to experienced Palo Alto practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this SSE-Engineer practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real SSE-Engineer exam.

Related Palo Alto resources

• SSE-Engineer study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• XDR-Analyst practice examRelated
• XDR-Engineer practice examRelated
• CloudSec-Pro practice examRelated

SSE-Engineer practice exam FAQ