Domain 1: Prisma Access Planning and Deployment
- The infrastructure subnet is a private range Prisma Access uses to connect locations internally; mobile user IP pools and remote network subnets must not overlap it.
- Service connections link Prisma Access to headquarters and data centers so mobile users and remote networks can reach private apps; they are also the default identity redistribution agents.
- Remote networks allocate bandwidth by compute location, and each IPSec termination node provides up to 1,000 Mbps, with extra nodes added above that.
- Location groups let mobile user IP pools be smaller than theaters, so a source address says more about where the user connected.
- If both static routes and BGP are configured for a remote network, the static routes take precedence, and the BGP Peer AS must be an RFC 6996 private AS number.
- Do Not Export Routes stops Prisma Access sending BGP advertisements to a remote network, so on-premises equipment then needs static routes back to Prisma Access.
- ZTNA Connector secures private apps through connector VMs that build IPSec tunnels to Prisma Access; Preserve User ID on a connector group keeps User-ID mapping when the connector source-NATs traffic.
- Explicit Proxy uses a PAC file to steer browser traffic; decryption is required so Prisma Access can read the authentication cookie it sets, or the proxy could be abused as an open proxy.
- The Cloud Identity Engine gives Prisma Access read-only directory access for user and group policy, and its instance should sit in the same region as Prisma Access and Strata Logging Service.
- GlobalProtect mobile users get User-ID mapping automatically from the GlobalProtect agent; users at remote networks need User-ID configured for those sites.
Domain 2: Prisma Access Services
- Decryption policy rules are evaluated top to bottom, so no-decrypt exclusion rules belong above broad decrypt rules.
- When a decryption profile allows unsupported modes, servers that break decryption are placed in a local exclusion cache for 12 hours; changing the decryption rule or profile flushes that cache.
- Best practice is to block unsupported TLS versions and cipher suites but allow client authentication in the decryption profile.
- Each asterisk in an SSL decryption exclusion matches exactly one subdomain label, so *.company.com does not cover eng.tools.company.com.
- QUIC cannot be decrypted; blocking it forces browsers onto TLS, which Prisma Access can then inspect.
- QoS for remote networks is enabled per compute location, and guaranteed bandwidth is not reserved: unused guaranteed bandwidth stays available to all traffic.
- With Customize Per Site selected, a newly onboarded remote network on the same termination node gets an allocation ratio of 0 until the ratios are rebalanced.
- Service connections support QoS Pre Rules only, and their QoS profile Egress Max is set per IPSec tunnel, up to 1 Gbps.
- Identity redistribution shares IP-to-user, HIP, tag and quarantine data across Prisma Access and with on-premises firewalls; for Panorama deployments the firewall points at the service connection's User-ID Agent Address.
- Dynamic user groups take membership from tags, so auto-tagging from logs can restrict risky users without a new commit.
- Third-party Device-ID objects in mobile user security rules can be used only as destination devices.
Domain 3: Prisma Browser
- Prisma Browser enforces access and data controls inside a managed browser, so policy follows the user on managed and unmanaged devices.
- Policy profiles group data controls such as file download, screenshot and screen-sharing settings, and policy rules apply those profiles to users and applications.
- Data leak prevention controls such as watermarking, masking and read-only pages apply to the web pages a user opens inside the browser.
- Location-based rules depend on the device reporting location; OS location services improve accuracy on managed devices where consumer VPNs could mislead IP-based location.
- Upgrade management settings such as delays and pinned versions apply to browsers that update online, and critical security fixes can be expedited past configured delays.
- Admin-defined remote connections, and the permission for users to create their own, control RDP and SSH access from the browser; revoking the permission makes the user-created connections inaccessible.
- The Prisma Browser Extension adds controls to an existing browser, but it supports a narrower set of capabilities than the full Prisma Browser.
- Tenant-specific rules for SaaS apps rely on the exact tenant identifier the admin enters, so a mistyped identifier stops the rule from matching.
- Files above the documented size limits are not scanned by content-aware rules, so those rules cannot act on the file's content.
Domain 4: Prisma Access Administration and Operation
- Enabling multitenancy on Panorama migrates the existing Prisma Access configuration to the first tenant and cannot be reversed.
- Each Panorama-managed tenant needs at least 200 Mbps of remote network bandwidth or 200 mobile users, and a user logged in to several tenants consumes one license unit per tenant.
- Deleting a tenant only marks it for deletion after the local commit; deprovisioning removes it from the infrastructure and returns its license.
- The Cloud Services plugin cannot be made read-only for a tenant-level administrator: access is either enabled, with full change rights, or removed.
- Strata Cloud Manager folders for Prisma Access are predefined, snippets standardize shared configuration, and variables supply per-folder values such as IP ranges.
- Restoring a config version snapshot updates the running configuration without a push and keeps the candidate, while Load replaces the candidate for editing and pushing.
- The first push for a new tenant must include changes from all administrators, and snippet association changes or reverts require a full push.
- Strata Logging Service stores Prisma Access logs without using licensed Prisma Access bandwidth; setting MAX RETENTION DAYS to 0 stops storage and deletes existing logs.
- Log forwarding supports syslog over RFC 5425 encrypted syslog, HTTPS, email and cloud storage, and the receiver must present a valid certificate chain over TLS 1.2.
- Policy Optimizer narrows rules that use any, keeps the original rule below the new ones, and the new rules enforce only after Push Config.
- Config Cleanup finds unused objects and zero-hit rules using traffic logs in Strata Logging Service, so rules without logging produce incomplete results.
Domain 5: Prisma Access Troubleshooting
- Serviceability commands return the Service IP Address a CPE uses as its IPSec peer, show routing tables, and clear security associations after a crypto profile fix.
- Given the same route, Prisma Access prefers a static route with a lower metric over a BGP route with a higher metric.
- ZTNA Connector status separates Tunnel Down (the IPSec tunnel is down) from Connection Down (the connector VM is down); ping and traceroute need ICMP to be allowed.
- A ZTNA Connector onboarding failure is usually DNS resolution of the cloud controller, outbound TCP 443, or an invalid or stale license token.
- ADEM experience scores are Good at 70 or more, Fair from 30 to 69 and Poor below 30, and root-cause analysis runs across device, Wi-Fi, LAN, ISP and gateway segments below 70.
- A firewall that shows Connected in Strata Logging Service with a zero logging rate usually has no log forwarding configured or has ingestion traffic blocked on the path.
- IPSec GlobalProtect tunnels cannot pass through a proxy because proxies do not carry UDP.
- Pinned certificates usually appear as UnknownCA or BadCertificate decryption errors; adding the site to the exclusion list allows it without inspection.
- An incomplete certificate chain is repaired by importing the missing intermediate certificate as a trusted root CA.
- HIP mismatches often come from a new endpoint product the app's OPSWAT database cannot detect; a partial HIP report is sent after the Max Wait Time and the full report follows.
- Security rules are evaluated top to bottom and the first match applies, and allowed traffic must also pass every attached security profile.
Palo Alto Security Service Edge Engineer exam tips
- Read every scenario for the management plane first: many answers differ between Prisma Access managed by Panorama and managed by Strata Cloud Manager.
- Know which settings are per compute location and which are per site or per tunnel - QoS, bandwidth allocation and service connection limits are common traps.
- Keep decryption behavior straight: rule order, the local exclusion cache, what a no-decrypt rule still checks, and why excluded traffic is allowed but not inspected.
- For troubleshooting questions, match the symptom to the tool: serviceability commands for tunnels and routes, ZTNA Connector diagnostics for private apps, ADEM for user experience, and Strata Logging Service inventory for missing logs.
- Remember the one-way and irreversible operations - enabling multitenancy, migrating from Panorama to Strata Cloud Manager, and deprovisioning a tenant - since the exam rewards knowing what cannot be undone.
Study guide FAQ
What does the SSE-Engineer exam cover?
Five domains from the March 2026 datasheet: Prisma Access Planning and Deployment (22%), Prisma Access Services (22%), Prisma Browser (22%), Prisma Access Administration and Operation (16%), and Prisma Access Troubleshooting (18%).
What is the passing score?
Palo Alto Networks sets the passing score at 860 on a 300-to-1000 scale for every one of its certification exams. A scaled score cannot be read as a percentage of questions answered correctly.
How many questions are on the exam and how long is it?
Palo Alto Networks does not publish a question count or seat time for this exam. It notes a 30-minute extension for candidates testing in non-English speaking countries. CertGrid's 75-question, 90-minute mock is a practice setting, not a vendor figure.
Does the exam cover Prisma Browser as well as Prisma Access?
Yes. Prisma Browser is one of the five domains at 22%, covering browser deployment, policy rules and profiles, data controls, and upgrade management, alongside the Prisma Access domains.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Palo Alto Networks - Security Service Edge Engineer datasheetBlueprint revised MARCH 2026 · link and content verified 28 September 2026Five domains totalling 100%: Prisma Access Planning and Deployment 22%, Prisma Access Services 22%, Prisma Browser 22%, Prisma Access Administration and Operation 16%, Prisma Access Troubleshooting 18% - the domain weights used by CertGrid practice exams exactly. The experience claim is a RECOMMENDATION: "3 years in a network security-related field; 1 to 2 years with Palo Alto Networks Prisma Access solutions". It also states that a 30-minute time extension is provided by default to candidates testing in non-English speaking countries.
- Palo Alto Networks - certification handbooklink and content verified 28 September 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." 700 is CertGrid's own grading threshold, never Palo Alto's.
The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length for this exam on its certification page, in the datasheet or in the handbook. So the 90 minutes and 75 questions of the CertGrid mock are practice settings, unverified from Palo Alto's own documents, and the question count is shown as "Varies" rather than as a Palo Alto figure.