5.1 Monitor and Troubleshoot Prisma Access Connectivity SECURITY-SERVICE-EDGE-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A remote employee reports that they can connect to the GlobalProtect VPN but cannot reach internal resources. The employee's device shows a green GlobalProtect icon, and the tunnel status appears connected. In the Prisma Access monitoring tools, the user's session shows active traffic, but the traffic logs show the sessions being dropped by policy. Which monitoring tool and log combination would provide the most direct evidence of the root cause?

   • AReview the System logs for the user's device to check for GlobalProtect client authentication failures.
   • BReview the Configuration Audit log to see if a recent change removed the user's access policy.
   • CReview the Traffic logs filtered by the user's source IP to see the specific security policy rule that is dropping the traffic.
   • DReview the User-ID logs to verify the user's identity mapping is correct for the source IP.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has users in multiple regions reporting slow performance when accessing a critical cloud application through Prisma Access. The administrator has verified that the Prisma Access infrastructure is healthy and there are no policy drops. The latency to the application is consistently high across all regions. Which of the following is the MOST likely cause of the performance issue, and what should the administrator do to resolve it?

   • AThe users' devices are not optimized for the application; the administrator should recommend hardware upgrades.
   • BThe Prisma Access security policies are performing deep packet inspection on all traffic, causing latency; the administrator should disable security features.
   • CThe users' local ISPs are experiencing congestion; the administrator should ask users to switch to a different ISP.
   • DThe application is hosted in a region far from the Prisma Access locations; the administrator should consider using a service connection to a closer cloud region or optimizing the path to the application.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which log type in Prisma Access is most useful for verifying that a mobile user's traffic was allowed or denied by security policy?

   • ASystem logs
   • BTraffic logs
   • CConfiguration logs
   • DAuthentication logs
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which dashboard would you use to verify the throughput of a service connection?

   • AService Connection Dashboard
   • BApplication Command Center
   • CMobile User Overview dashboard
   • DRemote Network Monitoring page
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A service connection to a cloud provider is experiencing intermittent throughput drops. The connection shows 'Connected' and BGP is stable. The administrator has ruled out issues on the Prisma Access side and the cloud provider's network. Which of the following should the administrator investigate NEXT to identify the cause of the throughput drops?

   • AReview the Configuration Audit log to see if any changes were made to the service connection's bandwidth settings.
   • BReview the BGP route table to see if any routes are being withdrawn and re-advertised.
   • CCheck the cloud provider's instance performance metrics to see if the application is CPU or memory bound.
   • DCheck the service connection's traffic distribution across multiple paths or links to see if one path is saturated.
   Reveal Solution Discussion Select an answer first