다운로드 Palo Alto Networks : SSE-Engineer 질문 & 답 PDF & Test Software

A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to-business (B2B) partners to their data centers. The solution must meet these requirements: The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations. The branch locations must have internet filtering and data center connectivity. The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports. The security team must have access to manage the mobile user and access to branch locations. The network team must have access to manage only the partner access. Which two components can be provisioned to enable data center connectivity over the internet? (Choose two answers)

• A. ZTNA Connector
• B. Colo-Connect
• C. SD-WAN Connector
• D. Service connections

Where are tags applied to control access to Generative AI when implementing AI Access Security?

• A. To user devices for identifying and controlling which Generative AI applications they can access
• B. To Generative AI URL categories for classifying trusted and untrusted Generative AI websites
• C. To security rules for defining which types of Generative AI applications are allowed or blocked
• D. To Generative AI applications for identifying sanctioned, tolerated, or unsanctioned applications

What is the network impact when a Prisma Access service connection is set as a dedicated service connection for traffic steering?

• A. It maintains its zone as Trust and continues to participate in both internal and external BGP routing.
• B. It maintains its zone as Trust; however, it disables all Security policies, allowing unrestricted traffic flow through the dedicated service connection.
• C. It changes its zone to Untrust, applies source NAT to forwarded traffic, and no longer participates in BGP routing.
• D. It applies destination NAT to forwarded traffic, maintains its BGP routing configurations, and allows traffic from both Trust and Untrust zones.

During a deployment of Prisma Access (Managed by Strata Cloud Manager) for mobile users, a SAML authentication type and authentication profile in the Cloud Identity Engine application is successfully created.
Using this SAML authentication, what is a valid next step to configure authentication for mobile users?

• A. Create a SAML authentication profile in Strata Cloud Manager and link it to the Cloud Identity Engine profile.
• B. Perform a full commit to Strata Cloud Manager so the Cloud Identity Engine profiles get synchronized from the application.
• C. Permit the Cloud Identity Engine service account RBAC access to the mobile user folder in Strata Cloud Manager.
• D. In Strata Cloud Manager, create a new authentication type of " Cloud Identity Engine. "

A user connected to Prisma Access reports that traffic intermittently is denied after matching a Catch-All Deny rule at the bottom and bypassing HIP-based policies. Refreshing VPN connection restores the access.
What are two reasons for this behavior? (Choose two.)

• A. User mapping is learned from sources other than gateway authentication.
• B. " Collect HIP data " needs to be enabled in the configuration.
• C. HIP-enforced policy is scheduled for certain hours of the day.
• D. Firewall loses user mapping due to missed HIP report checks.