Purchase Palo Alto Networks : SSE-Engineer Exam Materials and then pass exam easily

A security administrator wants to use Cloud Identity Engine to automate the application of Security policies for mobile users based on specific metadata from their Microsoft Entra ID profiles, such as job title and department. The administrator wants to avoid manual group management of these policies. Which feature can the administrator use to create a Security policy that dynamically identifies the users? (Choose one answer)

• A. Entra ID Group Attribute
• B. Cloud Dynamic User Group
• C. Attribute Group Mapping
• D. Entra ID Cloud Group

What is the network impact when a Prisma Access service connection is set as a dedicated service connection for traffic steering?

• A. It applies destination NAT to forwarded traffic, maintains its BGP routing configurations, and allows traffic from both Trust and Untrust zones.
• B. It maintains its zone as Trust; however, it disables all Security policies, allowing unrestricted traffic flow through the dedicated service connection.
• C. It changes its zone to Untrust, applies source NAT to forwarded traffic, and no longer participates in BGP routing.
• D. It maintains its zone as Trust and continues to participate in both internal and external BGP routing.

How can an engineer verify that only the intended changes will be applied when modifying Prisma Access policy configuration in Strata Cloud Manager (SCM)?

• A. Compare the candidate configuration and the most recent version under " Config Version Snapshots. "
• B. Select the most recent job under Operations > Push Status to view the pending changes that would apply to Prisma Access.
• C. Open the push dialogue in SCM to preview all changes which would be pushed to Prisma Access.
• D. Review the SCM portal for blue circular indicators next to each configuration menu item and ensure only the intended areas of configuration have this indicator.

A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to-business (B2B) partners to their data centers. [Same scenario as above.] Which two options will allow the engineer to support the requirements? (Choose two.)

• A. Configure Remote Networks and define the branch IP subnets using Static Routes.
• B. Configure the CPE with Static Routes pointing to Prisma Access Infrastructure and Mobile User routes.
• C. Enable eBGP for dynamic routing and configure Remote Networks.
• D. Enable Remote Networks Advertise Default Route.

Secure Inbound Access has been configured to allow access to an RDP application at a branch location, as shown in the image below. After a successful commit, return traffic from the application is not reaching the internet user. What is causing the return traffic to fail?

• A. Source NAT is enabled, but the branch location ' s CPE does not have a route back to the Service Endpoint Address of the Inbound Access Remote Network Node.
• B. The " Allow inbound flows to other Remote Networks over the Prisma Access backbone " checkbox is selected.
• C. Source NAT is enabled, but the branch location ' s CPE does not have a route back to the eBGP Router ID of the Inbound Access Remote Network Node.
• D. The Remote Network Security policy source zone is configured as " Untrust. "