Palo Alto Networks PAN-SSEE - Questions & Answers

The Strata Logging Service allows log replay , which enables resending logs that were not successfully forwarded to an external syslog server due to disruptions. By configuring a replay profile with the affected time range and associating it with the syslog server profile , Prisma Access will resend the missing logs, ensuring that all relevant data is restored in the external logging system. This approach is the most efficient and automated way to recover missing logs.

In a multitenant deployment , access control must be configured at the Child Tenant level to ensure that security administrators have full control over Security policy only within their assigned tenant while restricting access to other tenants. By selecting Prisma Access & NGFW Configuration , the assigned users gain full administrative access only for security policy management within the designated tenant, aligning with RBAC best practices for controlled access in Prisma Access Managed by Strata Cloud Manager .

In a Panorama Managed Prisma Access multitenant environment Access Domains , provide granular role-based access control (RBAC) . By defining an Access Domain , the network security team can be granted full administrative privileges for a specific tenant's configuration while ensuring they cannot access or modify other tenants . This method enforces proper segmentation and ensures compliance with multitenant security policies .

When configuring Remote Browser Isolation (RBI) Prisma Access (Managed by Strata Cloud Manager) in for mobile users, a URL access management profile must be created with the site access action set to "Isolate" . This profile is then applied to a Security policy to enforce isolation for specific URLs. This ensures that web traffic to designated high-risk or untrusted sites redirected to a remote, secure browser is instance , protecting endpoints from potential web-based threats.

When onboarding a new branch office to an existing IPSec termination node Prisma Access in , the QoS bandwidth is not automatically assigned . Instead, the newly added branch remains unallocated until the administrator manually assigns bandwidth within the QoS configuration settings . This ensures that customized bandwidth per site remains intact and allows for fine-tuned traffic management based on business needs.

In an Explicit Proxy deployment where no agent can be used on the endpoint, SAML (Security Assertion Markup Language) is the supported authentication method for mobile users SAML . allows authentication via an Identity Provider (IdP) without requiring an agent on the endpoint, making it ideal for web-based authentication in cloud and remote access environments . It enables Single Sign-On (SSO) and secure authentication without direct integration with LDAP or Kerberos , which typically require an agent or local network presence.

For GlobalProtect with pre-logon , certificates must be installed in the Machine Certificate Store to ensure that authentication occurs before user login . This allows the GlobalProtect client to establish a VPN connection before the user logs in , enabling access to corporate resources such as domain controllers and authentication services. Using machine certificates ensures secure authentication and eliminates dependency on user credentials at the pre-logon stage.

A ZTNA Connector requires a stable and direct connection to the cloud gateway . When the connector is deployed behind a double NAT (Network Address Translation) , it can cause issues with reachability and session establishment because the cloud gateway may not be able to properly identify and communicate with the connector. Double NAT can interfere withsecure tunneling, IP address resolution, and authentication mechanisms , leading to connection failures . To resolve this, the connector should be placed in a network segment with a single NAT or a public IP assignment .