Free Palo Alto Networks Security Service Edge Engineer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Palo Alto Networks Security Service Edge Engineer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An engineer configuring DNS for a secure access deployment needs to publish a host's IPv6 address. Which DNS resource record type stores that address?

   1. A.MX
   2. B.AAAACorrect answer: B
   3. C.CNAME
   4. D.A

   Explanation: RFC 3596 states, "The AAAA resource record type is a record specific to the Internet class that stores a single IPv6 address." Therefore, AAAA is the record type for the host's IPv6 address.

   Reference: RFC 3596: DNS Extensions to Support IP Version 6 — Section 2.1

2. 2An organization isolates untrusted web sessions away from endpoints and sends the user display updates. Which remote component executes the page's active scripts in this isolation architecture?

   1. A.A virtualized browser instanceCorrect answer: A
   2. B.A reverse proxy instance
   3. C.A web caching instance
   4. D.A forward proxy instance

   Explanation: CISA describes remote browser isolation as moving the “processing of web data off the local system to a secure,” virtualized or isolated cloud environment. The remote virtual browser executes the page; the endpoint receives its representation.

   Reference: CISA Capacity Enhancement Guide: Securing Web Browsers and Defending Against Malvertising — Consider Isolating Web Browsers from Operating Systems, remote browser isolation

3. 3A browser SSO assertion has two AudienceRestriction conditions. The first lists service providers Alpha and Beta; the second lists Beta and Gamma. Which named service provider satisfies the audience conditions?

   1. A.Alpha
   2. B.BetaCorrect answer: B
   3. C.Gamma
   4. D.Delta

   Explanation: SAML Core states, “within a given condition, the audiences form a disjunction (an "OR") while multiple conditions form a conjunction (an "AND").” Only Beta appears in both independently evaluated conditions.

   Reference: Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0 — Section 2.5.1.4, AudienceRestriction

4. 4An administrator is reviewing a role-based access system. Which rule requires a user's active role to be one that the user is authorized to assume?

   1. A.Role assignment
   2. B.Role authorizationCorrect answer: B
   3. C.Transaction authorization
   4. D.Static separation of duty

   Explanation: NIST states, "Role authorization: A subject's active role must be authorized for the subject." That rule controls whether the active role is authorized for the user.

   Reference: NIST Role Based Access Control: Frequently Asked Questions — What Is Role Based Access Control?, three basic rules

5. 5A technician troubleshoots an IKEv2 connection. The initiator receives NAT detection payloads that do not match the addresses in the outer packet. Which UDP destination port must the initiator use to tunnel subsequent IKE and ESP packets for that security association?

   1. A.500
   2. B.1701
   3. C.1812
   4. D.4500Correct answer: D

   Explanation: RFC 7296 requires the initiator, when the specified NAT detection payloads do not match, to "tunnel all future IKE and ESP packets associated with this IKE SA over UDP port 4500."

   Reference: RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2) — Section 2.23, NAT Traversal

6. 6An engineer reserves an IPv4 /26 block for a secure access deployment. How many total addresses are in that block, including the network and broadcast addresses?

   1. A.32 addresses
   2. B.62 addresses
   3. C.128 addresses
   4. D.64 addressesCorrect answer: D

   Explanation: RFC 4632 lists the /26 prefix with "n.n.n.x/26 64 67108864" in its addresses-per-block table. A /26 leaves six address bits, yielding 2^6, or 64 total addresses.

   Reference: RFC 4632: Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan — Section 3.1, IPv4 prefix-size table, page 7

7. 7A data security team needs to locate and inventory sensitive files already stored in enterprise repositories. Which data loss prevention component addresses this task?

   1. A.Monitor
   2. B.DiscoverCorrect answer: B
   3. C.Protect
   4. D.Manage

   Explanation: NIST describes Discover as "Define the sensitivity of enterprise data, create an inventory of sensitive data, locate sensitive data wherever it is stored, and manage data cleanup." That is the task in the scenario.

   Reference: Data Loss Prevention — Solution Components, Discover

8. 8A browser data protection policy must compare inspected content against a protected dataset of known employee records. Which detection technique is intended for matching against that dataset?

   1. A.Optical character recognition
   2. B.Indexed document matching
   3. C.Exact data matchingCorrect answer: C
   4. D.Machine-learning classification

   Explanation: The browser data protection guidance describes "Exact Data Matching (EDM) — Match against encrypted datasets (e.g., employee records)." That is the dataset comparison required here.

   Reference: Enterprise Data Loss Prevention — Detection techniques, Exact Data Matching

9. 9An enterprise assigns administrative permissions through role-based access control. In the NIST model, which entity groups permissions that users receive through assignment or inheritance?

   1. A.A subject
   2. B.A roleCorrect answer: B
   3. C.An object
   4. D.A session

   Explanation: NIST states, "A role is essentially a collection of permissions, and all users receive permissions only through the roles to which they are assigned, or through roles they inherit through the role hierarchy." A role groups those permissions.

   Reference: NIST Role Based Access Control: Frequently Asked Questions — What Is Role Based Access Control?

10. 10A user cannot reach a web resource through an explicit proxy. The proxy responds with an HTTP status and a Proxy-Authenticate challenge because the client must authenticate to the proxy. Which status code indicates this condition?

    1. A.401
    2. B.403
    3. C.407Correct answer: C
    4. D.503

    Explanation: RFC 9110 states, "A 407 (Proxy Authentication Required) response message is used by a proxy to challenge the authorization of a client". The challenge in the scenario is issued by the proxy.

    Reference: RFC 9110: HTTP Semantics — Section 11.3, Authentication Challenges