The Palo Alto Networks Security Service Edge Engineer (SSE-Engineer)

The specific data-movement pattern described — selecting text within the browser session and then pasting it into another application running outside the browser — is a clipboard-based exfiltration method, and PAB ' s Clipboard control is the purpose-built mechanism to govern exactly this behavior, controlling copy-and-paste data flow both into and out of the isolated browser session on a per-application, per-URL, or per-category basis. Configuring the Clipboard control to block outbound copy/paste from the matched financial portal sessions directly disables the ability to select on-screen text and paste it into an external document or program, which is precisely the requirement stated, making option C the correct answer. Data loss prevention (option A) is a broader, content-inspection-based category of controls that can detect and act on sensitive data patterns across multiple vectors (uploads, downloads, screen sharing, and more), but it is not the specific, named control governing the copy/paste clipboard mechanism itself — DLP describes a category of protection, not the discrete control that directly disables clipboard-based transfer. " Data Transfer " (option B) is not the specific PAB control name associated with clipboard-based data movement between the browser and other local applications; PAB ' s documented control terminology for this exact function is Clipboard. " Webpage Data Masking " (option D) addresses a different concern entirely — obscuring or redacting sensitive fields as they are rendered on screen — and does nothing to prevent a user from copying already-visible text and pasting it elsewhere, so it does not solve the stated requirement.

Command Center in Strata Cloud Manager is specifically built as a unified, interactive visual summary that draws on data from an organization ' s cloud-delivered security subscriptions and Autonomous DEM to surface applications, threats, user experience, and hosts across the network in a single consolidated view — and critically, it is designed to aggregate this insight consistently across both NGFW-managed sites and Prisma Access deployments rather than requiring the operations team to pivot between separate NGFW-only and Prisma-Access-only interfaces. This cross-product, single-pane consolidation of application, threat, and user data is exactly the capability the question describes, making option A the correct feature. Log Viewer (option B) provides raw, queryable access to individual log records across log types; it is a powerful investigative tool, but it is not the purpose-built visual summary interface for correlated application/threat/user insight the question is asking about, and using it for that purpose would require manual correlation the operations team would otherwise get natively from Command Center. " Branch Site Monitor " (option C) is not a named feature within Strata Cloud Manager. The SASE Health Dashboard (option D) is oriented toward infrastructure and connectivity health signals — tunnel status, latency, packet loss, and service availability — rather than application, threat, and user-centric insight, making it a distinct and separate capability from the one described in the question.

In a Prisma Access mobile user deployment using SAML through the Cloud Identity Engine, the Cloud Identity Engine — not Strata Cloud Manager directly — is the SAML service provider entity that actually exchanges metadata and assertions with the customer ' s IdP; Strata Cloud Manager ' s role is to reference the authentication profile the Cloud Identity Engine has already established, not to independently hold the SAML relationship with the IdP. The error message explicitly names " CIE-SAML " as the point of failure, which is a strong, direct indicator that the misconfiguration lives in the metadata exchange between the Cloud Identity Engine and the IdP specifically, rather than anywhere downstream in Strata Cloud Manager itself. A 400 Bad Request returned to the portal after IdP authentication typically points to a malformed or mismatched SAML assertion, entity ID, or ACS URL between these two specific parties, making a targeted review of CIE-to-IdP metadata (option C) the correct, root-cause-focused action, since the question also states that " URLs and certificates are correctly configured " from the general check already performed in option A ' s framing — pointing the investigation toward CIE specifically. Reviewing Security policy rules (option B) addresses network-layer reachability, not SAML protocol-level metadata errors, and would not explain a 400 Bad Request occurring after successful IdP login. Reviewing Authentication logs (option D) is a reasonable general diagnostic step but does not, by itself, identify the root cause the way directly verifying the CIE-to-IdP metadata configuration does.

Strata Copilot ' s documented value proposition is centered on being an AI-assisted guidance layer embedded within Strata Cloud Manager, surfacing context-aware, actionable recommendations that help security teams diagnose and resolve issues faster — effectively an intelligent advisor that interprets the operational and configuration state of the environment and proposes specific, relevant next steps for the administrator to take. This positions Strata Copilot as an assistive, human-in-the-loop tool rather than an autonomous engine that independently performs actions, which is precisely what makes option C the accurate description of its current capability: customized guidance and recommended next steps, delivered to inform an administrator ' s own decision-making and remediation actions. Option A overstates Copilot ' s function by describing it as performing automated threat prevention through real-time traffic analysis, which is the domain of the platform ' s actual security enforcement engines (Threat Prevention, Advanced URL Filtering, and similar cloud-delivered security services), not Copilot itself. Option B similarly overstates capability by suggesting Copilot can perform entire initial Prisma Access deployments through natural language alone; while conversational and assistive elements exist, this framing goes beyond documented, current guided-assistance functionality. Option D describes fully autonomous remediation of misconfigurations without human review, which does not match Copilot ' s positioning as a recommendation and guidance tool — actual policy changes remain administrator-driven, with Copilot providing the analysis and suggested path forward rather than executing changes independently.

Domain-based split tunneling behaves fundamentally differently from traditional access-route-based split tunneling: where access-route tunneling operates purely through entries in the local operating system routing table, domain-based split tunneling is implemented through a filter driver on Windows and a network extension on macOS that intercepts and redirects connections dynamically as domains are resolved and matched, rather than by inserting static host routes the administrator or user can simply read from a routing table. Because the enforcement mechanism itself lives inside this filter driver/extension rather than in visible routing entries, the documented, reliable way to confirm the configuration has actually been pushed correctly and is being applied as expected is to collect detailed, dump-level GlobalProtect application logs, which expose the filter driver ' s internal decision-making for the specified domain — this is precisely option B, and it matches Palo Alto Networks ' own published troubleshooting guidance for this feature. Checking the routing table (option A) is the correct verification method for route-based (access-route) split tunneling, but it is explicitly documented as not reflective of domain-based split tunnel behavior, since no corresponding static route is guaranteed to appear there. Verifying DNS resolution alone (option C) confirms name resolution occurred, but not that the filter driver actually applied the correct include/exclude action to the resulting session. Pinging the domain (option D) is unreliable because split-tunneling rules apply to TCP/UDP traffic and explicitly do not govern ICMP, so a ping result does not validate split-tunnel enforcement at all.

The question specifically asks for components that provide data center connectivity over the internet, which is the distinguishing factor between the four options. Service connections are the classic IPSec-based method: they build an encrypted tunnel from the customer ' s data center edge device to Prisma Access across the public internet, requiring no private circuit. ZTNA Connector achieves the same outcome through a different architecture — a lightweight, outbound-only connector deployed in the data center that establishes a secure, brokered tunnel to the nearest Prisma Access cloud gateway, again entirely over the internet, without requiring inbound firewall rules or a traditional IPSec peer. Both are therefore valid answers. Colo-Connect is explicitly excluded because it is built for the opposite use case: it delivers private, high-bandwidth connectivity to data centers using GCP Dedicated or Partner Interconnects, bypassing the public internet entirely to achieve up to 100 Gbps with lower latency and jitter — the architecture exists specifically because customers want to avoid internet transport for their highest-throughput sites. SD-WAN Connector is not a genuine Prisma Access private-application access method; Prisma SD-WAN integrates with Prisma Access through ION devices acting as CPE for remote networks or service connections, not as a distinct " connector " component in this context, so it does not belong in this answer set.

The reported symptom — traffic intermittently falling through to the bottom Catch-All Deny rule, bypassing the HIP-based policy that should be matching first, and being resolved simply by refreshing the VPN connection — is a classic signature of stale or lost user-to-IP mapping combined with expired HIP state, rather than a fundamental policy configuration error, which is why refreshing the session (forcing re-authentication and a fresh HIP report) restores correct behavior. If user mapping for the connected session is being learned or refreshed from a source other than the gateway ' s own authentication event (for example, User-ID redistribution or another mapping source with different timing or reliability characteristics than the gateway ' s native session state), that mapping can become inconsistent with the live GlobalProtect session, causing the HIP-enforced rule ' s user-based match criteria to intermittently fail — this is option B. Separately, the firewall periodically expects HIP report checks from the connected endpoint to keep its HIP-based match state current; if a report check is missed due to a client-side timing issue or transient connectivity blip, the firewall can lose the HIP match state for that session even though the tunnel itself remains up, causing subsequent traffic to fail HIP-based rule matching and fall through to the deny-all rule — this is option C. " Collect HIP data " not being enabled (option A) would cause a total, consistent failure to match HIP-based policy from the outset, not the intermittent pattern described. A time-of-day schedule on the HIP rule (option D) would produce a predictable, not intermittent and refresh-resolved, pattern of denial.

App Acceleration works by having Prisma Access decrypt, optimize, and re-encrypt SaaS application traffic across its backbone to reduce round-trip latency and improve throughput to well-known, high-volume SaaS destinations, and that optimization is fundamentally dependent on SSL Forward Proxy decryption already being functional and trusted end-to-end. Two certificate-related prerequisites make this possible: a Forward Trust Certificate configured for SSL decryption, which Prisma Access presents to the client in place of the SaaS provider ' s original certificate when it performs the man-in-the-middle decryption necessary to inspect and accelerate the session, and that certificate ' s issuing CA must be distributed to and trusted by client endpoints as a Trusted Root CA, so that browsers and applications do not throw certificate warnings or reject the substituted certificate. Both of these are explicit, documented prerequisites for App Acceleration to function correctly, which makes options C and D the correct pair. There is no dedicated " acceleration agent " software component that must be installed on client machines (option A); App Acceleration operates transparently at the Prisma Access infrastructure level for tunneled or proxied users, not through an endpoint agent add-on. QoS (option B) is a separate traffic-shaping capability used to prioritize bandwidth for specific application classes; it is not a prerequisite for App Acceleration to be enabled and is functionally unrelated to the decryption trust chain that acceleration depends on.

The Cloud Identity Engine functions as an identity broker and profile source, but it does not directly authenticate mobile users on Prisma Access ' s behalf by itself — the actual authentication enforcement point for GlobalProtect mobile users lives in Strata Cloud Manager ' s own authentication profile object, which must be created there and explicitly linked back to the SAML profile already built in the Cloud Identity Engine application. This linkage is what allows Strata Cloud Manager to reference the IdP metadata, certificates, and attribute mappings the Cloud Identity Engine has already established, without duplicating that configuration, and it is the documented, required next step once the Cloud Identity Engine side of the setup is complete — making option D correct. Performing a " full commit " (option A) is not how Cloud Identity Engine profiles become usable for authentication; a commit pushes configuration changes to devices, it does not perform a discovery-and-synchronization step that magically surfaces an unlinked SAML profile for mobile user authentication. Granting the Cloud Identity Engine service account RBAC access to the mobile user folder (option B) describes a permissions structure that is not part of the documented authentication configuration workflow and does not, by itself, wire up SAML for mobile users. There is no authentication type literally named " Cloud Identity Engine " to select in Strata Cloud Manager (option C); the authentication profile type remains SAML, referencing the Cloud Identity Engine as its source, not " Cloud Identity Engine " as a discrete authentication type.