SSE-Engineer Exam Dumps : Palo Alto Networks Security Service Edge Engineer

When multiple Remote Networks share an identical, overlapping IP address subnet, Prisma Access has no way to uniquely and deterministically route traffic destined to a specific store, to a specific mobile user, or to a private application located behind one particular site, because the destination or source subnet alone can no longer disambiguate which physical location a packet needs to reach — every store looks identical on the wire. The Overlapping Subnets checkbox exists to acknowledge and accommodate this reality, but the trade-off is that Prisma Access can only reliably support the traffic flow where uniqueness of the store ' s internal subnet is not required for correct forwarding: outbound internet-bound traffic, which is source-NATed at egress and does not depend on the branch ' s internal addressing being globally unique within the Prisma Access backbone. This is why option B, internet-bound traffic, is the flow that remains fully supported. Flows to private applications (option A) and to other remote networks (option C) require the backbone to route based on the branch ' s actual internal subnet to reach specific internal destinations or to allow other sites to reach that store directly, which becomes ambiguous and unsupported once the subnet is duplicated across multiple onboarded locations. Mobile user access to an overlapping-subnet branch (option D) suffers from the same ambiguity, since a mobile user ' s traffic destined to that internal subnet cannot be deterministically routed to the correct physical store.

GlobalProtect is the correct mobile-user connection method here because the requirement explicitly calls for remote site connectivity from mobile users to the branch locations, in addition to internet filtering and data center access — a full-tunnel capability that Explicit Proxy, which is scoped to web/proxy-aware traffic only, cannot provide. Remote Networks is the purpose-built onboarding method for the branch locations, tunneling their traffic into Prisma Access over IPSec for consistent internet filtering and, through the shared backbone, reachability to data center resources. Service connections are the piece that stitches both populations to the data center: they terminate at the customer ' s HQ/data center and, once established, become reachable from both the GlobalProtect mobile user pool and the Remote Networks locations across the Prisma Access backbone, satisfying the data center connectivity requirement for both user types without requiring a dedicated tunnel per site. Option B and D are eliminated because Explicit Proxy cannot deliver full network-layer access to internal branch or data center resources; it is designed for outbound web traffic redirection via PAC file or forwarding profile, not IPSec-based site-to-site or full-tunnel remote access. Option C omits Remote Networks entirely, which would leave the branch offices unconnected. GlobalProtect plus Remote Networks plus service connections is the standard, minimal-footprint design pattern for this exact hybrid mobile-user/branch/data-center topology.

Preventing paper copies of on-screen information is a data control problem, and PAB ' s actual, named control for this function is the Print control, which can be set to block printing for matching sessions — this is the correct, real mechanism, making option A correct; there is no separate, distinct " kiosk control " object in PAB ' s control set, which makes option B a fabricated distractor rather than a genuine configuration element. The second requirement — ensuring the policy applies specifically and reliably to this one fixed-location kiosk device — is a matching-criteria problem, and the two candidate approaches offered are location-based scoping and network-based scoping. Location-based policy scope in PAB primarily relies on OS-level location services or GeoIP resolution, both of which are typically imprecise at the level of a single building or office floor and can be unavailable entirely on a locked-down, purpose-built kiosk device that may not have location services enabled or a rich OS profile reporting into it. Network-based scoping, by contrast, lets the administrator match specifically on the corporate office ' s known public IP range or CIDR block, which is a precise, reliable, and location-independent way to guarantee the rule applies consistently to traffic originating from that fixed premises regardless of GeoIP accuracy or device location-service availability — making option D the more dependable and correct match criterion for this exact scenario, and Location-based scope (option C) the weaker, less appropriate choice for a fixed, single-building kiosk enforcement requirement.