Free Palo Alto Networks SSE-Engineer Actual Exam Questions - Question 3 Discussion

Routing tables give the clearest proof of traffic paths, so checking them directly is solid. I’d go with A.

I’m thinking B makes sense here. Enabling GlobalProtect logs would give a detailed look at how the app is actually handling zoom.us traffic, so you’d see if the split tunnel config is really applied in practice, not just in theory like with routing tables. It’s a more direct way to confirm expected behavior on the client side.

Good point, but A is clearer since routing tables show actual path rules.

Maybe D is worth considering since pinging zoom.us from the CLI can show if the traffic actually goes through the tunnel by checking the response path or latency. Routing tables (A) show config but not real-time behavior. DNS resolution (C) confirms name lookup but not if the traffic uses the tunnel. Logs (B) could be noisy and less straightforward to interpret. So a simple ping test might give a quick, practical confirmation on the client side that zoom.us traffic is routed as expected.

It’s A because verifying the routing table shows if split tunnel routes for zoom.us are actually set, which directly confirms traffic will follow the intended path. DNS or ping just show parts, not full routing.

A/B? Logs might give the clearest proof the tunnel is handling zoom.us traffic specifically, while routing tables (A) could help confirm split tunnel routes exist. Both show different angles.

Checking DNS resolution confirms domain-based tunnel use, so C.

Maybe D makes sense here since pinging zoom.us can show if traffic actually routes through the tunnel. It’s a direct test of connectivity rather than just DNS or logs.

Think about it—A is tricky since routes deal with IPs, not domains, so it won’t clearly show zoom.us traffic going through the tunnel. C seems more precise for domain-based checks. So I’d go with C.

B imo, because app logs directly show if the split tunnel applies to zoom.us traffic.

Option A doesn’t really fit because routing tables work with IPs, not domains. So checking the route won’t confirm zoom.us is tunneled by domain. Better to rely on DNS or actual traffic checks.

C vs D, verifying DNS resolution seems more accurate than ping.

Seems like checking the routing table would give a clear view of split tunnel behavior, so I’d go with A.