[Full-Version] 2026 New Preparation Guide of Palo Alto Networks SD-WAN-Engineer Exam
SD-WAN-Engineer Practice Exam - 88 Unique Questions
Palo Alto Networks SD-WAN-Engineer Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 52
A branch manager reports slow network performance, and the network administrator wants to use Prisma SD- WAN Copilot to quickly identify if a specific user, by source IP address, is consuming excessive bandwidth as well as which applications are contributing to this consumption. How can Copilot assist in this investigation?
- A. It can identify the top applications being used across the entire branch and can be correlated with Flow Browser to attribute specific application usage or total bandwidth consumption to individual source IPs.
- B. It will redirect the administrator to the WAN Clarity "Top N: Source IPs" report and the "Flow Browser" utility, suggesting correlation between these tools to determine a user's specific application usage.
- C. It can directly process a natural language query such as "Show top bandwidth source IPs at SD-WAN Branch X over last 3 hours," provide summarized views of the top-consuming source IPs, and view the primary applications they are using.
- D. It will automatically generate and email a "User Bandwidth Consumption" report for the specified branch, which the administrator can use to find the top user and the application details.
Answer: C
Explanation:
Prisma SD-WAN Copilot is an AI-powered operational tool designed to simplify network management through Natural Language Processing (NLP). Traditionally, identifying a bandwidth "hog" required manual navigation through multiple dashboards, such as WAN Clarity and the Flow Browser, to correlate source IP addresses with specific application flows and timestamps. Copilot transforms this workflow by allowing administrators to interact with the system using conversational queries.
When an administrator inputs a query like "Show top bandwidth source IPs at SD-WAN Branch X over last 3 hours," Copilot leverages its underlying machine learning models and integrated data lake to aggregate telemetry across the entire fabric. It instantly identifies the specific source IPs responsible for the highest throughput and correlates that data with application visibility. Instead of providing a static report or redirecting the user to other tools, Copilot presents an interactive, summarized view directly within the interface. This view highlights the top-consuming users and breaks down their consumption by application, such as YouTube, Netflix, or business-critical SaaS tools.
This capability significantly reduces the Mean Time to Resolution (MTTR) for performance issues. By bypassing the need for manual data correlation, Copilot provides immediate "Day 2" operational insights. It effectively acts as a virtual assistant that understands the context of the network topology, site names, and time ranges, allowing the administrator to quickly determine if a branch's slow performance is due to an individual user's behavior or a broader infrastructure issue.
NEW QUESTION # 53
Based on the HA topology image below, which two statements describe the end-state when power is removed from the ION 1200-S labeled "Active", assuming that the ION labeled "Standby" becomes the active ION? (Choose two.)
- A. The connection to ISP A will be usable, but the connection to LTE/5G will not.
- B. The VRRP Virtual IP address assigned to any SVIs will be moved to the newly active ION.
- C. The newly active ION will send a gratuitous ARP to the LAN for the IP address of any SVIs.
- D. Both the connection to ISP A and the connection to LTE/5G will be usable.
Answer: C,D
Explanation:
Comprehensive and Detailed Explanation
This scenario depicts a High Availability (HA) topology utilizing the ION 1200-S model's Fail-to-Wire (bypass) capabilities to share WAN links between two devices without needing external switches for every WAN connection.
1. WAN Link Availability (Statement A):
The diagram illustrates a "daisy-chain" cabling method supported by the ION 1200-S bypass pairs.
ISP A (Green): Connects directly to the "Standby" (Left) unit first. Since the Standby unit remains powered on, it maintains direct access to ISP A.
LTE/5G (Blue): Connects to the "Active" (Right) unit first. The connection then loops through a bypass pair on the Active unit to the Standby unit. When power is removed from the "Active" unit, the fail-to-wire relays on its Ethernet ports close physically. This creates a passive electrical bridge that connects the LTE modem directly to the Standby unit. The Standby unit (now becoming Active) will detect the link state change and successfully utilize the LTE connection. Therefore, both WAN links remain usable.
2. LAN Failover Mechanism (Statement C):
Prisma SD-WAN ION devices typically use a VRRP-like mechanism for LAN redundancy.
When the "Active" node fails (loses power), the "Standby" node stops receiving keepalives and promotes itself to the Active state.
To ensure downstream switches and clients immediately send traffic to the new Active unit, it must update their ARP tables. It does this by broadcasting a Gratuitous ARP (GARP) packet for the Virtual IP (VIP) address of the Switch Virtual Interfaces (SVIs). This action informs the network that the MAC address associated with the Gateway I1P is now reachable via the port connected to the new Active ION.234
NEW QUESTION # 54
When using the CloudBlade to integrate Prisma SD-WAN with Prisma Access, how does the system ensure that the IPSec tunnels between the branch ION and the Prisma Access Security Processing Node (SPN) are kept alive during periods of no user traffic?
- A. The IPSec tunnel uses standard DPD (Dead Peer Detection) and the ION sends keepalives.
- B. The administrator must configure a continuous ping script on a branch PC.
- C. Prisma Access initiates the connection to the branch every 60 seconds.
- D. The CloudBlade automatically configures the ION to send Synthetic Probes (ICMP/HTTP) across the tunnel.
Answer: A
Explanation:
Comprehensive and Detailed Explanation
The stability of VPN tunnels in the Prisma SD-WAN + Prisma Access integration relies on standard IPSec mechanisms.
Dead Peer Detection (DPD): The CloudBlade configuration automatically enables DPD on the IPSec tunnels it provisions.
Mechanism: DPD is a standard keepalive mechanism where the ION device sends periodic "R-U-THERE" messages to the Prisma Access gateway (and vice versa). If no acknowledgment is received after a specific count/timer, the ION marks the tunnel as down and attempts to re-key or switch to a backup path.
Synthetic Probes (B): While Synthetic Probes (part of ADEM or Path Quality monitoring) can be configured to measure latency/loss, the fundamental mechanism that keeps the IPSec security association (SA) active and detects link failure is DPD, not an application-layer probe.
NEW QUESTION # 55
Which statement is valid when integrating Prisma SD-WAN with Prisma Access remote networks?
- A. A branch with multiple internet circuits will automatically connect to Prisma Access on each circuit and will be used in an active/standby manner for internet-bound traffic.
- B. Security policies for remote networks are configured in Prisma Access and pushed to Prisma SD-WAN for enforcement on the branch ION devices.
- C. Easy onboarding automatically recommends the closest preconfigured remote network security processing nodes and can be overridden manually.
- D. Bandwidth must be allocated to each Prisma Access remote network compute location, and this bandwidth is shared between all branches that terminate on this remote network node.
Answer: D
Explanation:
Comprehensive and Detailed Explanation
When deploying Prisma Access for Remote Networks (connecting branch offices), the licensing and throughput model is based on aggregate bandwidth allocated to specific compute locations (regions).
Bandwidth Allocation (Option D): Administrators must purchase and allocate a specific amount of bandwidth (e.g., 500 Mbps, 1 Gbps) to a Prisma Access "Compute Location" (e.g., US West, Europe Central). This allocated bandwidth is then shared as a pool among all the branch sites (Remote Networks) that onboard and terminate their IPSec tunnels at that specific location. The system does not allocate bandwidth on a strict per-site basis but rather enforces the limit on the aggregate throughput of the compute node itself.
Policy Enforcement (Option A): Security policies for Prisma Access are enforced in the cloud (at the Prisma Access Service Processing Node), not pushed down to the branch ION devices for local enforcement. The ION device handles local segmentation (ZBFW) and traffic steering, but the "Remote Network" security stack resides in the cloud.
Path Usage (Option C): Prisma SD-WAN is designed to utilize Active/Active paths. When a branch has multiple internet circuits connected to Prisma Access, the CloudBlade and ION automatically build tunnels on all compatible paths and can load-balance traffic across them based on application performance (SLA), rather than defaulting to a strict Active/Standby model for internet traffic.
NEW QUESTION # 56
How can a network administrator detect a site outage or a service-level agreement (SLA) violation using controller-generated incidents?
- A. Priority alerts, informational alerts, and audit logs
- B. Incidents, SNMP traps, and audits
- C. Device logs, alerts, and incidents
- D. Incidents, alerts, statistics, and audit logs
Answer: D
Explanation:
In the Prisma SD-WAN ecosystem, the centralized cloud controller provides a robust multi-layered visibility framework to ensure network reliability. To effectively detect critical events like site outages or application performance issues (SLA violations), the controller aggregates several types of operational data. Incidents are the primary mechanism for high-level alerting; they are automatically generated when the system detects significant state changes, such as an ION device going offline (site outage) or a path failing to meet the required performance metrics.
While Incidents provide the "what" and "where," Alerts offer granular notifications for specific events that may not yet have escalated to a full-scale incident. To provide deep context, the controller also utilizes Statistics, which include real-time and historical telemetry regarding bandwidth, latency, jitter, and packet loss. These statistics allow administrators to visualize the specific SLA violation as it occurs. Furthermore, Audit logs are essential for tracking configuration changes or administrative actions that might have preceded an outage, helping engineers correlate human intervention with network behavior.
By combining these four elements-Incidents for major events, Alerts for specific notifications, Statistics for performance validation, and Audit logs for change tracking-a network administrator gains a 360-degree view of the fabric. This comprehensive approach moves beyond simple "up/down" monitoring, allowing for
"Day 2" operational excellence where performance degradation is identified and remediated before it impacts the end-user experience.
NEW QUESTION # 57
User-ID integration is configured for a Prisma SD-WAN deployment. Branch-1 has the user-to-IP mappings available, and User-1 is mapped to IP-1.
To which two use cases can User-ID based zone-based firewall policies be applied? (Choose two.)
- A. User-1 accessing a private application within Branch-1, and source User-ID based zone-based firewall rules on Branch-1 ION
- B. User-1 accessing a private application in Branch-2 via SD-WAN overlay, and destination User-ID based zone-based firewall rules on Branch-2 ION
- C. User-1 accessing a private application in data center via SD-WAN overlay, and destination User-ID based zone-based firewall rules on DC ION
- D. User-1 accessing a SaaS application on direct internet and source User-ID based zone-based firewall rules on Branch-1 ION
Answer: A,D
Explanation:
Comprehensive and Detailed Explanation
In Prisma SD-WAN (CloudGenix), Zone-Based Firewall (ZBFW) policies rely on the device's ability to map an IP address to a User-ID to enforce identity-based rules. The key to this question is understanding where the mapping exists and which direction the policy attributes (Source User vs. Destination User) apply to.
1. Mapping Location (Branch-1): The prompt states that Branch-1 has the user-to-IP mapping for User-1.
For the most effective and scalable security enforcement, policies should be applied at the source (ingress) device where the traffic originates and where the user identity is known. This prevents unauthorized traffic from consuming WAN bandwidth only to be dropped at the destination. Therefore, the Branch-1 ION is the correct enforcement point for User-1's traffic.
2. Source vs. Destination User:
* User-1 is the Source: In all scenarios, User-1 is the initiator of the traffic. Therefore, the security rule must match on Source User-ID.
* Options C and D are incorrect because they suggest using Destination User-ID based rules to control User-1. Destination User-ID rules are used when the target of the traffic is a known user (e.g., VoIP calls to a specific user's phone), not when filtering based on the sender. Furthermore, relying on the DC or Branch-2 ION to enforce policies for User-1 would require the propagation of User-ID mappings across the overlay, whereas local enforcement at Branch-1 is the standard architectural model.
3. Valid Use Cases (A and B):
* Option A (SaaS/Internet): The Branch-1 ION acts as the internet gateway. It can use the local mapping (IP-1 = User-1) to allow or deny access to specific SaaS applications (Direct Internet Access) based on the user's identity (e.g., "Allow Marketing Group to access Social Media").
* Option B (Internal Segmentation): The Branch-1 ION can enforce policies for traffic moving between local zones (e.g., from a "Users" VLAN to a "Servers" VLAN within the branch). Since the ION routes this traffic and holds the mapping, it can enforce Source User-ID policies to secure local private applications.
NEW QUESTION # 58
Where is route leaking configured between VRFs?
- A. BGP peer
- B. VRF profile
- C. VRF definition
- D. Site configuration
Answer: B
Explanation:
In the Prisma SD-WAN solution, multi-tenancy and network isolation are achieved through the use of Virtual Routing and Forwarding (VRF) instances. However, there are many operational scenarios-such as providing shared access to a common service (e.g., DNS, NTP) or a central Internet gateway-where traffic must transition between these isolated routing domains. This process is known as route leaking.
In the Prisma SD-WAN management interface, route leaking is specifically configured within the VRF Profile. Unlike traditional CLI-based routers where route leaking might be configured under a global routing table or individual VRF definitions via import/export targets, Prisma SD-WAN utilizes a profile-based approach to ensure scalability and consistency across multiple sites. A VRF Profile acts as a template that defines the routing behavior for specific VRFs across the fabric.
When an administrator navigates to the VRF Profile settings, they can define "Leaking Rules." These rules specify the "From VRF" (source) and "To VRF" (destination) parameters, along with the specific prefixes or default routes that should be shared. By placing this configuration within the VRF Profile rather than a site- specific configuration, Palo Alto Networks allows for a "configure once, apply many" workflow. Once the VRF Profile is updated with the leaking rules, any ION device associated with that profile will automatically update its local routing table to allow the specified inter-VRF communication. This centralized orchestration simplifies the management of complex segmentation requirements in large-scale SD-WAN deployments.
NEW QUESTION # 59
A network engineer is troubleshooting a "Voice Quality" issue. They suspect that the DSCP markings are being stripped or altered by the ISP.
Which tool in the Prisma SD-WAN portal allows the engineer to capture live packets on the WAN interface and inspect the IP header ToS/DSCP field?
- A. Flow Browser
- B. Event Logs
- C. Packet Capture (PCAP)
- D. Path Quality Monitor
Answer: C
NEW QUESTION # 60
What is the number and structure of Prisma SD-WAN QoS queues supported per WAN interface?
- A. 8 queues
2 classes
4 application criteria within each class - B. 12 queues
4 classes1
3 application criteria within each class - C. 8 queues
1 priority queue
7 non-priority queues - D. 16 queues
4 classes
4 application criteria with each class
Answer: D
Explanation:
Comprehensive and Detailed Explanation
The Prisma SD-WAN (ION) QoS engine utilizes a hierarchical queuing structure designed to provide granular control over application performance. Each WAN interface on an ION device supports a total of 16 QoS queues.
This 16-queue structure is derived from a matrix of 4 Classes (often referred to as Priority Classes) multiplied by 4 Application Criteria (Traffic Types).2
4 Priority Classes: The system defines four high-level business priority categories:3 Platinum (Highest priority)4 Gold Silver Bronze (Lowest priority/Best Effort)5
4 Application Criteria (Sub-queues): Within each of the four priority classes, the system further categorizes traffic into four specific application types to ensure proper handling (e.g., ensuring voice doesn't get stuck behind bulk data even within the same priority level):6 Real-Time Video Real-Time Audio Transactional Bulk7 Calculation: 4 Priority Classes × 4 Application Types = 16 Total Queues per interface. This structure allows the scheduler to ensure that a "Platinum" voice call is prioritized over "Platinum" bulk data, and both are prioritized over "Gold" traffic.
NEW QUESTION # 61
When deploying a branch gateway, secure fabric VPN tunnels are automatically established between which two site types? (Choose two.)
- A. Branch gateway to data center
- B. Branch gateway to branch gateway
- C. Branch to branch gateway (different domain)
- D. Branch to branch gateway (same domain)
Answer: A,B
Explanation:
In the Prisma SD-WAN (Instant-On Network) architecture, the "Secure Fabric" is a key feature that simplifies VPN orchestration through automation. When an ION device is deployed at a site and associated with a specific role, the Prisma SD-WAN Controller automatically manages the establishment of encrypted VPN tunnels without requiring manual IPsec configuration.
The most fundamental tunnel type is Branch gateway to data center (Option B). By default, the system follows a hub-and-spoke model where every branch ION device automatically attempts to build secure tunnels to all available Data Center clusters within its domain. This ensures that branch locations have immediate, redundant connectivity to centralized corporate resources and applications as soon as they are brought online.
Additionally, Prisma SD-WAN supports automated Branch gateway to branch gateway connectivity (Option C). Unlike traditional architectures that backhaul all traffic through a central hub, the Prisma SD- WAN fabric can dynamically establish "spoke-to-spoke" tunnels between branch gateways to facilitate direct communication. This is particularly useful for latency-sensitive applications like Voice over IP (VoIP) or video conferencing. While this can be configured as a "full mesh" where all sites build tunnels to all other sites, the controller intelligently manages these connections based on the defined site roles and domain configurations to optimize resource usage and performance. Options A and D are incorrect because the fabric orchestration logic is primarily focused on the functional roles of the gateways (Branch vs. Data Center) rather than "domains" in the context of tunnel initiation.
NEW QUESTION # 62
An administrator has configured a Path Policy for "ERP_Traffic". The policy allows two public internet links, "ISP-A" and "ISP-B", both marked as "Active". The Path Quality Profile (SLA) requires a latency of less than 150ms. Currently, both ISP-A and ISP-B have a latency of 40ms, well within the SLA.
How does the Prisma SD-WAN ION determine which link to use for a new flow of "ERP_Traffic" when both active paths meet the SLA requirements?
- A. It selects the path with the highest available bandwidth capacity.
- B. It selects the path that appears first in the interface configuration list.
- C. It duplicates the packets across both paths (Packet Duplication) to ensure delivery.
- D. It selects the path with the lowest numerical latency (e.g., if ISP-A drops to 39ms).
Answer: A
Explanation:
Comprehensive and Detailed Explanation
Prisma SD-WAN utilizes a sophisticated decision engine for Application-Based Path Selection that goes beyond simple failover. When configuring a Path Policy, the administrator defines "Active" paths and a "Path Quality Profile" (SLA).
SLA Compliance (The Filter): First, the system filters the available paths based on the Path Quality Profile. In this scenario, both ISP-A and ISP-B have 40ms latency against a 150ms threshold. Both are "green" or compliant paths.
Selection Criteria (The Tie-Breaker): When multiple paths are configured as "Active" and all meet the performance SLA, the ION device aims to optimize the overall user experience and network utilization. The default behavior for load balancing across healthy, compliant active paths is to select the path with the highest available bandwidth capacity.
By steering new flows to the link with the most "headroom" (available Mbps), the system prevents the saturation of a smaller link (e.g., a 20Mbps DSL line) while a larger link (e.g., 1Gbps Fiber) sits underutilized. This maximizes the aggregate throughput for the site. While latency is the qualifier, bandwidth availability is often the selector for compliant paths. Note that if the application was defined as "Real-Time" and configured for packet duplication, behavior would differ, but for standard traffic, capacity-based distribution is the standard active/active logic.
NEW QUESTION # 63
In a Prisma SD-WAN deployment, what is the defining characteristic of a "Standard VPN" compared to a "Secure Fabric Link"?
- A. Standard VPNs are automatically built between ION devices, while Secure Fabric Links require manual configuration.
- B. Standard VPNs are manually configured IPSec tunnels to non-ION endpoints, while Secure Fabric Links are automated tunnels between ION devices.
- C. Standard VPNs use GRE encapsulation, while Secure Fabric Links use VXLAN.
- D. Standard VPNs support BGP, whereas Secure Fabric Links only support static routing.
Answer: B
Explanation:
Comprehensive and Detailed Explanation
In the Prisma SD-WAN architecture, the terminology distinguishes between "Native" automation and "Legacy" interoperability.
Secure Fabric Links: These are the proprietary, automated overlay tunnels created between two Prisma SD-WAN ION devices (e.g., Branch ION to Data Center ION). The controller automatically manages the IP addressing, key rotation, and routing for these links. You do not manually configure "Phase 1" or "Phase 2" parameters for Secure Fabric links.
Standard VPNs: These are traditional, standards-based IPSec tunnels configured to connect an ION device to a Non-ION endpoint (Third-Party Peer). This is used for "Data Center to Data Center" connections where one side is a legacy firewall (e.g., Cisco ASA, Palo Alto Networks NGFW) or for connecting to cloud security services (SSE) that do not have a specific CloudBlade integration. For a Standard VPN, the administrator must manually define the IKE/IPSec profiles, pre-shared keys, and peer IP addresses to match the third-party device's configuration.
NEW QUESTION # 64
By default, how many days will Prisma SD-WAN VPNs stay operational before the keys expire when an ION device loses connection with the controller?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
Comprehensive and Detailed Explanation
The Prisma SD-WAN (CloudGenix) solution is designed with a separation of the control plane (Controller) and the data plane (ION devices).1 In the event that an ION device loses connectivity to the Cloud Controller (often referred to as running in "headless mode"), the device continues to forward traffic and maintain existing VPN tunnels using the keys it currently holds.2 However, for security purposes, the VPN session keys (shared secrets) used for the Secure Fabric have a finite validity period. The system is designed such that these keys are rotated regularly.3 If the controller is unreachable, the ION device can continue to rotate keys locally and maintain the VPNs for a maximum default period of 72 hours (exactly 3 days).4 If the connection to the controller is not restored within this 72-hour window, the keys will eventually expire, and the ION will be unable to retrieve new authorized key material from the controller.5 Consequently, the VPN tunnels will go down, and the "out of shared secret key" error will be observed in the VPN status logs. This mechanism ensures that a permanently compromised or stolen device cannot maintain network access indefinitely without central authorization.
NEW QUESTION # 65
In a data center (DC) with two ION devices, all of the remote branch Prisma SD-WAN VPNs are active only on DC ION-1.
Why are no VPNs active on DC ION-2?
- A. The ION device is behind a NAT.
- B. The DC and branches are in a different domain.
- C. The BGP core peer is down.
- D. The static route to core as a next hop is missing.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
In a Prisma SD-WAN Data Center deployment, the operational state of the Secure Fabric VPNs (overlay tunnels) is directly tied to the health of the BGP Core Peer configuration.4 Core Peer Dependency: DC ION devices typically peer with the data center core switch (Core Router) via BGP to learn the subnets (prefixes) for the applications hosted in the DC. The Prisma SD-WAN controller monitors this BGP peering status.5 Controller Logic: If the BGP Core Peer on a DC ION goes down (or is not established), the controller automatically marks the VPN tunnels terminating at that specific ION as "Inactive".6 This is a fail-safe mechanism designed to prevent remote branches from sending traffic to a DC ION that has lost conne7ctivity to the internal data center network (and thus the applications).
Scenario Analysis: In this scenario, DC ION-1 has active VPNs, meaning its BGP Core Peer is UP and it is successfully advertising reachability. DC ION-2 has no active VPNs, which strongly indicates that its BGP Core Peer is down.8 Because the controller sees the peer is down, it suppresses the tunnel establishment or marks existing tunnels as inactive to ensure traffic is only directed to the healthy node (ION-1).
NEW QUESTION # 66
A network engineer is troubleshooting a user complaint regarding "slow application performance" for an internal web application. While viewing the Flow Browser in the Prisma SD-WAN portal, the engineer notices that the Server Response Time (SRT) is consistently high (over 500ms), while the Network Transfer Time (NTT) and Round Trip Time (RTT) are low (under 50ms).
What does this data indicate about the root cause of the issue?
- A. The issue is caused by a high packet loss rate on the internet path.
- B. The issue is likely on the application server itself (e.g., high CPU, slow database query), not the network.
- C. The issue is likely caused by congestion on the WAN circuit, requiring a QoS policy adjustment.
- D. The issue is due to a misconfigured DNS server at the branch.
Answer: B
Explanation:
Comprehensive and Detailed Explanation
The Flow Browser and App Response Time metrics in Prisma SD-WAN are critical tools for isolating the fault domain-determining whether a problem lies in the "Network" or the "Application."
* Network Transfer Time (NTT) / Round Trip Time (RTT): These metrics measure the time it takes for packets to traverse the network (WAN/LAN) and for acknowledgments to return. A low NTT (e.g.,
<50ms) confirms that the network pipes (SD-WAN overlay, Underlay circuits) are healthy and transporting packets quickly.
* Server Response Time (SRT): This metric specifically measures the time between the server receiving a request and the server sending the first byte of the response. It essentially measures the "processing time" of the backend server.
In the scenario described, the network metrics (NTT/RTT) are excellent, effectively ruling out WAN congestion, packet loss, or latency (Option A and C). However, the Server Response Time (SRT) is very high (500ms). This signature is a definitive indicator that the network delivered the request instantly, but the application server took a long time to process it. This points the troubleshooting effort toward the server infrastructure (e.g., a slow SQL query, an overloaded web server, or lack of compute resources) rather than the SD-WAN environment.
NEW QUESTION # 67
Which metrics can be monitored at the individual Prisma SD-WAN ION device level to assess its health and operational performance?
- A. Device VPN tunnels and controller reachability status
- B. Device CPU, memory and disk use, interface bandwidth, and errors/discards
- C. Device software version and interface bandwidth
- D. Device application flow statistics, Autonomous Digital Experience Manager (ADEM) metrics, and site health score
Answer: B
Explanation:
To ensure the stability and performance of the SD-WAN fabric, Prisma SD-WAN provides granular visibility into the health of each Instant-On Network (ION) appliance. While the solution is primarily application- defined, monitoring the underlying physical and system resources of the hardware or virtual instance is critical for proactive maintenance and troubleshooting.
At the individual device level, administrators can monitor system resource utilization, which includes CPU usage, memory (RAM) consumption, and disk space availability.1 High CPU or memory usage can indicate that the device is reaching its throughput limits or that a specific process (such as deep packet inspection) is overtaxing the system. Disk utilization is monitored to ensure there is sufficient space for local logs and system operations.
Beyond internal system health, interface-level metrics are essential. This includes monitoring interface bandwidth utilization to identify bottlenecks on WAN or LAN ports. Crucially, operational performance is also assessed through error and discard counters on each interface. High error rates or frequent packet discards often signal physical layer issues (like bad cabling), duplex mismatches, or upstream provider congestion. While VPN status and application flows are vital for network-wide visibility, the core health of an ION device is defined by these foundational system and interface metrics.
Monitoring these specific parameters allows network engineers to distinguish between an application performance issue caused by network latency and one caused by a local hardware resource constraint.
NEW QUESTION # 68
Which statements accurately describes how the Prisma SD-WAN zone-based firewall functions within a branch network?
- A. North-south traffic is handled by application-aware policies, while east-west traffic requires traditional Access Control List (ACLs).
- B. East-west traffic between the zones can be explicitly blocked, but traditional Access Control List (ACLs) are required to block north-south traffic.
- C. North-south traffic (internet/WAN egress) is handled by zone-based firewall and relies on external firewalls for east-west segmentation.1
- D. Security zones enable granular control over both WAN-to-LAN and LAN-to-WAN as well as east-west (LAN-to-LAN) traffic flows within the branch.
Answer: D
Explanation:
The Prisma SD-WAN (ION) device includes a native, application-aware Zone-Based Firewall (ZBFW) that provides comprehensive security within the branch without the mandatory requirement for additional hardware.2 The fundamental principle of this architecture is the grouping of interfaces and sub-interfaces into logical Security Zones.3 Once these zones are defined (e.g., LAN, WAN, Guest, IoT), the administrator can create security policies that govern the traffic permitted to flow between them.4 Unlike traditional routers that rely on stateless Access Control Lists (ACLs) which are difficult to manage and lack application visibility, the Prisma SD-WAN ZBFW is stateful and application-aware.5 This means it can apply granular control over North-South traffic (flows moving between the LAN and the WAN/Internet) and East-West traffic (flows moving between different segments within the LAN, such as from a Guest zone to a Corporate zone).6 By using security zones, an ION device can ensure that even if two local networks are connected to the same physical appliance, they remain completely isolated unless a specific policy explicitly allows communication.
This "Zero Trust" approach at the branch edge allows organizations to segment vulnerable devices (like IoT) from critical internal resources and strictly control how users access the internet or the corporate data center.7 The ZBFW works in tandem with the global controller to ensure that security postures are consistent across all branch locations, eliminating the complexity of manual ACL management at each site.8
NEW QUESTION # 69
By default, how many days will Prisma SD-WAN VPNs stay operational before the keys expire when an ION device loses connection with the controller?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
Comprehensive and Detailed Explanation
The Prisma SD-WAN (CloudGenix) solution is designed with a separation of the control plane (Controller) and the data plane (ION devices).1 In the event that an ION device loses connectivity to the Cloud Controller (often referred to as running in "headless mode"), the device continues to forward traffic and maintain existing VPN tunnels using the keys it currently holds.2 However, for security purposes, the VPN session keys (shared secrets) used for the Secure Fabric have a finite validity period. The system is designed such that these keys are rotated regularly.3 If the controller is unreachable, the ION device can continue to rotate keys locally and maintain the VPNs for a maximum default period of 72 hours (exactly 3 days).4 If the connection to the controller is not restored within this 72-hour window, the keys will eventually expire, and the ION will be unable to retrieve new authorized key material from the controller.5 Consequently, the VPN tunnels will go down, and the "out of shared secret key" error will be observed in the VPN status logs.
This mechanism ensures that a permanently compromised or stolen device cannot maintain network access indefinitely without central authorization.
NEW QUESTION # 70
What is the primary function of the "CloudBlade" platform in a Prisma SD-WAN deployment when integrating with third-party services or Prisma Access?
- A. It acts as a physical line card on the ION device to provide additional 10Gbps interfaces.
- B. It is a cloud-based API integration layer that automates the configuration of the ION devices and the remote service.
- C. It is a containerized application running on the ION device that performs Deep Packet Inspection (DPI).
- D. It is a monitoring dashboard used exclusively for viewing flow records.
Answer: B
Explanation:
Comprehensive and Detailed Explanation
The CloudBlade platform is a distinguishing architectural component of the Prisma SD-WAN solution. It is not a physical piece of hardware, nor is it software that runs directly on the branch ION device's CPU.
Instead, the CloudBlade platform is a cloud-based API integration layer hosted by Palo Alto Networks. It functions as an intelligent broker or "translator" between the Prisma SD-WAN Controller and external third-party services (such as Prisma Access, Amazon Web Services, Azure, ServiceNow, or Zscaler).
When an administrator configures the Prisma Access CloudBlade, for example, they input their API credentials and intent (e.g., "Connect all US branches to US West"). The CloudBlade engine then:
Communicates with the Prisma Access API to provision the remote IPSec termination nodes (Security Processing Nodes).
Translates this configuration into specific instruction sets for the Prisma SD-WAN Controller.
The Controller then pushes the necessary VPN tunnel configurations, IKE parameters, and routing rules to the relevant ION devices.
This architecture eliminates the need for manual IPSec configuration on every branch device. It ensures that if the third-party service changes its IP addresses or settings, the CloudBlade can detect the change via API and automatically update the branch fleet, maintaining connectivity without manual administrator intervention.
NEW QUESTION # 71
Two branch sites, "Branch-A" and "Branch-B", are both behind active NAT devices (Source NAT) on their local internet circuits.
What requirement must be met for these two branches to successfully establish a direct Dynamic VPN (ION-to-ION) tunnel over the internet?
- A. One of the sites must have a Static Public IP (1:1 NAT) to act as the initiator.
- B. Both sites must disable NAT and use public IPs on the ION interface.
- C. The ION devices automatically use STUN (Session Traversal Utilities for NAT) to discover their public IPs and negotiate the connection.
- D. Dynamic VPNs are not supported if both sides are behind NAT.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
Prisma SD-WAN supports Dynamic VPNs (Branch-to-Branch) even when both endpoints are behind Source NAT (e.g., typical broadband connections).
To achieve this, the ION devices utilize standard NAT Traversal techniques, specifically leveraging STUN (Session Traversal Utilities for NAT).
Discovery: Each ION communicates with the Cloud Controller (which acts as a STUN server/signaling broker). Through this communication, the controller observes the public IP and Port that the ION's traffic is coming from (the post-NAT address).
Signaling: The controller shares this public reachability information with the peer ION.
Hole Punching: The IONs then attempt to initiate connections to each other's discovered public IP/Port. This "UDP Hole Punching" allows them to establish a direct IPSec tunnel through the NAT devices without requiring static 1:1 NAT mapping or manual port forwarding on the provider routers, enabling mesh connectivity in commodity internet environments.
NEW QUESTION # 72
An administrator is configuring a BGP peer on a Data Center ION to learn routes from the core switch. The goal is to have the ION learn these prefixes and then advertise them to all remote branch sites across the SD- WAN overlay.
Which setting must be configured on the BGP Peer to ensure these learned routes are redistributed into the SD-WAN fabric?
- A. Set the "Scope" to "Global".
- B. Enable "Graceful Restart".
- C. Configure a "Prefix List" to deny all.
- D. Set the "Admin Distance" to 20.
Answer: A
Explanation:
Comprehensive and Detailed Explanation
In Prisma SD-WAN routing configuration, the Scope setting on a BGP Peer (or a Static Route) controls the redistribution logic for the prefixes learned from that source.
* Local Scope: If a BGP peer is configured with "Local" scope, the ION device will install the learned routes into its local routing table for its own reachability, but it will not advertise (redistribute) these routes to other ION devices via the Secure Fabric. They remain local to the site.
* Global Scope: To advertise reachability to the rest of the network, the BGP peer must be configured with "Global" scope. This tells the ION that any prefixes learned from this specific neighbor (e.g., the DC Core Switch) should be propagated across the SD-WAN overlay to remote branches. This is the critical setting for enabling branch-to-DC communication for applications hosted behind that BGP peer.
Without "Global" scope, the branches would never learn the routes to the data center subnets.
NEW QUESTION # 73
What are two potential causes when a secondary public circuit has been added to the branch site, but the Prisma SD-WAN tunnel is not forming to the data center? (Choose two.)
- A. Interface role is not selected as "internet."
- B. Interface scope is set to "local."
- C. DNS is not configured.
- D. Circuit label is missing from interface type.
Answer: A,B
Explanation:
Comprehensive and Detailed Explanation
In Prisma SD-WAN (formerly CloudGenix), the establishment of Secure Fabric (VPN) tunnels is automated but relies heavily on the correct definition of the Network Context for each interface. If a tunnel fails to form on a newly added s2econdary circuit, it is typically due to a misconfiguration in how the interface is defined in the ION portal.
1. Interface Scope (Statement D):
The Scope setting on an interface determines its function in the network topology.
Global Scope: This defines the interface as a WAN-facing port. The ION device will only attempt to build VPN tunnels (overlay) on interfaces configured with Global scope.
Local Scope: This defines the interface as a LAN-facing port (for users, switches, or APs). If the administrator mistakenly sets the scope to "Local" for the new internet line, the ION treats it as a private LAN segment and will not initiate any tunnel negotiation or WAN signaling on that port.
2. Interface Role/Circuit Category (Statement A):
Prisma SD-WAN uses Circuit Categories (often referred to as Interface Roles in general networking terms, or specifically "Circuit Category" in the ION UI) to determine peering logic.
To form a tunnel over a public internet link to a Data Center, the circuit attached to the interface must be categorized as "Internet".
The controller uses this category to match compatible endpoints. It knows that a "Private WAN" (MPLS) link cannot directly tunnel to an "Internet" link without a gateway. If the new circuit is not correctly selected/categorized as "Internet" (e.g., left undefined or set to a different category), the system will not attempt to build the standard IPSec overlay to the Data Center's public IP address.
NEW QUESTION # 74
The UI triggers incident DEVICESW_CONCURRENT_FLOWLIMIT_EXCEEDED for a branch site. Based in the image below, which tool can be used to identify the host?
- A. Run tcpdump under the LAN interface
- B. Monitor # Activity # Transaction Stats
- C. Monitor # Activity # Flows
- D. Monitor # Activity # New flows
Answer: C
Explanation:
When a Prisma SD-WAN ION device triggers the
DEVICESW_CONCURRENT_FLOWLIMIT_EXCEEDED incident, it indicates that the number of active sessions has reached the hardware or software-defined capacity limit of that specific appliance. In the provided graph, we can see a massive spike in concurrent TCP flows on May 13th, reaching nearly 500k, which is a clear indicator of anomalous behavior-likely a "top talker" host, a malware outbreak, or a misconfigured application generating excessive connections.
To identify the specific host responsible for this surge, administrators should navigate to Monitor # Activity
# Flows. This interface, commonly known as the Flow Browser, provides the most granular visibility into real-time and historical session data within the Prisma SD-WAN fabric. Unlike "Transaction Stats," which provide high-level summaries, or "New Flows," which only show the rate of session initiation, the Flows view allows an engineer to filter and sort the active session table by metadata such as Source IP, Destination IP, Application, and Site.
By utilizing the Flow Browser, an administrator can quickly group flows by "Source IP" to pinpoint exactly which internal host is consuming the most flow table entries. This is the standard "Day 2" operational workflow for troubleshooting performance and capacity incidents. While running a tcpdump (Option A) is a valid diagnostic for packet-level analysis, it is inefficient for identifying a single host among hundreds of thousands of flows and can further tax the device's CPU during a high-load event. The Monitor # Activity # Flows tool is designed specifically for this type of scale, providing the necessary visibility to remediate the flow limit exhaustion and restore normal network operations.
NEW QUESTION # 75
......
Latest Questions SD-WAN-Engineer Guide to Prepare Free Practice Tests: https://www.passreview.com/SD-WAN-Engineer_exam-braindumps.html
Reliable SD-WAN-Engineer Dumps Questions Available as Web-Based Practice Test Engine: https://drive.google.com/open?id=16oUh8ShPp-1hiwkP47jv43wkOxQXZPmC