Latest Palo Alto Networks SD-WAN-Engineer Exam questions and answers
RealValidExam SD-WAN-Engineer Exam Practice Test Questions (Updated 88 Questions)
Palo Alto Networks SD-WAN-Engineer Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 11
An administrator is configuring a BGP peer on a Data Center ION to learn routes from the core switch. The goal is to have the ION learn these prefixes and then advertise them to all remote branch sites across the SD-WAN overlay.
Which setting must be configured on the BGP Peer to ensure these learned routes are redistributed into the SD-WAN fabric?
- A. Set the "Admin Distance" to 20.
- B. Set the "Scope" to "Global".
- C. Configure a "Prefix List" to deny all.
- D. Enable "Graceful Restart".
Answer: B
Explanation:
Comprehensive and Detailed Explanation
In Prisma SD-WAN routing configuration, the Scope setting on a BGP Peer (or a Static Route) controls the redistribution logic for the prefixes learned from that source.
Local Scope: If a BGP peer is configured with "Local" scope, the ION device will install the learned routes into its local routing table for its own reachability, but it will not advertise (redistribute) these routes to other ION devices via the Secure Fabric. They remain local to the site.
Global Scope: To advertise reachability to the rest of the network, the BGP peer must be configured with "Global" scope. This tells the ION that any prefixes learned from this specific neighbor (e.g., the DC Core Switch) should be propagated across the SD-WAN overlay to remote branches. This is the critical setting for enabling branch-to-DC communication for applications hosted behind that BGP peer. Without "Global" scope, the branches would never learn the routes to the data center subnets.
NEW QUESTION # 12
What are two requirements for implementing user/group-based path policies? (Choose two.)
- A. Cloud Identity Engine
- B. Data center ION
- C. Autonomous Digital Experience Manager (ADEM)
- D. Internal host detection
Answer: A,B
Explanation:
Comprehensive and Detailed Explanation
To implement User/Group-based policies (Path, QoS, or Security) in Prisma SD-WAN, the system requires two specific components to resolve user identities and map them to IP addresses within the fabric.
Cloud Identity Engine (CIE): This is the primary requirement for identity management. The Cloud Identity Engine connects the Prisma SD-WAN controller to your directory service (e.g., Active Directory, Azure AD/Entra ID). It allows the system to retrieve and resolve User and Group attributes (e.g., "Marketing Group," "User: john.doe") so they can be selected in policy rules. Without CIE, the controller cannot interpret the group names or user identities defined in the policies.
Data Center ION: In the standard deployment model for User-ID, a Data Center (DC) ION is required to act as the bridge or collector for IP-to-User mappings. The DC ION connects to the User-ID Agent (running on a PAN-OS firewall or Windows Server) to learn the mapping of IP addresses to usernames. It then redistributes this information to the controller or other branch IONs so they can identify which user is associated with the traffic flows originating from a specific private IP address.
NEW QUESTION # 13
Which component of Prisma SD-WAN is responsible for distributing User-IP and user-group mappings to branch devices that match the corresponding source IPs?
- A. NGFW
- B. DC ION
- C. Cloud Identity Engine
- D. Controller
Answer: D
Explanation:
In the Prisma SD-WAN architecture, the Controller serves as the centralized management and control plane for the entire fabric. While the Cloud Identity Engine (CIE) is the component responsible for collecting and consolidating user-to-IP mappings from various identity providers (such as Active Directory, Okta, or Azure AD), it does not directly manage the distribution of this operational data to the individual ION devices at the branch level.
Instead, the Prisma SD-WAN Controller integrates with the Cloud Identity Engine to ingest these identity mappings. Once the Controller has synchronized the User-IP and user-group information, it acts as the primary orchestrator. It is responsible for distributing these mappings down to the ION devices across all sites. This distribution ensures that when an ION device sees traffic from a specific source IP, it can accurately associate that traffic with a specific user or group based on the metadata provided by the Controller.
By centralizing this distribution through the Controller, Prisma SD-WAN ensures consistency across the network. Branch ION devices can then apply Application-Based Path Selection and security policies based on user identity rather than just IP addresses. This architectural design offloads the processing requirements of maintaining direct connections to identity providers from the branch hardware, allowing the Controller to handle the heavy lifting of orchestration and global synchronization of identity data.
NEW QUESTION # 14
User-ID integration is configured for a Prisma SD-WAN deployment. Branch-1 has the user-to-IP mappings available, and User-1 is mapped to IP-1.
To which two use cases can User-ID based zone-based firewall policies be applied? (Choose two.)
- A. User-1 accessing a SaaS application on direct internet and source User-ID based zone-based firewall rules on Branch-1 ION
- B. User-1 accessing a private application within Branch-1, and source User-ID based zone-based firewall rules on Branch-1 ION
- C. User-1 accessing a private application in Branch-2 via SD-WAN overlay, and destination User-ID based zone-based firewall rules on Branch-2 ION
- D. User-1 accessing a private application in data center via SD-WAN overlay, and destination User-ID based zone-based firewall rules on DC ION
Answer: A,B
Explanation:
Comprehensive and Detailed Explanation
In Prisma SD-WAN (CloudGenix), Zone-Based Firewall (ZBFW) policies rely on the device's ability to map an IP address to a User-ID to enforce identity-based rules. The key to this question is understanding where the mapping exists and which direction the policy attributes (Source User vs. Destination User) apply to.
1. Mapping Location (Branch-1): The prompt states that Branch-1 has the user-to-IP mapping for User-1. For the most effective and scalable security enforcement, policies should be applied at the source (ingress) device where the traffic originates and where the user identity is known. This prevents unauthorized traffic from consuming WAN bandwidth only to be dropped at the destination. Therefore, the Branch-1 ION is the correct enforcement point for User-1's traffic.
2. Source vs. Destination User:
User-1 is the Source: In all scenarios, User-1 is the initiator of the traffic. Therefore, the security rule must match on Source User-ID.
Options C and D are incorrect because they suggest using Destination User-ID based rules to control User-1. Destination User-ID rules are used when the target of the traffic is a known user (e.g., VoIP calls to a specific user's phone), not when filtering based on the sender. Furthermore, relying on the DC or Branch-2 ION to enforce policies for User-1 would require the propagation of User-ID mappings across the overlay, whereas local enforcement at Branch-1 is the standard architectural model.
3. Valid Use Cases (A and B):
Option A (SaaS/Internet): The Branch-1 ION acts as the internet gateway. It can use the local mapping (IP-1 = User-1) to allow or deny access to specific SaaS applications (Direct Internet Access) based on the user's identity (e.g., "Allow Marketing Group to access Social Media").
Option B (Internal Segmentation): The Branch-1 ION can enforce policies for traffic moving between local zones (e.g., from a "Users" VLAN to a "Servers" VLAN within the branch). Since the ION routes this traffic and holds the mapping, it can enforce Source User-ID policies to secure local private applications.
NEW QUESTION # 15
Which configuration requirement must be met to allow two branch ION devices to automatically establish a direct Dynamic VPN (branch-to-branch) connection for traffic flow, bypassing the Data Center?
- A. Both ION devices must be members of the same VPN Cluster.
- B. The "Standard VPN" path policy must be selected.
- C. A static "Gre Tunnel" must be manually configured between the two sites.
- D. The Data Center ION must be offline to trigger the dynamic failover.
Answer: A
Explanation:
Comprehensive and Detailed Explanation
Dynamic VPNs (also known as ION-to-ION or Branch-to-Branch VPNs) allow Prisma SD-WAN devices to establish direct, on-demand secure tunnels between branch sites to optimize latency for peer-to-peer traffic (e.
g., VoIP calls between offices).
To enable this capability, the primary architectural requirement is the configuration of VPN Clusters.
A VPN Cluster defines a logical group of devices that are authorized to communicate with one another.
* By default, or if devices are in different clusters without peering, the topology typically defaults to Hub- and-Spoke, where branches only talk to the Data Center.
* When two branch ION devices are placed into the same VPN Cluster (or peered clusters), the controller shares the necessary reachability and cryptographic information between them.
Once in the same cluster, the ION devices monitor traffic. If a user at Branch A tries to contact a server at Branch B, the ION devices detect this interest. If a direct path is available (e.g., via public internet), they will dynamically negotiate a direct VPN tunnel, bypassing the Data Center hub. This offloads the hub and reduces latency. Option B is incorrect because SD-WAN eliminates manual GRE config. Option C is incorrect because dynamic VPNs are a performance feature, not just a disaster recovery feature.
NEW QUESTION # 16
Which component of the Prisma SD-WAN solution is responsible for the deep application identification (App-ID) and the generation of flow metrics (Network Transfer Time, Server Response Time) at the branch?
- A. The API Gateway
- B. The Prisma SD-WAN Controller
- C. The CloudBlade container
- D. The ION Device Data Plane
Answer: D
Explanation:
Comprehensive and Detailed Explanation
The ION Device Data Plane (the software running locally on the hardware appliance at the branch) is the component responsible for the heavy lifting of traffic analysis.
Edge Processing: Prisma SD-WAN uses an "Application-Defined" architecture. The ION device performs Deep Packet Inspection (DPI) on the first few packets of a flow to identify the application (e.g., distinguishing "Skype Video" from "Skype Chat").
Metric Calculation: The ION device timestamping engine calculates the performance metrics (RTT, NTT, SRT) in real-time as packets pass through its interfaces. It aggregates this metadata.
Role of Controller (B): The Controller collects and visualizes this data (Analytics), but it does not generate it. The Controller does not sit in the data path of the user traffic. If the ION relied on the controller for App-ID, latency would be unacceptably high. Therefore, all detection and metric generation happens locally on the ION Device.
NEW QUESTION # 17
Site templates are to be used for the large-scale deployment of 100 Prisma SD-WAN branch sites across different regions.
Which two statements align with the capabilities and best practices for Prisma SD-WAN site templates?
(Choose two.)
- A. Site templates offer the capability to pre-stage device configurations by creating a device shell.
- B. Mandatory variables for any site template include the site name, ION software version, and at least one ION serial number /device name pair.
- C. The use of Jinja conditional statements within a site template is not supported, thereby limiting dynamic customization options.
- D. Once a site has been deployed using a template, its configuration can be updated or modified by applying an updated version of the template.
Answer: A,B
Explanation:
Comprehensive and Detailed Explanation
Site Templates (often referred to as Site Configuration Templates) are a critical tool for the Zero Touch Provisioning (ZTP) of large-scale deployments in Prisma SD-WAN.
1. Device Pre-staging (Statement C):
One of the primary capabilities of Site Templates is the creation of Device Shells. A device shell is a configuration container that exists in the controller before the physical hardware is installed or connected. By using a template, an administrator can pre-provision the entire configuration (interfaces, routing, subnets) for the "Site" and "Element" (Device). When the physical ION device is later connected to the internet and claimed (associated with the shell via its Serial Number), it immediately inherits this pre-staged configuration, enabling a true "plug-and-play" deployment.
2. Mandatory Variables (Statement B):
To successfully instantiate a functional site from a generic template, specific unique identifiers are required in the variable data set (typically a CSV file).
* Site Name: Identifies the location in the portal.
* ION Software Version: Ensures the device boots to the specific validated code version required for the deployment, preventing inconsistencies.
* ION Serial Number / Device Name: Required to bind the logical configuration (Shell) to the physical hardware. Even if the serial is added later during the claim process, the structure of the template and the deployment workflow mandates these variables to ensure the device can be uniquely identified and managed within the fabric.
Note on Option D: While it is technically possible to re-deploy a template, the Best Practice for "Day 2" operations (updating or modifying configuration after deployment) is to use Prisma SD-WAN Stacks (Network Stacks, Security Stacks, etc.). Stacks allow for granular, policy-based updates across multiple sites without the destructive or rigid nature of re-applying a full site initialization template. Therefore, D is not the aligned best practice.
NEW QUESTION # 18
When integrating Prisma SD-WAN with Prisma Access, what is the specific role of the Service Connection (SC)?
- A. It connects the Prisma Access cloud infrastructure back to the customer's Headquarters or Data Center for access to internal private resources (e.g., AD, DNS, Intranet).
- B. It is the peering link between different Prisma Access regions to optimize global traffic.
- C. It is the IPSec tunnel that connects a Branch site to the Prisma Access gateway for internet access.
- D. It is the SSL VPN portal used by mobile users to connect to the network.
Answer: A
Explanation:
Comprehensive and Detailed Explanation
In the Prisma Access architecture (integrated with SD-WAN), distinct connection types serve different purposes.
Remote Networks: These are the connections from your Branch sites (using ION devices) into the cloud. They allow branches to get to the internet or other branches.
Service Connections (SC): This is a specialized high-bandwidth connection used to bridge the Prisma Access Cloud to your Private Data Center or Headquarters.
The primary use case for a Service Connection (Option A) is to allow mobile users and branch users (who are connected to the Prisma cloud) to reach private, centralized resources that still reside on-premise, such as Active Directory controllers, legacy databases, or mainframes. Without a Service Connection, users in the cloud would be able to reach the internet and each other, but not the servers physically located in your HQ data center. The CloudBlade automates the creation of these tunnels, but architecturally, the "Service Connection" is the "cloud-to-HQ" bridge.
NEW QUESTION # 19
When integrating Prisma SD-WAN with Prisma Access, what is the specific role of the Service Connection (SC)?
- A. It connects the Prisma Access cloud infrastructure back to the customer's Headquarters or Data Center for access to internal private resources (e.g., AD, DNS, Intranet).
- B. It is the peering link between different Prisma Access regions to optimize global traffic.
- C. It is the IPSec tunnel that connects a Branch site to the Prisma Access gateway for internet access.
- D. It is the SSL VPN portal used by mobile users to connect to the network.
Answer: A
Explanation:
Comprehensive and Detailed Explanation
In the Prisma Access architecture (integrated with SD-WAN), distinct connection types serve different purposes.
Remote Networks: These are the connections from your Branch sites (using ION devices) into the cloud. They allow branches to get to the internet or other branches.
Service Connections (SC): This is a specialized high-bandwidth connection used to bridge the Prisma Access Cloud to your Private Data Center or Headquarters.
The primary use case for a Service Connection (Option A) is to allow mobile users and branch users (who are connected to the Prisma cloud) to reach private, centralized resources that still reside on-premise, such as Active Directory controllers, legacy databases, or mainframes. Without a Service Connection, users in the cloud would be able to reach the internet and each other, but not the servers physically located in your HQ data center. The CloudBlade automates the creation of these tunnels, but architecturally, the "Service Connection" is the "cloud-to-HQ" bridge.
NEW QUESTION # 20
An engineer at a managed services provider is updating an application that allows its customers to request firewall changes to also manage SD-WAN. The application will be able to make any approved changes directly to devices via API.
What is a requirement for the application to create SD-WAN interfaces?
- A. XML API's "sdwanprofiles/interfaces" parameter on a Panorama device
- B. REST API's "sdwanInterfaces" parameter on a firewall device
- C. REST API's "sdwanInterfaceprofiles" parameter on a Panorama device
- D. XML API's "InterfaceProfiles/sdwan" parameter on a firewall device
Answer: B
Explanation:
Comprehensive and Detailed Explanation at least 150 to 250 words each from Palo Alto Networks SD-WAN Engineer documents:
In Palo Alto Networks PAN-OS SD-WAN environments, automation and orchestration are key components for service providers managing large-scale deployments. The PAN-OS REST API provides a modern, structured way to programmatically manage configuration objects, including those required for SD-WAN functionality.
When an application is designed to push changes directly to devices (individual firewalls) rather than through a centralized template in Panorama, it must interact with the firewall's local REST API. To successfully create a virtual SD-WAN interface, the application must target the correct resource URI. In the PAN-OS API schema, the logical SD-WAN interface-which groups physical links to enable application-based path selection-is managed via the sdwanInterfaces parameter within the REST API.
It is important to distinguish between the interface itself and the profiles that support it. Option A refers to sdwanInterfaceprofiles, which are the objects used to define the characteristics of a link (such as bandwidth, link type, and monitoring frequency), but not the interface itself. Furthermore, since the scenario specifies making changes "directly to devices," the target must be the firewall rather than Panorama. While Panorama can manage these objects via templates, a direct-to-device automation workflow necessitates using the firewall's REST API endpoint. Utilizing the REST API over the legacy XML API is the recommended standard for modern integrations due to its ease of use with JSON payloads and alignment with contemporary DevSecOps practices. By using the sdwanInterfaces parameter on the firewall, the MSP application can programmatically bind physical Layer 3 interfaces to the SD-WAN fabric.
NEW QUESTION # 21
A network installer is attempting to claim a new ION device using the "Claim Code" method. The device is connected to the internet, but the status in the portal remains stuck at "Claimed" and does not transition to
"Online". The installer connects a laptop to the LAN port of the ION and can successfully browse the internet, confirming the uplink is active.
What is the most likely cause of the device failing to reach the "Online" state?
- A. The device is missing the "Site" assignment in the portal.
- B. The upstream firewall is blocking outbound TCP port 443 or UDP port 123 (NTP).
- C. The "Circuit Label" has not been applied to the WAN interface.
- D. The device has not yet downloaded the latest software image.
Answer: B
NEW QUESTION # 22
A network administrator is viewing the Flow Browser to investigate a report that a specific user cannot access an internal web server. The flow entry for this traffic shows the "Flow State" as "INIT" and it remains in that state until it times out.
What does the "INIT" state indicate about the traffic flow?
- A. The traffic is being buffered while the ION waits for a dynamic VPN tunnel to establish.
- B. The ION device received the SYN packet from the client but never saw a SYN-ACK response from the server.
- C. The TCP 3-way handshake was completed successfully, and data is being transferred.
- D. The flow was denied by a Zone-Based Firewall policy on the ION.
Answer: B
Explanation:
Comprehensive and Detailed Explanation
In the Prisma SD-WAN Flow Browser, the Flow State provides a real-time snapshot of the TCP/UDP session lifecycle.
INIT (Initialization): This state indicates that the ION device has seen the initial packet of a new session (typically a TCP SYN) originating from the client (Source), but it has not yet seen a return packet (such as a TCP SYN-ACK) from the destination server.
Diagnosis: A flow stuck in INIT is a classic indicator of a "Blackhole" or reachability issue downstream. It implies that the ION successfully routed the packet out toward the destination, but the destination did not reply. Common causes include:
The server is offline.
A firewall in the path (or on the server itself) is dropping the traffic.
Routing is broken on the return path (asymmetric routing where the return traffic bypasses the ION).
If the flow had been denied by the ION's own firewall (Option C), the state would typically show as DENY or REJECT. If the handshake completed (Option A), the state would be ESTABLISHED. Therefore, INIT points to a lack of response from the remote end.
NEW QUESTION # 23
A multinational company is deploying Prisma SD-WAN across North America, Europe, and Asia. The data centers in the North America region have served all regions, but regional policies are now being enforced that mandate each of the regions to build their own data centers and branch sites to only connect to their respective regional data centers.
How can this regionalization be achieved so that new or existing branch sites only build tunnels to the regional DC IONs?
- A. Disable the auto-tunnel feature globally on the Prisma SD-WAN portal and manually create all necessary tunnels exclusively between IONs within their designated regions.
- B. Assign WAN interfaces to distinct Virtual Routing and Forwarding (VRF) instances for each region on the DC IONs, ensuring that branches only connect to the WAN interfaces/VRFs designated for their region.
- C. Create a new cluster for each regional DC ION and move the sites from the existing cluster to the new cluster.
- D. Remove the circuit labels and apply new circuit labels for in-region circuits only.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
To achieve strict regional isolation where branch sites only form VPN tunnels with Data Centers in their specific region (e.g., EU branches to EU DCs only), the correct architectural feature to utilize is VPN Clusters
.
In Prisma SD-WAN (CloudGenix), a Cluster defines a logical security and topology boundary for the overlay network. By default, devices may be placed in a "Default" cluster where they attempt to form a mesh or hub- and-spoke topology with all other reachable devices in that context.
To enforce the new policy:
* Logical Partitioning: The administrator should create separate VPN Clusters for each region (e.g.,
"Cluster-NA", "Cluster-EU", "Cluster-Asia").
* Assignment: The Regional Data Center IONs and their corresponding Branch IONs must be moved into their respective clusters.
* Result: The Prisma SD-WAN controller dictates that devices can only establish Secure Fabric (VPN) tunnels with other devices within the same cluster. This effectively segments the global network, ensuring that an Asian branch never attempts to build a tunnel to a North American DC, satisfying the compliance requirement without complex access lists or manual tunnel configuration.
* Option B (Manual Tunnels) is administratively unscalable and negates the benefits of SD-WAN automation.
* Option C (Circuit Labels) is primarily for path selection and traffic steering, not for hard topology segmentation.
* Option D (VRFs) is used for local Layer 3 segmentation (routing isolation) within a device, not for controlling WAN overlay tunnel formation scope.
NEW QUESTION # 24
In the Prisma SD-WAN portal, the Application Health dashboard assigns a color-coded "Health Score" (Green, Yellow, Red) to applications.
Which three metrics are combined to calculate this composite AppX (Application Experience) score? (Choose three.)
- A. Bandwidth Utilization
- B. Network Transfer Time (NTT)
- C. Server Response Time (SRT)
- D. Jitter
- E. Transaction Failure Rate
Answer: B,C,E
Explanation:
Comprehensive and Detailed Explanation
The AppX (Application Experience) score is a proprietary metric used by Prisma SD-WAN to provide a holistic view of user experience, rather than just network statistics. It is calculated based on three key components:
Transaction Failure Rate (A): The percentage of application transactions that failed (e.g., TCP resets, HTTP 500 errors). This indicates availability.
Network Transfer Time (B): The time taken for packets to traverse the network (WAN/LAN latency). This indicates network health.
Server Response Time (C): The time taken by the application server to respond to a request. This indicates backend performance.
Why not D or E?
Bandwidth Utilization (D) is a capacity metric, not a direct measure of quality. A link can be 90% full but still deliver packets quickly (good AppX), or 10% full but dropping packets (bad AppX).
Jitter (E) is a network-layer metric primarily relevant for UDP Real-Time media. While important, the high-level "AppX" score for general TCP apps focuses on the "Time-to-Glass" metrics (NTT/SRT) and success rates.
NEW QUESTION # 25
When identifying devices for IoT classification purposes, which two methods does Prisma SD-WAN use to discover devices that are not directly connected to the branch ION? (Choose two.)
- A. LLDP
- B. CDP
- C. SNMP
- D. Syslog
Answer: C,D
Explanation:
Comprehensive and Detailed Explanation
Prisma SD-WAN (formerly CloudGenix) integrates with Palo Alto Networks IoT Security to provide comprehensive visibility into all devices at a branch, including those that are not directly connected to the ION device. While the ION automatically detects and classifies devices connected directly to its interfaces via traffic inspection (DPI), DHCP, and ARP analysis, gaining visibility into off-branch devices (devices connected to downstream switches or access points) requires additional discovery mechanisms that can query the network infrastructure or ingest its logs.
1. SNMP (Simple Network Management Protocol): This is the primary active discovery method for off-branch devices. The Prisma SD-WAN ION device acts as a sensor that actively polls local network switches and wireless controllers using SNMP. By querying the ARP tables and MAC address tables (Bridge MIBs) of these intermediate network devices, the ION can identify endpoints that are connected to the switch ports, even if those endpoints are not currently sending traffic through the ION. This allows the system to map the topology and discover silent or lateral-traffic-only devices.
2. Syslog: In conjunction with SNMP, the IoT Security solution can utilize Syslog messages to discover and profile devices. Network infrastructure devices (like switches and WLAN controllers) can be configured to send Syslog messages to the collection point (which enables the IoT Security service) whenever a device connects or disconnects (e.g., port up/down events, DHCP snooping logs, or 802.1x authentication logs). These logs provide real-time data about device presence and identity (MAC/IP mappings) for devices that are not directly adjacent to the ION, ensuring 100% visibility across the branch network segments. LLDP (A) and CDP (B) are typically Link Layer discovery protocols used for discovering directly connected neighbors and do not propagate beyond the immediate link, making them unsuitable for discovering devices multiple hops away or behind a switch.
NEW QUESTION # 26
For how many hours are Prisma SD-WAN VPN shared secrets valid?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
Explanation:
In the Prisma SD-WAN architecture, security is built directly into the AppFabric using a centralized, controller-led approach to key management. Unlike traditional VPNs that rely on manual Internet Key Exchange (IKE) or static Pre-Shared Keys (PSKs) which can be administratively burdensome and security- vulnerable, Prisma SD-WAN automates the entire lifecycle of encrypted tunnels. The Prisma SD-WAN Controller acts as the central authority for identity and key distribution for all ION (Instant-On Network) devices within the tenant's fabric.
Specifically, the VPN shared secrets used to secure these tunnels are ephemeral and are valid for exactly 24 hours. This 24-hour validity period is a security best practice implemented by Palo Alto Networks to limit the
"blast radius" or window of exposure in the unlikely event that a key is compromised. The controller automatically handles the generation, distribution, and rotation of these secrets. Before the 24-hour timer expires, the controller pushes new keys to the ION devices, which then perform a hitless rollover. This ensures that the data plane remains active and encrypted without requiring manual intervention from a network administrator. If an ION device loses its control plane connection to the controller, it will maintain its existing tunnels using the current keys until they expire, at which point it must re-authenticate with the controller to receive a new set of valid secrets. This automated rotation is a core component of the Prisma SD- WAN Zero-Trust security model.
NEW QUESTION # 27
Which troubleshooting action should be taken when resources at one branch site can reach the internet but cannot be reached from the data center (DC)?
- A. Set the site in a control mode.
- B. Admin up the Prisma SD-WAN DC endpoints.
- C. Create static route with DC ION as a next hop.
- D. Ensure the LAN branch prefixes are set to "global."
Answer: D
Explanation:
In the Prisma SD-WAN architecture, reachability between sites is managed by the Control Plane, which automatically advertises prefixes across the secure fabric based on their scope. If a branch site has successful Direct Internet Access (DIA) but is invisible to the Data Center (DC), it indicates that while the local ION is online, its internal network information has not been propagated to the rest of the SD-WAN fabric.
The most common cause for this behavior is that the LAN interfaces or static routes at the branch are configured with a Local scope rather than a Global scope. When a prefix is set to "Local," the ION device treats that network as reachable only within that specific site; it will not advertise that prefix to the Controller for distribution to other ION devices, such as those at the Data Center. By ensuring the LAN branch prefixes are set to "global" (Option B), the administrator instructs the ION device to share these routes with the global fabric.
Once the prefix is marked as global, the Prisma SD-WAN Controller identifies it as a reachable destination and updates the routing tables of all peer ION devices in the same domain, including the DC gateways. This allows the Data Center to build a valid path to the branch resources over the secure VPN tunnels. Options like creating static routes (Option A) or changing site modes (Option C) do not address the fundamental requirement of prefix advertisement within the software-defined fabric, which relies on correctly defined metadata like route scope.
NEW QUESTION # 28
1000 branches are to be deployed on Prisma SD-WAN with the following constraints:
* Devices will be shipped in batches directly to the site
* Configuration Management Database (CMDB) has all the necessary details for a site deployment
* Field tech will be responsible for rack, stack, and cabling of the IONs at each site
* Field tech will need to spend minimum amount of time at each branch site to reduce the cost
* The NOC operates in shifts and is responsible for remote cutover support Which method will achieve the mass deployment in shortest possible time?
- A. Use site templates and device shells to pre-create the configuration using CSV bulk upload, connect the device to the ISP modem or using cellular, assign the device to the template when device is online, and connect the LAN switch to the ION.
- B. Connect the device to the ISP modem or use cellular, use Prisma SD-WAN Software Development Kit (SDK) using API method for site deployment once the device is online, connect the LAN switch to the ION.
- C. Connect the ION to the LAN switch to bring it online, configure the device using the legacy network, connect the ISP modem or cellular, and cutover the site once the ION is configured.
- D. Connect the device to the ISP modem or use cellular, use device shell to pre-create the configuration for a site, assign the device to the template when device is online, and connect the LAN switch to the ION.
Answer: A
Explanation:
For a massive rollout involving 1,000 branch sites, Prisma SD-WAN (formerly CloudGenix) provides a specialized workflow known as Bulk Site Configuration. This method is designed to minimize manual intervention and maximize deployment velocity by leveraging Site Templates and Device Shells.
In this scenario, the primary architectural advantage of Option C is the use of Pre-Staging. By exporting an empty SD-WAN device CSV from the Prisma SD-WAN Controller and populating it with data from the corporate CMDB, administrators can perform a bulk upload to create hundreds or thousands of sites and device shells simultaneously in the management portal. A "Device Shell" acts as a placeholder for a physical ION device that has not yet connected to the cloud. It contains all the site-specific configuration-such as interface roles, circuit labels, and IP addressing-waiting for a serial number to be associated with it.
When the field technician performs the physical "rack and stack," they simply connect the ION device to the internet (via ISP modem or cellular). Through Zero Touch Provisioning (ZTP), the device automatically
"phones home" to the Prisma SD-WAN Cloud Controller using its Manufacturer Installed Certificate (MIC).
Because the configuration was pre-created via the CSV bulk upload, the controller recognizes the device (once assigned to its shell) and immediately pushes the complete configuration. This eliminates the need for the field tech to access a console port or perform local configuration, reducing their on-site time to the bare minimum. While APIs (Option D) can be used for automation, the built-in CSV template workflow is the standard, documented "best practice" for rapidly translating CMDB data into a functioning SD-WAN fabric at this scale.
NEW QUESTION # 29
A network operator receives a critical SITE_CONNECTIVITY_DOWN alarm for a branch site in the Prisma SD-WAN portal.
What specific condition triggers this alarm type?
- A. The device has lost power and rebooted.
- B. One of the two internet circuits at the site has gone down.
- C. All Secure Fabric Links (VPNs) to all remote peers are down, isolating the site from the overlay.
- D. The site has exceeded its licensed bandwidth capacity.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
The SITE_CONNECTIVITY_DOWN alarm is a high-severity alert indicating a total loss of overlay connectivity for a site.
It does not trigger if just one circuit fails (Option B), provided that other circuits are still up and maintaining VPNs. A single link failure would typically trigger a "Link Down" or "VPN Down" alarm, but the Site connectivity would remain "Up" (degraded).
It does not simply mean the device rebooted (Option A), although a reboot would cause it temporarily; the alarm specifically tracks the state of the VPN fabric.
The SITE_CONNECTIVITY_DOWN alarm specifically generates when all Secure Fabric Links (VPN tunnels) on the device are in the "Down" state. This means the branch is completely isolated from the rest of the SD-WAN network (Data Centers and other branches), even if the device itself might still be powered on and reachable via the controller (management plane). It signifies a "Blackout" of the data plane for that location.
NEW QUESTION # 30
A network engineer is troubleshooting a user complaint regarding "slow application performance" for an internal web application. While viewing the Flow Browser in the Prisma SD-WAN portal, the engineer notices that the Server Response Time (SRT) is consistently high (over 500ms), while the Network Transfer Time (NTT) and Round Trip Time (RTT) are low (under 50ms).
What does this data indicate about the root cause of the issue?
- A. The issue is likely caused by congestion on the WAN circuit, requiring a QoS policy adjustment.
- B. The issue is likely on the application server itself (e.g., high CPU, slow database query), not the network.
- C. The issue is due to a misconfigured DNS server at the branch.
- D. The issue is caused by a high packet loss rate on the internet path.
Answer: B
Explanation:
Comprehensive and Detailed Explanation
The Flow Browser and App Response Time metrics in Prisma SD-WAN are critical tools for isolating the fault domain-determining whether a problem lies in the "Network" or the "Application."
* Network Transfer Time (NTT) / Round Trip Time (RTT): These metrics measure the time it takes for packets to traverse the network (WAN/LAN) and for acknowledgments to return. A low NTT (e.g.,
<50ms) confirms that the network pipes (SD-WAN overlay, Underlay circuits) are healthy and transporting packets quickly.
* Server Response Time (SRT): This metric specifically measures the time between the server receiving a request and the server sending the first byte of the response. It essentially measures the "processing time" of the backend server.
In the scenario described, the network metrics (NTT/RTT) are excellent, effectively ruling out WAN congestion, packet loss, or latency (Option A and C). However, the Server Response Time (SRT) is very high (500ms). This signature is a definitive indicator that the network delivered the request instantly, but the application server took a long time to process it. This points the troubleshooting effort toward the server infrastructure (e.g., a slow SQL query, an overloaded web server, or lack of compute resources) rather than the SD-WAN environment.
NEW QUESTION # 31
......
Pass Your Palo Alto Networks Exam with SD-WAN-Engineer Exam Dumps: https://www.realvalidexam.com/SD-WAN-Engineer-real-exam-dumps.html
