2026 Realistic SD-WAN-Engineer Dumps are Available for Instant Access
Download Exam SD-WAN-Engineer Practice Test Questions with 100% Verified Answers
NEW QUESTION # 30
When configuring a Path Policy rule for a "Real-Time Video" application, the administrator wants to ensure the traffic uses the path with the lowest packet loss.
How does the Prisma SD-WAN ION determine the "Packet Loss" metric for a given path when there is no active user traffic flowing on that link?
- A. It defaults to a static value of 0% loss until user traffic begins.
- B. It relies solely on Passive Monitoring of TCP retransmissions from other user traffic on that link.
- C. It sends Active Probes (synthetic UDP packets) across the Secure Fabric to measure path quality continuously.
- D. It queries the ISP's router via SNMP to retrieve interface error counters.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
Prisma SD-WAN utilizes Link Quality Monitoring (LQM) to maintain a real-time health score for every WAN path.
To ensure the system knows the quality of a path before sending critical user traffic onto it, the ION device uses Active Probing.
Mechanism: The ION sends synthetic probe packets (typically UDP) across the Secure Fabric (VPN tunnels) and Direct Internet paths to its peers. These probes measure Latency, Jitter, and Packet Loss.
Active vs. Passive: While the system does use Passive Monitoring (observing actual user flows) when traffic is present to reduce overhead, Active Probes are essential for idle links or backup paths. Without active probing, the ION would have no data to make an intelligent steering decision for the first packet of a new video call. This ensures that "Real-Time" policies always have up-to-date metrics to select the best path immediately.
NEW QUESTION # 31
A network design mandates segmentation at the routing level and traffic isolation across various services, such as teller cash registers, ATM traffic, guest Wi-Fi, and corporate applications. Which command can be used to validate and display the Virtual Routing and Forwarding (VRF) route leak rules?
- A. show interface vrf route_leak_rule all
- B. dump vrf route_leak_rule
- C. inspect vrf route_leak_rule all
- D. inspect flow_browser vrf all
Answer: C
Explanation:
In complex retail or banking environments, maintaining strict network segmentation is a regulatory and security requirement. Prisma SD-WAN utilizes Virtual Routing and Forwarding (VRF) to provide this isolation, ensuring that high-security traffic, such as ATM transactions or teller cash registers, remains logically separated from Guest Wi-Fi or general corporate applications. While isolation is the default state, route leaking is used to allow specific communication between these VRFs-for instance, allowing multiple isolated segments to reach a common shared service like a DNS server or a centralized security gateway.
To verify that these configurations have been correctly pushed from the Controller to the local ION device, administrators utilize the ION CLI (Command Line Interface) for deep-dive diagnostics. The command inspect vrf route_leak_rule all is the definitive tool for this purpose. Unlike "show" commands which typically provide interface status, "inspect" commands in the Prisma SD-WAN ecosystem are designed to pull real-time operational state data from the control plane's internal databases.
When executed, this command displays the specific prefix-level rules that allow routes to "leak" from one VRF table into another. It provides visibility into the source VRF, the destination VRF, and the exact network prefixes or default routes being shared. This is critical for troubleshooting "Day 2" operations; if a teller register cannot reach a shared database, the administrator can use this command to confirm if the necessary route leak rule is active and accurately reflecting the intent of the VRF Profile configured in the portal.
Without this command, verifying inter-VRF reachability would be limited to trial-and-error connectivity tests, making it an essential part of the Prisma SD-WAN engineer's toolkit.
NEW QUESTION # 32
A network operator receives a critical SITE_CONNECTIVITY_DOWN alarm for a branch site in the Prisma SD-WAN portal.
What specific condition triggers this alarm type?
- A. One of the two internet circuits at the site has gone down.
- B. All Secure Fabric Links (VPNs) to all remote peers are down, isolating the site from the overlay.
- C. The device has lost power and rebooted.
- D. The site has exceeded its licensed bandwidth capacity.
Answer: B
Explanation:
Comprehensive and Detailed Explanation
The SITE_CONNECTIVITY_DOWN alarm is a high-severity alert indicating a total loss of overlay connectivity for a site.
It does not trigger if just one circuit fails (Option B), provided that other circuits are still up and maintaining VPNs. A single link failure would typically trigger a "Link Down" or "VPN Down" alarm, but the Site connectivity would remain "Up" (degraded).
It does not simply mean the device rebooted (Option A), although a reboot would cause it temporarily; the alarm specifically tracks the state of the VPN fabric.
The SITE_CONNECTIVITY_DOWN alarm specifically generates when all Secure Fabric Links (VPN tunnels) on the device are in the "Down" state. This means the branch is completely isolated from the rest of the SD-WAN network (Data Centers and other branches), even if the device itself might still be powered on and reachable via the controller (management plane). It signifies a "Blackout" of the data plane for that location.
NEW QUESTION # 33
Two branch sites, "Branch-A" and "Branch-B", are both behind active NAT devices (Source NAT) on their local internet circuits.
What requirement must be met for these two branches to successfully establish a direct Dynamic VPN (ION-to-ION) tunnel over the internet?
- A. Dynamic VPNs are not supported if both sides are behind NAT.
- B. The ION devices automatically use STUN (Session Traversal Utilities for NAT) to discover their public IPs and negotiate the connection.
- C. One of the sites must have a Static Public IP (1:1 NAT) to act as the initiator.
- D. Both sites must disable NAT and use public IPs on the ION interface.
Answer: B
Explanation:
Comprehensive and Detailed Explanation
Prisma SD-WAN supports Dynamic VPNs (Branch-to-Branch) even when both endpoints are behind Source NAT (e.g., typical broadband connections).
To achieve this, the ION devices utilize standard NAT Traversal techniques, specifically leveraging STUN (Session Traversal Utilities for NAT).
Discovery: Each ION communicates with the Cloud Controller (which acts as a STUN server/signaling broker). Through this communication, the controller observes the public IP and Port that the ION's traffic is coming from (the post-NAT address).
Signaling: The controller shares this public reachability information with the peer ION.
Hole Punching: The IONs then attempt to initiate connections to each other's discovered public IP/Port. This "UDP Hole Punching" allows them to establish a direct IPSec tunnel through the NAT devices without requiring static 1:1 NAT mapping or manual port forwarding on the provider routers, enabling mesh connectivity in commodity internet environments.
NEW QUESTION # 34
An organization has created a custom internal application definition for "Inventory_App" on the Prisma SD-WAN controller based on its destination IP address and port (L3/L4 rule). The application server IP has just changed.
After updating the custom application definition on the controller, how is this change propagated to the branch ION devices?
- A. The administrator must reboot the ION devices for the new object to load.
- B. The change will only take effect after the daily "App-ID" scheduled update.
- C. The controller automatically pushes the updated Application Definition (App-Def) to all ION devices immediately.
- D. The administrator must manually "Push" the policy to all sites.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
In Prisma SD-WAN, Custom Applications are global policy objects managed centrally on the controller.
Immediate Propagation: When an administrator creates or modifies a Custom Application definition (e.g., updating the IP subnet or port for an internal app), the Prisma SD-WAN controller automatically pushes this update to all connected ION devices in the tenant.
No Manual Push: Unlike some legacy firewall management paradigms (like Panorama "Commit and Push"), the Prisma SD-WAN architecture is "intent-based" and continuously synchronized. A change to a global object like an App Definition is considered a live configuration change and is distributed immediately via the secure control channel.
No Reboot: The ION data plane updates its classification engine dynamically without interrupting traffic or requiring a reboot. This ensures that policy enforcement (steering "Inventory_App" to the correct path) remains accurate in real-time.
NEW QUESTION # 35
What is the default action for real-time media applications if link performance is poor?
- A. Apply Forward Error Correction (FEC).1
- B. Move flows.
- C. Raise an alarm.
- D. Drop the flow.
Answer: B
Explanation:
Comprehensive and Detailed Explanation
According to the Prisma SD-WAN Performance Policy Default Behavior documentation, the default action configured for applications (including real-time media) when a path experiences poor performance (violates the SLA thresholds for latency, jitter, or packet loss) is to Move Flows.
The Prisma SD-WAN ION device continuously monitors the health of all available paths. If the active path for a media application degrades and fails to meet the specified SLA, the default policy dictates that the traffic should be steered (moved) to an alternate, compliant path that meets the performance criteria.
While Forward Error Correction (FEC) is a powerful feature available in Prisma SD-WAN to mitigate packet loss for real-time applications, it is an optional action that must be explicitly enabled or configured within the performance policy rules. It is not the default action in the base system configuration; the primary default mechanism for handling performance issues is to leverage the multi-path fabric to switch to a better link.
NEW QUESTION # 36
What is the basis for calculating the minimum bandwidth subscription required for branch IONs?
- A. Amount of traffic which will traverse the SD-WAN secure fabric
- B. Maximum throughput supported by the ION hardware deployed at data center locations
- C. ISP circuit capacity at the branch location
- D. Maximum traffic (ingress and egress) passing through the ION device
Answer: D
Explanation:
Palo Alto Networks utilizes an aggregate throughput model for Prisma SD-WAN licensing.1 The minimum bandwidth subscription required for a branch ION is determined by the maximum traffic (the sum of both ingress and egress) that passes through the ION device. This is often referred to as "Aggregate Throughput." It is a critical distinction in the Prisma SD-WAN architecture because the license must account for all traffic processed by the device, whether that traffic stays local (Direct Internet Access), goes to the Data Center via the VPN fabric, or moves between local LAN segments.
When sizing a subscription, engineers must evaluate the total capacity of the WAN circuits connected to the branch. For example, if a branch has two 100 Mbps internet circuits, the device is capable of processing 200 Mbps of egress traffic and 200 Mbps of ingress traffic simultaneously. However, the licensing is based on the aggregate peak throughput the customer expects to utilize across the device's interfaces.
Choosing an under-sized subscription based only on "fabric traffic" (Option B) or "ISP capacity" (Option D) without considering the total bi-directional flow can lead to artificial performance bottlenecks. If the traffic exceeds the licensed bandwidth, the ION device will police the traffic to the licensed limit, regardless of the physical port speed or the hardware's theoretical maximum. Therefore, the subscription must be aligned with the total actual traffic volume the device is expected to handle to ensure an optimal user experience and full utilization of available circuit bandwidth.
NEW QUESTION # 37
A network administrator notices that a branch ION device is experiencing high CPU utilization due to a suspected TCP SYN Flood attack originating from a compromised host on the local LAN.
Which specific security feature should be configured and applied to the "LAN" zone to mitigate this Denial of Service (DoS) attack?
- A. Zone Protection Profile
- B. Application Quality Profile (AQP)
- C. Zone-Based Firewall (ZBFW) Rule with a "Deny" action
- D. Access Control List (ACL) on the WAN interface
Answer: A
Explanation:
Comprehensive and Detailed Explanation
To defend against volumetric attacks such as TCP SYN Floods, UDP Floods, or ICMP Floods, Prisma SD-WAN (like PAN-OS) utilizes Zone Protection Profiles.
Function: A Zone Protection Profile is a specific security object designed to screen traffic for protocol anomalies and flood behaviors before it is processed by the complex firewall policy engine. It sets thresholds (e.g., "Max 1000 SYNs/sec"). If the traffic rate exceeds this threshold, the system triggers an action (Alarm, Drop, or SYN Cookies) to protect the device's resources.
Application: Unlike a standard ZBFW Rule (A) which filters based on Source/Destination/App-ID (which might still allow the initial handshake packets that cause the flood), a Zone Protection Profile is applied to the Zone object itself (in this case, the LAN Zone). This ensures that the flood is mitigated at the ingress stage, preventing the ION's session table and CPU from being exhausted by the attack.
NEW QUESTION # 38
1000 branches are to be deployed on Prisma SD-WAN with the following constraints:
* Devices will be shipped in batches directly to the site
* Configuration Management Database (CMDB) has all the necessary details for a site deployment
* Field tech will be responsible for rack, stack, and cabling of the IONs at each site
* Field tech will need to spend minimum amount of time at each branch site to reduce the cost
* The NOC operates in shifts and is responsible for remote cutover support Which method will achieve the mass deployment in shortest possible time?
- A. Connect the device to the ISP modem or use cellular, use device shell to pre-create the configuration for a site, assign the device to the template when device is online, and connect the LAN switch to the ION.
- B. Connect the device to the ISP modem or use cellular, use Prisma SD-WAN Software Development Kit (SDK) using API method for site deployment once the device is online, connect the LAN switch to the ION.
- C. Use site templates and device shells to pre-create the configuration using CSV bulk upload, connect the device to the ISP modem or using cellular, assign the device to the template when device is online, and connect the LAN switch to the ION.
- D. Connect the ION to the LAN switch to bring it online, configure the device using the legacy network, connect the ISP modem or cellular, and cutover the site once the ION is configured.
Answer: C
Explanation:
For a massive rollout involving 1,000 branch sites, Prisma SD-WAN (formerly CloudGenix) provides a specialized workflow known as Bulk Site Configuration. This method is designed to minimize manual intervention and maximize deployment velocity by leveraging Site Templates and Device Shells.
In this scenario, the primary architectural advantage of Option C is the use of Pre-Staging. By exporting an empty SD-WAN device CSV from the Prisma SD-WAN Controller and populating it with data from the corporate CMDB, administrators can perform a bulk upload to create hundreds or thousands of sites and device shells simultaneously in the management portal. A "Device Shell" acts as a placeholder for a physical ION device that has not yet connected to the cloud. It contains all the site-specific configuration-such as interface roles, circuit labels, and IP addressing-waiting for a serial number to be associated with it.
When the field technician performs the physical "rack and stack," they simply connect the ION device to the internet (via ISP modem or cellular). Through Zero Touch Provisioning (ZTP), the device automatically
"phones home" to the Prisma SD-WAN Cloud Controller using its Manufacturer Installed Certificate (MIC).
Because the configuration was pre-created via the CSV bulk upload, the controller recognizes the device (once assigned to its shell) and immediately pushes the complete configuration. This eliminates the need for the field tech to access a console port or perform local configuration, reducing their on-site time to the bare minimum. While APIs (Option D) can be used for automation, the built-in CSV template workflow is the standard, documented "best practice" for rapidly translating CMDB data into a functioning SD-WAN fabric at this scale.
NEW QUESTION # 39
A branch manager reports slow network performance, and the network administrator wants to use Prisma SD- WAN Copilot to quickly identify if a specific user, by source IP address, is consuming excessive bandwidth as well as which applications are contributing to this consumption. How can Copilot assist in this investigation?
- A. It will redirect the administrator to the WAN Clarity "Top N: Source IPs" report and the "Flow Browser" utility, suggesting correlation between these tools to determine a user's specific application usage.
- B. It can directly process a natural language query such as "Show top bandwidth source IPs at SD-WAN Branch X over last 3 hours," provide summarized views of the top-consuming source IPs, and view the primary applications they are using.
- C. It can identify the top applications being used across the entire branch and can be correlated with Flow Browser to attribute specific application usage or total bandwidth consumption to individual source IPs.
- D. It will automatically generate and email a "User Bandwidth Consumption" report for the specified branch, which the administrator can use to find the top user and the application details.
Answer: B
Explanation:
Prisma SD-WAN Copilot is an AI-powered operational tool designed to simplify network management through Natural Language Processing (NLP). Traditionally, identifying a bandwidth "hog" required manual navigation through multiple dashboards, such as WAN Clarity and the Flow Browser, to correlate source IP addresses with specific application flows and timestamps. Copilot transforms this workflow by allowing administrators to interact with the system using conversational queries.
When an administrator inputs a query like "Show top bandwidth source IPs at SD-WAN Branch X over last 3 hours," Copilot leverages its underlying machine learning models and integrated data lake to aggregate telemetry across the entire fabric. It instantly identifies the specific source IPs responsible for the highest throughput and correlates that data with application visibility. Instead of providing a static report or redirecting the user to other tools, Copilot presents an interactive, summarized view directly within the interface. This view highlights the top-consuming users and breaks down their consumption by application, such as YouTube, Netflix, or business-critical SaaS tools.
This capability significantly reduces the Mean Time to Resolution (MTTR) for performance issues. By bypassing the need for manual data correlation, Copilot provides immediate "Day 2" operational insights. It effectively acts as a virtual assistant that understands the context of the network topology, site names, and time ranges, allowing the administrator to quickly determine if a branch's slow performance is due to an individual user's behavior or a broader infrastructure issue.
NEW QUESTION # 40
An administrator has configured a Path Policy for "ERP_Traffic". The policy allows two public internet links,
"ISP-A" and "ISP-B", both marked as "Active". The Path Quality Profile (SLA) requires a latency of less than
150ms. Currently, both ISP-A and ISP-B have a latency of 40ms, well within the SLA.
How does the Prisma SD-WAN ION determine which link to use for a new flow of "ERP_Traffic" when both active paths meet the SLA requirements?
- A. It duplicates the packets across both paths (Packet Duplication) to ensure delivery.
- B. It selects the path with the lowest numerical latency (e.g., if ISP-A drops to 39ms).
- C. It selects the path that appears first in the interface configuration list.
- D. It selects the path with the highest available bandwidth capacity.
Answer: D
Explanation:
Comprehensive and Detailed Explanation
Prisma SD-WAN utilizes a sophisticated decision engine for Application-Based Path Selection that goes beyond simple failover. When configuring a Path Policy, the administrator defines "Active" paths and a "Path Quality Profile" (SLA).
* SLA Compliance (The Filter): First, the system filters the available paths based on the Path Quality Profile. In this scenario, both ISP-A and ISP-B have 40ms latency against a 150ms threshold. Both are
"green" or compliant paths.
* Selection Criteria (The Tie-Breaker): When multiple paths are configured as "Active" and all meet the performance SLA, the ION device aims to optimize the overall user experience and network utilization. The default behavior for load balancing across healthy, compliant active paths is to select the path with the highest available bandwidth capacity.
By steering new flows to the link with the most "headroom" (available Mbps), the system prevents the saturation of a smaller link (e.g., a 20Mbps DSL line) while a larger link (e.g., 1Gbps Fiber) sits underutilized.
This maximizes the aggregate throughput for the site. While latency is the qualifier, bandwidth availability is often the selector for compliant paths. Note that if the application was defined as "Real-Time" and configured for packet duplication, behavior would differ, but for standard traffic, capacity-based distribution is the standard active/active logic.
NEW QUESTION # 41
In the Prisma SD-WAN portal, the Application Health dashboard assigns a color-coded "Health Score" (Green, Yellow, Red) to applications.
Which three metrics are combined to calculate this composite AppX (Application Experience) score? (Choose three.)
- A. Bandwidth Utilization
- B. Network Transfer Time (NTT)
- C. Jitter
- D. Server Response Time (SRT)
- E. Transaction Failure Rate
Answer: B,D,E
Explanation:
Comprehensive and Detailed Explanation
The AppX (Application Experience) score is a proprietary metric used by Prisma SD-WAN to provide a holistic view of user experience, rather than just network statistics. It is calculated based on three key components:
Transaction Failure Rate (A): The percentage of application transactions that failed (e.g., TCP resets, HTTP 500 errors). This indicates availability.
Network Transfer Time (B): The time taken for packets to traverse the network (WAN/LAN latency). This indicates network health.
Server Response Time (C): The time taken by the application server to respond to a request. This indicates backend performance.
Why not D or E?
Bandwidth Utilization (D) is a capacity metric, not a direct measure of quality. A link can be 90% full but still deliver packets quickly (good AppX), or 10% full but dropping packets (bad AppX).
Jitter (E) is a network-layer metric primarily relevant for UDP Real-Time media. While important, the high-level "AppX" score for general TCP apps focuses on the "Time-to-Glass" metrics (NTT/SRT) and success rates.
NEW QUESTION # 42
An administrator is configuring an ION 2000 device for a deployment where high availability is required, but the site has only a single internet circuit. The administrator configures a Bypass Pair (Fail-to-Wire) on ports 1 and 2 connecting the ISP modem to the legacy firewall.
If the ION device loses power, what is the resulting behavior of the traffic flowing through this Bypass Pair?
- A. Traffic is blocked to prevent uninspected packets from entering the network (Fail-to-Block).
- B. Traffic is rerouted to the LTE modem automatically.
- C. The internal relay closes, physically bridging Port 1 and Port 2, allowing traffic to flow transparently between the modem and firewall.
- D. The device reboots into "Safe Mode" and acts as a Layer 2 switch.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
The Bypass Pair feature on Prisma SD-WAN ION devices (specifically supported models like ION 2000, 3000, 7000, 9000) is a hardware-based resiliency mechanism known as Fail-to-Wire.
Operation: A "Bypass Pair" logically groups two physical interfaces (e.g., WAN 1 and LAN 1). Under normal operation, the ION processes traffic between them.
Power Loss: In the event of a total power loss (or critical software failure), a mechanical relay inside the device physically closes the circuit between the two ports.
Result: This creates a direct electrical connection (like a patch cable) between the upstream device (ISP Modem) and the downstream device (Legacy Firewall or Router). This ensures that internet connectivity is preserved for the site, even if the SD-WAN appliance is completely dead. This is critical for single-point-of-failure deployments where maintaining basic dial-tone is more important than SD-WAN optimization during a hardware outage.
NEW QUESTION # 43
An administrator has configured a Zone-Based Firewall (ZBFW) policy on a branch ION. They created a rule to "Allow" traffic from the "Guest" zone to the "Internet" zone. However, users in the "Guest" zone are reporting they cannot reach a specific public website, and the Flow Browser shows the flow state as "REJECT".
What is the most likely reason for this specific rejection, assuming the "Allow" rule is correctly placed at the top of the list?
- A. There is a "Deny" rule in the "Global" policy stack that is taking precedence over the "Local" site rule.
- B. The implicit default action at the bottom of the security policy is "Deny All".
- C. The "Allow" rule does not have the specific "Application" defined (it is set to Any), causing a mismatch.
- D. The ION device does not support firewalling for HTTP traffic.
Answer: A
Explanation:
Comprehensive and Detailed Explanation
In Prisma SD-WAN, security policies can be applied via Policy Stacks, which often have a hierarchy.
Stack Precedence: A common configuration involves a Global Security Stack (applied to all sites) and a Local/Site Security Stack (specific to one site). If the administrator configured a "Global" rule that says "Deny Access to Gambling Sites" (or a specific IP list), and that rule is higher in the binding order or part of a higher-priority stack, it will enforce the block before the local "Allow Guest to Internet" rule is processed.
Specifics of "REJECT": The state REJECT specifically implies a policy enforcement action (sending a TCP RST or ICMP Unreachable) rather than a silent drop or a routing failure.
Why not A? If the "Allow" rule is at the top and matches the traffic parameters (Zone/IP), the Default Deny at the bottom would never be reached. The issue implies a higher priority Deny exists.
NEW QUESTION # 44
An ION 3000 device at a remote branch has suffered a critical hardware failure and must be replaced via the RMA process. The administrator has received the replacement unit.
What is the correct procedure to transfer the configuration and license from the defective unit to the replacement unit to ensure minimal downtime and retention of historical data?
- A. Manually configure the new device from scratch, then open a support ticket to transfer the license.
- B. Delete the old device from the portal, create a new site for the replacement device, and rebuild the policies manually.
- C. Use the "Replace Device" workflow in the Prisma SD-WAN portal, which automatically transfers the configuration (Device Shell) and re-associates the site to the new serial number.
- D. Backup the configuration of the old device to a USB drive and restore it to the new device using the local console.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
The RMA replacement process in Prisma SD-WAN is designed to be seamless, leveraging the decoupling of logical configuration from physical hardware.
* Replace Device Workflow: The administrator should use the "Replace Device" (or RMA) function within the portal. This workflow allows you to select the "Defective" device (old serial) and the
"Replacement" device (new serial).
* Configuration Transfer: Once executed, the system automatically binds the existing Device Shell (which contains all interface configs, routing policies, and site associations) to the new hardware's serial number. The new device, once connected to the internet, will "call home," identify itself, and download the exact configuration of the previous unit.
* License Transfer: While the configuration moves automatically, the Support License transfer typically requires a specific step in the Customer Support Portal (CSP) or happens automatically if processed as a formal RMA order. Options A and D are incorrect because they involve manual reconfiguration, which is unnecessary and error-prone. Option C is incorrect as the ION platform relies on cloud-based config management, not local USB backups for hardware swaps.
NEW QUESTION # 45
A network engineer is troubleshooting a user complaint regarding "slow application performance" for an internal web application. While viewing the Flow Browser in the Prisma SD-WAN portal, the engineer notices that the Server Response Time (SRT) is consistently high (over 500ms), while the Network Transfer Time (NTT) and Round Trip Time (RTT) are low (under 50ms).
What does this data indicate about the root cause of the issue?
- A. The issue is likely on the application server itself (e.g., high CPU, slow database query), not the network.
- B. The issue is likely caused by congestion on the WAN circuit, requiring a QoS policy adjustment.
- C. The issue is due to a misconfigured DNS server at the branch.
- D. The issue is caused by a high packet loss rate on the internet path.
Answer: A
Explanation:
Comprehensive and Detailed Explanation
The Flow Browser and App Response Time metrics in Prisma SD-WAN are critical tools for isolating the fault domain-determining whether a problem lies in the "Network" or the "Application."
* Network Transfer Time (NTT) / Round Trip Time (RTT): These metrics measure the time it takes for packets to traverse the network (WAN/LAN) and for acknowledgments to return. A low NTT (e.g.,
<50ms) confirms that the network pipes (SD-WAN overlay, Underlay circuits) are healthy and transporting packets quickly.
* Server Response Time (SRT): This metric specifically measures the time between the server receiving a request and the server sending the first byte of the response. It essentially measures the "processing time" of the backend server.
In the scenario described, the network metrics (NTT/RTT) are excellent, effectively ruling out WAN congestion, packet loss, or latency (Option A and C). However, the Server Response Time (SRT) is very high (500ms). This signature is a definitive indicator that the network delivered the request instantly, but the application server took a long time to process it. This points the troubleshooting effort toward the server infrastructure (e.g., a slow SQL query, an overloaded web server, or lack of compute resources) rather than the SD-WAN environment.
NEW QUESTION # 46
An administrator has configured a Path Policy for "ERP_Traffic". The policy allows two public internet links, "ISP-A" and "ISP-B", both marked as "Active". The Path Quality Profile (SLA) requires a latency of less than 150ms. Currently, both ISP-A and ISP-B have a latency of 40ms, well within the SLA.
How does the Prisma SD-WAN ION determine which link to use for a new flow of "ERP_Traffic" when both active paths meet the SLA requirements?
- A. It duplicates the packets across both paths (Packet Duplication) to ensure delivery.
- B. It selects the path with the lowest numerical latency (e.g., if ISP-A drops to 39ms).
- C. It selects the path that appears first in the interface configuration list.
- D. It selects the path with the highest available bandwidth capacity.
Answer: D
Explanation:
Comprehensive and Detailed Explanation
Prisma SD-WAN utilizes a sophisticated decision engine for Application-Based Path Selection that goes beyond simple failover. When configuring a Path Policy, the administrator defines "Active" paths and a "Path Quality Profile" (SLA).
SLA Compliance (The Filter): First, the system filters the available paths based on the Path Quality Profile. In this scenario, both ISP-A and ISP-B have 40ms latency against a 150ms threshold. Both are "green" or compliant paths.
Selection Criteria (The Tie-Breaker): When multiple paths are configured as "Active" and all meet the performance SLA, the ION device aims to optimize the overall user experience and network utilization. The default behavior for load balancing across healthy, compliant active paths is to select the path with the highest available bandwidth capacity.
By steering new flows to the link with the most "headroom" (available Mbps), the system prevents the saturation of a smaller link (e.g., a 20Mbps DSL line) while a larger link (e.g., 1Gbps Fiber) sits underutilized. This maximizes the aggregate throughput for the site. While latency is the qualifier, bandwidth availability is often the selector for compliant paths. Note that if the application was defined as "Real-Time" and configured for packet duplication, behavior would differ, but for standard traffic, capacity-based distribution is the standard active/active logic.
NEW QUESTION # 47
When integrating Prisma SD-WAN with Prisma Access, what is the specific role of the Service Connection (SC)?
- A. It is the IPSec tunnel that connects a Branch site to the Prisma Access gateway for internet access.
- B. It is the peering link between different Prisma Access regions to optimize global traffic.
- C. It is the SSL VPN portal used by mobile users to connect to the network.
- D. It connects the Prisma Access cloud infrastructure back to the customer's Headquarters or Data Center for access to internal private resources (e.g., AD, DNS, Intranet).
Answer: D
Explanation:
Comprehensive and Detailed Explanation
In the Prisma Access architecture (integrated with SD-WAN), distinct connection types serve different purposes.
Remote Networks: These are the connections from your Branch sites (using ION devices) into the cloud. They allow branches to get to the internet or other branches.
Service Connections (SC): This is a specialized high-bandwidth connection used to bridge the Prisma Access Cloud to your Private Data Center or Headquarters.
The primary use case for a Service Connection (Option A) is to allow mobile users and branch users (who are connected to the Prisma cloud) to reach private, centralized resources that still reside on-premise, such as Active Directory controllers, legacy databases, or mainframes. Without a Service Connection, users in the cloud would be able to reach the internet and each other, but not the servers physically located in your HQ data center. The CloudBlade automates the creation of these tunnels, but architecturally, the "Service Connection" is the "cloud-to-HQ" bridge.
NEW QUESTION # 48
When troubleshooting an issue at a site that is running on two cellular links from two carriers, the operations team shared some evidence shown in the graph below:
For the time duration shown in the graph, what are two inferences about the site's traffic that can be made?
(Choose two.)
- A. Using Carrier-2 as the WAN path may have switched over to Carrier-1.
- B. Using Carrier-1 as the WAN path may have experienced some performance degradation.
- C. Using Carrier-1 as the WAN path may have switched over to Carrier-2.
- D. Using Carrier-2 as the WAN path may have experienced some performance degradation.
Answer: B,C
Explanation:
The provided graph displays the Signal-to-Noise Ratio (SNR) for two cellular carriers, Carrier-1 (blue line) and Carrier-2 (green line), over a specific period. In cellular communications, SNR is a critical metric used to determine the quality of a wireless signal. A higher SNR indicates a cleaner, stronger signal, while a lower SNR indicates that the signal is being "drowned out" by background noise or interference, which directly correlates to performance degradation, packet loss, and lower throughput.
Looking at the graph, Carrier-1 experiences a significant and sustained drop in SNR, falling from roughly
4.5 dB to nearly 0.5 dB for the majority of the time duration. This drastic reduction in signal quality strongly suggests that Carrier-1 may have experienced performance degradation (Option A). During this dip, the link quality would likely fall below the configured thresholds for business-critical application traffic.
Because Prisma SD-WAN is an application-defined fabric that continuously monitors path health, the ION device would detect this degradation on Carrier-1. If Carrier-2 maintains a significantly higher and more stable SNR (as shown by the green line remaining between 4.5 dB and 6.5 dB), the ION device's Path Selection engine would automatically steer traffic away from the degraded link. Consequently, it is highly probable that Carrier-1 traffic switched over to Carrier-2 (Option D) to maintain the application SLA. This automated failover is a core strength of the Prisma SD-WAN architecture, ensuring that the best available path is utilized based on real-time link statistics rather than simple "up/down" states.
NEW QUESTION # 49
A network engineer is troubleshooting a "Voice Quality" issue. They suspect that the DSCP markings are being stripped or altered by the ISP.
Which tool in the Prisma SD-WAN portal allows the engineer to capture live packets on the WAN interface and inspect the IP header ToS/DSCP field?
- A. Path Quality Monitor
- B. Flow Browser
- C. Event Logs
- D. Packet Capture (PCAP)
Answer: D
Explanation:
Comprehensive and Detailed Explanation
To validate specific packet-level details like DSCP (Differentiated Services Code Point) values, header checksums, or exact payload sizes, a Packet Capture (PCAP) is required.
* PCAP Tool: Prisma SD-WAN provides a built-in PCAP utility accessible directly from the portal. The engineer can select the specific Interface (e.g., Internet 1), apply a Filter (e.g., port 5060 or host
1.2.3.4), and capture the traffic.
* Analysis: The resulting .pcap file can be downloaded and opened in Wireshark. This allows the engineer to definitively see if the packets leaving the ION have DSCP EF (46) and if the packets arriving (if capturing on the other side) still retain that marking, or if the ISP has bleached it to CS0 (0).
* Flow Browser (A): While it shows "Application" and metrics, the Flow Browser typically displays the assigned priority class, not necessarily the raw bit-level DSCP value present in the packet header on the wire.
NEW QUESTION # 50
A network installer is at a remote branch site to deploy a new ION 3000 device. The device has been racked, cabled to the internet, and powered on. The installer has the "Claim Code" displayed on the email sent by the administrator.
When the administrator enters this Claim Code into the Prisma SD-WAN portal, what is the immediate status of the device before the configuration is fully pushed?
- A. Online
- B. Claimed
- C. Provisioned
- D. Active
Answer: B
Explanation:
Comprehensive and Detailed Explanation
In the Prisma SD-WAN (CloudGenix) Zero Touch Provisioning (ZTP) lifecycle, the device status transitions through specific stages that indicate its readiness and connectivity.
When an administrator enters the Claim Code (or Serial Number/Claim Code pair) into the portal, the device status immediately updates to "Claimed".
This status confirms that the portal has registered the device's unique identity and associated it with the customer's tenant. However, "Claimed" does not necessarily mean the device is fully operational or passing traffic yet. It simply signifies that the ownership is verified.
Once the physical device at the site successfully connects to the internet and reaches the Prisma SD-WAN Controller (using the call-home function), it will authenticate using its installed certificate. Upon successful authentication and the establishment of the secure control channel, the status will transition from "Claimed" to
"Online".
Only after the device is "Online" can the controller push the specific site configuration (Device Shell), policies, and IP addressing required for the device to become "Provisioned" and eventually "Active" in the data path. If the device remains in the "Claimed" state for an extended period, it indicates that the hardware has not yet successfully contacted the controller, which prompts troubleshooting of the physical internet circuit or firewall rules upstream.
NEW QUESTION # 51
An ION 3000 device at a remote branch has suffered a critical hardware failure and must be replaced via the RMA process. The administrator has received the replacement unit.
What is the correct procedure to transfer the configuration and license from the defective unit to the replacement unit to ensure minimal downtime and retention of historical data?
- A. Manually configure the new device from scratch, then open a support ticket to transfer the license.
- B. Delete the old device from the portal, create a new site for the replacement device, and rebuild the policies manually.
- C. Use the "Replace Device" workflow in the Prisma SD-WAN portal, which automatically transfers the configuration (Device Shell) and re-associates the site to the new serial number.
- D. Backup the configuration of the old device to a USB drive and restore it to the new device using the local console.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
The RMA replacement process in Prisma SD-WAN is designed to be seamless, leveraging the decoupling of logical configuration from physical hardware.
Replace Device Workflow: The administrator should use the "Replace Device" (or RMA) function within the portal. This workflow allows you to select the "Defective" device (old serial) and the "Replacement" device (new serial).
Configuration Transfer: Once executed, the system automatically binds the existing Device Shell (which contains all interface configs, routing policies, and site associations) to the new hardware's serial number. The new device, once connected to the internet, will "call home," identify itself, and download the exact configuration of the previous unit.
License Transfer: While the configuration moves automatically, the Support License transfer typically requires a specific step in the Customer Support Portal (CSP) or happens automatically if processed as a formal RMA order. Options A and D are incorrect because they involve manual reconfiguration, which is unnecessary and error-prone. Option C is incorrect as the ION platform relies on cloud-based config management, not local USB backups for hardware swaps.
NEW QUESTION # 52
When defining a Path Quality Profile (SLA) for a "Transactional" application group (e.g., Citrix, Oracle), the administrator sets the "Packet Loss" threshold to 1%.
What happens to the traffic for this application if all active paths currently exceed this 1% loss threshold?
- A. The traffic is queued indefinitely until a path recovers.
- B. The traffic is dropped to prevent data corruption.
- C. The system automatically enables a Backup path, even if the Active paths are technically "Up" but degraded.
- D. The system selects the best available path (lowest loss) among the active paths, even if it violates the profile.
Answer: D
Explanation:
Comprehensive and Detailed Explanation
This behavior describes the "Best Available Path" logic inherent in Prisma SD-WAN's availability design.
* SLA Thresholds: Path Quality Profiles act as filters to identify compliant paths.
* Total Violation: If all configured "Active" paths violate the SLA (e.g., Path A has 2% loss, Path B has
5% loss, and the threshold is 1%), the system does not drop the traffic (Option A) because maintaining connectivity is prioritized over perfect quality.
* Selection Logic: The system enters a fallback state where it compares the available active paths and selects the "Least Bad" one-the path that is closest to meeting the SLA (in this case, Path A with 2% loss).
* Backup Paths: Traffic would only move to a Backup path (Option D) if the policy explicitly configures the backup path to engage upon SLA violation of the active set. However, strictly speaking, if only active paths are considered and all fail, it picks the best of the active group rather than blackholing the traffic.
NEW QUESTION # 53
A site has two internet circuits: Circuit A with 500 Mbps capacity and Circuit B with 100 Mbps capacity.
Which path policy configuration will ensure traffic is automatically shifted from a saturated circuit to the circuit with available bandwidth?
- A. Both circuits under active path
- B. Circuit A as an active, Circuit B as a backup
- C. Circuit B as an active, Circuit A as a backup
- D. Circuit B as an L3 failure path
Answer: A
Explanation:
Comprehensive and Detailed Explanation
In Prisma SD-WAN (CloudGenix), Path Policies control how application traffic is steered across WAN links.
To ensure that traffic is automatically shifted from a saturated circuit to another circuit with available bandwidth, both circuits must be configured as Active Paths within the policy rule.
When multiple paths are designated as "Active," the ION device treats them as a shared pool of available resources. The system continuously monitors the bandwidth utilization (capacity) and health (latency, jitter, loss) of all active links. If "Circuit A" (500 Mbps) becomes saturated or approaches its defined bandwidth limit, the ION's intelligent scheduler will automatically direct new application flows to "Circuit B" (100 Mbps) because it is a valid, healthy Active path with available capacity. This achieves effective load balancing and bandwidth aggregation.
In contrast, configuring "Circuit B" as a Backup Path (Option A or B) creates a strict priority relationship.
Traffic would only move to the Backup path if the Active path completely failed or violated its configured SLA (Path Quality Profile) significantly enough to be considered "down." Mere bandwidth saturation might not trigger an SLA failure immediately, potentially leading to dropped packets on the saturated link while the backup link remains idle. Therefore, placing Both circuits under active path is the correct configuration for dynamic capacity management.
NEW QUESTION # 54
In the Prisma SD-WAN portal, an administrator is viewing the "Media" analytics for a branch site to troubleshoot complaints about poor voice quality.
When calculating the Mean Opinion Score (MOS) for voice traffic, which two metrics does the system prioritize active monitoring for, even when no user voice traffic is present on the link? (Choose two.)
- A. Packet Loss
- B. Latency (One-Way)
- C. Jitter
- D. Throughput
Answer: A,C
Explanation:
Comprehensive and Detailed Explanation
Prisma SD-WAN calculates the Mean Opinion Score (MOS) to provide a standardized metric (1-5) for voice quality. To ensure the system always knows the "voice readiness" of a path-even before a call starts-it uses Active Probes (synthetic UDP packets).
While latency is measured, the MOS calculation algorithm is most heavily penalized by Packet Loss (D) and Jitter (B).
Packet Loss: Even a small amount of loss (e.g., >1%) dramatically reduces voice clarity, causing dropouts.
Jitter: High variance in packet arrival time (jitter) causes the "robotic" voice effect and buffer underruns.
The system continuously measures these specific metrics on all WAN links using synthetic probes. If the packet loss or jitter exceeds the threshold defined in the "Path Quality Profile" (e.g., Voice Profile), the path is marked as non-compliant, and the MOS score drops, triggering a policy action to move the flow. Throughput (C) is less critical for voice as calls consume very little bandwidth (e.g., 64-100 Kbps), making congestion (loss/jitter) the primary enemy, not raw speed.
NEW QUESTION # 55
......
Positive Aspects of Valid Dumps SD-WAN-Engineer Exam Dumps! : https://pass4sure.dumpstorrent.com/SD-WAN-Engineer-exam-prep.html