Paloalto Networks SD-WAN-Engineer 시험

Question No : 1

When planning a software upgrade for a large fleet of ION devices, what is the recommended best practice regarding the "Software Version" assigned in the Site Summary?

• A.Manually log into each device and upload the new image file via US
• B.Assign the new software version to the "Global" site configuration to upgrade all 1000+ sites simultaneously.
• C.Use Site Tags to group sites (e.g., "Pilot", "Region-1", "Region-2") and assign the new software version incrementally to these tags to minimize risk.
• D.The ION devices upgrade themselves automatically whenever a new version is released by Palo Alto Networks.

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
The best practice for managing upgrades in a large-scale Prisma SD-WAN environment is the Canary or Phased Rollout approach, utilizing Site Tags.
Risk Mitigation: Upgrading all sites simultaneously (Option B) is highly risky. If the new software version has an unforeseen bug or compatibility issue with a specific circuit type, the entire network could face an outage.
Tag-Based Management: Administrators should create tags such as "Upgrade-Phase-1" (Pilot sites) or "Region-North". By assigning the specific Software Version to the Tag (rather than the individual site or the global default), the controller pushes the update only to that subset of devices.
Procedure:
Apply update to "Pilot" tag (5 sites). Monitor for 24-48 hours.
Apply update to "Region-1" tag (50 sites). Monitor.
Eventually, update the Global default once confidence is high.
Option A is unscalable, and Option D is incorrect as the administrator retains full control over when upgrades occur; they are not forced automatically without policy configuration.

Question No : 2

An administrator wants to configure a Path Policy that routes all "Guest Wi-Fi" traffic directly to the internet using the local broadband interface, bypassing all VPN tunnels.
Which Service & DC Group setting should be selected in the policy rule to achieve this "Direct Internet Access" (DIA) behavior?

• A.Standard VPN
• B.Direct
• C.Any-Private
• D.Default-Cluster

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
In Prisma SD-WAN Path Policies, the Service & DC Group (Destination) field determines where the traffic is sent.
Direct: This is the specific keyword/object used to instruct the ION to route traffic directly out to the local WAN interface (Local Breakout) towards the Internet, without encapsulation in a VPN tunnel. This is the correct setting for Guest Wi-Fi, SaaS applications (like Office 365), or any public web browsing that does not need to be backhauled.
Standard VPN / Default-Cluster: These options direct traffic into an IPSec overlay tunnel destined for a Data Center or another ION. Selecting these would "backhaul" the guest traffic, which contradicts the requirement for DIA.
When "Direct" is selected, the ION uses its available "Internet" category links. The policy can further specify which internet link to use (e.g., "Use Broadband, avoid LTE") via the path preference list, but the Destination type must be "Direct".

Question No : 3

When integrating Prisma SD-WAN with Prisma Access, what is the specific role of the Service Connection (SC)?

• A.It connects the Prisma Access cloud infrastructure back to the customer's Headquarters or Data Center for access to internal private resources (e.g., AD, DNS, Intranet).
• B.It is the IPSec tunnel that connects a Branch site to the Prisma Access gateway for internet access.
• C.It is the SSL VPN portal used by mobile users to connect to the network.
• D.It is the peering link between different Prisma Access regions to optimize global traffic.

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
In the Prisma Access architecture (integrated with SD-WAN), distinct connection types serve different purposes.
Remote Networks: These are the connections from your Branch sites (using ION devices) into the cloud. They allow branches to get to the internet or other branches.
Service Connections (SC): This is a specialized high-bandwidth connection used to bridge the Prisma Access Cloud to your Private Data Center or Headquarters.
The primary use case for a Service Connection (Option A) is to allow mobile users and branch users (who are connected to the Prisma cloud) to reach private, centralized resources that still reside on-premise, such as Active Directory controllers, legacy databases, or mainframes. Without a Service Connection, users in the cloud would be able to reach the internet and each other, but not the servers physically located in your HQ data center. The CloudBlade automates the creation of these tunnels, but architecturally, the "Service Connection" is the "cloud-to-HQ" bridge.

Question No : 4

A network administrator is viewing the Flow Browser to investigate a report that a specific user cannot access an internal web server. The flow entry for this traffic shows the "Flow State" as "INIT" and it remains in that state until it times out.
What does the "INIT" state indicate about the traffic flow?

• A.The TCP 3-way handshake was completed successfully, and data is being transferred.
• B.The ION device received the SYN packet from the client but never saw a SYN-ACK response from the server.
• C.The flow was denied by a Zone-Based Firewall policy on the IO
• D.The traffic is being buffered while the ION waits for a dynamic VPN tunnel to establish.

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
In the Prisma SD-WAN Flow Browser, the Flow State provides a real-time snapshot of the TCP/UDP session lifecycle.
INIT (Initialization): This state indicates that the ION device has seen the initial packet of a new session (typically a TCP SYN) originating from the client (Source), but it has not yet seen a return packet (such as a TCP SYN-ACK) from the destination server.
Diagnosis: A flow stuck in INIT is a classic indicator of a "Blackhole" or reachability issue downstream. It implies that the ION successfully routed the packet out toward the destination, but the destination did not reply. Common causes include:
The server is offline.
A firewall in the path (or on the server itself) is dropping the traffic.
Routing is broken on the return path (asymmetric routing where the return traffic bypasses the ION).
If the flow had been denied by the ION's own firewall (Option C), the state would typically show as DENY or REJECT. If the handshake completed (Option A), the state would be ESTABLISHED. Therefore, INIT points to a lack of response from the remote end.

Question No : 5

An administrator is configuring a High Availability (HA) pair of ION 3000 devices at a Data Center.
Which statement accurately describes the requirement for the HA Control Interface connection between the two devices?

• A.The HA Control interface must be connected via a Layer 3 routed network to ensure reachability across different subnets.
• B.The HA Control interface must be a direct physical connection or a Layer 2 adjacent connection on a dedicated VLAN, with no routing between them.
• C.The HA Control connection is optional if both devices are managed by the same Cloud Controller.
• D.The HA Control interface uses the management port and must be connected to the internet.

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
In a Prisma SD-WAN High Availability (HA) deployment, the HA Control Interface is the critical lifeline
used to synchronize state, heartbeats, and flow information between the Active and Standby ION devices.
The strict requirement for this connection is that it must be Layer 2 adjacent.
Best Practice: A direct physical cable connection between the designated HA ports of the two devices (e.g., Port 2 on Device A to Port 2 on Device B).
Alternative: Connectivity through a switch on a dedicated, isolated VLAN is supported, provided the devices are in the same broadcast domain and subnet.
Routing (Layer 3) is not supported for the HA Control link because the keepalive mechanism relies on low-latency, multicast/broadcast-level adjacency to detect failures instantly (sub-second failover). If the HA link were routed (Option A), network latency or router convergence issues could cause "Split-Brain" scenarios where both devices assume the Active role, leading to IP conflicts and traffic loops.
Option C is incorrect because the Controller is too slow to manage real-time failover; the decision must be local.

Question No : 6

A network operator receives a critical SITE_CONNECTIVITY_DOWN alarm for a branch site in the Prisma SD-WAN portal.
What specific condition triggers this alarm type?

• A.The device has lost power and rebooted.
• B.One of the two internet circuits at the site has gone down.
• C.All Secure Fabric Links (VPNs) to all remote peers are down, isolating the site from the overlay.
• D.The site has exceeded its licensed bandwidth capacity.

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
The SITE_CONNECTIVITY_DOWN alarm is a high-severity alert indicating a total loss of overlay connectivity for a site.
It does not trigger if just one circuit fails (Option B), provided that other circuits are still up and maintaining VPNs. A single link failure would typically trigger a "Link Down" or "VPN Down" alarm,
but the Site connectivity would remain "Up" (degraded).
It does not simply mean the device rebooted (Option A), although a reboot would cause it temporarily; the alarm specifically tracks the state of the VPN fabric.
The SITE_CONNECTIVITY_DOWN alarm specifically generates when all Secure Fabric Links (VPN tunnels) on the device are in the "Down" state. This means the branch is completely isolated from the rest of the SD-WAN network (Data Centers and other branches), even if the device itself might still be powered on and reachable via the controller (management plane). It signifies a "Blackout" of the data plane for that location.

Question No : 7

An administrator is configuring a BGP peer on a Data Center ION to learn routes from the core switch. The goal is to have the ION learn these prefixes and then advertise them to all remote branch sites across the SD-WAN overlay.
Which setting must be configured on the BGP Peer to ensure these learned routes are redistributed into the SD-WAN fabric?

• A.Set the "Admin Distance" to 20.
• B.Enable "Graceful Restart".
• C.Set the "Scope" to "Global".
• D.Configure a "Prefix List" to deny all.

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
In Prisma SD-WAN routing configuration, the Scope setting on a BGP Peer (or a Static Route) controls
the redistribution logic for the prefixes learned from that source.
Local Scope: If a BGP peer is configured with "Local" scope, the ION device will install the learned routes into its local routing table for its own reachability, but it will not advertise (redistribute) these routes to other ION devices via the Secure Fabric. They remain local to the site.
Global Scope: To advertise reachability to the rest of the network, the BGP peer must be configured with "Global" scope. This tells the ION that any prefixes learned from this specific neighbor (e.g., the DC Core Switch) should be propagated across the SD-WAN overlay to remote branches. This is the critical setting for enabling branch-to-DC communication for applications hosted behind that BGP peer. Without "Global" scope, the branches would never learn the routes to the data center subnets.

Question No : 8

In a Prisma SD-WAN deployment, what is the defining characteristic of a "Standard VPN" compared to a "Secure Fabric Link"?

• A.Standard VPNs use GRE encapsulation, while Secure Fabric Links use VXLA
• B.Standard VPNs are automatically built between ION devices, while Secure Fabric Links require manual configuration.
• C.Standard VPNs are manually configured IPSec tunnels to non-ION endpoints, while Secure Fabric Links are automated tunnels between ION devices.
• D.Standard VPNs support BGP, whereas Secure Fabric Links only support static routing.

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
In the Prisma SD-WAN architecture, the terminology distinguishes between "Native" automation and
"Legacy" interoperability.
Secure Fabric Links: These are the proprietary, automated overlay tunnels created between two Prisma SD-WAN ION devices (e.g., Branch ION to Data Center ION). The controller automatically manages the IP addressing, key rotation, and routing for these links. You do not manually configure "Phase 1" or "Phase 2" parameters for Secure Fabric links.
Standard VPNs: These are traditional, standards-based IPSec tunnels configured to connect an ION device to a Non-ION endpoint (Third-Party Peer). This is used for "Data Center to Data Center" connections where one side is a legacy firewall (e.g., Cisco ASA, Palo Alto Networks NGFW) or for connecting to cloud security services (SSE) that do not have a specific CloudBlade integration. For a Standard VPN, the administrator must manually define the IKE/IPSec profiles, pre-shared keys, and peer IP addresses to match the third-party device's configuration.

Question No : 9

A network engineer is troubleshooting an ION device that is showing as "Offline" in the Prisma SD-WAN portal, despite the site reporting that local internet access is working. The engineer has console access to the device.
Which CLI command should be used to specifically validate the device's ability to resolve the controller's hostname and establish a secure connection to it over a specific interface?

• A.ping <controller-ip>
• B.debug controller reachability <interface>
• C.show system connectivity
• D.dump vpn summary

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
The CLI command debug controller reachability <interface> (e.g., debug controller reachability 1) is the specific diagnostic tool designed to verify the entire connectivity chain required for management plane availability.
Unlike a simple ICMP ping (Option A), which only tests Layer 3 connectivity to an IP address, the debug controller reachability command performs a sequential set of tests:
DNS Resolution: It attempts to resolve the specific Locator service URL (locator.cgnx.net or region-specific FQDN) to verify DNS functionality.
TCP Connectivity: It tests the ability to establish a TCP connection to the controller on port 443 (HTTPS).
SSL/TLS Handshake: It validates that the device can successfully negotiate the secure tunnel required for authentication.
If this command fails at the DNS step, the issue is likely a missing DNS server in the interface config. If it fails at the TCP step, it implies an upstream firewall is blocking outbound port 443. This targeted output allows the engineer to pinpoint exactly why the device is offline in the portal.

Question No : 10

During the Zero Touch Provisioning (ZTP) process of a new ION device at a branch site, which interface ports are supported by default to request an IP address via DHCP and reach the Prisma SD-WAN controller for claiming?

• A.Only the dedicated Controller port (if available)
• B.Any LAN or WAN port on the device
• C.The dedicated Controller port, or Port 1 / Internet 1 if a dedicated port is absent
• D.Only the USB port via a cellular modem

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
For a successful Zero Touch Provisioning (ZTP) experience, the ION device must be able to obtain an IP address and reach the internet immediately upon boot-up.
According to Palo Alto Networks hardware guides, the Controller Port (often labeled specifically as "CONTROLLER" on models like the ION 3000/7000/9000) is pre-configured to act as a DHCP client by default. It is the preferred interface for the initial "call home" process.
However, for smaller desktop models (like the ION 1000/2000/1200 series) or scenarios where a dedicated management network is not available, the device firmware is also configured to attempt DHCP client requests on Port 1 (often labeled as Internet 1 or simply 1).
Connecting the ISP circuit to any random port (like Port 4 or a LAN port) will not work for ZTP because those interfaces are not pre-configured as DHCP clients in the factory default state. Therefore, the installer must ensure the internet uplink is connected to either the dedicated Controller port or Port 1/Internet 1 to ensure the device can resolve the controller FQDN and download its configuration.

Question No : 11

Which configuration requirement must be met to allow two branch ION devices to automatically establish a direct Dynamic VPN (branch-to-branch) connection for traffic flow, bypassing the Data Center?

• A.Both ION devices must be members of the same VPN Cluster.
• B.A static "Gre Tunnel" must be manually configured between the two sites.
• C.The Data Center ION must be offline to trigger the dynamic failover.
• D.The "Standard VPN" path policy must be selected.

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
Dynamic VPNs (also known as ION-to-ION or Branch-to-Branch VPNs) allow Prisma SD-WAN devices to establish direct, on-demand secure tunnels between branch sites to optimize latency for peer-to-peer traffic (e.g., VoIP calls between offices).
To enable this capability, the primary architectural requirement is the configuration of VPN Clusters.
A VPN Cluster defines a logical group of devices that are authorized to communicate with one another.
By default, or if devices are in different clusters without peering, the topology typically defaults to Hub-and-Spoke, where branches only talk to the Data Center.
When two branch ION devices are placed into the same VPN Cluster (or peered clusters), the controller shares the necessary reachability and cryptographic information between them.
Once in the same cluster, the ION devices monitor traffic. If a user at Branch A tries to contact a server at Branch B, the ION devices detect this interest. If a direct path is available (e.g., via public internet), they will dynamically negotiate a direct VPN tunnel, bypassing the Data Center hub. This offloads the hub and reduces latency.
Option B is incorrect because SD-WAN eliminates manual GRE config.
Option C is incorrect because dynamic VPNs are a performance feature, not just a disaster recovery feature.

Question No : 12

A network engineer is troubleshooting a user complaint regarding "slow application performance" for an internal web application. While viewing the Flow Browser in the Prisma SD-WAN portal, the engineer notices that the Server Response Time (SRT) is consistently high (over 500ms), while the Network Transfer Time (NTT) and Round Trip Time (RTT) are low (under 50ms).
What does this data indicate about the root cause of the issue?

• A.The issue is likely caused by congestion on the WAN circuit, requiring a QoS policy adjustment.
• B.The issue is likely on the application server itself (e.g., high CPU, slow database query), not the network.
• C.The issue is caused by a high packet loss rate on the internet path.
• D.The issue is due to a misconfigured DNS server at the branch.

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
The Flow Browser and App Response Time metrics in Prisma SD-WAN are critical tools for isolating the fault domain―determining whether a problem lies in the "Network" or the "Application."
Network Transfer Time (NTT) / Round Trip Time (RTT): These metrics measure the time it takes for packets to traverse the network (WAN/LAN) and for acknowledgments to return. A low NTT (e.g., <50ms) confirms that the network pipes (SD-WAN overlay, Underlay circuits) are healthy and transporting packets quickly.
Server Response Time (SRT): This metric specifically measures the time between the server receiving a request and the server sending the first byte of the response. It essentially measures the "processing time" of the backend server.
In the scenario described, the network metrics (NTT/RTT) are excellent, effectively ruling out WAN congestion, packet loss, or latency (Option A and C). However, the Server Response Time (SRT) is
very high (500ms). This signature is a definitive indicator that the network delivered the request instantly, but the application server took a long time to process it. This points the troubleshooting effort toward the server infrastructure (e.g., a slow SQL query, an overloaded web server, or lack of compute resources) rather than the SD-WAN environment.

Question No : 13

What is the primary function of the "CloudBlade" platform in a Prisma SD-WAN deployment when integrating with third-party services or Prisma Access?

• A.It acts as a physical line card on the ION device to provide additional 10Gbps interfaces.
• B.It is a containerized application running on the ION device that performs Deep Packet Inspection (DPI).
• C.It is a cloud-based API integration layer that automates the configuration of the ION devices and the remote service.
• D.It is a monitoring dashboard used exclusively for viewing flow records.

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
The CloudBlade platform is a distinguishing architectural component of the Prisma SD-WAN solution. It is not a physical piece of hardware, nor is it software that runs directly on the branch ION device's CPU.
Instead, the CloudBlade platform is a cloud-based API integration layer hosted by Palo Alto Networks. It functions as an intelligent broker or "translator" between the Prisma SD-WAN Controller and external third-party services (such as Prisma Access, Amazon Web Services, Azure, ServiceNow, or Zscaler).
When an administrator configures the Prisma Access CloudBlade, for example, they input their API credentials and intent (e.g., "Connect all US branches to US West"). The CloudBlade engine then:
Communicates with the Prisma Access API to provision the remote IPSec termination nodes (Security Processing Nodes).
Translates this configuration into specific instruction sets for the Prisma SD-WAN Controller.
The Controller then pushes the necessary VPN tunnel configurations, IKE parameters, and routing rules to the relevant ION devices.
This architecture eliminates the need for manual IPSec configuration on every branch device. It ensures that if the third-party service changes its IP addresses or settings, the CloudBlade can detect the change via API and automatically update the branch fleet, maintaining connectivity without manual administrator intervention.

Question No : 14

An administrator has configured a Path Policy for "ERP_Traffic". The policy allows two public internet links, "ISP-A" and "ISP-B", both marked as "Active". The Path Quality Profile (SLA) requires a latency of less than 150ms. Currently, both ISP-A and ISP-B have a latency of 40ms, well within the SLA.
How does the Prisma SD-WAN ION determine which link to use for a new flow of "ERP_Traffic" when both active paths meet the SLA requirements?
A. It selects the path with the lowest numerical latency (e.g., if ISP-A drops to 39ms).
B. It selects the path with the highest available bandwidth capacity.
C. It duplicates the packets across both paths (Packet Duplication) to ensure delivery.
D. It selects the path that appears first in the interface configuration list.

답을 확인하기

정답: B
Explanation:
Comprehensive and Detailed Explanation
Prisma SD-WAN utilizes a sophisticated decision engine for Application-Based Path Selection that goes beyond simple failover. When configuring a Path Policy, the administrator defines "Active" paths and a "Path Quality Profile" (SLA).
SLA Compliance (The Filter): First, the system filters the available paths based on the Path Quality Profile. In this scenario, both ISP-A and ISP-B have 40ms latency against a 150ms threshold. Both are "green" or compliant paths.
Selection Criteria (The Tie-Breaker): When multiple paths are configured as "Active" and all meet the performance SLA, the ION device aims to optimize the overall user experience and network utilization. The default behavior for load balancing across healthy, compliant active paths is to select the path with the highest available bandwidth capacity.
By steering new flows to the link with the most "headroom" (available Mbps), the system prevents the saturation of a smaller link (e.g., a 20Mbps DSL line) while a larger link (e.g., 1Gbps Fiber) sits underutilized. This maximizes the aggregate throughput for the site. While latency is the qualifier, bandwidth availability is often the selector for compliant paths. Note that if the application was defined as "Real-Time" and configured for packet duplication, behavior would differ, but for standard traffic, capacity-based distribution is the standard active/active logic.

Question No : 15

A network installer is at a remote branch site to deploy a new ION 3000 device. The device has been racked, cabled to the internet, and powered on. The installer has the "Claim Code" displayed on the email sent by the administrator.
When the administrator enters this Claim Code into the Prisma SD-WAN portal, what is the immediate status of the device before the configuration is fully pushed?

• A.Online
• B.Claimed
• C.Provisioned
• D.Active

답을 확인하기

정답:
Explanation:
Comprehensive and Detailed Explanation
In the Prisma SD-WAN (CloudGenix) Zero Touch Provisioning (ZTP) lifecycle, the device status transitions through specific stages that indicate its readiness and connectivity.
When an administrator enters the Claim Code (or Serial Number/Claim Code pair) into the portal, the device status immediately updates to "Claimed".
This status confirms that the portal has registered the device's unique identity and associated it with the customer's tenant. However, "Claimed" does not necessarily mean the device is fully operational or passing traffic yet. It simply signifies that the ownership is verified.
Once the physical device at the site successfully connects to the internet and reaches the Prisma SD-WAN Controller (using the call-home function), it will authenticate using its installed certificate. Upon successful authentication and the establishment of the secure control channel, the status will transition from "Claimed" to "Online".
Only after the device is "Online" can the controller push the specific site configuration (Device Shell), policies, and IP addressing required for the device to become "Provisioned" and eventually "Active" in the data path. If the device remains in the "Claimed" state for an extended period, it indicates that the hardware has not yet successfully contacted the controller, which prompts troubleshooting of the physical internet circuit or firewall rules upstream.