Palo Alto SD-WAN Engineer (SD-WAN-Engineer)

✅ Option C (Correct) Reasoning: When a Standard VPN is configured as an L3 failure path, it must be associated with a Standard Services and DC Group to correctly define the destinations reachable through that VPN. If this group is missing or misconfigured, the VPN tunnel might be up, but the system won't know which destinations are valid for that path, causing flows for "SuperSaaSApp" to be dropped. This aligns with the administrator's suspicion of a policy misconfiguration related to destination groups.❌ Why the other choices are incorrect:

Option A is incorrect: The question states the system "attempted to route traffic... over an L3 failure path", indicating traffic was shifted. "Move Flows Forced" dictates how aggressively traffic moves, not whether it drops once on the path.

Option B is incorrect: The "Required" checkbox affects how path availability is determined for a Service & DC Group. While a conflict could occur, the issue here is flows dropping on the VPN path itself, implying the path was selected but failed to deliver traffic due to destination policy.

Option D is incorrect: "Minimize Cellular Usage" relates to managing metered data on cellular interfaces. The scenario does not mention cellular paths or metered data, making this an unlikely cause for a Standard VPN L3 failure path to Prisma Access.

✅ Option A (Correct) Reasoning: User-ID identifies the source user. For User-1 accessing a direct internet SaaS application, the Branch-1 ION is the egress point. A source User-ID based firewall policy on Branch-1 ION can correctly identify User-1 and apply security rules.✅ Option B (Correct) Reasoning: When User-1 accesses a private application within Branch-1, the traffic originates from User-1 within the branch. The Branch-1 ION can apply a source User-ID based firewall policy to identify User-1 and enforce security policies for internal traffic.❌ Why the other choices are incorrect:

Option C is incorrect: User-ID primarily identifies the source user (User-1 at Branch-1). Applying a 'destination User-ID based' rule at the DC ION for a user originating from Branch-1 is not the correct application of source User-ID. The DC ION would not have User-1's mapping unless a separate User-ID instance exists there for local users.

Option D is incorrect: Similar to option C, applying 'destination User-ID based' rules on the Branch-2 ION for User-1 from Branch-1 is incorrect. User-ID on Branch-2 would be for users within Branch-2, not for identifying a remote source user like User-1 from Branch-1.

✅ Option A (Correct) Reasoning: Secure Group Tag (SGT) propagation in Prisma SD-WAN is used to integrate with external identity-based security solutions. This allows the SD-WAN fabric to carry identity context (SGTs) from users or devices, enabling consistent, granular security policies to be enforced by firewalls or other security devices across the network. ❌ Why the other choices are incorrect:

Option B is incorrect: SGTs are primarily for security segmentation based on identity, not directly for managing Quality of Service (QoS) policies. QoS typically uses classifications like DSCP, application IDs, or bandwidth requirements.

Option C is incorrect: This describes good documentation practices or naming conventions, not the technical function of SGT propagation itself. SGTs carry dynamic identity context for policy enforcement.

Option D is incorrect: While SGTs might be enabled/disabled at an interface, the purpose of propagation is not merely configuration. Initiating services like NTP, DHCP, or App Probes is unrelated to SGT propagation, which focuses on security context.

✅ Option C (Correct) Reasoning:Configuring both circuits as active enables the SD-WAN solution to dynamically distribute traffic across both links. The SD-WAN controller can monitor real-time bandwidth utilization and performance metrics, automatically shifting traffic from a saturated circuit to the one with available bandwidth to maintain optimal application experience and prevent congestion.❌ Why the other choices are incorrect:

Option A is incorrect: An active-backup configuration only engages the backup circuit if the primary active circuit experiences a complete failure, not merely saturation. This does not allow for dynamic shifting based on congestion.

Option B is incorrect: Similar to Option A, this active-backup setup only initiates a failover when the primary circuit fails, rather than providing intelligent load balancing or traffic shifting due to saturation.

Option D is incorrect: An L3 failure path typically addresses routing failures or link unavailability at Layer 3, not bandwidth saturation or performance degradation. It's a different mechanism for network resilience.

✅ Option B (Correct) Reasoning: For large-scale Prisma SD-WAN deployments using site templates, key mandatory variables include the site name for identification, the ION software version for compatibility, and at least one ION serial number or device name for device onboarding. These are essential for proper provisioning. ✅ Option D (Correct) Reasoning: A core capability of Prisma SD-WAN site templates is centralized configuration management. Once sites are deployed, updating the associated site template allows for efficient, large-scale modification or updating of configurations across all linked sites. ❌ Why the other choices are incorrect:

Option A is incorrect: Prisma SD-WAN templates fully support Jinja2 templating, which includes conditional statements, loops, and variables. This feature allows for extensive dynamic customization within templates.

Option C is incorrect: While site templates enable pre-staging of configurations for devices, the templates themselves define configurations for a site to which a device is assigned. The term "device shell" is not standard terminology in Prisma SD-WAN for this process; templates define the configuration that is applied to the IONs.

✅ Option B (Correct) Reasoning: Prisma SD-WAN leverages Virtual Routing and Forwarding (VRF) profiles to create logical segmentation for networks, essential for overlapping IP address spaces and M&A scenarios. These profiles, with proper site bindings, ensure traffic isolation both at the local site and across the secure SD-WAN fabric, providing end-to-end connectivity for specific segments. ❌ Why the other choices are incorrect:

Option A is incorrect: While VRF profiles are correct, stating isolation only “across the underlay” is incomplete. Prisma SD-WAN extends this segmentation across the secure overlay fabric for end-to-end segmented connectivity.

Option C is incorrect: "Multiple contexts" is not the primary Prisma SD-WAN feature for this use case; VRF profiles are. Interface segmentation is a component of applying VRFs, but not the overarching feature.

Option D is incorrect: While virtual routers are part of VRF functionality, "Multiple virtual routers" is not the direct configuration object used for creating end-to-end segmentation across the fabric in Prisma SD-WAN; VRF profiles encapsulate this functionality.

✅ Option D (Correct) Reasoning: Application acceleration directly employs Layer 4 and Layer 7 optimizations, such as protocol optimization, caching, and compression, to boost application throughput and improve inconsistent user experiences across varying network conditions. This aligns precisely with the question's focus on L4/L7 methods for enhanced application performance.❌ Why the other choices are incorrect:

Option A is incorrect: Packet duplication is a redundancy technique for path resilience and reliability, not primarily a Layer 4/Layer 7 optimization for boosting application throughput.

Option B is incorrect: WAN optimization is a broad category encompassing various techniques. While application acceleration is a type of WAN optimization, 'Application acceleration' is a more specific and direct answer when Layer 4 and Layer 7 optimizations for application performance are explicitly mentioned.

Option C is incorrect: Forward Error Correction (FEC) is a technique for recovering lost packets to improve reliability and reduce retransmissions. It does not directly focus on Layer 4 or Layer 7 optimizations to boost application throughput.

✅ Option B (Correct) Reasoning: CPU, memory, and disk usage are direct indicators of an ION device's internal resource health. Interface bandwidth, errors, and discards reflect the device's network traffic load and physical layer health, all crucial for assessing individual device operational performance. ❌ Why the other choices are incorrect:

Option A is incorrect: Device software version is a configuration detail, not a dynamic performance metric. While interface bandwidth is relevant, this option is incomplete for a comprehensive health assessment.

Option C is incorrect: VPN tunnel and controller reachability status are critical operational states and connectivity metrics, but they represent the device's functionality and network context rather than the fundamental internal resource health and interface performance as comprehensively as Option B.

Option D is incorrect: Application flow statistics and ADEM metrics relate to application performance through the device and user experience, not primarily the individual ION device's internal health. Site health score is an aggregated metric for an entire site.

✅ Option D (Correct) Reasoning: Prisma SD-WAN branches are deployed in Production for active operations and POV (Proof of Value) for pilot or testing phases. These are two of the three official branch deployment modes.
❌ Why the other choices are incorrect:

Option A is incorrect: While POV is valid, "Testing" is a concept, not a formal mode. "Control" refers to the control plane, not a branch deployment mode.

Option B is incorrect: While Production and Disabled are valid modes, "Control" refers to the system's control plane, not a branch deployment mode.

Option C is incorrect: "Analytics" is a feature, and "ControlMost Voted" is not a recognized branch deployment mode. Only Disabled is a valid mode listed here.

✅ Option B (Correct) Reasoning: Prisma SD-WAN VPN shared secrets are valid for a default duration of 8 hours. This period is a common security practice for re-keying, ensuring frequent rotation of encryption keys and enhancing overall VPN security by limiting the exposure time of a single key.❌ Why the other choices are incorrect:

Option A is incorrect: 1 hour is too short for a typical default VPN shared secret validity and is not the standard for Prisma SD-WAN.

Option C is incorrect: 24 hours is a possible configuration but not the default validity period for Prisma SD-WAN VPN shared secrets.

Option D is incorrect: 72 hours is a prolonged validity period for a default shared secret, increasing security risks, and is not the default for Prisma SD-WAN.