18 free Palo Alto Networks SD-WAN Engineer practice questions from the CertStash pack of 70, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 18 free here, all 70 in the pack, and each step includes the one before it.
Get all 70 questions (US$39) · Download the first 10 as a PDF
Question 1
Which metrics can be monitored at the individual Prisma SD-WAN ION device level to assess its health and operational performance?
Show answer and explanation
Correct answer: B. Device CPU, memory and disk use, interface bandwidth, and errors/discards
Individual ION device health monitoring encompasses system resource utilization (CPU, memory, disk), network interface metrics (bandwidth, errors, discards), and these are the standard operational performance indicators at the device level. Option A omits critical error/discard metrics; Option C relates to connectivity status rather than performance metrics; Option D includes site-level aggregates and application statistics that are not device-level monitoring.
Why the other options are wrong
- A. Missing error and discard metrics which are essential for assessing interface health.
- C. VPN tunnel and controller reachability are connectivity checks, not device performance health metrics.
- D. Application flow statistics and site health scores are higher-level aggregates, not individual device-level metrics.
Question 2
Where is route leaking configured between VRFs?
Show answer and explanation
Correct answer: D. VRF profile
Route leaking between VRFs is configured within the VRF profile, which allows traffic and routes to be selectively shared between different routing and forwarding instances while maintaining separation. VRF definitions establish the VRF itself; BGP peers handle routing protocol neighbors but not inter-VRF route leaking; site configuration is where VRFs are applied but not where leaking rules are defined.
Why the other options are wrong
- A. VRF definitions establish the VRF identity but do not configure the leaking mechanism.
- B. BGP peers manage routing protocol relationships, not inter-VRF route leaking policies.
- C. Site configuration applies VRFs to sites but does not define route leaking behavior between them.
Question 3
In which modes can a Prisma SD-WAN branch be deployed?
Show answer and explanation
Correct answer: D. POV, Production, Analytics
Prisma SD-WAN branches support three deployment modes: POV (Proof of Concept), Production, and Analytics. These modes govern how the branch operates and reports telemetry. Options A, B, and C mix incorrect mode names like Testing, Control, and Disabled that are not valid Prisma SD-WAN branch deployment modes.
Why the other options are wrong
- A. Testing and Control are not valid branch deployment modes in Prisma SD-WAN.
- B. Control and Disabled are not standard branch deployment mode options.
- C. Disabled and Analytics are not the correct set; the three modes are POV, Production, and Analytics.
Question 4
What are two requirements for implementing user/group-based path policies? (Choose two.)
Show answer and explanation
Correct answer: A, D. Cloud Identity Engine; Data center ION
User and group-based path policies require the Cloud Identity Engine to map users and groups to IP addresses, and the data center ION to provide the path selection and tunnel infrastructure. Internal host detection and ADEM are supporting features but not core requirements for implementing user/group-based path policies.
Why the other options are wrong
- B. Internal host detection is a supplementary capability but not a fundamental requirement for user/group path policies.
- C. ADEM provides performance analytics but is not required to implement user/group-based path policy functionality.
Question 5
For how many hours are Prisma SD-WAN VPN shared secrets valid?
Show answer and explanation
Correct answer: C. 24
Prisma SD-WAN VPN shared secrets are valid for 24 hours. This time-limited validity enhances security by requiring periodic renewal and reducing the window of exposure if a secret is compromised. The other timeframes do not align with Prisma SD-WAN's security design.
Why the other options are wrong
- A. 1 hour is too short for practical tunnel operations.
- B. 8 hours does not match the standard validity period.
- D. 72 hours is too long and does not align with SD-WAN security practices.
Question 6
Which component of Prisma SD-WAN is responsible for distributing User-IP and user-group mappings to branch devices that match the corresponding source IPs?
Show answer and explanation
Correct answer: C. Controller
The Prisma SD-WAN controller receives User-IP and user group mappings and distributes them to the branch ION devices whose subnets match the source IPs. This lets the IONs enforce user and group based policies locally.
Why the other options are wrong
- A. A DC ION is a data center device that receives policy; it does not distribute identity mappings to branches.
- B. Cloud Identity Engine supplies directory information, but it is the controller that distributes the mappings to branch devices.
- D. An NGFW can be a source of User-ID data but does not distribute mappings to Prisma SD-WAN branch devices.
Question 7
A multinational company is deploying Prisma SD-WAN across North America, Europe, and Asia. The data centers in the North America region have served all regions, but regional policies are now being enforced that mandate each of the regions to build their own data centers and branch sites to only connect to their respective regional data centers. How can this regionalization be achieved so that new or existing branch sites only build tunnels to the regional DC IONs?
Show answer and explanation
Correct answer: A. Create a new cluster for each regional DC ION and move the sites from the existing cluster to the new cluster.
Creating separate clusters for each regional DC ION and moving branch sites to their respective regional clusters ensures that branches only establish tunnels within their geographic region. This cluster-based isolation is the native Prisma SD-WAN mechanism for regional segregation. Disabling auto-tunnel requires manual management; circuit labels control interface selection but not cluster membership; VRF assignment on DC IONs does not prevent cross-region tunnel creation at the branch level.
Why the other options are wrong
- B. Manual tunnel creation is operationally cumbersome and lacks the scalability and automatic management that clusters provide.
- C. Circuit labels determine which WAN interfaces are used but do not prevent branches from tunneling to non-regional DC IONs.
- D. VRF assignment on DC IONs does not prevent branch sites from initiating tunnels to DC IONs outside their designated region.
Question 8
When identifying devices for IoT classification purposes, which two methods does Prisma SD-WAN use to discover devices that are not directly connected to the branch ION? (Choose two.)
Show answer and explanation
Correct answer: A, C. LLDP; SNMP
Prisma SD-WAN uses LLDP (Link Layer Discovery Protocol) and SNMP (Simple Network Management Protocol) to discover devices that are not directly connected to the branch ION. LLDP operates at Layer 2 to discover neighboring devices, while SNMP can be used to query and gather device information across the network topology for IoT classification purposes.
Why the other options are wrong
- B. CDP (Cisco Discovery Protocol) is a Cisco proprietary protocol and is not a standard discovery method used by Prisma SD-WAN for IoT device identification.
- D. Syslog is a logging protocol used for centralized log collection and monitoring, not for active device discovery.
Question 9
A network administrator is troubleshooting a critical SaaS application, “SuperSaaSApp”, that is experiencing connectivity issues. Initially, the configured active and backup paths for the application were reported as completely down at Layer 3. The Prisma SD-WAN system attempted to route traffic for the application over an L3 failure path that was explicitly configured as a Standard VPN to Prisma Access. However, users are still reporting a complete outage for the application and monitoring tools show application flows being dropped when attempting to use the Standard VPN L3 failure path, even though the tunnel itself appears to be up. The administrator suspects a policy misconfiguration related to how the Standard VPN path interacts with destination groups. What is the most likely reason for flows being dropped when attempting to use the Standard VPN L3 failure path?
Show answer and explanation
Correct answer: C. The path policy rule explicitly designates a Standard VPN as the L3 failure path, but it does not include a designated Standard Services and DC Group, causing traffic to be dropped.
When a Standard VPN is designated as an L3 failure path in the path policy, it must have an associated Standard Services and DC Group defined. Without this designation, the system cannot properly route and process traffic destined for services, causing flows to be dropped even though the tunnel itself is operationally up. This is a policy misconfiguration that prevents proper traffic forwarding through the failover path.
Why the other options are wrong
- A. Move Flows Forced is a performance policy action related to active traffic shifting, not the root cause of flows being dropped on an operationally up tunnel.
- B. While the Required checkbox creates strictness in path selection, the issue manifests as traffic drops on the tunnel itself, not a fundamental conflict preventing tunnel establishment.
- D. Minimize Cellular Usage is a bandwidth management setting unrelated to Standard VPN path policies or the dropping of flows on a configured failover path.
Question 10
User-ID integration is configured for a Prisma SD-WAN deployment. Branch-1 has the user-to-IP mappings available, and User-1 is mapped to IP-1. To which two use cases can User-ID based zone-based firewall policies be applied? (Choose two.)
Show answer and explanation
Correct answer: A, B. User-1 accessing a SaaS application on direct internet and source User-ID based zone-based firewall rules on Branch-1 ION; User-1 accessing a private application within Branch-1, and source User-ID based zone-based firewall rules on Branch-1 ION
User-ID based zone-based firewall policies can be applied when sourcing rules on the ION where the user-to-IP mapping is available. This includes User-1 accessing SaaS applications on direct internet with source rules applied at Branch-1 ION (where the mapping exists), and User-1 accessing private applications within Branch-1 with source rules also applied locally. Destination-based User-ID rules require the receiving ION to have the user-to-IP mapping, which is not present at remote branches or data centers.
Why the other options are wrong
- C. Destination User-ID rules cannot be sourced at a data center ION when the user-to-IP mapping only exists at Branch-1.
- D. Destination User-ID rules cannot be applied at Branch-2 ION when the user-to-IP mapping for User-1 only exists at Branch-1.
Question 11
Which implementation allows Prisma SD-WAN to improve application performance for organizations facing inconsistent user experiences across branch locations, especially due to varying device types and network conditions, by using Layer 4 and Layer 7 optimization to boost throughput?
Show answer and explanation
Correct answer: B. WAN optimization
WAN optimization uses Layer 4 and Layer 7 optimization techniques including compression, deduplication, and protocol optimization to improve application performance and boost throughput across branch locations. This is particularly effective for addressing inconsistent user experiences caused by varying device types and network conditions by reducing bandwidth consumption and improving data transmission efficiency.
Why the other options are wrong
- A. Packet duplication is a reliability mechanism for critical paths, not a throughput improvement technique.
- C. Forward Error Correction (FEC) adds redundancy to recover from packet loss but does not provide Layer 4/7 optimization for throughput improvement.
- D. Application acceleration is a broader category, while WAN optimization specifically provides the Layer 4 and Layer 7 optimization mechanisms described in the question.
Question 12
Site templates are to be used for the large-scale deployment of 100 Prisma SD-WAN branch sites across different regions. Which two statements align with the capabilities and best practices for Prisma SD-WAN site templates? (Choose two.)
Show answer and explanation
Correct answer: C, D. Site templates offer the capability to pre-stage device configurations by creating a device shell; Once a site has been deployed using a template, its configuration can be updated or modified by applying an updated version of the template.
Site templates support Jinja conditional statements for dynamic customization, enabling flexible configuration based on variables. Templates can pre-stage device configurations by creating device shells without requiring full deployment. Additionally, once a site is deployed using a template, administrators can update the site's configuration by applying an updated template version, allowing for ongoing management and modifications at scale.
Why the other options are wrong
- A. Jinja conditional statements are fully supported in Prisma SD-WAN site templates, providing dynamic customization capabilities.
- B. While site name and device information are important, mandatory variables do not universally require ION software version specification for all template scenarios.
Question 13
A site has two internet circuits: Circuit A with 500 Mbps capacity and Circuit B with 100 Mbps capacity. Which path policy configuration will ensure traffic is automatically shifted from a saturated circuit to the circuit with available bandwidth?
Show answer and explanation
Correct answer: C. Both circuits under active path
Configuring both circuits as active paths enables automatic load balancing and dynamic traffic shifting based on available bandwidth. When both circuits are active simultaneously, the system continuously monitors bandwidth utilization and automatically distributes traffic to the circuit with available capacity, ensuring that saturated circuits are relieved without waiting for explicit failure conditions.
Why the other options are wrong
- A. Active/backup configuration does not shift traffic based on saturation; it only fails over when the active circuit fails completely.
- B. This configuration prioritizes the smaller circuit, wasting the larger circuit's capacity and providing no advantage.
- D. L3 failure path only activates on Layer 3 failures, not on bandwidth saturation conditions.
Question 14
While designing a greenfield Prisma SD-WAN solution for a retailer, the risk management group requires segmentation of the retail network to avoid one large fault domain. The following data points are provided: Two data centers and all sites need to access applications in both data centers 1000 retail branches with stores concentrated in multiple metropolitan areas Data Center 1 and Data Center 2 have different set of applications that are not replicated Maintaining application availability is the primary goal Which action will segment the retail network and reduce regional outages?
Show answer and explanation
Correct answer: C. Create more than one data center cluster in each data center and assign sites to cluster so nearby retail locations can be spread on separate clusters.
To segment the retail network and reduce regional outages while maintaining application availability across two data centers with different applications, creating multiple data center clusters within each data center and distributing nearby retail locations across separate clusters achieves both goals. This provides geographic distribution, fault domain isolation, and ensures that regional outages in one cluster do not affect sites assigned to other clusters.
Why the other options are wrong
- A. A single large cluster spanning both data centers creates one large fault domain, directly contradicting the risk management requirement.
- B. Creating multiple clusters without geographic distribution and site assignment logic does not effectively segment the network by region.
- D. Adding aggregation devices within the same cluster improves capacity but does not create the network segmentation needed to reduce regional outages.
Question 15
Which condition, when configured within a performance policy, is a trigger for generating an incident related to application performance or path degradation?
Show answer and explanation
Correct answer: A. Violation of defined service-level agreement (SLA) thresholds for application performance or link quality.
Performance policies in Prisma SD-WAN are specifically designed to monitor application performance and link quality metrics against defined SLA thresholds. When these thresholds are violated, incidents are generated related to application performance or path degradation. This is the core purpose of performance-based policies within the system.
Why the other options are wrong
- B. Concurrent flow threshold exceeded generates a SYSTEM event, not an application performance or path degradation incident.
- C. BGP session loss is a routing control plane event, not an application performance metric trigger.
- D. Physical interface state changes generate NETWORK events, not application performance-related incidents.
Question 16
Network segmentation is required due to overlapping IP address space and M&A scenarios. Which Prisma SD-WAN feature will achieve the desired segmentation and end-to-end connectivity in this use case?
Show answer and explanation
Correct answer: B. Virtual Routing and Forwarding (VRF) profiles with proper site bindings to achieve desired isolation locally and across the secure fabric
Virtual Routing and Forwarding (VRF) profiles with proper site bindings achieve desired isolation both locally within branches and across the secure SD-WAN fabric overlay. VRF enables complete network segmentation for overlapping IP address spaces and M&A scenarios by maintaining separate routing tables, ensuring end-to-end connectivity while keeping traffic logically isolated across the entire SD-WAN infrastructure.
Why the other options are wrong
- A. VRF isolation limited to the underlay does not provide end-to-end segmentation across the secure overlay fabric.
- C. Multiple contexts with interface segmentation primarily isolates traffic locally and does not provide robust cross-fabric segmentation.
- D. Multiple virtual routers do not provide the same level of integrated isolation and end-to-end connectivity as VRF profiles within the SD-WAN fabric.
Question 17
In a branch high availability (HA) deployment, which action is taken by the standby device when the active device goes down?
Show answer and explanation
Correct answer: B. It automatically detects the failure, assumes the active role, and sends gratuitous ARP to minimize downtime for forwarding traffic.
In a branch HA deployment, the standby device automatically detects the failure of the active device, assumes the active role, and sends gratuitous ARP messages to the local network. This minimizes downtime by immediately redirecting forwarding traffic to the newly active device without waiting for controller intervention.
Why the other options are wrong
- A. Relying on controller notification and rerouting introduces delay and does not minimize downtime compared to automatic local failover.
- C. Resetting active sessions would disrupt user experience; HA should maintain active sessions during failover.
- D. Requiring controller intervention and diagnostic mode significantly increases failover time and does not represent automatic HA behavior.
Question 18
What is the purpose of Secure Group Tag (SGT) propagation in Prisma SD-WAN?
Show answer and explanation
Correct answer: A. To integrate with external identity-based security solutions
Secure Group Tag (SGT) propagation in Prisma SD-WAN enables integration with external identity-based security solutions such as Cisco TrustSec and other zero-trust security frameworks. SGT propagation allows security policies to follow user and device identity across the network, enabling context-aware security decisions based on who is accessing resources rather than just network location.
Why the other options are wrong
- B. QoS policy management is handled through separate QoS configurations, not SGT propagation.
- C. Rule clarification and organization is achieved through comments and naming conventions, not SGT functionality.
- D. Interface-level settings and service initiation (NTP, DHCP, App Probes) are managed through interface and service configurations, not SGT propagation.
That was 18 of 70.
The full Palo Alto Networks SD-WAN Engineer pack has all 70 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 24 free as one PDF by email. Get the Half Pack →