SD-WAN-Engineer Sample Questions Answers

Comprehensive and Detailed Explanation

The transition from "Claimed" to "Online" depends entirely on the ION device's ability to establish a secure, persistent management tunnel to the Prisma SD-WAN Controller.

Connectivity Requirements: The ION device initiates an outbound connection to the controller on TCP Port 443 (HTTPS). It also requires accurate time synchronization to validate SSL certificates, necessitating access to NTP (UDP Port 123).

Scenario Analysis: Since the installer can browse the internet from the LAN, we know the physical link and basic routing/NAT are functional. The issue is specific to the management plane traffic.

Root Cause: If an upstream firewall (e.g., a corporate edge firewall or ISP filter) is inspecting SSL traffic or blocking specific FQDNs/Ports required by the ION, the device cannot complete the handshake. Consequently, it remains "Claimed" (registered in the database) but cannot go "Online" (active management session). Options A, C, and D prevent provisioning (configuration push) but generally do not prevent the device from initially checking in and going "Online" if the pipe is open.

Comprehensive and Detailed Explanation

The Prisma SD-WAN (ION) QoS engine utilizes a hierarchical queuing structure designed to provide granular control over application performance. Each WAN interface on an ION device supports a total of 16 QoS queues.

This 16-queue structure is derived from a matrix of 4 Classes (often referred to as Priority Classes) multiplied by 4 Application Criteria (Traffic Types).2

4 Priority Classes: The system defines four high-level business priority categories:3

Platinum (Highest priority)4

Gold

Silver

Bronze (Lowest priority/Best Effort)5

4 Application Criteria (Sub-queues): Within each of the four priority classes, the system further categorizes traffic into four specific application types to ensure proper handling (e.g., ensuring voice doesn't get stuck behind bulk data even within the same priority level):6

Real-Time Video

Real-Time Audio

Transactional

Bulk7

Calculation: 4 Priority Classes × 4 Application Types = 16 Total Queues per interface. This structure allows the scheduler to ensure that a "Platinum" voice call is prioritized over "Platinum" bulk data, and both are prioritized over "Gold" traffic.

In modern enterprise environments, particularly those undergoing Mergers and Acquisitions (M&A), engineers often face the challenge of overlapping IP address space.4 Prisma SD-WAN addresses this by utilizing Virtual Routing and Forwarding (VRF) profiles.5 A VRF creates a separate routing table instance within the ION device, allowing multiple networks to coexist on the same physical hardware even if they use the same IP ranges.

To achieve end-to-end connectivity while maintaining strict segmentation, these VRF profiles must be correctly associated with site bindings.7 When a VRF is "bound" to a site, the ION device ensures that traffic belonging to that specific segment remains isolated not only locally (on the LAN) but also across the secure SD-WAN fabric. Prisma SD-WAN achieves this by encapsulating the traffic within the overlay tunnels and tagging it with a unique VRF identifier.8 This ensures that a "Corporate" VRF at Site A can only communicate with the "Corporate" VRF at Site B, effectively keeping "Guest" or "Acquisition" traffic completely separate.

This architectural approach is superior to traditional underlay segmentation (Option A) or simple interface-based virtual routers (Option D) because it provides a centralized, software-defined method to manage multi-tenancy. By using VRF profiles, administrators can define a global security and routing posture once and push it to all relevant sites.9 This simplifies the integration of new business units with conflicting IP schemes, as the Prisma SD-WAN controller handles the complex orchestration required to maintain path selection and security policies uniquely for each VRF across the entire global network.

Prisma SD-WAN High Availability (HA) for branch ION devices, particularly the Gen-2 ION 1200-S, is designed to provide "100% WAN Capacity" preservation during a hardware or power failure. This is achieved through the use of Bypass Pairs (Fail-to-Wire). In the provided topology, the ISP A and LTE/5G circuits are cross-connected using the bypass ports (typically ports 3 and 4 on the ION 1200-S).

When the "Active" ION device loses power, the internal physical relays in its bypass ports transition to a closed state, effectively creating a physical bridge between the ports. In this scenario, the LTE/5G signal—which enters the Active ION's port 4—is mechanically bridged to port 3, allowing it to pass through to port 4 of the Standby ION. Simultaneously, ISP A is already connected to the Standby ION. Consequently, once the Standby device completes its transition to the "Active" state, it has physical access to both WAN circuits, validating Statement A.

Regarding the LAN transition, Prisma SD-WAN does not use standard VRRP for ION-to-ION HA; instead, it uses a proprietary Control Plane HA mechanism. When the failover occurs, the newly active ION takes over the IP addresses of all configured Switch Virtual Interfaces (SVIs) and LAN interfaces. To ensure the downstream Layer 2 infrastructure (like the LAN switches shown in the diagram) updates its MAC address tables to point to the new physical hardware for those IPs, the newly active ION immediately broadcasts a Gratuitous ARP (GARP). This ensures that LAN traffic is correctly steered to the new device without a significant timeout, validating Statement C.

Comprehensive and Detailed Explanation

To implement User/Group-based policies (Path, QoS, or Security) in Prisma SD-WAN, the system requires two specific components to resolve user identities and map them to IP addresses within the fabric.

Cloud Identity Engine (CIE): This is the primary requirement for identity management. The Cloud Identity Engine connects the Prisma SD-WAN controller to your directory service (e.g., Active Directory, Azure AD/Entra ID). It allows the system to retrieve and resolve User and Group attributes (e.g., "Marketing Group," "User: john.doe") so they can be selected in policy rules. Without CIE, the controller cannot interpret the group names or user identities defined in the policies.

Data Center ION: In the standard deployment model for User-ID, a Data Center (DC) ION is required to act as the bridge or collector for IP-to-User mappings. The DC ION connects to the User-ID Agent (running on a PAN-OS firewall or Windows Server) to learn the mapping of IP addresses to usernames. It then redistributes this information to the controller or other branch IONs so they can identify which user is associated with the traffic flows originating from a specific private IP address.

Comprehensive and Detailed Explanation

Prisma SD-WAN utilizes STUN (Session Traversal Utilities for NAT) to facilitate NAT Traversal for its Secure Fabric overlay.

Discovery: When an ION device connects to the internet behind a NAT router, it reaches out to the Prisma SD-WAN Controller. The controller acts as a STUN server, identifying the public IP address and port that the ION's traffic is originating from.

Symmetric NAT Challenge: In Symmetric NAT, the mapping changes for every destination. However, the Prisma SD-WAN architecture is designed to handle this by having the controller coordinate the connection attempt.

Hole Punching: The controller shares the discovered public mapping information between two peer ION devices. They then simultaneously initiate traffic to each other's public IP/Port (a technique called "UDP Hole Punching"). This tricks the intermediate NAT devices into allowing the inbound traffic, establishing a direct P2P IPSec tunnel without requiring manual port forwarding or static IPs at the edge.

Comprehensive and Detailed Explanation

In Prisma SD-WAN Path Policies, the Service & DC Group (Destination) field determines where the traffic is sent.

Direct: This is the specific keyword/object used to instruct the ION to route traffic directly out to the local WAN interface (Local Breakout) towards the Internet, without encapsulation in a VPN tunnel. This is the correct setting for Guest Wi-Fi, SaaS applications (like Office 365), or any public web browsing that does not need to be backhauled.

Standard VPN / Default-Cluster: These options direct traffic into an IPSec overlay tunnel destined for a Data Center or another ION. Selecting these would "backhaul" the guest traffic, which contradicts the requirement for DIA.

When "Direct" is selected, the ION uses its available "Internet" category links. The policy can further specify which internet link to use (e.g., "Use Broadband, avoid LTE") via the path preference list, but the Destination type must be "Direct".

Comprehensive and Detailed Explanation

The RMA replacement process in Prisma SD-WAN is designed to be seamless, leveraging the decoupling of logical configuration from physical hardware.

Replace Device Workflow: The administrator should use the "Replace Device" (or RMA) function within the portal. This workflow allows you to select the "Defective" device (old serial) and the "Replacement" device (new serial).

Configuration Transfer: Once executed, the system automatically binds the existing Device Shell (which contains all interface configs, routing policies, and site associations) to the new hardware's serial number. The new device, once connected to the internet, will "call home," identify itself, and download the exact configuration of the previous unit.

License Transfer: While the configuration moves automatically, the Support License transfer typically requires a specific step in the Customer Support Portal (CSP) or happens automatically if processed as a formal RMA order. Options A and D are incorrect because they involve manual reconfiguration, which is unnecessary and error-prone. Option C is incorrect as the ION platform relies on cloud-based config management, not local USB backups for hardware swaps.

Comprehensive and Detailed Explanation

According to Palo Alto Networks Prisma SD-WAN administrator documentation regarding Path Policy configuration, specific rules apply when utilizing Standard VPNs (IPSec tunnels to non-ION devices, such as Prisma Access or third-party firewalls) as an L3 Failure Path.

When a Path Policy rule is configured, the administrator defines Active Paths, Backup Paths, and L3 Failure Paths. The L3 Failure Path is a "last resort" mechanism used when all Active and Backup paths are unavailable (Layer 3 down).

If Standard VPN is selected as the L3 Failure Path type, the system explicitly requires that the administrator also associates it with a specific Standard Services and DC Group within that same policy rule.

The ION device uses the Standard Services and DC Group to identify the specific remote endpoint (tunnel destination) where the traffic should be routed. Unlike a "Direct" (Internet) path which can simply route out to the WAN, a Standard VPN represents a logical tunnel. If the policy rule designates "Standard VPN" as the failure path but leaves the "Standard Services and DC Group" field empty or unselected, the ION effectively has a directive to "use a VPN" but lacks the instruction on which VPN group to use for this specific application context. Consequently, even if the IPSec tunnel to Prisma Access is physically up and stable, the policy engine cannot resolve the next hop for the "SuperSaaSApp" traffic, resulting in the packets being dropped. To resolve this, the administrator must edit the Path Policy rule to ensure the specific Standard Service/DC Group representing Prisma Access is checked/selected for the L3 Failure Path.

Comprehensive and Detailed Explanation

Prisma Access manages Remote Network bandwidth using an Aggregate Bandwidth licensing model.

Compute Locations: When you purchase bandwidth (e.g., 1 Gbps), you allocate it to specific Prisma Access Compute Locations (e.g., US West, Europe Central).

Shared Pool: All branch sites (Remote Networks) that connect to that specific Compute Location share the allocated bandwidth pool. For example, if you allocate 500 Mbps to "US West" and connect 10 branches to it, they compete for that 500 Mbps aggregate.

Bursting: An individual branch is not strictly rate-limited to a "slice" (e.g., 50 Mbps) unless you explicitly configure QoS guarantees. By default, a single branch can burst and consume a large portion of the aggregate pool if other branches are idle. The enforcement happens at the Region/Compute Node level, ensuring the total throughput does not exceed the licensed capacity for that region.

Comprehensive and Detailed Explanation

When deploying Prisma Access for Remote Networks (connecting branch offices), the licensing and throughput model is based on aggregate bandwidth allocated to specific compute locations (regions).

Bandwidth Allocation (Option D): Administrators must purchase and allocate a specific amount of bandwidth (e.g., 500 Mbps, 1 Gbps) to a Prisma Access "Compute Location" (e.g., US West, Europe Central). This allocated bandwidth is then shared as a pool among all the branch sites (Remote Networks) that onboard and terminate their IPSec tunnels at that specific location. The system does not allocate bandwidth on a strict per-site basis but rather enforces the limit on the aggregate throughput of the compute node itself.

Policy Enforcement (Option A): Security policies for Prisma Access are enforced in the cloud (at the Prisma Access Service Processing Node), not pushed down to the branch ION devices for local enforcement. The ION device handles local segmentation (ZBFW) and traffic steering, but the "Remote Network" security stack resides in the cloud.

Path Usage (Option C): Prisma SD-WAN is designed to utilize Active/Active paths. When a branch has multiple internet circuits connected to Prisma Access, the CloudBlade and ION automatically build tunnels on all compatible paths and can load-balance traffic across them based on application performance (SLA), rather than defaulting to a strict Active/Standby model for internet traffic.

To ensure the stability and performance of the SD-WAN fabric, Prisma SD-WAN provides granular visibility into the health of each Instant-On Network (ION) appliance. While the solution is primarily application-defined, monitoring the underlying physical and system resources of the hardware or virtual instance is critical for proactive maintenance and troubleshooting.

At the individual device level, administrators can monitor system resource utilization, which includes CPU usage, memory (RAM) consumption, and disk space availability.1 High CPU or memory usage can indicate that the device is reaching its throughput limits or that a specific process (such as deep packet inspection) is overtaxing the system. Disk utilization is monitored to ensure there is sufficient space for local logs and system operations.

Beyond internal system health, interface-level metrics are essential. This includes monitoring interface bandwidth utilization to identify bottlenecks on WAN or LAN ports. Crucially, operational performance is also assessed through error and discard counters on each interface. High error rates or frequent packet discards often signal physical layer issues (like bad cabling), duplex mismatches, or upstream provider congestion. While VPN status and application flows are vital for network-wide visibility, the core health of an ION device is defined by these foundational system and interface metrics.

Monitoring these specific parameters allows network engineers to distinguish between an application performance issue caused by network latency and one caused by a local hardware resource constraint.

Comprehensive and Detailed Explanation

In the Prisma SD-WAN Data Center (DC) model, the terminology for BGP peers defines their role in the topology and how the system generates route maps.

Core Peer: This peer type is designated for the LAN-side connection (facing the DC Core Switch or internal Routers). Its primary purpose is to learn the subnets/prefixes hosted in the data center so the ION can advertise them to the remote branches. The system automatically creates route maps to facilitate this redistribution into the fabric.

Edge Peer: This peer type is designated for the WAN-side connection (facing the Edge Router or MPLS PE). Its primary purpose is to provide reachability to the underlay network.

Distinction: Selecting the correct type affects the default Route Maps and Prefix Lists generated by the controller. Configuring a Core Peer correctly ensures that the DC's internal subnets are properly learned and propagated to the overlay, whereas an Edge Peer configuration focuses on WAN next-hop reachability.

Comprehensive and Detailed Explanation

Prisma SD-WAN supports Dynamic VPNs (Branch-to-Branch) even when both endpoints are behind Source NAT (e.g., typical broadband connections).

To achieve this, the ION devices utilize standard NAT Traversal techniques, specifically leveraging STUN (Session Traversal Utilities for NAT).

Discovery: Each ION communicates with the Cloud Controller (which acts as a STUN server/signaling broker). Through this communication, the controller observes the public IP and Port that the ION's traffic is coming from (the post-NAT address).

Signaling: The controller shares this public reachability information with the peer ION.

Hole Punching: The IONs then attempt to initiate connections to each other's discovered public IP/Port. This "UDP Hole Punching" allows them to establish a direct IPSec tunnel through the NAT devices without requiring static 1:1 NAT mapping or manual port forwarding on the provider routers, enabling mesh connectivity in commodity internet environments.

Prisma SD-WAN Copilot is an AI-powered operational tool designed to simplify network management through Natural Language Processing (NLP). Traditionally, identifying a bandwidth "hog" required manual navigation through multiple dashboards, such as WAN Clarity and the Flow Browser, to correlate source IP addresses with specific application flows and timestamps. Copilot transforms this workflow by allowing administrators to interact with the system using conversational queries.

When an administrator inputs a query like “Show top bandwidth source IPs at SD-WAN Branch X over last 3 hours,” Copilot leverages its underlying machine learning models and integrated data lake to aggregate telemetry across the entire fabric. It instantly identifies the specific source IPs responsible for the highest throughput and correlates that data with application visibility. Instead of providing a static report or redirecting the user to other tools, Copilot presents an interactive, summarized view directly within the interface. This view highlights the top-consuming users and breaks down their consumption by application, such as YouTube, Netflix, or business-critical SaaS tools.

This capability significantly reduces the Mean Time to Resolution (MTTR) for performance issues. By bypassing the need for manual data correlation, Copilot provides immediate "Day 2" operational insights. It effectively acts as a virtual assistant that understands the context of the network topology, site names, and time ranges, allowing the administrator to quickly determine if a branch's slow performance is due to an individual user's behavior or a broader infrastructure issue.

In the Prisma SD-WAN ecosystem, the centralized cloud controller provides a robust multi-layered visibility framework to ensure network reliability. To effectively detect critical events like site outages or application performance issues (SLA violations), the controller aggregates several types of operational data. Incidents are the primary mechanism for high-level alerting; they are automatically generated when the system detects significant state changes, such as an ION device going offline (site outage) or a path failing to meet the required performance metrics.

While Incidents provide the "what" and "where," Alerts offer granular notifications for specific events that may not yet have escalated to a full-scale incident. To provide deep context, the controller also utilizes Statistics, which include real-time and historical telemetry regarding bandwidth, latency, jitter, and packet loss. These statistics allow administrators to visualize the specific SLA violation as it occurs. Furthermore, Audit logs are essential for tracking configuration changes or administrative actions that might have preceded an outage, helping engineers correlate human intervention with network behavior.

By combining these four elements—Incidents for major events, Alerts for specific notifications, Statistics for performance validation, and Audit logs for change tracking—a network administrator gains a 360-degree view of the fabric. This comprehensive approach moves beyond simple "up/down" monitoring, allowing for "Day 2" operational excellence where performance degradation is identified and remediated before it impacts the end-user experience.

Comprehensive and Detailed Explanation

Dynamic VPNs (also known as ION-to-ION or Branch-to-Branch VPNs) allow Prisma SD-WAN devices to establish direct, on-demand secure tunnels between branch sites to optimize latency for peer-to-peer traffic (e.g., VoIP calls between offices).

To enable this capability, the primary architectural requirement is the configuration of VPN Clusters.

A VPN Cluster defines a logical group of devices that are authorized to communicate with one another.

By default, or if devices are in different clusters without peering, the topology typically defaults to Hub-and-Spoke, where branches only talk to the Data Center.

When two branch ION devices are placed into the same VPN Cluster (or peered clusters), the controller shares the necessary reachability and cryptographic information between them.

Once in the same cluster, the ION devices monitor traffic. If a user at Branch A tries to contact a server at Branch B, the ION devices detect this interest. If a direct path is available (e.g., via public internet), they will dynamically negotiate a direct VPN tunnel, bypassing the Data Center hub. This offloads the hub and reduces latency. Option B is incorrect because SD-WAN eliminates manual GRE config. Option C is incorrect because dynamic VPNs are a performance feature, not just a disaster recovery feature.

The provided graph displays the Signal-to-Noise Ratio (SNR) for two cellular carriers, Carrier-1 (blue line) and Carrier-2 (green line), over a specific period. In cellular communications, SNR is a critical metric used to determine the quality of a wireless signal. A higher SNR indicates a cleaner, stronger signal, while a lower SNR indicates that the signal is being "drowned out" by background noise or interference, which directly correlates to performance degradation, packet loss, and lower throughput.

Looking at the graph, Carrier-1 experiences a significant and sustained drop in SNR, falling from roughly 4.5 dB to nearly 0.5 dB for the majority of the time duration. This drastic reduction in signal quality strongly suggests that Carrier-1 may have experienced performance degradation (Option A). During this dip, the link quality would likely fall below the configured thresholds for business-critical application traffic.

Because Prisma SD-WAN is an application-defined fabric that continuously monitors path health, the ION device would detect this degradation on Carrier-1. If Carrier-2 maintains a significantly higher and more stable SNR (as shown by the green line remaining between 4.5 dB and 6.5 dB), the ION device's Path Selection engine would automatically steer traffic away from the degraded link. Consequently, it is highly probable that Carrier-1 traffic switched over to Carrier-2 (Option D) to maintain the application SLA. This automated failover is a core strength of the Prisma SD-WAN architecture, ensuring that the best available path is utilized based on real-time link statistics rather than simple "up/down" states.

In large-scale Prisma SD-WAN deployments, such as a retail network with 1,000 branches, architectural resilience is achieved through a strategy known as Hub Clustering. A Data Center Cluster is a logical grouping of ION devices at a hub site that provides termination for branch-to-DC VPN tunnels. To prevent the creation of a massive, single fault domain, Palo Alto Networks best practices recommend segmenting the branch population across multiple clusters.

By creating more than one data center cluster in each data center and strategically assigning sites to these clusters, an administrator can effectively isolate failure events. In a metropolitan area where stores are concentrated, spreading nearby retail locations across different clusters ensures that a localized resource failure or a cluster-specific misconfiguration only impacts a subset of the stores in that region rather than causing a complete regional outage.

This design directly addresses the requirement for maintaining application availability. Since Data Center 1 and Data Center 2 host different applications, each branch site must maintain active paths to both DCs. By using multiple clusters at each DC, the risk management group's goal of avoiding a large fault domain is met through "blast radius" containment. If Cluster A at Data Center 1 fails, the 1,000 sites are not all affected simultaneously; instead, only the specific sites bound to Cluster A lose connectivity to that hub, while their neighbors bound to Cluster B remain functional. This approach provides the highest level of regional resiliency and operational stability for high-density retail environments.

In the Prisma SD-WAN architecture, security is built directly into the AppFabric using a centralized, controller-led approach to key management. Unlike traditional VPNs that rely on manual Internet Key Exchange (IKE) or static Pre-Shared Keys (PSKs) which can be administratively burdensome and security-vulnerable, Prisma SD-WAN automates the entire lifecycle of encrypted tunnels. The Prisma SD-WAN Controller acts as the central authority for identity and key distribution for all ION (Instant-On Network) devices within the tenant's fabric.

Specifically, the VPN shared secrets used to secure these tunnels are ephemeral and are valid for exactly 24 hours. This 24-hour validity period is a security best practice implemented by Palo Alto Networks to limit the "blast radius" or window of exposure in the unlikely event that a key is compromised. The controller automatically handles the generation, distribution, and rotation of these secrets. Before the 24-hour timer expires, the controller pushes new keys to the ION devices, which then perform a hitless rollover. This ensures that the data plane remains active and encrypted without requiring manual intervention from a network administrator. If an ION device loses its control plane connection to the controller, it will maintain its existing tunnels using the current keys until they expire, at which point it must re-authenticate with the controller to receive a new set of valid secrets. This automated rotation is a core component of the Prisma SD-WAN Zero-Trust security model.

Comprehensive and Detailed Explanation

To diagnose specific VPN negotiation failures (Phase 1 or Phase 2 IPSec issues), the Event Logs (specifically filtered for System or VPN events) are the correct resource.

Event Logs: This section records the control plane signaling messages. If a VPN tunnel fails to establish, the Event Log will generate an entry containing the specific IKE failure reason sent by the peer or generated locally. Common errors found here include INVALID_COOKIE, NO_PROPOSAL_CHOSEN (mismatch in encryption algorithms), or PRE_SHARED_KEY_MISMATCH.

Flow Browser (A): This shows user traffic (TCP/UDP sessions). If the VPN is down, user traffic won't even enter the tunnel, so the Flow Browser will just show dropped flows or blackholes, but it won't explain why the tunnel itself is broken.

Link Quality (D): This shows latency/loss graphs for established tunnels. It cannot diagnose why a tunnel failed to form in the first place.

Comprehensive and Detailed Explanation

To achieve strict regional isolation where branch sites only form VPN tunnels with Data Centers in their specific region (e.g., EU branches to EU DCs only), the correct architectural feature to utilize is VPN Clusters.

In Prisma SD-WAN (CloudGenix), a Cluster defines a logical security and topology boundary for the overlay network. By default, devices may be placed in a "Default" cluster where they attempt to form a mesh or hub-and-spoke topology with all other reachable devices in that context.

To enforce the new policy:

Logical Partitioning: The administrator should create separate VPN Clusters for each region (e.g., "Cluster-NA", "Cluster-EU", "Cluster-Asia").

Assignment: The Regional Data Center IONs and their corresponding Branch IONs must be moved into their respective clusters.

Result: The Prisma SD-WAN controller dictates that devices can only establish Secure Fabric (VPN) tunnels with other devices within the same cluster. This effectively segments the global network, ensuring that an Asian branch never attempts to build a tunnel to a North American DC, satisfying the compliance requirement without complex access lists or manual tunnel configuration.

Option B (Manual Tunnels) is administratively unscalable and negates the benefits of SD-WAN automation.

Option C (Circuit Labels) is primarily for path selection and traffic steering, not for hard topology segmentation.

Option D (VRFs) is used for local Layer 3 segmentation (routing isolation) within a device, not for controlling WAN overlay tunnel formation scope.