SD-WAN-Engineer Sample Questions Answers

Comprehensive and Detailed Explanation

Dynamic VPNs (also known as ION-to-ION or Branch-to-Branch VPNs) allow Prisma SD-WAN devices to establish direct, on-demand secure tunnels between branch sites to optimize latency for peer-to-peer traffic (e.g., VoIP calls between offices).

To enable this capability, the primary architectural requirement is the configuration of VPN Clusters.

A VPN Cluster defines a logical group of devices that are authorized to communicate with one another.

By default, or if devices are in different clusters without peering, the topology typically defaults to Hub-and-Spoke, where branches only talk to the Data Center.

When two branch ION devices are placed into the same VPN Cluster (or peered clusters), the controller shares the necessary reachability and cryptographic information between them.

Once in the same cluster, the ION devices monitor traffic. If a user at Branch A tries to contact a server at Branch B, the ION devices detect this interest. If a direct path is available (e.g., via public internet), they will dynamically negotiate a direct VPN tunnel, bypassing the Data Center hub. This offloads the hub and reduces latency. Option B is incorrect because SD-WAN eliminates manual GRE config. Option C is incorrect because dynamic VPNs are a performance feature, not just a disaster recovery feature.

Comprehensive and Detailed Explanation

The Bypass Pair feature on Prisma SD-WAN ION devices (specifically supported models like ION 2000, 3000, 7000, 9000) is a hardware-based resiliency mechanism known as Fail-to-Wire.

Operation: A "Bypass Pair" logically groups two physical interfaces (e.g., WAN 1 and LAN 1). Under normal operation, the ION processes traffic between them.

Power Loss: In the event of a total power loss (or critical software failure), a mechanical relay inside the device physically closes the circuit between the two ports.

Result: This creates a direct electrical connection (like a patch cable) between the upstream device (ISP Modem) and the downstream device (Legacy Firewall or Router). This ensures that internet connectivity is preserved for the site, even if the SD-WAN appliance is completely dead. This is critical for single-point-of-failure deployments where maintaining basic dial-tone is more important than SD-WAN optimization during a hardware outage.

Comprehensive and Detailed Explanation at least 150 to 250 words each from Palo Alto Networks SD-WAN Engineer documents:

In Palo Alto Networks PAN-OS SD-WAN environments, automation and orchestration are key components for service providers managing large-scale deployments. The PAN-OS REST API provides a modern, structured way to programmatically manage configuration objects, including those required for SD-WAN functionality.

When an application is designed to push changes directly to devices (individual firewalls) rather than through a centralized template in Panorama, it must interact with the firewall's local REST API. To successfully create a virtual SD-WAN interface, the application must target the correct resource URI. In the PAN-OS API schema, the logical SD-WAN interface—which groups physical links to enable application-based path selection—is managed via the sdwanInterfaces parameter within the REST API.

It is important to distinguish between the interface itself and the profiles that support it. Option A refers to sdwanInterfaceprofiles, which are the objects used to define the characteristics of a link (such as bandwidth, link type, and monitoring frequency), but not the interface itself. Furthermore, since the scenario specifies making changes "directly to devices," the target must be the firewall rather than Panorama. While Panorama can manage these objects via templates, a direct-to-device automation workflow necessitates using the firewall’s REST API endpoint. Utilizing the REST API over the legacy XML API is the recommended standard for modern integrations due to its ease of use with JSON payloads and alignment with contemporary DevSecOps practices. By using the sdwanInterfaces parameter on the firewall, the MSP application can programmatically bind physical Layer 3 interfaces to the SD-WAN fabric.

Comprehensive and Detailed Explanation

The Prisma SD-WAN (CloudGenix) solution is designed with a separation of the control plane (Controller) and the data plane (ION devices).1 In the event that an ION device loses connectivity to the Cloud Controller (often referred to as running in "headless mode"), the device continues to forward traffic and maintain existing VPN tunnels using the keys it currently holds.2

However, for security purposes, the VPN session keys (shared secrets) used for the Secure Fabric have a finite validity period. The system is designed such that these keys are rotated regularly.3 If the controller is unreachable, the ION device can continue to rotate keys locally and maintain the VPNs for a maximum default period of 72 hours (exactly 3 days).4

If the connection to the controller is not restored within this 72-hour window, the keys will eventually expire, and the ION will be unable to retrieve new authorized key material from the controller.5 Consequently, the VPN tunnels will go down, and the "out of shared secret key" error will be observed in the VPN status logs. This mechanism ensures that a permanently compromised or stolen device cannot maintain network access indefinitely without central authorization.

Comprehensive and Detailed Explanation at least 150 to 250 words each from Palo Alto Networks SD-WAN Engineer documents:

In Prisma SD-WAN, the Signal-to-Noise Ratio (SNR) is a critical metric used to monitor the health and performance of cellular WAN interfaces. SNR measures the strength of the desired signal relative to the background noise level; higher values indicate a cleaner signal, while lower values suggest that noise is overwhelming the signal, typically leading to increased packet loss, high latency, and reduced throughput.

Analyzing the provided graph, Carrier-1 (blue line) shows a severe drop in SNR, plummeting from approximately 4.5 dB to nearly 0.3 dB between 15:00 and 23:00. An SNR value this low is indicative of a failing or highly unstable link that cannot reliably sustain data traffic, directly supporting Inference A—that Carrier-1 experienced significant performance degradation. In contrast, Carrier-2 (green line) maintains a much higher and more consistent SNR throughout the same period.

Prisma SD-WAN’s AppFabric uses application-based path selection and SLA monitoring to ensure the best possible user experience. When the system detects that a primary path (like Carrier-1) has degraded below acceptable thresholds—often triggered by high loss or latency resulting from poor signal quality—it will dynamically steer application flows to an alternative healthy path. Therefore, Inference D is correct: because Carrier-1’s quality became untenable while Carrier-2 remained stable, the ION device would have likely initiated a path switchover to move traffic from the degraded Carrier-1 to the healthier Carrier-2.

Comprehensive and Detailed Explanation

According to the Prisma SD-WAN Performance Policy Default Behavior documentation, the default action configured for applications (including real-time media) when a path experiences poor performance (violates the SLA thresholds for latency, jitter, or packet loss) is to Move Flows.

The Prisma SD-WAN ION device continuously monitors the health of all available paths. If the active path for a media application degrades and fails to meet the specified SLA, the default policy dictates that the traffic should be steered (moved) to an alternate, compliant path that meets the performance criteria.

While Forward Error Correction (FEC) is a powerful feature available in Prisma SD-WAN to mitigate packet loss for real-time applications, it is an optional action that must be explicitly enabled or configured within the performance policy rules. It is not the default action in the base system configuration; the primary default mechanism for handling performance issues is to leverage the multi-path fabric to switch to a better link.

Comprehensive and Detailed Explanation

This scenario depicts a High Availability (HA) topology utilizing the ION 1200-S model's Fail-to-Wire (bypass) capabilities to share WAN links between two devices without needing external switches for every WAN connection.

1. WAN Link Availability (Statement A):

The diagram illustrates a "daisy-chain" cabling method supported by the ION 1200-S bypass pairs.

ISP A (Green): Connects directly to the "Standby" (Left) unit first. Since the Standby unit remains powered on, it maintains direct access to ISP A.

LTE/5G (Blue): Connects to the "Active" (Right) unit first. The connection then loops through a bypass pair on the Active unit to the Standby unit. When power is removed from the "Active" unit, the fail-to-wire relays on its Ethernet ports close physically. This creates a passive electrical bridge that connects the LTE modem directly to the Standby unit. The Standby unit (now becoming Active) will detect the link state change and successfully utilize the LTE connection. Therefore, both WAN links remain usable.

2. LAN Failover Mechanism (Statement C):

Prisma SD-WAN ION devices typically use a VRRP-like mechanism for LAN redundancy.

When the "Active" node fails (loses power), the "Standby" node stops receiving keepalives and promotes itself to the Active state.

To ensure downstream switches and clients immediately send traffic to the new Active unit, it must update their ARP tables. It does this by broadcasting a Gratuitous ARP (GARP) packet for the Virtual IP (VIP) address of the Switch Virtual Interfaces (SVIs). This action informs the network that the MAC address associated with the Gateway I1P is now reachable via the port connected to the new Active ION.234

Comprehensive and Detailed Explanation

In Prisma SD-WAN routing configuration, the Scope setting on a BGP Peer (or a Static Route) controls the redistribution logic for the prefixes learned from that source.

Local Scope: If a BGP peer is configured with "Local" scope, the ION device will install the learned routes into its local routing table for its own reachability, but it will not advertise (redistribute) these routes to other ION devices via the Secure Fabric. They remain local to the site.

Global Scope: To advertise reachability to the rest of the network, the BGP peer must be configured with "Global" scope. This tells the ION that any prefixes learned from this specific neighbor (e.g., the DC Core Switch) should be propagated across the SD-WAN overlay to remote branches. This is the critical setting for enabling branch-to-DC communication for applications hosted behind that BGP peer. Without "Global" scope, the branches would never learn the routes to the data center subnets.

Comprehensive and Detailed Explanation

In Prisma SD-WAN, security policies can be applied via Policy Stacks, which often have a hierarchy.

Stack Precedence: A common configuration involves a Global Security Stack (applied to all sites) and a Local/Site Security Stack (specific to one site). If the administrator configured a "Global" rule that says "Deny Access to Gambling Sites" (or a specific IP list), and that rule is higher in the binding order or part of a higher-priority stack, it will enforce the block before the local "Allow Guest to Internet" rule is processed.

Specifics of "REJECT": The state REJECT specifically implies a policy enforcement action (sending a TCP RST or ICMP Unreachable) rather than a silent drop or a routing failure.

Why not A? If the "Allow" rule is at the top and matches the traffic parameters (Zone/IP), the Default Deny at the bottom would never be reached. The issue implies a higher priority Deny exists.

Comprehensive and Detailed Explanation at least 150 to 250 words each from Palo Alto Networks SD-WAN Engineer documents:

In a Prisma SD-WAN deployment, the routing of traffic between branches and Data Centers (DCs) relies on the proper synchronization between the AppFabric (the overlay) and the local routing protocols (the underlay/LAN side). In this scenario, the branch can successfully reach DC1, indicating the branch ION is correctly participating in the fabric. However, traffic to DC2 (10.2.2.22) is failing.

The DC2 site has the site prefix 10.2.2.0/23 configured. In Prisma SD-WAN, defining a site prefix informs the Controller that this specific subnet "belongs" to that site, causing the Controller to advertise reachability for this prefix to all other ION devices in the fabric. Consequently, when the branch ION (192.168.1.123) attempts to reach 10.2.2.22, it correctly identifies DC2 as the destination and encapsulates the traffic toward the DC2 ION.

The bottleneck occurs once the packet arrives at the DC2 ION. While the ION is advertising the branch subnet (192.168.1.0/24) to the DC Core (ensuring the return path), the ION itself must know how to forward the incoming traffic from the branch to the internal DC network. If the DC2 ION does not have a specific route in its local routing table for the 10.2.2.0/23 subnet pointing to the DC Core's internal interface, the packet will be dropped.

According to Palo Alto Networks best practices for Data Center ION deployment, a static default route (0.0.0.0/0) should be configured on the ION device pointing toward the DC Core’s next-hop IP address. This ensures that any traffic received from the AppFabric destined for internal DC resources—which are not directly connected to the ION—is successfully handed off to the core switching fabric for final delivery. Adding this default route (Option A) resolves the reachability issue by providing the "last-hop" routing instruction within the DC.

Comprehensive and Detailed Explanation

Prisma SD-WAN (formerly CloudGenix) integrates with Palo Alto Networks IoT Security to provide comprehensive visibility into all devices at a branch, including those that are not directly connected to the ION device. While the ION automatically detects and classifies devices connected directly to its interfaces via traffic inspection (DPI), DHCP, and ARP analysis, gaining visibility into off-branch devices (devices connected to downstream switches or access points) requires additional discovery mechanisms that can query the network infrastructure or ingest its logs.

1. SNMP (Simple Network Management Protocol): This is the primary active discovery method for off-branch devices. The Prisma SD-WAN ION device acts as a sensor that actively polls local network switches and wireless controllers using SNMP. By querying the ARP tables and MAC address tables (Bridge MIBs) of these intermediate network devices, the ION can identify endpoints that are connected to the switch ports, even if those endpoints are not currently sending traffic through the ION. This allows the system to map the topology and discover silent or lateral-traffic-only devices.

2. Syslog: In conjunction with SNMP, the IoT Security solution can utilize Syslog messages to discover and profile devices. Network infrastructure devices (like switches and WLAN controllers) can be configured to send Syslog messages to the collection point (which enables the IoT Security service) whenever a device connects or disconnects (e.g., port up/down events, DHCP snooping logs, or 802.1x authentication logs). These logs provide real-time data about device presence and identity (MAC/IP mappings) for devices that are not directly adjacent to the ION, ensuring 100% visibility across the branch network segments. LLDP (A) and CDP (B) are typically Link Layer discovery protocols used for discovering directly connected neighbors and do not propagate beyond the immediate link, making them unsuitable for discovering devices multiple hops away or behind a switch.

Comprehensive and Detailed Explanation

Prisma SD-WAN utilizes Link Quality Monitoring (LQM) to maintain a real-time health score for every WAN path.

To ensure the system knows the quality of a path before sending critical user traffic onto it, the ION device uses Active Probing.

Mechanism: The ION sends synthetic probe packets (typically UDP) across the Secure Fabric (VPN tunnels) and Direct Internet paths to its peers. These probes measure Latency, Jitter, and Packet Loss.

Active vs. Passive: While the system does use Passive Monitoring (observing actual user flows) when traffic is present to reduce overhead, Active Probes are essential for idle links or backup paths. Without active probing, the ION would have no data to make an intelligent steering decision for the first packet of a new video call. This ensures that "Real-Time" policies always have up-to-date metrics to select the best path immediately.

Comprehensive and Detailed Explanation

The Flow Browser and App Response Time metrics in Prisma SD-WAN are critical tools for isolating the fault domain—determining whether a problem lies in the "Network" or the "Application."

Network Transfer Time (NTT) / Round Trip Time (RTT): These metrics measure the time it takes for packets to traverse the network (WAN/LAN) and for acknowledgments to return. A low NTT (e.g., <50ms) confirms that the network pipes (SD-WAN overlay, Underlay circuits) are healthy and transporting packets quickly.

Server Response Time (SRT): This metric specifically measures the time between the server receiving a request and the server sending the first byte of the response. It essentially measures the "processing time" of the backend server.

In the scenario described, the network metrics (NTT/RTT) are excellent, effectively ruling out WAN congestion, packet loss, or latency (Option A and C). However, the Server Response Time (SRT) is very high (500ms). This signature is a definitive indicator that the network delivered the request instantly, but the application server took a long time to process it. This points the troubleshooting effort toward the server infrastructure (e.g., a slow SQL query, an overloaded web server, or lack of compute resources) rather than the SD-WAN environment.

Comprehensive and Detailed Explanation

The AppX (Application Experience) score is a proprietary metric used by Prisma SD-WAN to provide a holistic view of user experience, rather than just network statistics. It is calculated based on three key components:

Transaction Failure Rate (A): The percentage of application transactions that failed (e.g., TCP resets, HTTP 500 errors). This indicates availability.

Network Transfer Time (B): The time taken for packets to traverse the network (WAN/LAN latency). This indicates network health.

Server Response Time (C): The time taken by the application server to respond to a request. This indicates backend performance.

Why not D or E?

Bandwidth Utilization (D) is a capacity metric, not a direct measure of quality. A link can be 90% full but still deliver packets quickly (good AppX), or 10% full but dropping packets (bad AppX).

Jitter (E) is a network-layer metric primarily relevant for UDP Real-Time media. While important, the high-level "AppX" score for general TCP apps focuses on the "Time-to-Glass" metrics (NTT/SRT) and success rates.