While designing a greenfield Prisma SD-WAN solution for a retailer, the risk management group requires segmentation of the retail network to avoid one large fault domain.The following data points are provided:-Two data centers and all sites need to access applications in both data centers-1000 retail branches with stores concentrated in multiple metropolitan areas-Data Center 1 and Data Center 2 have different set of applications that are not replicated-Maintaining application availability is the primary goalWhich action will segment the retail network and reduce regional outages?
Answer(s): C
Creating multiple data center clusters in each data center and distributing nearby branches across different clusters segments the control/data-plane fault domains. If a cluster or regional dependency fails, only a subset of sites is affected, preserving application availability to the others while still allowing access to apps in both data centers.
Full discovery and classification of IoT devices by the IoT Security service is failing.Which Prisma SD-WAN ION device configuration will cause this behavior?
Answer(s): A
Prisma SD-WAN IoT Security relies on DHCP traffic logs to discover and classify devices. If the ION devices are not configured as a DHCP server or relay, DHCP requests and responses are not captured, preventing the system from building complete device profiles. Without this DHCP information, full discovery and classification of IoT devices fails.
Which troubleshooting step should be taken when users at a branch site are experiencing a maximum throughput of 200 Mbps for Direct Internet Access (DIA) traffic on a 1Gbps internet connection?
Answer(s): B
If DIA traffic is limited to 200 Mbps on a 1 Gbps link, the issue is likely related to the WAN interface speed configuration. Ensuring the interface is set to 1 Gbps or auto-negotiation mode allows the ION device to utilize the full bandwidth of the ISP connection. Misconfigured interface speeds can artificially cap throughput regardless of QoS or performance policies.
Based on the HA topology image below, which two statements describe the end-state when power is removed from the ION 1200-S labeled “Active”, assuming that the ION labeled “Standby” becomes the active ION? (Choose two.)
Answer(s): B,C
In a branch HA deployment:-The VRRP Virtual IP addresses assigned to SVIs are moved to the newly active ION, maintaining continuity of traffic routing.-The newly active ION sends gratuitous ARPs on the LAN to update switches and hosts with the MAC address of the VRRP IPs, ensuring minimal disruption.Connections to ISP A or LTE/5G depend on whether the interfaces are physically connected to the standby ION and their configuration; in this topology, only the LAN-facing behavior is guaranteed by VRRP and ARP.
During a security audit, an administrator must provide evidence of the routing isolation and controlled leaking between the PCI-Zone and the Mgmt-Zone on a specific ION device.Which command, when executed on the ION CLI, will output the configuration for all VRF route leak rules?
This command displays all configured VRF route-leaking rules on the ION device, including the source VRF, destination VRF, VNIs, and permitted IP prefixes.It allows the administrator to verify controlled route leaking between the PCI-Zone and Mgmt-Zone while confirming their routing isolation.
https://docs.paloaltonetworks.com/prisma-sd-wan/ion-cli-reference/use-cli-commands/dump-comm ands/dump-vrf
Post your Comments and Discuss Palo Alto Networks SD-WAN-Engineer exam prep with other Community members: