When an ION device has been claimed, the cloud-based controller generates and communicates with the device by which method?
Answer(s): A
When a Prisma SD-WAN ION device is claimed, the cloud-based controller communicates securely with the device using the Manufacturer Installed Certificate (MIC). The MIC is pre-installed by the manufacturer on the device, enabling secure authentication and encrypted communication with the Prisma SD-WAN cloud controller.
A network engineer adds a new subnet to a branch office ION device. Users within this subnet report that they can access public websites and SaaS applications without issue: however, the centralized management server in the data center cannot reach the devices in this new branch subnet.Which configuration error on the branch ION device prevents the data center from reaching these resources?
A LAN prefix configured with local scope is not advertised through the Prisma SD-WAN fabric to remote sites. Setting the new branch subnet to global scope allows its prefix to be propagated to the data center so centralized resources can route traffic back to that subnet.
Which metrics can be monitored at the individual Prisma SD-WAN ION device level to assess its health and operational performance?
Answer(s): B
At the individual ION device level, Prisma SD-WAN monitors CPU, memory, and disk utilization, as well as interface bandwidth usage and errors/discards. These metrics provide direct insight into the device’s health and operational performance, allowing administrators to detect resource bottlenecks and interface issues in real time.
A network engineer is diagnosing a black hole issue in which return traffic for a business-critical application arrives at the branch but is dropped by the ION device. The Path Policy requires an MPLS path as Active and Prisma Access as Backup.Which configuration state on the ION device would result in these drops?
Answer(s): C
If the branch does not have the MPLS circuit required as the active path and the configured Prisma Access backup tunnel is also down, the ION has no usable path that satisfies the Path Policy. With all active and backup paths unavailable, traffic can be black-holed unless an eligible L3 failure path is configured.
https://docs.paloaltonetworks.com/prisma-sd-wan/release-notes/new-features/prisma-sd-wan-relea se-information/prisma-sd-wan-features-introduced-in-2020/features-introduced-in-february-2020https://docs.paloaltonetworks.com/prisma-sd-wan/administration/prisma-sd-wan-stacked-policies/add-a-path-p olicy-rule
A multinational company is deploying Prisma SD-WAN across North America, Europe, and Asia. The data centers in the North America region have served all regions, but regional policies are now being enforced that mandate each of the regions to build their own data centers and branch sites to only connect to their respective regional data centers.How can this regionalization be achieved so that new or existing branch sites only build tunnels to the regional DC IONs?
Circuit labels control tunnel establishment between ION devices in Prisma SD-WAN. By removing existing global circuit labels and assigning new, region-specific circuit labels, branch IONs will automatically build tunnels only to data center IONs within their own region. This approach enforces regional segmentation without manual tunnel creation or VRF reconfiguration.
Post your Comments and Discuss Palo Alto Networks SD-WAN-Engineer exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SD-WAN-Engineer content, but please register or login to continue.