Discuss Palo Alto Networks SD-WAN-Engineer Exam Topic 2 Question 14

Which statement is valid when integrating Prisma SD-WAN with Prisma Access remote networks?

ASecurity policies for remote networks are configured in Prisma Access and pushed to Prisma SD-WAN for enforcement on the branch ION devices.

BEasy onboarding automatically recommends the closest preconfigured remote network security processing nodes and can be overridden manually.

CA branch with multiple internet circuits will automatically connect to Prisma Access on each circuit and will be used in an active/standby manner for internet-bound traffic.

DBandwidth must be allocated to each Prisma Access remote network compute location, and this bandwidth is shared between all branches that terminate on this remote network node.

Suggested Answer: D

Comprehensive and Detailed Explanation

When deploying Prisma Access for Remote Networks (connecting branch offices), the licensing and throughput model is based on aggregate bandwidth allocated to specific compute locations (regions).

Bandwidth Allocation (Option D): Administrators must purchase and allocate a specific amount of bandwidth (e.g., 500 Mbps, 1 Gbps) to a Prisma Access 'Compute Location' (e.g., US West, Europe Central). This allocated bandwidth is then shared as a pool among all the branch sites (Remote Networks) that onboard and terminate their IPSec tunnels at that specific location. The system does not allocate bandwidth on a strict per-site basis but rather enforces the limit on the aggregate throughput of the compute node itself.

Policy Enforcement (Option A): Security policies for Prisma Access are enforced in the cloud (at the Prisma Access Service Processing Node), not pushed down to the branch ION devices for local enforcement. The ION device handles local segmentation (ZBFW) and traffic steering, but the 'Remote Network' security stack resides in the cloud.

Path Usage (Option C): Prisma SD-WAN is designed to utilize Active/Active paths. When a branch has multiple internet circuits connected to Prisma Access, the CloudBlade and ION automatically build tunnels on all compatible paths and can load-balance traffic across them based on application performance (SLA), rather than defaulting to a strict Active/Standby model for internet traffic.

Get Premium SD-WAN-Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Tyra 2 months ago

C seems valid too. Active/standby for circuits is a smart way to manage traffic.

Carmelina 2 months ago

I’m leaning towards B. Easy onboarding sounds really helpful for setups.

Vicki 2 months ago

I think A is the right choice. It makes sense for security policies to be pushed from Prisma Access.

Samuel 2 months ago

Wait, are we really sharing bandwidth across branches? That seems risky!

Elroy 2 months ago

D) makes sense, but sharing bandwidth could be a problem.

Reena 3 months ago

C) is interesting, but does it really work that way?

Galen 3 months ago

I disagree, B) sounds more accurate for onboarding.

Layla 3 months ago

A) is correct, security policies are pushed from Prisma Access.

Ocie 3 months ago

D is tricky. I remember bandwidth allocation being a topic, but I can't recall if it's shared across branches or dedicated to each one.

Shenika 3 months ago

C seems a bit off to me. I recall something about active/standby setups, but I thought they were more about load balancing rather than automatic connections.

Diane 3 months ago

I'm not entirely sure about B, but I remember something about onboarding and how it can suggest nodes. It might be right?

Celeste 4 months ago

I think option A sounds familiar since we discussed how security policies are managed in Prisma Access during our study sessions.

Palo Alto Networks SD-WAN-Engineer Exam - Topic 2 Question 14 Discussion