Palo Alto Networks SD-WAN-Engineer Exam - Topic 3 Question 3 Discussion

Actual exam question for Palo Alto Networks's SD-WAN-Engineer exam

Question #: 3
Topic #: 3

An administrator is configuring an ION 2000 device for a deployment where high availability is required, but the site has only a single internet circuit. The administrator configures a Bypass Pair (Fail-to-Wire) on ports 1 and 2 connecting the ISP modem to the legacy firewall.

If the ION device loses power, what is the resulting behavior of the traffic flowing through this Bypass Pair?

ATraffic is blocked to prevent uninspected packets from entering the network (Fail-to-Block).

BThe internal relay closes, physically bridging Port 1 and Port 2, allowing traffic to flow transparently between the modem and firewall.

CThe device reboots into 'Safe Mode' and acts as a Layer 2 switch.

DTraffic is rerouted to the LTE modem automatically.

Show Suggested Answer

Suggested Answer: B

Comprehensive and Detailed Explanation

The Bypass Pair feature on Prisma SD-WAN ION devices (specifically supported models like ION 2000, 3000, 7000, 9000) is a hardware-based resiliency mechanism known as Fail-to-Wire.

Operation: A 'Bypass Pair' logically groups two physical interfaces (e.g., WAN 1 and LAN 1). Under normal operation, the ION processes traffic between them.

Power Loss: In the event of a total power loss (or critical software failure), a mechanical relay inside the device physically closes the circuit between the two ports.

Result: This creates a direct electrical connection (like a patch cable) between the upstream device (ISP Modem) and the downstream device (Legacy Firewall or Router). This ensures that internet connectivity is preserved for the site, even if the SD-WAN appliance is completely dead. This is critical for single-point-of-failure deployments where maintaining basic dial-tone is more important than SD-WAN optimization during a hardware outage.

by Alfred at Dec 21, 2025, 07:50 AM

Limited Time Offer

25%

Off

Get Premium SD-WAN-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Bettye

28 days ago

D is out of the question. No LTE modem involved in this setup.

upvoted 0 times

...

Leatha

1 month ago

C sounds unlikely. A switch mode isn't the right behavior here.

upvoted 0 times

...

Vivienne

1 month ago

But if it blocks, what happens to the traffic? B is more practical.

upvoted 0 times

...

Mila

1 month ago

I feel like A could be a valid option too. Blocking might be safer.

upvoted 0 times

...

Latanya

2 months ago

Agreed, B makes sense. No inspection means no blockage.

upvoted 0 times

...

Salome

2 months ago

I think it's B. Traffic should flow transparently.

upvoted 0 times

...

Ettie

2 months ago

Definitely B, that's how bypass pairs work in high availability!

upvoted 0 times

...

Gilbert

2 months ago

I thought it would just reboot into Safe Mode. Interesting!

upvoted 0 times

...

Noelia

2 months ago

Wait, are we sure it doesn't block traffic? Sounds off.

upvoted 0 times

...

Zoila

2 months ago

B) Bingo! The ION device just throws up its hands and says "I'm done, you're on your own!" Gotta love that fail-safe functionality.

upvoted 0 times

...

Barney

3 months ago

B) Yep, that's the one. Gotta love it when your network device just says "Screw it, I'm going on break" and lets the traffic flow freely.

upvoted 0 times

...

Monte

3 months ago

B) Definitely the right answer. I mean, who doesn't love a good ol' fashioned hardware bridge when the power goes out? It's like a network version of duct tape and baling wire.

upvoted 0 times

...

Jerilyn

4 months ago

Ah, the old "Fail-to-Wire" trick. Gotta love when your network just says "Nope, I'm out!" and goes straight to the pub.

upvoted 0 times

...

Pearlie

4 months ago

I vaguely recall something about Safe Mode, but that seems less likely in this scenario. I think it’s probably not C.

upvoted 0 times

...

Sean

4 months ago

I practiced a similar question, and I think the internal relay closing is the key point here. I would lean towards B as well.

upvoted 0 times

...

Trina

4 months ago

I'm not entirely sure, but I feel like Fail-to-Block would make sense to prevent any uninspected packets. Could it be A?

upvoted 0 times

...

Coletta

4 months ago

I remember studying bypass pairs, and I think if the ION device loses power, it should allow traffic to flow through the bypass. So, maybe it's B?

upvoted 0 times

...

Lemuel

4 months ago

I'm pretty confident about this one. The Bypass Pair is designed to maintain connectivity even if the device loses power, so the correct answer is option B - the internal relay closes to bridge the two ports and allow traffic to flow transparently.

upvoted 0 times

...

Sherill

5 months ago

Okay, let me break this down. The question says the Bypass Pair is configured to connect the ISP modem to the legacy firewall. If the ION device loses power, the ports should physically bridge to allow traffic to pass through, so I'm going to go with option B.

upvoted 0 times

...

Beula

5 months ago

Hmm, I'm a bit confused. I know the Bypass Pair is supposed to provide high availability, but I'm not sure how it behaves when the device loses power. I'll have to think this through carefully.

upvoted 0 times

...

Coleen

5 months ago

I think the key here is understanding what a Bypass Pair (Fail-to-Wire) does. If the ION device loses power, it should physically bridge the two ports to allow traffic to flow transparently between the modem and firewall, so I'll go with option B.

upvoted 0 times

...

Tarra

5 months ago

B) The internal relay closes, physically bridging Port 1 and Port 2, allowing traffic to flow transparently between the modem and firewall. This makes the most sense for a Fail-to-Wire setup.

upvoted 0 times