Palo Alto Networks SD-WAN-Engineer Exam - Topic 3 Question 3 Discussion

Actual exam question for Palo Alto Networks's SD-WAN-Engineer exam

Question #: 3
Topic #: 3

An administrator is configuring an ION 2000 device for a deployment where high availability is required, but the site has only a single internet circuit. The administrator configures a Bypass Pair (Fail-to-Wire) on ports 1 and 2 connecting the ISP modem to the legacy firewall.

If the ION device loses power, what is the resulting behavior of the traffic flowing through this Bypass Pair?

ATraffic is blocked to prevent uninspected packets from entering the network (Fail-to-Block).

BThe internal relay closes, physically bridging Port 1 and Port 2, allowing traffic to flow transparently between the modem and firewall.

CThe device reboots into 'Safe Mode' and acts as a Layer 2 switch.

DTraffic is rerouted to the LTE modem automatically.

Show Suggested Answer

Suggested Answer: B

Comprehensive and Detailed Explanation

The Bypass Pair feature on Prisma SD-WAN ION devices (specifically supported models like ION 2000, 3000, 7000, 9000) is a hardware-based resiliency mechanism known as Fail-to-Wire.

Operation: A 'Bypass Pair' logically groups two physical interfaces (e.g., WAN 1 and LAN 1). Under normal operation, the ION processes traffic between them.

Power Loss: In the event of a total power loss (or critical software failure), a mechanical relay inside the device physically closes the circuit between the two ports.

Result: This creates a direct electrical connection (like a patch cable) between the upstream device (ISP Modem) and the downstream device (Legacy Firewall or Router). This ensures that internet connectivity is preserved for the site, even if the SD-WAN appliance is completely dead. This is critical for single-point-of-failure deployments where maintaining basic dial-tone is more important than SD-WAN optimization during a hardware outage.

by Alfred at Dec 21, 2025, 07:50 AM

Limited Time Offer

25%

Off

Get Premium SD-WAN-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Barney

6 days ago

B) Yep, that's the one. Gotta love it when your network device just says "Screw it, I'm going on break" and lets the traffic flow freely.

upvoted 0 times

...

Monte

11 days ago

B) Definitely the right answer. I mean, who doesn't love a good ol' fashioned hardware bridge when the power goes out? It's like a network version of duct tape and baling wire.

upvoted 0 times

...

Jerilyn

16 days ago

Ah, the old "Fail-to-Wire" trick. Gotta love when your network just says "Nope, I'm out!" and goes straight to the pub.

upvoted 0 times

...

Pearlie

21 days ago

I vaguely recall something about Safe Mode, but that seems less likely in this scenario. I think it’s probably not C.

upvoted 0 times

...

Sean

26 days ago

I practiced a similar question, and I think the internal relay closing is the key point here. I would lean towards B as well.

upvoted 0 times

...

Trina

1 month ago

I'm not entirely sure, but I feel like Fail-to-Block would make sense to prevent any uninspected packets. Could it be A?

upvoted 0 times

...

Coletta

1 month ago

I remember studying bypass pairs, and I think if the ION device loses power, it should allow traffic to flow through the bypass. So, maybe it's B?

upvoted 0 times

...

Lemuel

1 month ago

I'm pretty confident about this one. The Bypass Pair is designed to maintain connectivity even if the device loses power, so the correct answer is option B - the internal relay closes to bridge the two ports and allow traffic to flow transparently.

upvoted 0 times

...

Sherill

2 months ago

Okay, let me break this down. The question says the Bypass Pair is configured to connect the ISP modem to the legacy firewall. If the ION device loses power, the ports should physically bridge to allow traffic to pass through, so I'm going to go with option B.

upvoted 0 times

...

Beula

2 months ago

Hmm, I'm a bit confused. I know the Bypass Pair is supposed to provide high availability, but I'm not sure how it behaves when the device loses power. I'll have to think this through carefully.

upvoted 0 times

...

Coleen

2 months ago

I think the key here is understanding what a Bypass Pair (Fail-to-Wire) does. If the ION device loses power, it should physically bridge the two ports to allow traffic to flow transparently between the modem and firewall, so I'll go with option B.

upvoted 0 times

...

Tarra

2 months ago

B) The internal relay closes, physically bridging Port 1 and Port 2, allowing traffic to flow transparently between the modem and firewall. This makes the most sense for a Fail-to-Wire setup.

upvoted 0 times

...

Scot

2 months ago

Totally agree, it's all about that fail-to-wire setup!

upvoted 0 times

...

Burma

2 months ago

Bypass Pair lets traffic flow if power's lost, right?

upvoted 0 times

...