Palo Alto Networks SD-WAN-Engineer Exam Questions

In complex retail or banking environments, maintaining strict network segmentation is a regulatory and security requirement. Prisma SD-WAN utilizes Virtual Routing and Forwarding (VRF) to provide this isolation, ensuring that high-security traffic, such as ATM transactions or teller cash registers, remains logically separated from Guest Wi-Fi or general corporate applications. While isolation is the default state, route leaking is used to allow specific communication between these VRFs---for instance, allowing multiple isolated segments to reach a common shared service like a DNS server or a centralized security gateway.

To verify that these configurations have been correctly pushed from the Controller to the local ION device, administrators utilize the ION CLI (Command Line Interface) for deep-dive diagnostics. The command inspect vrf route_leak_rule all is the definitive tool for this purpose. Unlike 'show' commands which typically provide interface status, 'inspect' commands in the Prisma SD-WAN ecosystem are designed to pull real-time operational state data from the control plane's internal databases.

When executed, this command displays the specific prefix-level rules that allow routes to 'leak' from one VRF table into another. It provides visibility into the source VRF, the destination VRF, and the exact network prefixes or default routes being shared. This is critical for troubleshooting 'Day 2' operations; if a teller register cannot reach a shared database, the administrator can use this command to confirm if the necessary route leak rule is active and accurately reflecting the intent of the VRF Profile configured in the portal. Without this command, verifying inter-VRF reachability would be limited to trial-and-error connectivity tests, making it an essential part of the Prisma SD-WAN engineer's toolkit.

The Prisma SD-WAN (ION) device includes a native, application-aware Zone-Based Firewall (ZBFW) that provides comprehensive security within the branch without the mandatory requirement for additional hardware.2 The fundamental principle of this architecture is the grouping of interfaces and sub-interfaces into logical Security Zones.3 Once these zones are defined (e.g., LAN, WAN, Guest, IoT), the administrator can create security policies that govern the traffic permitted to flow between them.4

Unlike traditional routers that rely on stateless Access Control Lists (ACLs) which are difficult to manage and lack application visibility, the Prisma SD-WAN ZBFW is stateful and application-aware.5 This means it can apply granular control over North-South traffic (flows moving between the LAN and the WAN/Internet) and East-West traffic (flows moving between different segments within the LAN, such as from a Guest zone to a Corporate zone).6

By using security zones, an ION device can ensure that even if two local networks are connected to the same physical appliance, they remain completely isolated unless a specific policy explicitly allows communication. This 'Zero Trust' approach at the branch edge allows organizations to segment vulnerable devices (like IoT) from critical internal resources and strictly control how users access the internet or the corporate data center.7 The ZBFW works in tandem with the global controller to ensure that security postures are consistent across all branch locations, eliminating the complexity of manual ACL management at each site.8

Comprehensive and Detailed Explanation

Prisma SD-WAN (formerly CloudGenix) integrates with Palo Alto Networks IoT Security to provide comprehensive visibility into all devices at a branch, including those that are not directly connected to the ION device. While the ION automatically detects and classifies devices connected directly to its interfaces via traffic inspection (DPI), DHCP, and ARP analysis, gaining visibility into off-branch devices (devices connected to downstream switches or access points) requires additional discovery mechanisms that can query the network infrastructure or ingest its logs.

1. SNMP (Simple Network Management Protocol): This is the primary active discovery method for off-branch devices. The Prisma SD-WAN ION device acts as a sensor that actively polls local network switches and wireless controllers using SNMP. By querying the ARP tables and MAC address tables (Bridge MIBs) of these intermediate network devices, the ION can identify endpoints that are connected to the switch ports, even if those endpoints are not currently sending traffic through the ION. This allows the system to map the topology and discover silent or lateral-traffic-only devices.

2. Syslog: In conjunction with SNMP, the IoT Security solution can utilize Syslog messages to discover and profile devices. Network infrastructure devices (like switches and WLAN controllers) can be configured to send Syslog messages to the collection point (which enables the IoT Security service) whenever a device connects or disconnects (e.g., port up/down events, DHCP snooping logs, or 802.1x authentication logs). These logs provide real-time data about device presence and identity (MAC/IP mappings) for devices that are not directly adjacent to the ION, ensuring 100% visibility across the branch network segments. LLDP (A) and CDP (B) are typically Link Layer discovery protocols used for discovering directly connected neighbors and do not propagate beyond the immediate link, making them unsuitable for discovering devices multiple hops away or behind a switch.

Comprehensive and Detailed Explanation

When deploying Prisma Access for Remote Networks (connecting branch offices), the licensing and throughput model is based on aggregate bandwidth allocated to specific compute locations (regions).

Bandwidth Allocation (Option D): Administrators must purchase and allocate a specific amount of bandwidth (e.g., 500 Mbps, 1 Gbps) to a Prisma Access 'Compute Location' (e.g., US West, Europe Central). This allocated bandwidth is then shared as a pool among all the branch sites (Remote Networks) that onboard and terminate their IPSec tunnels at that specific location. The system does not allocate bandwidth on a strict per-site basis but rather enforces the limit on the aggregate throughput of the compute node itself.

Policy Enforcement (Option A): Security policies for Prisma Access are enforced in the cloud (at the Prisma Access Service Processing Node), not pushed down to the branch ION devices for local enforcement. The ION device handles local segmentation (ZBFW) and traffic steering, but the 'Remote Network' security stack resides in the cloud.

Path Usage (Option C): Prisma SD-WAN is designed to utilize Active/Active paths. When a branch has multiple internet circuits connected to Prisma Access, the CloudBlade and ION automatically build tunnels on all compatible paths and can load-balance traffic across them based on application performance (SLA), rather than defaulting to a strict Active/Standby model for internet traffic.

Comprehensive and Detailed Explanation

The Self-Zone is a predefined security zone in the Prisma SD-WAN ZBFW that represents the ION device's own control plane and management traffic.

Default Rule: The security policy contains an implicit, uneditable default rule that Allows traffic originating from the Self-Zone to any destination zone (Internet, Private WAN, etc.).

Rationale: This ensures that the device can always perform essential critical functions---such as connecting to the Cloud Controller, resolving DNS, syncing time via NTP, and establishing VPN tunnels---without the administrator needing to manually create 'Allow' rules for the device itself. If this traffic were blocked by a 'Deny All' default, the device would become unmanageable (bricked) immediately after applying the policy.