Palo Alto Networks SD-WAN-Engineer Exam Questions

Comprehensive and Detailed Explanation

This behavior describes the 'Best Available Path' logic inherent in Prisma SD-WAN's availability design.

SLA Thresholds: Path Quality Profiles act as filters to identify compliant paths.

Total Violation: If all configured 'Active' paths violate the SLA (e.g., Path A has 2% loss, Path B has 5% loss, and the threshold is 1%), the system does not drop the traffic (Option A) because maintaining connectivity is prioritized over perfect quality.

Selection Logic: The system enters a fallback state where it compares the available active paths and selects the 'Least Bad' one---the path that is closest to meeting the SLA (in this case, Path A with 2% loss).

Backup Paths: Traffic would only move to a Backup path (Option D) if the policy explicitly configures the backup path to engage upon SLA violation of the active set. However, strictly speaking, if only active paths are considered and all fail, it picks the best of the active group rather than blackholing the traffic.

Comprehensive and Detailed Explanation

The Prisma SD-WAN (ION) QoS engine utilizes a hierarchical queuing structure designed to provide granular control over application performance. Each WAN interface on an ION device supports a total of 16 QoS queues.

This 16-queue structure is derived from a matrix of 4 Classes (often referred to as Priority Classes) multiplied by 4 Application Criteria (Traffic Types).2

4 Priority Classes: The system defines four high-level business priority categories:3

Platinum (Highest priority)4

Gold

Silver

Bronze (Lowest priority/Best Effort)5

4 Application Criteria (Sub-queues): Within each of the four priority classes, the system further categorizes traffic into four specific application types to ensure proper handling (e.g., ensuring voice doesn't get stuck behind bulk data even within the same priority level):6

Real-Time Video

Real-Time Audio

Transactional

Bulk7

Calculation: 4 Priority Classes 4 Application Types = 16 Total Queues per interface. This structure allows the scheduler to ensure that a 'Platinum' voice call is prioritized over 'Platinum' bulk data, and both are prioritized over 'Gold' traffic.

Comprehensive and Detailed Explanation

In the Prisma Access architecture (integrated with SD-WAN), distinct connection types serve different purposes.

Remote Networks: These are the connections from your Branch sites (using ION devices) into the cloud. They allow branches to get to the internet or other branches.

Service Connections (SC): This is a specialized high-bandwidth connection used to bridge the Prisma Access Cloud to your Private Data Center or Headquarters.

The primary use case for a Service Connection (Option A) is to allow mobile users and branch users (who are connected to the Prisma cloud) to reach private, centralized resources that still reside on-premise, such as Active Directory controllers, legacy databases, or mainframes. Without a Service Connection, users in the cloud would be able to reach the internet and each other, but not the servers physically located in your HQ data center. The CloudBlade automates the creation of these tunnels, but architecturally, the 'Service Connection' is the 'cloud-to-HQ' bridge.

Comprehensive and Detailed Explanation

Prisma SD-WAN separates real-time visibility from historical summarization.

Reports (C): The Reports section is the dedicated engine for generating historical summaries. Administrators can create custom report templates (e.g., 'Monthly Executive Summary') that include specific widgets like 'Top Applications by Volume,' 'Site Availability,' or 'Circuit Utilization.' Crucially, this feature allows for Scheduling, where the system automatically generates the PDF report at a set interval (e.g., first day of the month) and emails it to a distribution list.

Activity Charts (A) / Media Analytics (B): These provide interactive, visual graphs for ad-hoc analysis but are not designed for generating downloadable, scheduled PDF summaries for management.

Flow Browser (D): This is for deep-dive troubleshooting of individual sessions, not for high-level aggregate reporting.

Comprehensive and Detailed Explanation

The Bypass Pair feature on Prisma SD-WAN ION devices (specifically supported models like ION 2000, 3000, 7000, 9000) is a hardware-based resiliency mechanism known as Fail-to-Wire.

Operation: A 'Bypass Pair' logically groups two physical interfaces (e.g., WAN 1 and LAN 1). Under normal operation, the ION processes traffic between them.

Power Loss: In the event of a total power loss (or critical software failure), a mechanical relay inside the device physically closes the circuit between the two ports.

Result: This creates a direct electrical connection (like a patch cable) between the upstream device (ISP Modem) and the downstream device (Legacy Firewall or Router). This ensures that internet connectivity is preserved for the site, even if the SD-WAN appliance is completely dead. This is critical for single-point-of-failure deployments where maintaining basic dial-tone is more important than SD-WAN optimization during a hardware outage.