Palo Alto Networks Certified SD-WAN Engineer Free Sample Questions

Per the April 2024 ION specifications, the ION 9000 (positioned for multigigabit remote-office data centers and large campuses) has 8 x 10 GE SFP+ ports, four bypass (fail-to-wire) pairs, and 8 Gbps encrypted throughput in branch mode (15 Gbps in DC mode), and supports branch HA. The ION 1200 (700 Mbps, no 10 GE) and ION 3200 (1 Gbps branch, 1 GE RJ45/SFP combo ports, one bypass pair) fall short, and the legacy ION 3000 has only 1 GE RJ45 ports. The ION 9000 has since been succeeded by the ION 9200.

Prisma SD-WAN branch HA allows one HA group per branch site with up to two devices. One is elected active and handles path selection, BGP, VPNs and statistics; the other is the backup and only bridges traffic to the active device. Fail-to-wire cabling lets the active ION use the full capacity of all WAN circuits. Liveliness uses VRRP advertisements on the HA control interface (interval 200 ms-10 s); after 3 missed advertisements the backup becomes active. Priority (up to 255, with at least 40 difference recommended), optional preemption and up to four tracked interfaces control the election, and DHCP leases are synchronized from active to backup.

Path Policy rules in Prisma SD-WAN are used to define traffic steering logic. They allow administrators to select paths (Active/Backup) based on application types and specific SLA requirements (latency, jitter, packet loss).

CloudBlades are API-based integrations in the Prisma SD-WAN controller that automate connectivity to third-party services. For example, the Zscaler Internet Access CloudBlade automatically integrates the controller, the remote IONs and the Zscaler Enforcement Nodes, building the Standard VPN (IPsec/GRE) tunnels; the Admin Guide points to CloudBlades for streamlined autoconfiguration of IPsec or GRE tunnels. A virtual ION is a device form factor, and 'Prisma Access Connector' and 'App-Fabric Gateway' are not integration platforms.

Path policy rules list Active, Backup and L3 Failure paths, each an overlay (Direct, Prisma SD-WAN VPN or Standard VPN) plus a circuit category. A guest rule whose only paths are Direct on the internet circuit category keeps guest traffic local, while corporate rules keep using the VPN to the data center. By default, Prisma SD-WAN performs Source NAT out of the box on traffic going directly to public internet interfaces, so no extra NAT rule is needed unless custom translation is required.

Branch IONs treat each underlay and Standard VPN as a separate routing domain and do not advertise routes learned from one domain into another, so a branch never dynamically becomes a transit point. Branches build Secure Fabric VPNs to the data centers. From ION 6.5.1, DC-to-DC Secure Fabric Links can be created under Data Centers > Overlay Connections, and prefixes learned on inter-DC VPNs are not redistributed further, which prevents loops. There is no 'Transit' toggle on branch sites.

Secure Fabric tunnels between IONs are always IPsec-encrypted with AES-256-GCM, AES-256-CBC, AES-128-GCM or AES-128-CBC; the controller picks the best common cipher. They do not use IKE. The controller sends three encrypted shared secrets (each valid for one day), the endpoints exchange nonces and derive tunnel-specific session keys, and the keys are renegotiated every hour without the controller (tunnels survive up to 3 days without it). IKEv1/IKEv2 apply only to Standard VPNs, and encryption cannot be turned off per circuit.

A path policy rule can use only the paths it lists: Active paths (load-shared while SLA-compliant), Backup paths and L3 Failure paths, each an overlay plus a circuit category. If the guest rule lists only the public Broadband and LTE circuit categories, guest traffic can never be placed on MPLS. Listing MPLS as a Backup path would allow it, and a security rule is not the intended path-steering control.

Per the Prisma SD-WAN Administrator's Guide (Connect the ION Device), the ION controller port is DHCP-enabled by default and must be connected to a subnet with internet access; models without a dedicated controller port use port 1 or port 2 on a DHCP-enabled network. The device then resolves and connects to the controller (controller.cgnx.net / locator.cgnx.net over TCP 443), changes from Offline to Online, and can be claimed and assigned to its site, after which the controller pushes the site configuration. A static IP (set from the AUX console) is needed only when the circuit has no DHCP; there is no claim key and no MPLS-first requirement.

Prisma SD-WAN site configuration templates are Jinja blueprints. Values that differ per site, such as LAN subnets, are turned into variables with 'Make Variable' and rendered as {{ variable_name }}; each site's value is supplied in the CSV site data file (or entered manually) when the sites are deployed, so one template serves all 50 sites. Device shells only pre-stage a device configuration before the hardware arrives, 'Site Overrides' are not a Prisma SD-WAN template feature, and dynamic routing does not assign LAN subnets.