Two branch sites, "Branch-A" and "Branch-B", are both behind active NAT devices (Source NAT) on their local internet circuits.
What requirement must be met for these two branches to successfully establish a direct Dynamic VPN (ION- to-ION) tunnel over the internet?

• A.One of the sites must have a Static Public IP (1:1 NAT) to act as the initiator.
• B.Both sites must disable NAT and use public IPs on the ION interface.
• C.The ION devices automatically use STUN (Session Traversal Utilities for NAT) to discover their public IPs and negotiate the connection.
• D.Dynamic VPNs are not supported if both sides are behind NAT.

Comment: *

Name: *

Email: *

Verification: *

A network administrator is viewing the Flow Browser to investigate a report that a specific user cannot access an internal web server. The flow entry for this traffic shows the "Flow State" as "INIT" and it remains in that state until it times out.
What does the "INIT" state indicate about the traffic flow?

• A.The TCP 3-way handshake was completed successfully, and data is being transferred.
• B.The ION device received the SYN packet from the client but never saw a SYN-ACK response from the server.
• C.The flow was denied by a Zone-Based Firewall policy on the ION.
• D.The traffic is being buffered while the ION waits for a dynamic VPN tunnel to establish.

Comment: *

Name: *

Email: *

Verification: *

An administrator has configured a Path Policy for "ERP_Traffic". The policy allows two public internet links,
"ISP-A" and "ISP-B", both marked as "Active". The Path Quality Profile (SLA) requires a latency of less than
150ms. Currently, both ISP-A and ISP-B have a latency of 40ms, well within the SLA.
How does the Prisma SD-WAN ION determine which link to use for a new flow of "ERP_Traffic" when both active paths meet the SLA requirements?

• A.It selects the path with the lowest numerical latency (e.g., if ISP-A drops to 39ms).
• B.It selects the path with the highest available bandwidth capacity.
• C.It duplicates the packets across both paths (Packet Duplication) to ensure delivery.
• D.It selects the path that appears first in the interface configuration list.

Comment: *

Name: *

Email: *

Verification: *

A site has two internet circuits: Circuit A with 500 Mbps capacity and Circuit B with 100 Mbps capacity.
Which path policy configuration will ensure traffic is automatically shifted from a saturated circuit to the circuit with available bandwidth?

• A.Circuit A as an active, Circuit B as a backup
• B.Circuit B as an active, Circuit A as a backup
• C.Both circuits under active path
• D.Circuit B as an L3 failure path

Comment: *

Name: *

Email: *

Verification: *

An administrator is configuring an ION 2000 device for a deployment where high availability is required, but the site has only a single internet circuit. The administrator configures a Bypass Pair (Fail-to-Wire) on ports 1 and 2 connecting the ISP modem to the legacy firewall.
If the ION device loses power, what is the resulting behavior of the traffic flowing through this Bypass Pair?

• A.Traffic is blocked to prevent uninspected packets from entering the network (Fail-to-Block).
• B.The internal relay closes, physically bridging Port 1 and Port 2, allowing traffic to flow transparently between the modem and firewall.
• C.The device reboots into "Safe Mode" and acts as a Layer 2 switch.
• D.Traffic is rerouted to the LTE modem automatically.

Comment: *

Name: *

Email: *

Verification: *