What is the purpose of Secure Group Tag (SGT) propagation in Prisma SD-WAN?
Correct Answer: A
In modern enterprise environments, maintaining a consistent security posture across disparate network domains is a major challenge. Prisma SD-WAN addresses this by supporting Secure Group Tag (SGT) propagation. SGTs are a key component of Cisco's TrustSec architecture, used to classify traffic based on the identity of the source (users, devices, or groups) rather than just IP addresses. By supporting SGT propagation, Prisma SD-WAN allows organizations to integrate with external identity-based security solutions seamlessly. When traffic enters an ION device from a LAN segment where SGTs are already applied (typically by an access layer switch or an Identity Services Engine), the ION device can be configured to preserve or "propagate" these tags as the traffic traverses the SD-WAN fabric.6 This ensures that the identity context remains intact even after the traffic has crossed the WAN.7 When the traffic reaches its destination-whether that is a data center, another branch, or a security gateway-the receiving device can use the SGT to enforce granular security policies. This integration is vital for organizations moving toward a Zero Trust architecture. Instead of rewriting complex firewall rules at every hop, the SGT acts as a portable identity badge. Prisma SD-WAN's ability to handle these tags allows it to participate in a larger security ecosystem, ensuring that a "Finance" user is treated with the same security restrictions at a remote branch as they would be at the corporate headquarters. This eliminates the need for manual IP-to-Group mapping across the WAN, reducing administrative overhead and minimizing the risk of security gaps during lateral movement of traffic.
Question 47
BGP core peers on data center IONs are learning only a default route from the core router. Which action will protect the SD-WAN network from getting isolated in the event of BGP misconfiguration on the core routers?
Correct Answer: C
In a Data Center (DC) deployment, the ION device typically peers with a core router via Border Gateway Protocol (BGP) to exchange reachability information between the SD-WAN fabric and the legacy corporate network.2 When the ION is configured to learn only a default route ($0.0.0.0/0$) from the core, the entire SD- WAN fabric relies on this single BGP-learned route to reach internal resources not directly connected to the ION. The primary risk in this design is network isolation caused by a BGP misconfiguration or a "soft failure" on the core router. If the BGP session stays "Up" but the core router stops advertising the default route due to a configuration error, the ION device will remove the route from its routing table. Without a valid path to the core, the branch sites connected to the DC ION will lose connectivity to all data center resources. To mitigate this, the recommended best practice is to add a static default route with a higher Administrative Distance (AD) pointing to the core peer IPs.3 This acts as a "floating static route." Under normal operations, the BGP-learned default route (typically with an AD of 20 for eBGP) remains active in the routing table. If the BGP advertisement fails, the static route with the higher AD (e.g., 250) becomes active. This ensures that the ION device maintains a persistent gateway toward the core infrastructure, preventing total fabric isolation and providing a fail-safe mechanism while the BGP peering issue is remediated. While BFD (Option A) helps with fast peer failure detection, it does not solve the issue of a missing prefix advertisement. Static route redundancy provides the necessary architectural "safety net" for the data center's reachability.
Question 48
A customer wants to deploy Prisma SD-WAN ION devices at small home offices that use consumer-grade broadband routers. These routers typically use Symmetric NAT and do not allow static port forwarding. Which standard mechanism does Prisma SD-WAN utilize to successfully establish direct Branch-to-Branch (Dynamic) VPN tunnels through these Symmetric NAT devices?
Correct Answer: B
Comprehensive and Detailed Explanation Prisma SD-WAN utilizes STUN (Session Traversal Utilities for NAT) to facilitate NAT Traversal for its Secure Fabric overlay. Discovery: When an ION device connects to the internet behind a NAT router, it reaches out to the Prisma SD-WAN Controller. The controller acts as a STUN server, identifying the public IP address and port that the ION's traffic is originating from. Symmetric NAT Challenge: In Symmetric NAT, the mapping changes for every destination. However, the Prisma SD-WAN architecture is designed to handle this by having the controller coordinate the connection attempt. Hole Punching: The controller shares the discovered public mapping information between two peer ION devices. They then simultaneously initiate traffic to each other's public IP/Port (a technique called "UDP Hole Punching"). This tricks the intermediate NAT devices into allowing the inbound traffic, establishing a direct P2P IPSec tunnel without requiring manual port forwarding or static IPs at the edge.
