In the Prisma SD-WAN solution, multi-tenancy and network isolation are achieved through the use of Virtual Routing and Forwarding (VRF) instances. However, there are many operational scenarios-such as providing shared access to a common service (e.g., DNS, NTP) or a central Internet gateway-where traffic must transition between these isolated routing domains. This process is known as route leaking. In the Prisma SD-WAN management interface, route leaking is specifically configured within the VRF Profile. Unlike traditional CLI-based routers where route leaking might be configured under a global routing table or individual VRF definitions via import/export targets, Prisma SD-WAN utilizes a profile-based approach to ensure scalability and consistency across multiple sites. A VRF Profile acts as a template that defines the routing behavior for specific VRFs across the fabric. When an administrator navigates to the VRF Profile settings, they can define "Leaking Rules." These rules specify the "From VRF" (source) and "To VRF" (destination) parameters, along with the specific prefixes or default routes that should be shared. By placing this configuration within the VRF Profile rather than a site- specific configuration, Palo Alto Networks allows for a "configure once, apply many" workflow. Once the VRF Profile is updated with the leaking rules, any ION device associated with that profile will automatically update its local routing table to allow the specified inter-VRF communication. This centralized orchestration simplifies the management of complex segmentation requirements in large-scale SD-WAN deployments.
Question 32
In the Prisma SD-WAN portal, the Application Health dashboard assigns a color-coded "Health Score" (Green, Yellow, Red) to applications. Which three metrics are combined to calculate this composite AppX (Application Experience) score? (Choose three.)
Correct Answer: A,B,C
Comprehensive and Detailed Explanation The AppX (Application Experience) score is a proprietary metric used by Prisma SD-WAN to provide a holistic view of user experience, rather than just network statistics. It is calculated based on three key components: Transaction Failure Rate (A): The percentage of application transactions that failed (e.g., TCP resets, HTTP 500 errors). This indicates availability. Network Transfer Time (B): The time taken for packets to traverse the network (WAN/LAN latency). This indicates network health. Server Response Time (C): The time taken by the application server to respond to a request. This indicates backend performance. Why not D or E? Bandwidth Utilization (D) is a capacity metric, not a direct measure of quality. A link can be 90% full but still deliver packets quickly (good AppX), or 10% full but dropping packets (bad AppX). Jitter (E) is a network-layer metric primarily relevant for UDP Real-Time media. While important, the high-level "AppX" score for general TCP apps focuses on the "Time-to-Glass" metrics (NTT/SRT) and success rates.
Question 33
When configuring SASE connectivity with easy onboarding at a branch, which two options must be selected? (Choose two.)
Correct Answer: B,D
Prisma SD-WAN simplifies the integration with Prisma Access through a feature known as "CloudBlades," specifically the Prisma Access for Networks CloudBlade. The "easy onboarding" workflow is designed to automate the complex task of establishing secure tunnels between Branch ION devices and the SASE security processing nodes (SPNs). When an administrator initiates this process, the system abstracts the manual configuration of IKE and IPSec parameters. Instead of manually defining an IPSec Crypto Profile or an IKE Profile (which are automatically handled by the CloudBlade orchestration), the user must specify where the traffic is going and which physical resources will handle the connection. The Prisma Access Primary Location (Option B) is a mandatory selection because it determines the geographical region and specific compute instance within the Prisma Access cloud that will serve as the primary security gateway for that branch. Furthermore, the IPSec Termination Node (Option D) must be selected to define the specific endpoint within the Prisma Access infrastructure where the ION device's tunnels will terminate. This selection ensures that the Controller can properly orchestrate the site-to-site VPN tunnels, ensuring that the branch traffic is correctly routed to the SASE fabric for security inspection. By selecting these two options, the CloudBlade can automatically negotiate the rest of the tunnel parameters, significantly reducing the potential for human error and accelerating the deployment of a Secure Access Service Edge (SASE) architecture across multiple branch locations.
Question 34
When using the CloudBlade to integrate Prisma SD-WAN with Prisma Access, how does the system ensure that the IPSec tunnels between the branch ION and the Prisma Access Security Processing Node (SPN) are kept alive during periods of no user traffic?
Correct Answer: C
Comprehensive and Detailed Explanation The stability of VPN tunnels in the Prisma SD-WAN + Prisma Access integration relies on standard IPSec mechanisms. Dead Peer Detection (DPD): The CloudBlade configuration automatically enables DPD on the IPSec tunnels it provisions. * Mechanism: DPD is a standard keepalive mechanism where the ION device sends periodic "R-U- THERE" messages to the Prisma Access gateway (and vice versa). If no acknowledgment is received after a specific count/timer, the ION marks the tunnel as down and attempts to re-key or switch to a backup path. * Synthetic Probes (B): While Synthetic Probes (part of ADEM or Path Quality monitoring) can be configured to measure latency/loss, the fundamental mechanism that keeps the IPSec security association (SA) active and detects link failure is DPD, not an application-layer probe.
Question 35
Based on the HA topology image below, which two statements describe the end-state when power is removed from the ION 1200-S labeled "Active", assuming that the ION labeled "Standby" becomes the active ION? (Choose two.)
Correct Answer: A,C
Comprehensive and Detailed Explanation at least 150 to 250 words each from Palo Alto Networks SD-WAN Engineer documents: Prisma SD-WAN High Availability (HA) for branch ION devices, particularly the Gen-2 ION 1200-S, is designed to provide "100% WAN Capacity" preservation during a hardware or power failure. This is achieved through the use of Bypass Pairs (Fail-to-Wire). In the provided topology, the ISP A and LTE/5G circuits are cross-connected using the bypass ports (typically ports 3 and 4 on the ION 1200-S). When the "Active" ION device loses power, the internal physical relays in its bypass ports transition to a closed state, effectively creating a physical bridge between the ports. In this scenario, the LTE/5G signal-which enters the Active ION's port 4-is mechanically bridged to port 3, allowing it to pass through to port 4 of the Standby ION. Simultaneously, ISP A is already connected to the Standby ION. Consequently, once the Standby device completes its transition to the "Active" state, it has physical access to both WAN circuits, validating Statement A. Regarding the LAN transition, Prisma SD-WAN does not use standard VRRP for ION-to-ION HA; instead, it uses a proprietary Control Plane HA mechanism. When the failover occurs, the newly active ION takes over the IP addresses of all configured Switch Virtual Interfaces (SVIs) and LAN interfaces. To ensure the downstream Layer 2 infrastructure (like the LAN switches shown in the diagram) updates its MAC address tables to point to the new physical hardware for those IPs, the newly active ION immediately broadcasts a Gratuitous ARP (GARP). This ensures that LAN traffic is correctly steered to the new device without a significant timeout, validating Statement C.
