Free Palo Alto Networks SD-WAN-Engineer Exam Questions

Become Palo Alto Networks Certified with updated SD-WAN-Engineer exam questions and correct answers

Page: 1 / 18

Total 87 Questions | Updated On: Jun 17, 2026

Add To Cart

Question 1

A network engineer is troubleshooting a "Voice Quality" issue. They suspect that the DSCP markings arebeing stripped or altered by the ISP.Which tool in the Prisma SD-WAN portal allows the engineer to capture live packets on the WAN interfaceand inspect the IP header ToS/DSCP field?

A : Flow Browser

B : Packet Capture (PCAP)

C : Path Quality Monitor

D : Event Logs

Answer: B

Question 2

Full discovery and classification of IoT devices by the IoT Security service is failing. Which Prisma SDWAN ION device configuration will cause this behavior?

A : The ION devices are missing DHCP Configuration. If ION devices are not explicitly configured aseither a DHCP relay agent or a DHCP server, DHCP traffic logs will not be sent to the Strata LoggingService, resulting in incomplete device profiles for IoT Security.

B : The Prisma SD-WAN ION devices lack properly configured or enabled Service Health Probesspecifically targeting the IoT device subnets. Without these active probes, the system cannot gathercritical real-time reachability and performance metrics essential for dynamic device profiling andclassification.

C : The Syslog export configuration on the ION devices to the Strata Logging Service has filters that aretoo restrictive, potentially excluding logs vital for IoT Security’s device identification and classificationengine. This prevents comprehensive event data, including device discovery messages, from reachingthe portal.

D : The ION devices are not configured to explicitly enable and export IPFIX flow records, especially thosecontaining Layer 2 and Layer 7 context, to the Strata Logging Service for IoT Security. While ARPdata is sent by default, comprehensive device classification relies on these detailed flow records, whichare not being captured.

Answer: A

Question 3

What are two requirements for implementing user/group-based path policies? (Choose two.)

A : Cloud Identity Engine

B : Internal host detection

C : Autonomous Digital Experience Manager (ADEM)

D : Data center ION

Answer: A,D

Question 4

Which troubleshooting action should be taken when resources at one branch site can reach the internet butcannot be reached from the data center (DC)?

A : Create static route with DC ION as a next hop.

B : Ensure the LAN branch prefixes are set to “global.”

C : Set the site in a control mode.

D : Admin up the Prisma SD-WAN DC endpoints.

Answer: B

Question 5

While designing a greenfield Prisma SD-WAN solution for a retailer, the risk management group requiressegmentation of the retail network to avoid one large fault domain.The following data points are provided:Two data centers and all sites need to access applications in both data centers1000 retail branches with stores concentrated in multiple metropolitan areasData Center 1 and Data Center 2 have different sets of applications that are not replicatedMaintaining application availability is the primary goalWhich action will segment the retail network and reduce regional outages?

A : Implement a single, large data center cluster spanning both data centers to centralize management andoptimize resource use.

B : Create more than one data center cluster for a larger pool of resources and resiliency.

C : Create more than one data center cluster in each data center and assign sites to clusters so nearby retaillocations can be spread on separate clusters.

D : Add more data center aggregation devices within the same cluster to enhance the scalability andresilience.

Answer: C

Page: 1 / 18

Total 87 Questions | Updated On: Jun 17, 2026

Add To Cart