Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Which log file on the ION device provides the most detailed information about WAN interface flapping?
flow.log
controller.log
auth.log
system.log
The system.log records detailed interface state transitions, including link up/down events and the underlying causes of WAN interface flapping, such as physical layer errors or keepalive timeouts. It satisfies the stem's requirement for the most detailed diagnostic information, offering greater granularity than event or alarm logs.
You notice an ION device is showing as 'Disconnected' in the Controller UI. What is the first step you should take?
Check physical interface status and WAN connectivity
Checking physical interface status and WAN connectivity directly addresses the most likely cause of an ION device losing its management tunnel to the Controller: a down WAN link or failed physical port. Since the device cannot reach the Controller without underlay connectivity, verifying layer 1 and WAN reachability first isolates the fault before deeper troubleshooting.
Upgrade the device firmware
Reboot the ION device
Delete and recreate the site
When analyzing a PCAP from an ION device, you see 'ICMP Destination Unreachable'. Which policy is most likely causing this?
Security Policy
ICMP Destination Unreachable is generated when a packet is administratively blocked, which is the action a Security Policy takes on the ION device; routing or QoS policies would drop or reclassify traffic without returning that ICMP error.
NAT Policy
QoS Policy
Path Selection Policy
A specific branch is failing to steer traffic via the preferred ISP despite a defined Path Policy. What is the most likely cause?
Incorrect application identification
Path policies match traffic by application signature; if the application is misidentified, the flow never matches the policy and falls through to default routing, so it exits via the wrong ISP despite the policy existing.
License expiry
Restart the WAN interface
Controller outage
BGP cost is too high
A branch site reports intermittent application slowness. Which tool in the Prisma SD-WAN ION dashboard is best for viewing real-time latency and jitter metrics per path?
BGP Neighbors
Flow Summary
Path Quality
Path Quality displays real-time per-path latency, jitter and loss for each WAN circuit, directly matching the intermittent slowness investigation. Flow Monitor and event logs show sessions or alarms rather than live path performance metrics, so Path Quality isolates which link degrades.
Security Events
A site has two ISPs. Traffic is only using one. What is the best way to verify if both paths are available?
Ping from the LAN
Review firewall rules
Check Path Quality dashboard
The Path Quality dashboard reports per-tunnel metrics for every WAN member, including reachability, latency, jitter and packet loss. Because the site has two ISPs, this view confirms whether the standby path is actually up and passing probes, rather than merely configured. It directly satisfies the requirement to verify both paths are available.
Check the BGP summary
Want more Troubleshooting practice?
Practice this domainWhich command or interface action is used to verify the current status of the SD-WAN overlay tunnels?
Show tunnels view in the Controller
The Controller's Show tunnels view displays per-tunnel operational state, including BFD session status and uptime, for every WAN edge device in the overlay. This gives the authoritative control-plane and data-plane view needed to verify whether IPsec tunnels are up, down or flapping.
show routing table
show interface status
ping gateway
A branch office requires local breakout for SaaS traffic. How do you configure the policy to ensure this traffic does not traverse the data center?
Set the VRF to global
Apply a hub-and-spoke routing policy
Configure a destination-based policy with a Local Breakout action
A destination-based policy matches traffic by its target address, so SaaS prefixes can be steered to a Local Breakout action that sends them directly out the branch WAN interface. This satisfies the requirement that SaaS traffic must not traverse the data centre.
Enable NAT on the WAN interface
You are implementing a QoS policy. Why would you configure a 'Shaping' rate on a WAN interface?
To enable load balancing
To increase the circuit bandwidth
To match the physical interface speed
To manage congestion and match the provider's provisioned rate
Shaping buffers excess traffic and delays it, rather than dropping it as policing does, so egress never exceeds the provider's provisioned rate. This directly satisfies the stem's congestion-management goal by smoothing bursts to the contracted bandwidth, preventing downstream provider drops.
What is the impact of assigning a site to a specific 'Site Group' in a Prisma SD-WAN policy?
It allows the application of policy sets to multiple sites simultaneously
Site Groups are logical collections of sites, and policy sets are attached to the group rather than each site individually. Assigning a site to a group therefore lets one policy set apply to every member site at once, satisfying the requirement to configure multiple sites simultaneously.
It creates a new physical network
It forces all sites into the same VRF
It limits the number of peers
You are configuring a path policy to prioritize VoIP traffic. Which specific metric should you leverage to ensure the best call quality when multiple paths are available?
DSCP marking
Bandwidth consumption
Source IP address
Path performance metric
Path performance continuously measures latency, jitter and packet loss across available WAN paths, letting the policy steer VoIP flows onto the healthiest link. Voice quality depends on these real-time characteristics rather than static attributes, so this metric directly satisfies the prioritisation requirement.
When configuring an ION device as a gateway for a cloud environment, what is the primary role of a 'Service' interface?
To provide connectivity to LAN-side services or segments
A Service interface on an ION device connects to LAN-side services or segments, allowing local traffic to reach internal resources. It is distinct from WAN or tunnel interfaces, which handle overlay connectivity toward remote sites or cloud environments.
To provide management access
To update firmware
To connect to the ISP modem
Want more Deployment And Configuration practice?
Practice this domainA network administrator is configuring Prisma SD-WAN to integrate with Prisma Access using the Automated Service Connection. During the onboarding process, which specific parameter must be configured in the ION device's service route to ensure traffic is correctly steered to the Prisma Access Service Infrastructure?
The specific Service Connection object representing the Prisma Access tunnel
The Service Connection object binds the ION device's service route to the specific Prisma Access tunnel, steering matching traffic into the service infrastructure. Without this binding, the ION cannot identify which tunnel carries the Automated Service Connection.
The WAN interface MTU size exclusively
The BGP AS number of the remote Prisma Access node
The local controller's IP address
You are deploying Cloud Identity Engine (CIE) to enable identity-based security policies across your SD-WAN and SASE environment. Which configuration step is required to ensure that user identity information is successfully propagated from the enterprise directory to the Prisma Access security nodes?
Link the Prisma Access instance to the CIE instance using the API Key and Tenant ID
Linking Prisma Access to the Cloud Identity Engine via API Key and Tenant ID authorises the security nodes to query CIE for user-to-IP mappings. Without this binding, directory identity data cannot be retrieved, so identity-based policies fail to resolve users.
Configure a local user database on every ION device
Manually map IP addresses to usernames in the Cloud SWG UI
Enable the Identity Service on the Prisma SD-WAN Controller
In a Unified SASE architecture, an administrator needs to ensure that branch offices prioritize voice traffic while using Prisma Access. Where should the Quality of Service (QoS) policy be defined to ensure consistent application performance?
On the local ION device CLI only
Inside the Prisma Access Security Policy
On the Prisma SD-WAN Controller under Application QoS Policy
Defining QoS on the Prisma SD-WAN Controller's Application QoS Policy lets the controller classify and prioritise voice across all branches centrally, satisfying the consistent-performance constraint. Edge-only policies would vary per site and could not enforce uniform priority.
Within the Cloud Identity Engine
A customer is experiencing intermittent connectivity to internal applications after enabling Unified SASE. Traffic is being routed through Prisma Access. What is the most likely cause?
The ION device is overheating
MTU size mismatch leading to packet fragmentation
Prisma Access adds encapsulation overhead, reducing the effective MTU on the tunnel. If the ION's interface MTU is not lowered accordingly, larger packets are dropped rather than fragmented, producing intermittent failures on internal applications that exchange bulk data.
Incorrect DNS server configuration
Identity cache expiration in CIE
An engineer is troubleshooting a scenario where users at a branch office cannot access SaaS applications via Prisma Access. The SD-WAN path is active, but the traffic is not reaching the Cloud SWG. What is the most likely cause related to the Unified SASE policy?
The ION device is missing the latest firmware
The Cloud Identity Engine is not reachable
The Security Policy rule for the branch traffic is set to 'Direct to Internet' instead of 'Service Connection'
The Unified SASE policy action determines whether branch traffic traverses the Prisma Access service infrastructure or exits locally. 'Direct to Internet' bypasses Cloud SWG entirely, so SaaS traffic never reaches it despite the active SD-WAN path.
The WAN port is set to DHCP
You are verifying the status of a Service Connection between a branch ION and Prisma Access. Which command or dashboard view provides the most accurate status of the tunnel reachability?
The ION device hardware health tab
The Controller Service Connection Status Dashboard
The Controller Service Connection Status Dashboard reports tunnel state as seen by the controller, showing whether the branch ION's Service Connection to Prisma Access is up or down, which is more authoritative than local interface or routing output.
The local device ARP table
The cloud provider logs
Want more Unified SASE practice?
Practice this domainA branch office uses both MPLS and Broadband. The design requires that business-critical traffic prefers MPLS, failing over to Broadband only if the MPLS path experiences packet loss exceeding 1%. Which metric should the PFR policy utilize?
Bandwidth Utilization
Packet Loss
This is the specific metric to trigger the failover based on the 1% threshold.
Jitter
Round Trip Time (RTT)
A customer requires a granular segmentation strategy where HR, Engineering, and Guest traffic must remain isolated across the SD-WAN fabric. Which configuration construct provides this logical separation?
IPsec Tunnel Groups
Virtual Networks (VNets)
Virtual Networks create separate logical routing and forwarding domains on the same SD-WAN fabric, so HR, Engineering and Guest traffic never share a topology segment. This delivers the granular isolation the segmentation strategy requires, unlike simple VLAN or policy-based segmentation.
Subnet Masking
VLAN Tagging
A network architect is designing a branch site deployment requiring sub-second failover. Which Prisma SD-WAN component must be configured to prioritize real-time traffic across multiple transport paths based on path quality metrics?
Performance Routing (PFR) Policy
Performance Routing (PFR) Policy continuously measures path quality metrics such as latency, jitter and packet loss across multiple transports, then steers real-time traffic onto the best-performing path. This satisfies the sub-second failover requirement by reacting to degradation before sessions break.
Traffic Policing Rule
NAT Control Policy
Access Control List (ACL)
Which Prisma SD-WAN tool is used to monitor real-time health and performance of the SD-WAN fabric during the deployment phase?
SNMP Traps
CLI Debugging
Controller Dashboard
The Controller Dashboard provides live telemetry on fabric health, including tunnel status, path quality and device reachability, directly satisfying the real-time monitoring requirement during deployment. Unlike configuration or policy tools, it aggregates current operational state across all sites, letting engineers verify connectivity and performance as branches are brought online.
Packet Capture (PCAP)
What is the primary function of the CloudBlades platform in the Prisma SD-WAN architecture?
Encryption key rotation
Hardware acceleration
Local breakout management
API-based service integration
CloudBlades provides an API-based framework that integrates Palo Alto Networks Prisma SD-WAN with third-party and cloud services, enabling automated service insertion without appliance changes. This satisfies the architecture's requirement for extensible, API-driven service integration across branches.
During pre-deployment planning for a high-security site, you must implement an identity-aware firewall policy. Where is this configuration mapped in the Prisma SD-WAN Controller?
Identity-Based Security Policy
Identity-Based Security Policy in the Prisma SD-WAN Controller maps user and group identity to firewall rules, enabling identity-aware enforcement at the site. This is the correct configuration location for policies that must act on who the traffic belongs to, not just IP addresses.
NAT Policy
Routing Policy
Quality of Service Policy
Want more Planning And Design practice?
Practice this domainWhen configuring Data Center Interconnect (DCI) between two sites, you notice that routing loops are occurring. What is the most effective way to prevent this in a dual-homed DCI scenario?
Disable OMP on the DCI interface.
Increase the OMP cost on all routes.
Implement Site-of-Origin (SoO) extended communities on the DCI links.
SoO tags are specifically designed to prevent loops in multi-homed BGP/OMP environments.
Configure a static route to the peer site.
Which dashboard component in vManage provides an 'at-a-glance' health score for the entire SD-WAN fabric?
Application Health.
Network Health Dashboard.
The Network Health Dashboard aggregates fabric-wide telemetry into a single composite score covering control, data, and transport planes, giving the at-a-glance status the stem requests. It is the vManage component purpose-built for whole-fabric health rather than per-device or per-tunnel views.
Control Connections.
Interface Usage.
If a device is stuck in 'In-Progress' during a template push, what is the first troubleshooting step?
Check the Device Tasks in vManage to view the specific error log.
vManage records each template push as a Device Task containing the granular error returned by the device. Inspecting that log first reveals whether the failure is a CLI mismatch, connectivity issue or template variable error, avoiding guesswork before attempting any retry or rollback.
Reboot the vManage server.
Perform a factory reset on the device.
Change the vBond address.
Where do you go in vManage to generate a report on historical bandwidth utilization for a specific site?
Configuration > Templates.
Administration > Maintenance.
Tools > Logs.
Monitor > Reports.
In vManage, historical bandwidth utilisation for a site is produced under Monitor > Reports, which offers prebuilt report types including bandwidth and application usage. This satisfies the stem's requirement to generate a historical bandwidth report.
When performing a 'Soft Shutdown' on an HA device, what is the expected behavior?
The device disables all interfaces without notifying the peer.
The device immediately reboots.
The device enters a maintenance mode that clears all routes.
The device gracefully transitions the active state to the standby device.
A Soft Shutdown drains traffic and hands over the active role cleanly, so sessions and tunnels fail over without dropping. This satisfies the graceful-transition constraint in the stem, unlike a hard shutdown, which forces an abrupt failover.
Where do you check the status of active control connections in vManage?
Administration > Maintenance.
Configuration > Policies > Security.
Tools > Network.
Monitor > Network > [Device] > Control Connections.
Monitor > Network > [Device] > Control Connections is the exact vManage path showing live control connection state per device, including system IP, local colour, remote colour, and state. It satisfies the stem's requirement to check active control connections directly, unlike tunnel, interface, or alarm views that omit per-connection control-plane status.
Want more Operations And Monitoring practice?
Practice this domainThe vendor does not publish an exact question count for the SD-WAN-Engineer. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Troubleshooting, Deployment And Configuration, Unified SASE, Planning And Design, Operations And Monitoring. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks SD-WAN-Engineer exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.