When onboarding a new branch site into a Unified SASE environment, what is the prerequisite for the branch ION device to establish a tunnel to Prisma Access?
An administrator wants to ensure that all traffic from a specific branch is routed to Prisma Access, but bypasses the Cloud SWG for specific trusted SaaS applications. How is this achieved?
When integrating Prisma SD-WAN with Prisma Access, how does the system ensure that the security policy is applied to the traffic correctly based on the user's identity?
A branch office uses an ION device with a single WAN link. The security team requires that all internet-bound traffic from the branch be inspected by Prisma Access, but only for users in the 'Finance' VLAN. Traffic from the 'Guest' VLAN should go directly to the internet. Which configuration on the ION device achieves this requirement?
A Prisma SD-WAN administrator needs to apply a consistent security policy to all traffic from a branch, including traffic that is destined for the internet and traffic that must be inspected by Prisma Access. The branch uses an ION device that is already connected to a Prisma SD-WAN Controller. The administrator wants to avoid configuring separate policies on the ION and in Prisma Access. Which Unified SASE feature should be used to meet this requirement?
An engineer is deploying a new branch with a Prisma SD-WAN ION device that must forward all internet-bound traffic to Prisma Access for security inspection. The branch has two ISP links, and the design requires that if one link fails, inspection continues without manual intervention. Which configuration on the ION device ensures this behavior?
A branch office uses a Prisma SD-WAN ION device connected to Prisma Access via an Automated Service Connection. The security team wants to ensure that traffic destined for a specific SaaS application is inspected by Prisma Access while all other internet-bound traffic goes directly out the local internet link. What should the administrator configure to achieve this?
A company is deploying Prisma SD-WAN with Unified SASE. The security team wants to ensure that traffic from branch ION devices to Prisma Access is encrypted and that Prisma Access can apply security policies based on the original source IP address of the branch devices. Which two configurations are required to meet these requirements? (Choose two.)
A network architect is designing a Unified SASE solution for a retail company with 200 stores. Each store has a Prisma SD-WAN ION device and requires secure internet access with URL filtering and threat prevention. The company wants to minimize hardware footprint and management overhead. Which Prisma SASE component should the architect recommend for providing these security services?
An administrator has deployed Prisma SD-WAN with Unified SASE and configured an Automated Service Connection to Prisma Access. Users at a branch report that they cannot access internal applications hosted in the data center, but internet access works fine. The administrator verifies that the Service Connection is up and that the ION device has a route to the data center via the VPN. What is the most likely cause?
An administrator is enabling Unified SASE for a branch and wants to verify that the ION device has successfully established a Service Connection to Prisma Access. Which status indicator should the administrator check on the ION device?
A network operations team is monitoring a Unified SASE deployment with Prisma SD-WAN and Prisma Access. They notice that security logs from Prisma Access show allowed traffic for a specific user, but Prisma SD-WAN logs show the same session as denied by a policy. What is the most likely explanation for this discrepancy?
A network engineer is deploying Prisma SD-WAN with Unified SASE. They need to ensure that traffic from a branch to a critical business application is always inspected by Prisma Access, even if the primary Service Connection fails. What should they configure?
A company has deployed Unified SASE with Prisma SD-WAN and Prisma Access. They want to ensure that security logs from Prisma Access and network logs from Prisma SD-WAN are correlated to provide a single view of user activity. Which component of the Unified SASE architecture is responsible for this correlation?
An administrator is troubleshooting a Unified SASE deployment where traffic from a branch to the internet is being inspected by Prisma Access, but traffic to a specific SaaS application is not being inspected. The administrator has verified that the Service Connection is up and that a policy rule exists to send that SaaS application's traffic to the Service Connection. What should the administrator check next?
An administrator is configuring a Service Connection between a Prisma SD-WAN ION device and Prisma Access. The administrator wants to ensure that the connection uses the most efficient path and that failover occurs automatically if the primary tunnel goes down. Which configuration should the administrator apply on the ION device?
A network engineer is designing a Unified SASE deployment with Prisma SD-WAN and Prisma Access. They need to ensure that traffic from a branch to the internet is inspected by Prisma Access, while traffic to internal data center applications is routed directly over the VPN without inspection. Which two actions should they take? (Choose two.)
A security administrator is integrating Prisma SD-WAN with Prisma Access to enforce security policies based on user identity. The administrator wants to ensure that user identity information is available for policy enforcement. Which TWO actions are required to enable user-based policies in this Unified SASE deployment? (Choose two.)
A network engineer is integrating Prisma SD-WAN with Prisma Access for Unified SASE. The engineer wants to ensure that user-based policies are enforced for branch traffic. Which Prisma SD-WAN component is responsible for mapping user identities to IP addresses to enable user-based policies?
A network administrator is configuring Prisma SD-WAN to integrate with Prisma Access using the Automated Service Connection. During the onboarding process, which specific parameter must be configured in the ION device's service route to ensure traffic is correctly steered to the Prisma Access Service Infrastructure?
You are deploying Cloud Identity Engine (CIE) to enable identity-based security policies across your SD-WAN and SASE environment. Which configuration step is required to ensure that user identity information is successfully propagated from the enterprise directory to the Prisma Access security nodes?
In a Unified SASE architecture, an administrator needs to ensure that branch offices prioritize voice traffic while using Prisma Access. Where should the Quality of Service (QoS) policy be defined to ensure consistent application performance?
A customer is experiencing intermittent connectivity to internal applications after enabling Unified SASE. Traffic is being routed through Prisma Access. What is the most likely cause?
An engineer is troubleshooting a scenario where users at a branch office cannot access SaaS applications via Prisma Access. The SD-WAN path is active, but the traffic is not reaching the Cloud SWG. What is the most likely cause related to the Unified SASE policy?
You are verifying the status of a Service Connection between a branch ION and Prisma Access. Which command or dashboard view provides the most accurate status of the tunnel reachability?
An organization is migrating to Unified SASE. When configuring the 'Direct to App' policy for branch offices, what is the primary benefit of leveraging the Prisma SD-WAN integration with Prisma Access?
You are monitoring traffic in a Unified SASE environment. You notice that traffic from a branch is taking a non-optimal path to Prisma Access. Which tool would you use to verify the path selection logic?
An engineer notices that some traffic is not being optimized by the Prisma SD-WAN fabric. Upon inspection, the traffic is bypassing the SD-WAN tunnels. What is the most likely cause?
A network engineer is deploying a new branch office with a Prisma SD-WAN ION device. The security team requires that all internet-bound traffic from the branch be inspected by Prisma Access Cloud SWG, while traffic to internal SaaS applications should use direct internet breakouts. The engineer must configure the ION to steer traffic appropriately. Which action should the engineer take to meet these requirements?
A network administrator is deploying a new branch with a Prisma SD-WAN ION device and wants to leverage Unified SASE for security inspection. The administrator has already configured the Service Connection to Prisma Access. Which additional step is required to ensure that traffic from the branch is inspected by Prisma Access?
A network engineer is deploying a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer wants to ensure that traffic from a specific branch is inspected by Prisma Access, but traffic to a critical internal application must bypass Prisma Access and go directly over the Prisma SD-WAN fabric. The branch has two ION devices for redundancy. Which configuration should the engineer use to achieve this?
A security administrator is troubleshooting a Unified SASE deployment where branch users cannot access a critical internal application hosted in an on-premises data center. The application is reachable from other sites, but branch traffic destined to the application's IP is being routed to Prisma Access instead of the data center. The ION device has a Service Connection configured to Prisma Access and a VPN connection to the data center. What is the most likely cause of this issue?
A security architect is designing a Unified SASE deployment where branch users must access both SaaS applications and internal data center resources. The requirement is that SaaS traffic be inspected by Prisma Access while internal traffic goes directly over the SD-WAN fabric without backhauling to the cloud. Which Prisma SD-WAN feature should be used to enforce this traffic separation?
A network engineer has just deployed a new ION device at a branch office. The device has successfully established its control plane connection to the Prisma SD-WAN controller. The engineer now wants to enable secure web gateway (SWG) inspection for all internet-bound traffic from this branch without manually creating tunnels. Which Prisma SD-WAN feature should the engineer configure?
A network engineer is deploying a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer needs to ensure that branch traffic destined for the internet is inspected by Prisma Access cloud security services, while traffic to internal data center applications goes directly over the SD-WAN fabric without inspection. Which configuration on the ION device accomplishes this?
An administrator is configuring a Unified SASE deployment with Prisma SD-WAN and Prisma Access. The administrator wants to verify that the service connection between the branch ION device and Prisma Access is operational and that traffic is being inspected. Which Prisma SD-WAN dashboard view should the administrator use to see the status of the service connection and the amount of traffic being sent to Prisma Access?
A network engineer is troubleshooting a Unified SASE deployment where branch users report slow access to Microsoft 365. The engineer suspects that traffic is being backhauled to a data center for security inspection instead of being sent directly to Prisma Access. The ION device has a Service Connection configured and active. Which action should the engineer take to ensure that Microsoft 365 traffic is inspected by Prisma Access while other traffic follows the default route?
A network security administrator is configuring Prisma Access to integrate with Prisma SD-WAN for Unified SASE. The administrator needs to ensure that security logs from Prisma Access can be correlated with traffic logs from Prisma SD-WAN to troubleshoot an incident. Which configuration is required to enable this correlation?
A security administrator is troubleshooting a Unified SASE deployment where branch users cannot access a cloud-based CRM application. The traffic is being steered to Prisma Access for inspection, but users report timeouts. The administrator checks the ION device and sees that the service connection to Prisma Access is up, and the CRM application is allowed in the security policy. What is the most likely cause of the issue?
A network architect is designing a Unified SASE solution for a company with multiple branches. The company wants to ensure that all internet-bound traffic from branches is inspected by Cloud SWG, while traffic to internal applications is routed through a data center. The architect plans to use Prisma SD-WAN with Service Connections to Prisma Access. Which configuration approach should the architect recommend to meet these requirements?
A company is deploying Unified SASE with Prisma SD-WAN and Prisma Access. The security team wants to ensure that traffic from branch ION devices is inspected by Prisma Access and that security logs from both products are correlated for unified reporting. Which TWO actions are required to achieve this integration? (Choose two.)
A security architect is designing a Unified SASE deployment for a retail chain with 200 branch sites. The company wants to enforce consistent security policies for both internet-bound and private application traffic, while minimizing the number of separate management consoles. Which architectural component of Unified SASE directly provides this consolidation?
A network engineer is configuring a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer wants to ensure that traffic from a specific branch is inspected by Prisma Access, but also wants to avoid sending traffic to Prisma Access for destinations that are reachable via a direct SD-WAN path to the data center. Which Prisma SD-WAN feature allows the engineer to define which traffic should be sent to Prisma Access?
A network engineer is troubleshooting a Unified SASE deployment where branch users report that access to internal applications is slow after enabling Prisma Access inspection. The engineer confirms that internal traffic is being sent to Prisma Access instead of directly over the SD-WAN fabric. Which configuration change should the engineer make to resolve the issue?
A network administrator is configuring a Service Connection between a branch ION device and Prisma Access. The administrator wants to ensure that all traffic from the branch to the internet is inspected by the cloud SWG, while traffic to private applications goes directly over the VPN. Which configuration element on the ION device is used to define which traffic is sent to the Service Connection?
An administrator is deploying Prisma SD-WAN with Unified SASE. The administrator needs to ensure that the ION device can establish a service connection to Prisma Access. Which of the following must be configured on the ION device to allow the service connection to be established?
A network engineer is deploying a new branch office with a Prisma SD-WAN ION device. The branch requires direct internet access for guest users, but corporate traffic must be inspected by Prisma Access. The engineer wants to minimize configuration overhead and ensure that only corporate traffic is redirected to Prisma Access while guest traffic goes directly to the internet. Which feature should the engineer configure on the ION device to achieve this?
A network administrator is designing a Unified SASE solution for a retail company with many small branches. The company wants to reduce the complexity of managing separate security and networking policies. Which primary benefit of Unified SASE should the administrator highlight to the management team?
A network engineer is deploying a new branch office with a Prisma SD-WAN ION device that will connect to Prisma Access for Unified SASE. The engineer needs to configure the ION device to establish a secure tunnel to the Prisma Access service infrastructure. Which protocol is used for this tunnel?
A network engineer is troubleshooting a Unified SASE deployment where a branch ION device has established a control connection to Prisma Access, but application traffic from the branch is not being inspected by Prisma Access security services. The engineer confirms that the ION device is online and the service connection is active. Which configuration element should the engineer verify to ensure that traffic is steered to Prisma Access for inspection?
A network engineer is troubleshooting a Unified SASE deployment. Branch users report that HTTPS traffic to a business-critical SaaS application is intermittently failing. The engineer suspects that the traffic is not being steered to Prisma Access for security inspection. Which action should the engineer take first to verify the traffic steering policy?
A security architect is designing a Unified SASE solution with Prisma SD-WAN and Prisma Access. The company requires that all traffic from branch ION devices to the internet be inspected by Prisma Access, but they also want to optimize performance for Microsoft 365 traffic by using local internet breakout. Which Prisma SD-WAN feature should the architect use to achieve this?
A network engineer is deploying Prisma SD-WAN with Unified SASE and wants to ensure that branch traffic destined for the internet is inspected by Prisma Access. The engineer has already configured the service connection on the ION device. Which additional configuration is required on the ION device to direct internet-bound traffic to Prisma Access?
A network engineer is configuring a Unified SASE deployment with Prisma SD-WAN and Prisma Access. The engineer needs to ensure that user traffic from branch offices is securely forwarded to Prisma Access for inspection. Which TWO components are required to establish this secure forwarding? (Choose two.)