SD-WAN-Engineer Troubleshooting Practice Question
When analyzing a PCAP from an ION device, you see 'ICMP Destination Unreachable'. Which policy is most likely causing this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security Policy
Security policies or access control lists (ACLs) blocking traffic will trigger ICMP unreachable messages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security Policy
Why this is correct
Security policies are configured to drop traffic and can return ICMP unreachable messages.
- ✗
NAT Policy
Why it's wrong here
NAT failure results in silent drops or routing loops.
- ✗
QoS Policy
Why it's wrong here
QoS drops traffic, but usually doesn't send ICMP unreachable.
- ✗
Path Selection Policy
Why it's wrong here
Path selection affects forwarding, not dropping with ICMP.
Visual reference
About these practice questions
Courseiva writes every SD-WAN-Engineer question from scratch — 175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This SD-WAN-Engineer practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SD-WAN-Engineer exam.