Palo Alto Networks Certified SD-WAN Engineer Practice Exam

What the Palo Alto Networks Certified SD-WAN Engineer exam covers

• Planning and Design121 questions
• Deployment and Configuration125 questions
• Operations and Monitoring79 questions
• Unified SASE71 questions
• Troubleshooting78 questions

Free Palo Alto Networks Certified SD-WAN Engineer practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 474-question bank.

1. Question 1Planning and Design

   Sakura Logistics is adding a small branch in Osaka and lists its requirements for the ION order. ``` | Requirement | Value | |----------------------|------------------------------------------------------| | Location | Osaka, Japan | | WAN | Integrated 5G primary, wired broadband as backup | | Regulatory | Cellular radio must carry Japan Giteki certification | | Planned ION software | 6.4.2 | | Form factor | Fanless desktop unit, no PoE devices at the site | ``` Which model fits these requirements?

   • AION 1200-C5G-EXP, the integrated 5G small branch variant that needs 6.1.3 or later softwareCorrect
   • BION 1200-C-5G-WW, the integrated 5G small branch variant described for worldwide deployment
   • CION 1200-C-ROW, the integrated cellular small branch variant that lists GCF as its certification
   • DION 1200-S-C5G-WW, the integrated 5G small branch variant with Layer 2 switch ports worldwide
   ✓ Correct answer: A

   The ION 1200 specification lists the ION 1200-C5G-EXP as an enterprise small branch device with integrated 5G for Japan, with Japan Giteki as its cellular carrier and regulatory certification. The same page states that its minimum supported device software version is 6.1.3 or later, and the compatibility matrix marks the model as supported on release 6.4.2. It is a fanless unit with desktop mounting, so it matches the form factor line as well. The worldwide 5G variants list AT&T, PTCRB, T-Mobile, Verizon and GCF certifications rather than Giteki.

   Why the other options are wrong

   • BThe ION 1200-C-5G-WW lists AT&T, PTCRB, T-Mobile, Verizon and GCF as its carrier and regulatory certifications, not Japan Giteki.
   • CThe ION 1200-C-ROW provides integrated 4G LTE rather than 5G, and its listed certification is GCF, not Japan Giteki.
   • DThe ION 1200-S-C5G-WW lists AT&T, PTCRB, T-Mobile, Verizon, GCF and Telstra certifications, not Japan Giteki.
2. Question 2Planning and Design

   Halvorsen Retail runs branch gateways on ION release 6.8.1. For one destination, the branch gateway at Tromso sees the candidate paths below for a new session. ``` | Path | State | Hop count | Path policy type | |------|-----------|-----------|------------------| | P1 | Available | 2 | Active | | P2 | Available | 1 | Backup | | P3 | Available | 2 | Backup | ``` Which path does the branch gateway select for the new session?

   • AP1, since an available Active path is chosen ahead of any Backup path
   • BP2, since only the paths with the lowest hop count remain candidatesCorrect
   • CP3, since Backup paths with more hops are kept for transit sessions
   • DP1 first, with the session moved to P2 only after P1 becomes unusable
   ✓ Correct answer: B

   The hop count path selection page states that the system filters candidate paths to include only those with the lowest hop count, then applies the standard path selection criteria to that subset. Its scenario table shows that with an Active path at hop count 2 and a Backup path at hop count 1, the Backup path is selected because hop count overrides Active and Backup. Here P2 is the only path at hop count 1, so it is the only remaining candidate. The page notes that a lower hop count path is preferred even when path policies would otherwise favor the longer path.

   Why the other options are wrong

   • AActive wins over Backup only among paths with the same hop count; a lower hop count path is chosen first.
   • CP3 has hop count 2, so it is filtered out when a hop count 1 path is available.
   • DFor a new session, hop count filtering leaves only P2 as a candidate, so P1 is not used first.
3. Question 3Planning and Design

   Fenwick Bank's branch QoS stack holds two policy sets: Corp-QoS on the left and Regional-QoS on the right. Corp-QoS has a DSCP mapping of 12 values that includes AF41 and places it in Gold Video, while Regional-QoS has a DSCP mapping that places AF41 in Platinum Video. A video flow marked AF41 is placed by DSCP mapping at a branch ION. Which result should the engineer expect?

   • AGold Video from Corp-QoS, since mappings are looked up in set order and the first match is usedCorrect
   • BPlatinum Video from Regional-QoS, since the right-most set in the stack is applied last and wins
   • CPlatinum Video, since the ION compares every matching mapping and keeps the higher priority class
   • DThe application rule's class, since a DSCP value mapped in two sets is ignored by the ION
   ✓ Correct answer: A

   The Configure DSCP page states that DSCP mapping can be defined in any policy set but only the first match is used for a decision, and that the lookup order matches the policy set order. QoS policy sets are ordered from left to right in a stack, with the left-most set having the highest priority. Corp-QoS is on the left, so its AF41 mapping to Gold Video is found first and decides the queue. A single mapping can list up to 16 DSCP values, so the 12 values in Corp-QoS are within that limit.

   Why the other options are wrong

   • BThe lookup follows policy set order, which runs from the left-most set as the highest priority, and the first match is used.
   • COnly the first matching DSCP mapping is used for the decision; the ION does not compare mappings to pick a higher class.
   • DThe page states that the first matching mapping is used, so a value present in two sets is not ignored.
4. Question 4Deployment and Configuration

   Marlow Pharma wants the subnets at its new Reading branch to be reachable from every other site in the Prisma SD-WAN fabric. The branch ION connects the user subnet on LAN port 3 and reaches two lab subnets through a static route to a LAN router. Which approach does the documentation prefer for advertising this branch's reachability?

   • ASet the LAN interface to Global scope and make the static route to the lab globally scopedCorrect
   • BAdd the user and lab subnets as site prefixes on the data centers that serve the branch
   • CAdd the user and lab subnets as IP prefixes in the branch site's routing settings
   • DRun BGP with the LAN router so the ION learns the lab subnets and advertises them
   ✓ Correct answer: A

   The Configure a Site Prefix page explains that site prefixes advertise reachability from sites into the SD-WAN fabric and let data center sites easily advertise routes to branch sites. It adds that site prefixes can be configured for branch sites, but the preferred method for advertising branch reachability is global scope interfaces and static routes. Setting the user subnet's interface to Global scope advertises that subnet, and a globally scoped static route advertises the lab destinations to other sites automatically.

   Why the other options are wrong

   • BThe page uses site prefixes to route traffic for data center sites; for branch reachability it names global scope interfaces and static routes as the preferred method.
   • CSite prefixes can be configured for branch sites, but the page names global scope interfaces and static routes as the preferred method for branches.
   • DBranch LAN BGP is supported from release 5.2.1, but the site prefix page names global scope interfaces and static routes, not dynamic LAN routing, as the preferred method for advertising branch reachability.
5. Question 5Deployment and Configuration

   Brennan Labs' branch ION has one static route to a partner network with three next hops and the NextHop Reachability Probe enabled. The engineer checks the status. ``` Static route 10.90.0.0/16 (Global VRF) | Next hop | Admin distance | Reachability | |--------------|----------------|--------------| | 192.168.10.1 | 1 | Unreachable | | 192.168.10.2 | 5 | Reachable | | 192.168.10.3 | 5 | Reachable | ``` How does the ION forward traffic to 10.90.0.0/16 in this state?

   • AIt balances flows across both of the next hops that have an admin distance of 5
   • BIt sends the traffic through only one of the two next hops with admin distance 5Correct
   • CIt drops new flows and holds existing flows on 192.168.10.1 until it recovers
   • DIt keeps sending flows to 192.168.10.1 because admin distance 1 is preferred
   ✓ Correct answer: B

   The static route page says the device prefers a next hop with a lower admin distance, and when several next hops share an admin distance and are all reachable, it forwards traffic to only one of them. When a next hop fails, alternate next hops, if available, are used for new and existing flows. Existing and new flows are dropped only when the last next hop to the prefixes fails. With 192.168.10.1 unreachable, traffic moves to one of the two reachable distance-5 next hops.

   Why the other options are wrong

   • AWhen several next hops have the same admin distance and are reachable, the device forwards traffic to only one of them rather than balancing.
   • CAlternate next hops are used for both new and existing flows when a next hop fails; flows are dropped only when the last next hop fails.
   • DThe lower admin distance is preferred only while that next hop is usable; once it fails, alternate next hops carry the flows.
6. Question 6Operations and Monitoring

   Thornbury Councils routes Prisma SD-WAN incident notifications by incident category, using the eight categories Configuration, Device, Digital Experience, Network & Traffic, Network Services, Security Services, Services and Software. One team must be told when an ION runs an image the controller does not recognize or that has reached end of life. A second team must be told when a site shows a consistently high volume of unclassified application traffic. Which categories should the engineer assign to these teams, in that order?

   • ADevice for the first team, and Network & Traffic for the second team
   • BSoftware for the first team, and Digital Experience for the second teamCorrect
   • CDevice for the first team, and Digital Experience for the second team
   • DSoftware for the first team, and Network & Traffic for the second team
   ✓ Correct answer: B

   The categories page lists eight categories: Configuration, Device, Digital Experience, Network & Traffic, Network Services, Security Services, Services and Software. Software covers incidents about the ION software image, including unsupported or end-of-life versions not recognized by the controller. Device covers hardware failures, software process errors, resource constraints and management issues rather than the image itself. Digital Experience covers application performance and user experience, including high volumes of unclassified application traffic.

   Why the other options are wrong

   • ADevice covers hardware failures, process errors, resource limits and management issues; an unrecognized or end-of-life image is Software, and unclassified application traffic is Digital Experience.
   • CUnclassified application traffic is correctly Digital Experience, but an unrecognized or end-of-life image falls under Software rather than Device.
   • DThe image condition is correctly Software, but unclassified application traffic belongs to Digital Experience, not Network & Traffic, which covers circuits, tunnels and site connectivity.
7. Question 7Unified SASESelect all that apply

   Penrose Group runs Panorama Managed Prisma Access and plans to connect its Prisma SD-WAN sites through SASE Easy Onboarding. Which two items are prerequisites that the documentation lists for this Panorama Managed deployment? (Choose TWO)

   • ACloud Services plugin 5.2.0-h24 or later installed on PanoramaCorrect
   • BA service account with a superuser role for All Apps and ServicesCorrect
   • CThe service account's client ID and secret entered in SASE Connectivity
   • DEvery branch ION upgraded to release 6.4.0 or later before onboarding
   • EThe store-client-details command run from each branch ION's CLI
   ✓ Correct answer: A, B

   The SASE Easy Onboarding page lists the prerequisites for Panorama Managed Prisma Access. They are installing the Cloud Services plugin at minimum version 5.2.0-h24 and creating a service account with a superuser role for All Apps and Services. The service account's client ID, secret and TSG ID are then stored by running request plugins cloud_services prisma-access store-client-details on Panorama as an administrator. The page notes that these prerequisites apply only to Panorama Managed Prisma Access.

   Why the other options are wrong

   • CThe client ID, secret and TSG ID are stored by running the store-client-details command on Panorama; SASE Connectivity holds settings such as the local AS, deployment mode and tunnel inner IP pool.
   • DThe documented ION requirement is software release 5.6.X or higher, not 6.4.0.
   • EThe store-client-details command is run on Panorama as an administrator, not on the ION devices.
8. Question 8Unified SASE

   Penwith Garden Centres enables IoT SNMP discovery at a branch whose ION has no controller port and no management interface. No IOT SNMP Discovery Source Interface has been configured. The broadband circuit on interface 1 failed this morning. The interfaces are listed below. ``` | Interface | Role | Used for controller | State | |-----------|-----------------|---------------------|-------| | 1 | WAN (broadband) | Yes | Down | | 2 | WAN (LTE) | No | Up | | 3 | LAN | No | Up | | VPN links | to DC-1, DC-2 | - | Up | ``` Which interface will the ION now use as the source for SNMP discovery?

   • AThe VPN links to DC-1 and DC-2, which reach the start nodes
   • BInterface 1, since it remains the configured controller interface
   • CInterface 2, the WAN interface on the LTE circuitCorrect
   • DInterface 3, the LAN interface that faces the local switches
   ✓ Correct answer: C

   The Set a Source Interface for IoT SNMP Discovery page says the ION uses the controller port or management interface address by default, and that a source interface can be set for devices without them. When none is configured, the system applies the sequence controller port, controller interface, WAN interfaces, LAN interfaces, then VPN links to all active and VPN interfaces. This ION has no controller port, and its controller interface is down, so it is not an active candidate. The next entry in the sequence is the WAN interfaces, which leaves interface 2, and the ION supports only one source interface.

   Why the other options are wrong

   • AVPN links are the last entry in the documented sequence and are used only after the WAN and LAN interfaces.
   • BThe sequence is applied to active interfaces, and interface 1 is down, so the ION moves on to the next entry.
   • DLAN interfaces follow WAN interfaces in the documented sequence, so the WAN interface on LTE is chosen first.
9. Question 9Troubleshooting

   Delling Consulting holds an App Acceleration license for Prisma SD-WAN and wants SaaS application acceleration for its CRM at its branches. The engineer checks the inventory: ``` Site ION model Software CRM traffic path Leeds ION 3200 6.4.3 Direct internet Hull ION 3200 6.4.3 Direct internet York ION 1200 6.4.3 Direct internet ``` What must happen before SaaS application acceleration can be used at these sites?

   • ARoute the CRM traffic over the VPN to the data center so it can be accelerated
   • BEnable FEC in the CRM performance rule, which provides SaaS app acceleration
   • CNothing; 6.4.2 or later covers both network optimization and SaaS acceleration
   • DUpgrade the IONs to 6.5.2 or later, as 6.4.x covers only network optimizationCorrect
   ✓ Correct answer: D

   The Configure App Acceleration page lists physical and virtual IONs on 6.4.2 or later for network optimization. It requires 6.5.2 or later for network optimization and SaaS application acceleration, plus an App Acceleration license. The App Acceleration action forwards direct internet destined TCP traffic to the SaaS App Acceleration Service to improve throughput and latency. These branches already send the CRM over direct internet, so the remaining gap is the 6.4.3 software.

   Why the other options are wrong

   • AApp Acceleration forwards direct internet destined TCP traffic to the SaaS App Acceleration Service, so moving the CRM onto the VPN is not required.
   • BFEC adds error-correcting data on Prisma SD-WAN VPNs against packet loss; App Acceleration is a separate action in the performance rule.
   • C6.4.2 and later covers network optimization only; SaaS application acceleration requires 6.5.2 or later.
10. Question 10Planning and DesignSelect all that apply

    Merriweather Labs is building a stacked security policy rule in a simple security stack, using values taken from one of its path policy rules. The draft is below. ``` | Tab | Field | Draft value | |--------------|-------------------------|----------------------------------| | Info | Order | 65000 | | Services | Source port ranges | 16 ranges | | Services | Destination port ranges | 20 ranges, including 49152-65535 | | Applications | Applications | 40 applications | ``` Which TWO draft values exceed a limit documented for a stacked security policy rule? (Choose TWO)

    • AThe 40 applications selected on the Applications tabCorrect
    • BThe 16 source port ranges entered on the Services tab
    • CThe 20 destination port ranges entered on the Services tabCorrect
    • DThe order of 65000 entered for the rule on the Info tab
    • EThe 49152-65535 range among the destination port ranges
    ✓ Correct answer: A, C

    The Add a Stacked Security Policy Rule page states that you can select 16 applications for one security policy rule. On the Services tab, source and destination port ranges take values between 1 and 65535, and you can add a maximum of 16 source port ranges and a maximum of 16 destination port ranges. On the Info tab, the order is entered between 1 and 65535. The 40 applications and the 20 destination port ranges must therefore be split across more than one security rule, while the other draft values are accepted.

    Why the other options are wrong

    • BA security rule can hold a maximum of 16 source port ranges, so 16 ranges are within the limit.
    • DThe Info tab accepts an order between 1 and 65535, so 65000 is a valid order for the rule.
    • EPort ranges take values between 1 and 65535, so a destination range of 49152-65535 is valid.

Who this Palo Alto Networks Certified SD-WAN Engineer practice exam is for

This practice set is for anyone preparing for the Palo Alto Networks Certified SD-WAN Engineer exam at the intermediate level - from first-time candidates building a foundation to experienced Palo Alto practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Palo Alto Networks Certified SD-WAN Engineer practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Palo Alto Networks Certified SD-WAN Engineer exam.

Related Palo Alto resources

• Palo Alto Networks Certified SD-WAN Engineer study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Palo Alto Networks Certified Security Operations Architect practice examRelated
• Palo Alto Networks Certified Security Operations Professional practice examRelated
• Palo Alto Networks Certified XSIAM Analyst practice examRelated

Palo Alto Networks Certified SD-WAN Engineer practice exam FAQ