Domain 1: Planning and Design
- Branch ION selection follows the site: the ION 1200-S adds four PoE ports on a 90 W budget and a bypass pair that the plain ION 1200 lacks, the hardened ION 3200H runs from -40 C to 70 C on 12-48 V DC with power substation certifications, and regional 5G variants such as the ION 1200-C5G-EXP for Japan each carry their own regulatory certification and minimum software release.
- The ION 3000, 3200, 5200, 7000, 9000 and 9200 can serve a data center, the ION 5200 and 9200 add 10G SFP+ ports and several bypass pairs, and lifecycle limits shape plans because the ION 1000, 2000 and 3000 are unsupported from release 6.6.1, the ION 7000 ends at 6.3.x and small virtual models such as the 3102V are not offered on Azure.
- The bandwidth plan begins with circuit LINK UP and LINK DOWN values that must equal the contracted rates because QoS shapes to them, a circuit Cost below the default of 128 makes that circuit preferred, BW Monitoring of link capacity is on by default, and a QoS policy set divides bandwidth into no more than four schemes across three breakpoints.
- Prisma SD-WAN subscriptions run from one to five years, a tenant uses a single branch license type for every branch, per-device tiers count ingress plus egress through each ION and need a license on both HA members, one per-site license covers every ION at that site, each data center ION needs its own DC subscription, and Clarity Network DVR extends retention beyond the default seven days.
- Assessing the existing network sets the deployment model, from a Layer 2-only ION placed in-line between the switch and the branch router to Router Replacement where the ION terminates every WAN link and peers with the provider edge, and from an off-path BGP data center ION that injects preferred routes into the core to an in-path OSPF placement from 6.4.1, with any perimeter firewall in front of internet ports allowing TCP 443 and UDP 4500.
- Core, edge and classic BGP peers can all run on one data center ION within a single routing domain, and that ION routes only on interfaces that peer with the network or carry a standard VPN, uses host tracking to take its VPN tunnels inactive when the core beyond its peer is unreachable so branches move to the other DC ION, and uses Distribution to Fabric to decide which branches receive its LAN-learned prefixes.
- From release 6.5.1 secure fabric tunnels can join data center sites using /31 tunnel addresses from 100.64.0.0/10, existing BGP peers become Local scope at that upgrade so only peers set to Global share prefixes between data centers, and each branch maps to exactly one DC cluster, so moving it between clusters interrupts its VPNs.
- A branch gateway combines hub services such as policy transit and LQM server with branch services, runs on larger and virtual IONs but not the ION 1200-S, must be in Control mode with both L3 forwarding settings (Direct Private WAN and LAN) turned on, starts with no overlay prefix filters, and from 6.8.1 narrows candidate paths to the lowest hop count first, whereas an ordinary branch ION keeps each underlay and standard VPN as a separate routing domain and never becomes a transit point.
- An ION with no security policy bound filters nothing except unsolicited inbound traffic on internet interfaces, so a default-deny stack belongs on every site before production, each site takes one Security Policy Stack of up to four policy sets plus the Default Policy Set, stacked policies are the only model from 6.0.1, and Security Profile Groups for Anti-Spyware, Vulnerability Protection, DNS Security and URL Access Management need a subscription.
- The controller negotiates secure fabric ciphers with AES-256-GCM first and offers only CBC ciphers when either end runs below 6.5.1, standard VPN AES-GCM needs IKEv2 with an explicitly chosen PRF, FIPS-CC mode keeps OCSP checks permanently on and allows only SHA256 NTP authentication, and post-quantum hardening starts with RFC 8784 pre-shared keys before RFC 9370 ML-KEM key exchanges are added.
- A branch HA group holds at most two IONs, the active one doing path selection and routing while the backup only bridges, the first device added stays active unless preempt lets the higher priority win with a recommended gap of 40, failover follows three missed advertisements on a 200 to 10000 ms interval, and the controller port is the preferred HA control interface when both controller ports share a subnet.
- Path rules are ordered from 1 to 65535 with 1 the highest, a rule with a network context outranks one without, each rule needs an active path while backup and L3 failure paths may be left empty, Best Path mode uses the single path with the lowest metric while SLA Compliant mode load shares every compliant path, and unmatched flows fall to Enterprise Default for RFC 1918 destinations or to Default for the internet.
- Security policy sets are evaluated left to right and their rules top to bottom with the first match winning, the implicit Intra-Zone, Self-Zone and Catch-All Deny rules exist only in the Default Policy Set, a new rule defaults to Allow and Deny drops silently without a reset, a rule references at most 16 applications, and empty source or destination zones should be avoided because they can exhaust ION memory.
- QoS rule attributes take precedence in the order network context, source prefix filter, application and destination prefix filter, a branch honors DSCP marks on the first packet of an unknown flow, Mark/Remark rewrites every matching LAN-to-WAN packet, only the first DSCP mapping found across the policy sets applies, and deleting a breakpoint merges two schemes under the upper scheme's allocation.
- Performance policies from 6.3.1 include default Move Flows rules with a 150 ms and 2 percent loss SLA for audio and video and 500 ms and 5 percent for transactional and bulk traffic, SLA metrics use the best values measured from a branch circuit toward any data center, FEC works only with Move Flows on Prisma SD-WAN VPNs, and a device ignores a whole rule when any function in it is unsupported on its release.
- NAT rules are Source Zone or Destination Zone rules ordered 1 to 4, use NAT zones that are separate from security zones and must be bound to interfaces, allow at most four pool ranges per device interface, never combine No NAT with another action, and select IPv4 or IPv6 protocol translation automatically from the interface stacks, using the 64:ff9b::/96 prefix for NAT64.
Domain 2: Deployment and Configuration
- Onboarding runs connect and power on, claim, assign to a site and then configure, with allocated hardware showing Unclaimed and Offline until claimed, the controller port taking DHCP unless a static address is set from the AUX port, and the move to Control mode both building zero-touch VPNs and filling analytics after 3 to 5 minutes.
- Activation uses single-use magic links whose serial numbers can take 15 to 60 minutes to appear, the Bandwidth or Data Center license must be activated for full Prisma SD-WAN function, the region choice applies only to a new tenant, and a multi-tenant estate allocates devices to the root tenant and activates each child with Activate Cloud Tenant before assigning hardware to it.
- ION software is never upgraded automatically, controller releases are announced at least 21 days ahead, bulk upgrade takes up to 50 compatible devices per run, an upgrade with no times set follows the download immediately, and the Strata Cloud Manager RMA flow needs an unclaimed online replacement while the FIPS RMA flow needs a claimed one of the same model and software.
- The On-Premises Controller serves air-gapped and data sovereignty deployments on KVM or ESXi with IONs reaching it over TCP 443, while CloudBlades automate cloud deployments such as the AWS Transit Gateway CloudBlade, which builds an HA pair of DC vIONs with GRE and BGP to the transit gateway, and the Azure vWAN CloudBlade, which needs an application registration holding the Contributor role.
- A new branch site joins the default data center cluster, circuit settings override circuit category settings, controller connections that the device initiates fall back to an excluded circuit when nothing else is left, LQM runs by default toward data centers but needs Use LQM for Non Hub Paths for the internet underlay, and Aggressive BFD is the default for fast failure detection.
- Interfaces default to Local scope, which keeps their subnets unadvertised, while Global scope advertises them to every site and is the preferred way to publish branch reachability, internet-designated ports accept only UDP 4500, UDP 500 and ESP, port channels on WAN circuits need 6.6.1, and a virtual interface bonds two unconfigured physical ports of the same type.
- Each bypass pair port must be shut and restored individually, PPPoE runs only on physical WAN ports, the integrated L2 switch supports 32 active VLANs with IDs up to 4000 from 6.0.2 on the ION 1200-S and 6.3.1 on the ION 3200, cellular interfaces default to Auto APN and switch to a secondary SIM when three wrong PINs block the active one, and PoE stays off per port until enabled.
- Site configuration templates deploy day-one sites from a Jinja template, a generated variables CSV and a site data CSV, are best taken from a validated source site that may still hold only a device shell, cannot be edited in place, run one job per site in Job History, and create a device shell wherever the serial number is left blank.
- A day-two template update changes existing resources but never the software version, serial number, device name or L2/L3 mode, while a site snapshot saves the live configuration as YAML that needs the site name, city, country and software_version to import and cannot be produced while a device shell is assigned.
- ION IPsec profiles default to 24-hour IKE and ESP lifetimes on IKE port 500, should use IKEv2 with NAT-T for NAT traversal or for several tunnels to one endpoint, and switch on IKEv2 fragmentation automatically when Additional Key Exchanges are enabled, while TLS syslog profiles support only TLS 1.2 on default port 6514.
- A branch LAN runs either BGP or OSPF, dynamic LAN routing needs L3 Direct Private WAN Forwarding plus L3 LAN Forwarding with no Private Layer 2 bypass pair, a branch by default advertises only a default route to LAN BGP peers and nothing to WAN peers, BGP-learned routes get admin distance 20, and peer timers override the global BGP timers.
- Route maps are generated for core and edge peers but must be written for classic peers, numbers 99 to 103 are reserved, a peer takes one route map so IPv4 and IPv6 filtering uses Continue entries, prefix lists stop at the first matching entry, and edits to referenced lists apply only after a soft reset that keeps the TCP session up.
- ION OSPF from 6.4.1 uses 10-second hello and 40-second dead defaults, does not run on SVIs, advertises only a default route until set to Unaggregated, and applies a Metric 30 backup metric on BGP redistribution, while static routes use the lowest admin distance next hop, advertise to other sites with Global scope and can be watched by an ICMP next-hop probe sent every second.
- Multicast scale depends on release, reaching 400 branch sites per data center from 6.2.1, with up to 30 PIM interfaces per branch and 8 static RPs, BSM learning from 6.0.1 needs specific routes to the RP and source rather than a default route, and from 6.5.1 the Intra Cluster Tunnel passes traffic to the DC ION holding a branch's active VPN when the core load balances to its peer.
- VRF segmentation defines VRFs in a VRF profile, binds the profile to sites and sets a VRF on each interface, carries a VRF identifier across the fabric so the remote ION egresses into the same VRF, keeps the undeletable Global VRF profile on every site, and supports LAN IPv6 only in the Global VRF.
- From 6.4.2 VRF segments can break out to the internet with path rules alone because stateful NAT tracks the VRF, service link multiplexing prefers a custom VRF service link before a Global one, standard VPNs can sit in any VRF from 6.4, and dump vrf and inspect vrf display the VRF configuration and every route table on the device.
Domain 3: Operations and Monitoring
- Device Activity reports CPU, free memory, free disk, interface utilization, drops and errors for every ION, and a device counts as Partially online when its Config and Events channel is connected while Analytics or Flows is not.
- Site Summary defaults to three hours and needs Network DVR beyond seven days, its best health score comes from the highest-scoring secure fabric link, circuit health combines ingress and egress loss with round-trip time against load and baseline, and machine-learning insights flag excessive loss or latency, bandwidth mismatches and upgrade needs.
- Application response time splits into Network Transfer Time, Round Trip Time and Server Response Time to show whether delay sits in the network or the server, Application Insights scores each path mainly on application RTT, App Health shows No Data for paths an application does not or may not use, and the 1H bandwidth view keeps per-minute peaks that the 1D view averages into 5-minute samples.
- In the legacy model alerts mark crossed thresholds and incidents mark faults that are raised and cleared, while Strata Cloud Manager Incidents holds only incidents, auto-resolves converted alerts after 12 hours and ignores actions taken on the old incidents page during the transition, and acknowledging any incident hides it without resolving it.
- The controller correlates related events, folding several VPN down incidents into one Secure Fabric Link incident, Sync Incident reconciles standing incidents with a device on demand, and audit logs reach back at least six months, expire after two years except the last two actions on each resource, and compare resource versions in color.
- Legacy incident policies allow up to 16 sets per site with 128 ordered rules each and one active set, a rule without an order number never runs, priority can be overridden from P1 to P5, escalation rules raise standing or flapping incidents, and a site-scoped rule with a schedule and Suppress set to Yes silences a maintenance window.
- Strata Cloud Manager Incidents replaces fall-through rule sets with per-code settings chosen by longest match and one notification profile shared across products, does not support PagerDuty, and is adopted by creating settings and profiles, having Support enable it, verifying delivery and only then pausing and removing the notifier CloudBlades, with a new ServiceNow table for the new ticket format.
- ION SNMP agents and traps start disabled, the agent is read-only with up to 16 trap servers per version and SNMPv3 passphrases of 8 to 25 characters, and the PagerDuty notifier CloudBlade polls every 300 seconds by default, keeping its checkpoint when paused but losing it when disabled.
- The WAN Clarity Report is a licensed weekly report in Strata Cloud Manager whose Traffic Distribution view checks aggregate goals such as broadband versus MPLS share and whose Utilization Quadrant plots each circuit's 90th percentile utilization, flagging circuits above half of provisioned capacity for the threshold and heatmap reports.
- A branch circuit hotspot is any period above 70 percent of provisioned bandwidth while a data center circuit may treat its 90th percentile as the hotspot, data center reports approximate utilization because they count only overlay traffic, daily aggregate bandwidth uses the largest contiguous 5-minute block, and a site rates Poor when over 10 percent of its health samples fall below 30.
- An IPFIX profile holds up to four collectors, a collector context binds to one interface per ION, filter contexts cannot sit on controller, loopback, standard VPN or port channel interfaces, a device-level configuration can override the bound profile, and the collectors-down alarm fires only when no collector can be reached.
- An ION forwards device events, authentication logs and flow logs to up to 16 syslog servers from the controller port unless another source interface is set, while SNMP polling should key on ifName because ifIndex is not persistent on release 6.x, and smaller IONs poll reliably only up to about 40-45 interfaces.
- Flow records report RTT apart from server response time, show inter-packet gap as a congestion signal, list user names beside addresses when User-ID is on and can carry IoT device and SGT details, while LLDP runs receive-only on non-PoE ports and transmit-and-receive on PoE ports by default.
- SASE events are monitored through the Prisma Access CloudBlade's Interface Tag Summary and Configuration Events for tag and site errors and CloudBlade Events for runtime failures, a failed TSG association raises FAWKES_PA_TENANT_NOT_FOUND, AUTO-PRISMA_MANAGED objects other than BGP route maps must be left alone, and a capacity incident fires when site CIR exceeds a SASE endpoint's regional allocation.
Domain 4: Unified SASE
- Without any CloudBlade, SASE Easy Onboarding attaches Prisma SD-WAN sites directly to Prisma Access, needs a branch site with an assigned ION and a WAN circuit first, builds one IPsec tunnel per circuit for up to four circuits per site, and requires a tenant already on the CloudBlade to deactivate it and contact support.
- SASE Connectivity sets a deployment mode that writes the BGP route maps, Private-App-Access, Internet-Only with no-advertise or Internet-Only-With-Mobile-User-Access with no-export, and affects only new or modified tunnels, plus a unique Tunnel Inner IP Pool outside the Prisma Access infrastructure subnet that gives each tunnel a /31 and, if wanted, a security zone for the tunnels.
- Site-based licensing runs from a 25 Mbps Very Small to a 2.5 Gbps X-Large site type, Remote Networks High Performance carries up to 2 Gbps per site with per-tunnel LQM from ION 6.4.2, and the recommended primary Prisma Access location is the one nearest the coordinates of the site address.
- Traffic is steered into Prisma Access by path policy rules that reference Service and DC Groups, native integration creates the Prisma Access: All Regions standard group whose endpoints count as equal, a site binds to one domain at a time, and learning Prisma Access routes over BGP matters only for passing them on to LAN peers.
- The Cloud Managed Prisma Access CloudBlade onboards a site through the prisma_access tag, advertises Global subnets unless PRISMA_INCLUDE or PRISMA_EXCLUDE tags change that, enables ECMP by default across up to four reachable interfaces, detects regions automatically only in the non-aggregate bandwidth model, and copies tunnels to an HA backup ION through prisma_ha_primary without using another license.
- The CloudBlade's default liveliness probe aims at the tunnel monitor IP at the top of the Prisma Access infrastructure subnet, natively created endpoints probe the firewall monitor address by ICMP every 10 seconds and fail after three misses, and Panorama lists IPsec termination nodes in deployment order rather than alphabetically.
- ADEM runs from an agent built into ION software, tests every path of an application except the L3 failure path with each active or backup path counting as one test, and is enabled per compute location with bandwidth equal to that location's Remote Networks allocation taken from the ADEM pool.
- ADEM tests always run from a remote site's active device because sites register by name, sample every five minutes, can be suspended per site with Monitoring State while the site keeps its license, and for Zoom and Teams use Split Tunnel set to true without path tests.
- IoT device visibility needs Prisma Access and IoT Security licenses in the Prisma SD-WAN TSG, discovers devices beyond direct neighbors from 6.3.1 by crawling LLDP data over SNMP without CDP, and sends IP and MAC bindings to Strata Logging Service in Enhanced Application Logs for Device Security.
- IoT discovery profiles default to a 24-hour network discovery schedule that the device discovery schedule may not exceed, support SNMPv2 and v3, allow up to 128 start nodes per site with eight scope subnets each, and path rules can then match device profiles on their Devices tab, for example to steer cameras onto MPLS.
- User-ID with the Cloud Identity Engine flows from a PAN-OS firewall that maps addresses to users and CIE that maps users to groups, through the controller to branch IONs, requires a TSG-compatible tenant with the firewall and Cloud Identity agent in the same TSG, and delivers to each site only mappings for prefixes learned there.
- Cloud User ID is turned on with Enable User Context Cloud Service under Configure Identity Engine using a UPN or SAM primary user name, the Site Summary Users Mapping view lists active mappings, INC_SDWAN_CUID_SYNC_FAILED points first at the User Context status in CIE, and dump user-id agent status and dump user-id group-mapping check agents and learned groups on the ION.
- From 6.2.1 path, QoS and security rules can match users or groups on the Users tab, where picking Any, Known or Unknown disables group selection, and for site-to-site traffic the sending ION tags packets with the user name so the receiving ION can enforce User-ID policy for that remote user.
Domain 5: Troubleshooting
- VPN tunnel recovery looks for bidirectional BFD, then captures ESP to confirm traffic once the tunnel forms, checks with dump vpn ha all that only the tunnel to the active peer is usable and with dump vpn sharedsecret that a key window covers the current time, and leaves circuit detach and re-attach as a disruptive last step under support supervision.
- VPN incident codes name the cause, with NETWORK_VPNSS_UNAVAILABLE and NETWORK_VPNKEK_UNAVAILABLE meaning missing shared secrets or the key that decrypts them, NETWORK_VPNPEER_UNREACHABLE pointing at peer address, NAT, underlay or blocked UDP 4500, and NETWORK_VPNLINKCIPHERS_INCOMPATIBLE meaning no common cipher, while SITE_CONNECTIVITY_DOWN suppresses dependent controller and fabric incidents.
- Controller connectivity is traced from dump controller status to debug controller reachability, where curl exit code 7 signals DNS, routing or port 443 trouble, while two IONs both reporting Active is split brain from lost VRRP advertisements, confirmed with a vrrp capture on the HA link and the ham process status.
- In dump routing peer status a number under State/PfxRcd means an established session with that many prefixes and Idle, Active or Connect means a down session, which needs matching peer addresses and AS numbers, open TCP 179 and matching keys, because its routes leave the forwarding table and can blackhole traffic.
- Forwarding is verified by passing the vpnlink_id from dump vpn ha all to inspect fib path-id, dump routing peer route-via and dump routing summary show learned routes and neighbors with VRF and address-family filters from 6.3.1, and the Flow Decision Bitmap records each path selection decision taken for a flow.
- CIRCUIT_PERFORMANCE_DEGRADED marks a link quality SLA breach and CARRIER_PERFORMANCE_DEGRADED signals carrier-wide trouble when several interfaces on one WAN network breach together, while APPLICATION_PERFORMANCE_DEGRADED tracks application SLAs and APPLICATION_UNKNOWNS_HIGH calls for reviewing unknown flows in the Flow Browser.
- Move Flows Graceful sends only new flows to a better path and keeps existing flows in place for up to 10 minutes, while Move Flows Forced shifts existing flows on events such as Layer 3 unreachability, LQM or probe SLA violations and service link changes, and probe configs measure ICMP, DNS, HTTP or HTTPS endpoints over direct or VPN paths.
- Application performance tools include dump app-probe status, dump qos-bwc config to map QoS agents to WANs, debug speedtest interface on WAN ports from 6.3.6 and dump flow count-summary for FPS_LIMIT_EXCEEDED, while App Acceleration needs ION 6.4.2 for network optimization and 6.5.2 for SaaS acceleration.
- Policy lookups explain unexpected treatment, since inspect policy-mix lookup-flow shows how a flow was classified when inspect network-policy lookup finds no rule, inspect performance-policy lookup and inspect security-policy lookup return the matched rule and action, and inspect flow brief lists live flows with their policy, security action and path.
- When policy resources run out the ION drops the costliest rules first regardless of order, SECURITY_POLICY_LIMITS_EXCEEDED leaves no security policy enforced until it clears, recovery unbinds and rebinds the stack after about 30 seconds before any reboot, and a local Device Toolkit interface edit raises an interface configuration out-of-sync incident.
- Copilot opens from the icon at the top right of Prisma SD-WAN once the supplemental EULA is accepted, works in seven languages, explains each result under How is this response generated, cites numbered sources in summaries, keeps a case-creation session for one hour and processes data in memory in the United States without retaining it.
- The Troubleshooting AI Agent runs inside Strata Copilot, gathers context from incidents and alerts before building a plan and calling backend tools, and gives next steps for adjacent infrastructure when the root cause lies outside SD-WAN, while the SD-WAN prompt library files prompts such as the top bandwidth site under Site and Network Management.
- Analytics guide optimization, as device lists badge IONs nearing end of life, weekly network insights cover every branch, capacity incidents such as HUB_CLUSTER_SITE_COUNT_THRESHOLD_EXCEEDED and VION_BANDWIDTH_LIMIT_EXCEEDED warn about planned load without blocking traffic, and the Visibility action overlays the performance SLA on secure fabric link charts from link quality metrics alone.
- Application overrides tune behavior per app, with a Connection Idle Timeout change affecting only new flows, TCP unreachability detection on by default and Use Parent App Network Policy off by default, while security policy memory shrinks when full port ranges become discrete ports, /32 prefixes are aggregated and unused custom applications are removed.
- Activity Insights aggregates Strata Logging Service data into Overview, Threats and Domains tabs, and with Strata Logging Service and Branch Security licensed the SD-WAN traffic, threat, URL and DNS logs sit under Network in Log Viewer.
Palo Alto SD-WAN Engineer exam tips
- Planning and Design and Deployment and Configuration each carry 24 percent, so nearly half the score rests on ION model fit, licensing tiers, data center and branch gateway designs, HA, the five policy types, site settings, templates, BGP, OSPF and VRFs; learn the defaults and the minimum ION release attached to each feature.
- Troubleshooting at 20 percent rewards fluency with the ION CLI: practise reading dump vpn ha all, dump routing peer status, dump controller status, inspect fib, inspect flow brief and the policy lookup commands, and know what each VPN, routing and policy incident code says about the root cause.
- Operations and Monitoring at 18 percent mixes dashboards and plumbing, so compare legacy incident policies with Strata Cloud Manager Incidents and notification profiles, and learn how WAN Clarity reports, IPFIX, syslog, SNMP and the Prisma Access CloudBlade monitor views surface problems.
- Unified SASE at 14 percent is the smallest domain but detail-heavy: know SASE Easy Onboarding and SASE Connectivity modes, CloudBlade tags and ECMP rules, how ADEM counts tests and draws bandwidth, IoT discovery profiles, and how the Cloud Identity Engine feeds User-ID policy to branch IONs.
- The hardest items hinge on precedence and release numbers, such as circuit versus category settings, path, QoS and security rule order, BGP scope after a 6.5.1 upgrade and features gated at 6.0.1, 6.3.1, 6.4.1, 6.5.1 and 6.8.1, so tie every fact you study to the release and setting it depends on.
Study guide FAQ
What does the Palo Alto Networks SD-WAN Engineer exam cover?
Five domains from the August 2025 datasheet: Planning and Design (24%), covering device selection, bandwidth and licensing, network assessment, data center, branch gateway, security and HA design and path, security, QoS, performance and NAT policies; Deployment and Configuration (24%), covering deployment, site settings, configuration templates, routing tuning and VRFs; Operations and Monitoring (18%), covering device statistics, incidents, alerts and audit logs, notifications, WAN Clarity reports, monitoring tools and SASE events; Unified SASE (14%), covering Prisma Access integration, ADEM, IoT with Device-ID, the Cloud Identity Engine and user and group based policy; and Troubleshooting (20%), covering site connectivity, routing and forwarding, application performance, policy problems, the co-pilot and analytics.
How does CertGrid practice map to the real exam?
The CertGrid bank holds 502 questions written to the five datasheet domains and weighted the same way: 127 in Planning and Design, 129 in Deployment and Configuration, 87 in Operations and Monitoring, 73 in Unified SASE and 86 in Troubleshooting, with many scenario items built around site and circuit tables, policy rule sets, HA and BGP settings, template files, CloudBlade tags and ION CLI output.
What is the passing score?
Palo Alto Networks sets the passing score at 860 on a 300-to-1000 scale for every one of its certification exams, and it publishes no question count or seat time for this exam, so the length of a CertGrid mock is a practice setting and a scaled score cannot be read as a percentage correct.
How should I prepare?
Start with Planning and Design and Deployment and Configuration at 24 percent each, then Troubleshooting at 20 percent, Operations and Monitoring at 18 percent and Unified SASE at 14 percent. Research the keywords of each blueprint task in the Prisma SD-WAN and Strata Cloud Manager documentation, complete the Palo Alto Networks learning path, and work hands-on with sites, circuits, policy stacks, routing, the Prisma Access integration and the ION CLI if you have lab access.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Palo Alto Networks - SD-WAN Engineer datasheetBlueprint revised AUGUST 2025 · link and content verified 20 October 2026Five domains totalling 100%: Planning and Design 24%, Deployment and Configuration 24%, Operations and Monitoring 18%, Unified SASE 14%, Troubleshooting 20%; leaf objectives per the datasheet blueprint table.
- Palo Alto Networks - certification handbooklink and content verified 20 October 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." 700 is CertGrid's own internal threshold, not the vendor figure.
The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length for this exam on its certification page, in the datasheet or in the handbook. So the 90 minutes and 75 questions of the CertGrid mock are practice settings, unverified from Palo Alto's own documents, and the question count is shown as "Varies" rather than as a Palo Alto figure.