Palo Alto Networks SD-WAN Engineer - SD-WAN-Engineer certification

A network administrator is viewing the Flow Browser to investigate a report that a specific user cannot access an internal web server. The flow entry for this traffic shows the "Flow State" as "INIT" and it remains in that state until it times out.
What does the "INIT" state indicate about the traffic flow?

• A. The TCP 3-way handshake was completed successfully, and data is being transferred.
• B. The ION device received the SYN packet from the client but never saw a SYN-ACK response from the server.
• C. The traffic is being buffered while the ION waits for a dynamic VPN tunnel to establish.
• D. The flow was denied by a Zone-Based Firewall policy on the ION.

A multinational company is deploying Prisma SD-WAN across North America, Europe, and Asia. The data centers in the North America region have served all regions, but regional policies are now being enforced that mandate each of the regions to build their own data centers and branch sites to only connect to their respective regional data centers.
How can this regionalization be achieved so that new or existing branch sites only build tunnels to the regional DC IONs?

• A. Assign WAN interfaces to distinct Virtual Routing and Forwarding (VRF) instances for each region on the DC IONs, ensuring that branches only connect to the WAN interfaces/VRFs designated for their region.
• B. Create a new cluster for each regional DC ION and move the sites from the existing cluster to the new cluster.
• C. Remove the circuit labels and apply new circuit labels for in-region circuits only.
• D. Disable the auto-tunnel feature globally on the Prisma SD-WAN portal and manually create all necessary tunnels exclusively between IONs within their designated regions.

While designing a greenfield Prisma SD-WAN solution for a retailer, the risk management group requires segmentation of the retail network to avoid one large fault domain.
The following data points are provided:
* Two data centers and all sites need to access applications in both data centers
* 1000 retail branches with stores concentrated in multiple metropolitan areas
* Data Center 1 and Data Center 2 have different sets of applications that are not replicated
* Maintaining application availability is the primary goal
Which action will segment the retail network and reduce regional outages?

• A. Create more than one data center cluster for a larger pool of resources and resiliency.
• B. Implement a single, large data center cluster spanning both data centers to centralize management and optimize resource use.
• C. Add more data center aggregation devices within the same cluster to enhance the scalability and resilience.
• D. Create more than one data center cluster in each data center and assign sites to clusters so nearby retail locations can be spread on separate clusters.

A network installer is attempting to claim a new ION device using the "Claim Code" method. The device is connected to the internet, but the status in the portal remains stuck at "Claimed" and does not transition to
"Online". The installer connects a laptop to the LAN port of the ION and can successfully browse the internet, confirming the uplink is active.
What is the most likely cause of the device failing to reach the "Online" state?

• A. The upstream firewall is blocking outbound TCP port 443 or UDP port 123 (NTP).
• B. The "Circuit Label" has not been applied to the WAN interface.
• C. The device has not yet downloaded the latest software image.
• D. The device is missing the "Site" assignment in the portal.

A network operator receives a critical SITE_CONNECTIVITY_DOWN alarm for a branch site in the Prisma SD-WAN portal.
What specific condition triggers this alarm type?

• A. The site has exceeded its licensed bandwidth capacity.
• B. One of the two internet circuits at the site has gone down.
• C. All Secure Fabric Links (VPNs) to all remote peers are down, isolating the site from the overlay.
• D. The device has lost power and rebooted.