Palo Alto Networks SD-WAN-Engineer 問題集

質問 1：
User-ID integration is configured for a Prisma SD-WAN deployment. Branch-1 has the user-to-IP mappings available, and User-1 is mapped to IP-1.
To which two use cases can User-ID based zone-based firewall policies be applied? (Choose two.)
A. User-1 accessing a private application in Branch-2 via SD-WAN overlay, and destination User-ID based zone-based firewall rules on Branch-2 ION
B. User-1 accessing a private application in data center via SD-WAN overlay, and destination User-ID based zone-based firewall rules on DC ION
C. User-1 accessing a private application within Branch-1, and source User-ID based zone-based firewall rules on Branch-1 ION
D. User-1 accessing a SaaS application on direct internet and source User-ID based zone-based firewall rules on Branch-1 ION
正解：C,D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Based on the HA topology image below, which two statements describe the end-state when power is removed from the ION 1200-S labeled "Active", assuming that the ION labeled "Standby" becomes the active ION?
(Choose two.)

A. The newly active ION will send a gratuitous ARP to the LAN for the IP address of any SVIs.
B. Both the connection to ISP A and the connection to LTE/5G will be usable.
C. The VRRP Virtual IP address assigned to any SVIs will be moved to the newly active ION.
D. The connection to ISP A will be usable, but the connection to LTE/5G will not.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A network administrator is troubleshooting a critical SaaS application, "SuperSaaSApp", that is experiencing connectivity issues. Initially, the configured active and backup paths for the application were reported as completely down at Layer 3. The Prisma SD-WAN system attempted to route traffic for the application over an L3 failure path that was explicitly configured as a Standard VPN to Prisma Access.
However, users are still reporting a complete outage for the application and monitoring tools show application flows being dropped when attempting to use the Standard VPN L3 failure path, even though the tunnel itself appears to be up. The administrator suspects a policy misconfiguration related to how the Standard VPN path interacts with destination groups.
What is the most likely reason for flows being dropped when attempting to use the Standard VPN L3 failure path?
A. The Standard VPN in the path policy was not configured to "Minimize Cellular Usage", leading to the depletion of metered data and subsequent flow drops.
B. The "Move Flows Forced" action was not enabled in the performance policy for "SuperSaaSApp", preventing the system from actively shifting traffic to the L3 failure path.
C. The path policy rule for "SuperSaaSApp" has the "Required" checkbox selected for its Service & DC Group, but no direct paths were configured alongside it, creating a conflict.
D. The path policy rule explicitly designates a Standard VPN as the L3 failure path, but it does not include a designated Standard Services and DC Group, causing traffic to be dropped.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
When troubleshooting an issue at a site that is running on two cellular links from two carriers, the operations team shared some evidence shown in the graph below:

For the time duration shown in the graph, what are two inferences about the site's traffic that can be made?
(Choose two.)
A. Using Carrier-2 as the WAN path may have experienced some performance degradation.
B. Using Carrier-2 as the WAN path may have switched over to Carrier-1.
C. Using Carrier-1 as the WAN path may have switched over to Carrier-2.
D. Using Carrier-1 as the WAN path may have experienced some performance degradation.
正解：C,D
解説: (Topexam メンバーにのみ表示されます)

質問 5：
What is the basis for calculating the minimum bandwidth subscription required for branch IONs?
A. Amount of traffic which will traverse the SD-WAN secure fabric
B. ISP circuit capacity at the branch location
C. Maximum throughput supported by the ION hardware deployed at data center locations
D. Maximum traffic (ingress and egress) passing through the ION device
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
An administrator has configured a Zone-Based Firewall (ZBFW) policy on a branch ION. They created a rule to "Allow" traffic from the "Guest" zone to the "Internet" zone. However, users in the "Guest" zone are reporting they cannot reach a specific public website, and the Flow Browser shows the flow state as
"REJECT".
What is the most likely reason for this specific rejection, assuming the "Allow" rule is correctly placed at the top of the list?
A. The "Allow" rule does not have the specific "Application" defined (it is set to Any), causing a mismatch.
B. There is a "Deny" rule in the "Global" policy stack that is taking precedence over the "Local" site rule.
C. The ION device does not support firewalling for HTTP traffic.
D. The implicit default action at the bottom of the security policy is "Deny All".
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 7：
An organization has created a custom internal application definition for "Inventory_App" on the Prisma SD- WAN controller based on its destination IP address and port (L3/L4 rule). The application server IP has just changed.
After updating the custom application definition on the controller, how is this change propagated to the branch ION devices?
A. The change will only take effect after the daily "App-ID" scheduled update.
B. The administrator must reboot the ION devices for the new object to load.
C. The controller automatically pushes the updated Application Definition (App-Def) to all ION devices immediately.
D. The administrator must manually "Push" the policy to all sites.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 8：
Return traffic for an application from the branch is being dropped on the branch ION. Application traffic arrives via SD-WAN internet overlay at the branch, and path policy for the application at the branch has the following settings:
Active = MPLS Overlay
Backup = Prisma Access on internet
Which branch configuration is the probable cause of this behavior?
A. It has Prisma Access tunnel over MPLS circuit but not on the internet circuit.
B. It has no MPLS circuit, and the Prisma Access tunnel is down.
C. It has one MPLS and one internet circuit.
D. It has two internet circuits and no MPLS circuit.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 9：
Full discovery and classification of IoT devices by the IoT Security service is failing. Which Prisma SD- WAN ION device configuration will cause this behavior?
A. The Prisma SD-WAN ION devices lack properly configured or enabled Service Health Probes specifically targeting the IoT device subnets. Without these active probes, the system cannot gather critical real-time reachability and performance metrics essential for dynamic device profiling and classification.
B. The ION devices are missing DHCP Configuration. If ION devices are not explicitly configured as either a DHCP relay agent or a DHCP server, DHCP traffic logs will not be sent to the Strata Logging Service, resulting in incomplete device profiles for IoT Security.
C. The Syslog export configuration on the ION devices to the Strata Logging Service has filters that are too restrictive, potentially excluding logs vital for IoT Security's device identification and classification engine. This prevents comprehensive event data, including device discovery messages, from reaching the portal.
D. The ION devices are not configured to explicitly enable and export IPFIX flow records, especially those containing Layer 2 and Layer 7 context, to the Strata Logging Service for IoT Security. While ARP data is sent by default, comprehensive device classification relies on these detailed flow records, which are not being captured.
正解：B
解説: (Topexam メンバーにのみ表示されます)