Palo Alto Networks SD-WAN Engineer SD-WAN-Engineer Exam Questions with Experts Answers Updated Recently

Comprehensive and Detailed Explanation

In Prisma SD-WAN (CloudGenix),Zone-Based Firewall (ZBFW)policies rely on the device's ability to map an IP address to a User-ID to enforce identity-based rules. The key to this question is understandingwhere the mapping existsandwhich directionthe policy attributes (Source User vs. Destination User) apply to.

1. Mapping Location (Branch-1):The prompt states that Branch-1 has the user-to-IP mapping for User-1. For the most effective and scalable security enforcement, policies should be applied at thesource (ingress)device where the traffic originates and where the user identity is known. This prevents unauthorized traffic from consuming WAN bandwidth only to be dropped at the destination. Therefore, the Branch-1 ION is the correct enforcement point for User-1's traffic.

2. Source vs. Destination User:

User-1 is the Source:In all scenarios, User-1 is the initiator of the traffic. Therefore, the security rule must match onSource User-ID.

Options C and D are incorrectbecause they suggest usingDestinationUser-ID based rules to control User-1. Destination User-ID rules are used when thetargetof the traffic is a known user (e.g., VoIP calls to a specific user's phone), not when filtering based on the sender. Furthermore, relying on the DC or Branch-2 ION to enforce policies for User-1 would require the propagation of User-ID mappings across the overlay, whereas local enforcement at Branch-1 is the standard architectural model.

3. Valid Use Cases (A and B):

Option A (SaaS/Internet):The Branch-1 ION acts as the internet gateway. It can use the local mapping (IP-1 = User-1) to allow or deny access to specific SaaS applications (Direct Internet Access) based on the user's identity (e.g., "Allow Marketing Group to access Social Media").

Option B (Internal Segmentation):The Branch-1 ION can enforce policies for traffic moving between local zones (e.g., from a "Users" VLAN to a "Servers" VLAN within the branch). Since the ION routes this traffic and holds the mapping, it can enforce Source User-ID policies to secure local private applications.

Comprehensive and Detailed Explanation

Prisma SD-WAN (formerly CloudGenix) integrates with Palo Alto NetworksIoT Securityto provide comprehensive visibility into all devices at a branch, including those that are not directly connected to the ION device. While the ION automatically detects and classifies devices connected directly to its interfaces via traffic inspection (DPI), DHCP, and ARP analysis, gaining visibility intooff-branch devices(devices connected to downstream switches or access points) requires additional discovery mechanisms that can query the network infrastructure or ingest its logs.

1. SNMP (Simple Network Management Protocol):This is the primary active discovery method for off-branch devices. The Prisma SD-WAN ION device acts as a sensor that actively polls local network switches and wireless controllers using SNMP. By querying theARP tablesandMAC address tables(Bridge MIBs) of these intermediate network devices, the ION can identify endpoints that are connected to the switch ports, even if those endpoints are not currently sending traffic through the ION. This allows the system to map the topology and discover silent or lateral-traffic-only devices.

2. Syslog:In conjunction with SNMP, the IoT Security solution can utilize Syslog messages to discover and profile devices. Network infrastructure devices (like switches and WLAN controllers) can be configured to send Syslog messages to the collection point (which enables the IoT Security service) whenever a device connects or disconnects (e.g., port up/down events, DHCP snooping logs, or 802.1x authentication logs). These logs provide real-time data about device presence and identity (MAC/IP mappings) for devices that are not directly adjacent to the ION, ensuring 100% visibility across the branch network segments. LLDP (A) and CDP (B) are typically Link Layer discovery protocols used for discoveringdirectly connectedneighbors and do not propagate beyond the immediate link, making them unsuitable for discovering devices multiple hops away or behind a switch.