Free SD-WAN-Engineer Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The Prisma SD-WAN Application Experience (AppX) Score is a composite metric designed to provide a holistic view of end-user experience for a specific application. It is calculated by combining three distinct performance indicators. These are the Network Transfer Time (NTT), which measures the round-trip network latency; the Server Response Time (SRT), which measures the time the application server takes to process a request; and the Transaction Failure Rate, which quantifies the percentage of failed application transactions. Together, these metrics accurately represent the end-to-end performance from the client to the application server and back.

D. Bandwidth Utilization: This metric reflects the consumption of link capacity. While it can impact performance, it is not a direct input into the AppX score calculation itself.

E. Jitter: Jitter measures the variation in packet delay. It is a key metric for assessing path quality, especially for real-time traffic like VoIP, but it is not a component of the AppX score.

1. Palo Alto Networks. (2023). Prisma SD-WAN Administrator's Guide 6.2. Monitor Application Performance. "Prisma SD-WAN calculates the Application Experience (AppX) Score for an application based on the following metrics: Network Transfer Time (NTT), Server Response Time (SRT), and Transaction Failure Rate." Retrieved from https://docs.paloaltonetworks.com/prisma-sd-wan/6-2/prisma-sd-wan-admin/monitor/monitor-application-performance

2. Palo Alto Networks. (2023). Prisma SD-WAN Administrator's Guide 6.2. Monitor Application Performance > Application Health - Summary. The section details the AppX Score and explicitly lists its three components: "Network Transfer Time (NTT)", "Server Response Time (SRT)", and "Transaction Failure Rate". Retrieved from https://docs.paloaltonetworks.com/prisma-sd-wan/6-2/prisma-sd-wan-admin/monitor/monitor-application-performance/application-health-summary

User-ID based zone-based firewall policies in Prisma SD-WAN are enforced on the ION device where the user's traffic originates and the user-to-IP mapping is available. In this scenario, the Branch-1 ION has the mapping for User-1. Therefore, it can apply source User-ID based policies to any traffic initiated by User-1. This includes traffic going directly to the internet for a SaaS application (A) and traffic destined for a private application within the local branch (B). The policy is enforced at the source ION based on the user initiating the connection.

C. The policy on the DC ION would be based on the source user (User-1), whose identity is propagated across the overlay, not on a destination User-ID rule.

D. Similar to option C, the policy on the Branch-2 ION would enforce rules based on the originating source user (User-1), not a destination User-ID.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide (23.1): In the "User-ID Based Policy" section, it states, "When a user attempts to access a resource, the ION device queries the directory service for the user and group mapping information for the source IP address of the user." This confirms that policies are based on the source user. The guide further explains, "The ION device at the branch where the user is located performs the User-ID mapping and enforces the policy." This directly supports the enforcement of policies at Branch-1 for traffic originating from User-1, as described in options A and B.

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide (23.1): The section "Configure a Security Policy Set" details the creation of security rules. The match criteria for users is explicitly labeled "Source User," indicating that policies are designed to identify the initiator of the traffic. There is no equivalent "Destination User" field for this type of policy, making options C and D invalid as described.

3. Palo Alto Networks Prisma SD-WAN Design and Sizing Guide: The "User-ID" section discusses the architecture, explaining that User-ID agents or IONs themselves collect IP-to-user mappings. This information is then used by the local ION to enforce source-based policies. It also describes the propagation of this identity information to remote IONs for consistent policy enforcement across the fabric, but the policy logic at the remote site still applies to the original source user.

Prisma SD-WAN implements a class-based Quality of Service (QoS) system on each WAN interface. This system is structured around four predefined traffic classes: Class 1 (Real-time), Class 2 (Interactive), Class 3 (Default), and Class 4 (Bulk). Within each of these four classes, traffic can be further categorized by four application criteria: High, Medium, Low, and Lowest. This hierarchical structure creates a 4x4 matrix, resulting in a total of 16 distinct queues that are used to prioritize and manage traffic, ensuring that critical applications receive the appropriate network resources.

A. This option is incorrect because Prisma SD-WAN uses four application criteria within each class, not three, which would only result in 12 queues.

C. This option incorrectly describes the queue structure; Prisma SD-WAN uses a 16-queue, class-based system, not a simple 1 priority plus 7 non-priority queue model.

D. This option is incorrect as it states there are only two classes. The Prisma SD-WAN QoS model is built upon four distinct traffic classes.

1. Palo Alto Networks. (2023). Prisma SD-WAN Administrator's Guide. Palo Alto Networks TechDocs. In the section "Policies > Quality of Service (QoS) > Traffic Classes," the guide states, "Prisma SD-WAN provides four predefined traffic classes... Within each of these four classes, you can define four application criteria: High, Medium, Low, and Lowest. This results in 16 queues for traffic prioritization."

The integration between Prisma SD-WAN and Prisma Access utilizes standard IKEv2/IPSec protocols for tunnel creation. A core component of this is Dead Peer Detection (DPD), which is used to verify the liveness of the IPSec peer. The branch ION device periodically sends IKEv2 informational messages (keepalives) to the Prisma Access Security Processing Node (SPN). If the SPN fails to respond after a set number of retries, the ION device declares the peer dead and can attempt to re-establish the tunnel. This mechanism ensures tunnel state is maintained even when there is no active user data traversing the link.

A. Requiring a manual ping script on a client PC is an unreliable and unscalable method, contrary to the automated, enterprise-grade design of the Prisma SD-WAN solution.

B. Synthetic Probes are used by Prisma SD-WAN for path performance monitoring (measuring latency, jitter, and loss) to make intelligent path selection decisions, not primarily for IPSec tunnel state maintenance.

D. In a standard branch-to-cloud connection model, the branch ION device is the initiator of the IPSec tunnel to the Prisma Access SPN, not the other way around.

1. Palo Alto Networks - Prisma Access Administrator's Guide: In the section describing remote network connections, the guide specifies the mechanism for tunnel health monitoring. It states, "Prisma Access uses Dead Peer Detection (DPD) to monitor the health of the IPsec tunnel." This confirms DPD is the standard method used. (Reference: Prisma Access Administrator's Guide, section "Set Up Remote Network Connections > Tunnel Monitoring").

2. Palo Alto Networks - Prisma SD-WAN Administrator's Guide: When configuring IPSec tunnels, the guide details the IKE Gateway settings, which include Dead Peer Detection. It describes DPD as the mechanism where the device "periodically sends messages to its peer to verify that the peer is available." The CloudBlade automates the configuration of this standard feature. (Reference: Prisma SD-WAN 9.1 Administrator's Guide, section "IPsec Tunnels > Configure an IKE Gateway", Page 435).

Prisma SD-WAN employs a sophisticated hierarchical queuing mechanism to manage Quality of Service (QoS). This system, based on principles of a Hierarchical Token Bucket (HTB) or Hierarchical Fair Service Curve (HFSC), allows for granular control over bandwidth allocation. For the "Platinum" class, which is reserved for the most critical, real-time traffic like VoIP, a guaranteed minimum bandwidth is allocated. This ensures that even when the circuit is saturated with lower-priority traffic, the Platinum queue receives the resources it needs, preventing packet drops and maintaining performance. This hierarchical scheduler provides strict priority for real-time needs while also enabling fair bandwidth distribution for other classes.

A. Strict Priority Queuing (SPQ): While the Platinum class receives the highest priority, SPQ alone is a simplistic model that can lead to the starvation of all lower-priority queues, which is not how the Prisma SD-WAN scheduler operates.

B. Weighted Round Robin (WRR): WRR is designed for fair bandwidth distribution based on weights but does not provide the strict, low-latency priority required for real-time applications like VoIP in the Platinum class.

D. First-In, First-Out (FIFO): FIFO is a non-prioritized queuing method where packets are processed in the order they arrive. It is the default behavior without QoS and would result in VoIP traffic being dropped during congestion.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section on Quality of Service (QoS), the guide explains the use of a hierarchical scheduler. "Prisma SD-WAN uses a Hierarchical Fair Service Curve (HFSC) scheduler to provide QoS. HFSC allows you to specify real-time, link-sharing, and priority-based policies." HTB is a similar and commonly referenced type of hierarchical scheduler that provides these capabilities. (Reference: Prisma SD-WAN Administrator's Guide, "Quality of Service (QoS)" section).

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide: The configuration options for QoS directly support the concept of guaranteed bandwidth. "For each traffic class, you can configure a Guaranteed Bandwidth Minimum as a percentage of the circuit’s provisioned bandwidth... This ensures that the traffic class is guaranteed a minimum amount of bandwidth." This directly aligns with the functionality described in option C. (Reference: Prisma SD-WAN Administrator's Guide, "Configure QoS" -> "QoS for Circuits" subsection).

A Service Connection (SC) is a dedicated, high-bandwidth IPSec VPN tunnel that links the Prisma Access cloud infrastructure to a customer's headquarters or data center. Its specific purpose is to provide secure access to internal, private resources (such as Active Directory, DNS, or internal applications) for all users and sites connected to the Prisma Access service. This ensures that traffic from remote networks and mobile users, once secured by Prisma Access, can be safely routed back to the corporate network to access necessary services that are not in the cloud.

B. This describes a Remote Network (RN) connection, which is the IPSec tunnel from a branch site (like a Prisma SD-WAN ION device) to the Prisma Access Security Processing Node (SPN).

C. This describes the GlobalProtect portal for mobile user VPNs, which is a separate component of Prisma Access focused on individual remote user connectivity, not site-to-site infrastructure links.

D. This describes the internal, high-speed backbone that Palo Alto Networks manages to interconnect its global Prisma Access locations. This is not a customer-configured component.

1. Palo Alto Networks. (2023). Prisma Access Administrator’s Guide. "Plan for Service Connections". The guide states, "A service connection provides access to services in your headquarters or data center for your mobile users and remote networks... Prisma Access secures the connection between your mobile users and remote networks and the services in your headquarters or data center."

2. Palo Alto Networks. (2023). Integrate Prisma SD-WAN with Prisma Access for Remote Networks. "Prisma Access for Remote Networks with Prisma SD-WAN Integration Overview". This document specifies the components: "Service Connections—Connects your corporate headquarters or data center to Prisma Access. This connection allows your mobile users and remote network sites to securely access the internal resources at your headquarters or data center."

3. Palo Alto Networks. (2024). Prisma Access Fundamentals. "Prisma Access Components". This documentation clearly distinguishes between the three main connection types: Mobile User connections, Remote Network connections, and Service Connections, defining the Service Connection as the link to the corporate headquarters or data center.

Palo Alto Networks Prisma SD-WAN is designed to maximize application availability and performance. When all available active paths for an application fail to meet the criteria defined in a Path Quality Profile (SLA), the system does not drop the traffic. Instead, it enters a "best-effort" mode. It will select the path that is performing the best relative to the others, even though it technically violates the configured threshold. In this scenario, it would choose the active path with the lowest packet loss (e.g., 1.5% loss over a path with 2% loss) to maintain connectivity and minimize the impact on the application. This ensures graceful degradation rather than a complete service outage.

A. Dropping traffic is a last-resort action and contradicts the primary SD-WAN goal of ensuring application resiliency and high availability.

C. Queuing traffic indefinitely is not a viable network strategy, as it would lead to severe latency, buffer exhaustion, and application timeouts.

D. A Backup path is used if it is available and meets the SLA. However, the fundamental behavior when all paths are degraded is to choose the "best of the worst," which could still be an active path.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section "Define Application Path and Quality Policies," the guide specifies the system's behavior for path selection. It states, "If no path meets the policy requirements, Prisma SD-WAN forwards the traffic on the best available path based on the path selection criteria." This directly supports the principle of selecting the "best of the worst" path. (Reference: Prisma SD-WAN Administrator's Guide, section on Application Path and Quality Policies).

2. Palo Alto Networks Prisma SD-WAN Design Guide: The design guide elaborates on failover and brownout scenarios. It explains that the system is designed to always forward traffic if a path is available, selecting the one that most closely aligns with policy objectives even during periods of degradation, which prevents "black-holing" traffic when all links are performing poorly. (Reference: Prisma SD-WAN Design Guide, section on High Availability and Path Failover).

The High Availability (HA) control interface is a dedicated link used for heartbeats, configuration synchronization, and session state exchange between the active and passive ION devices. To ensure low latency and reliability for these critical functions, the connection must be Layer 2 adjacent. This is achieved either through a direct physical cable connecting the two devices or by placing both interfaces on the same dedicated, untagged VLAN on a switch. Routing is explicitly not permitted on this control link as it would introduce unacceptable delay and complexity for the failover mechanism.

A. A Layer 3 routed network is not supported for the HA control link, which must be a direct Layer 2 connection to ensure timely heartbeats and state synchronization.

C. The HA control link is mandatory for the HA pair to function; the Cloud Controller manages configuration but does not handle the real-time failover process.

D. The HA control interface is a dedicated port, distinct from the management port, and is used for private communication between the HA peers, not for internet connectivity.

1. Palo Alto Networks. (2023). Prisma SD-WAN Administrator's Guide. "High Availability" section, "Configure High Availability" subsection. The guide states, "The HA control link is a dedicated link between the two ION devices in an HA pair. This link can be a direct physical connection or a Layer 2 adjacent connection on a dedicated VLAN. The HA control link must not have any routing between the two ION devices."

The SITECONNECTIVITYDOWN alarm is a critical alert in Prisma SD-WAN that signifies a complete loss of overlay connectivity for a specific site. This alarm is triggered precisely when all Secure Fabric Links (the VPN tunnels that form the SD-WAN overlay) from the site to all its remote peers (like data centers or other branches) have gone down. This means the site is effectively isolated from the rest of the SD-WAN fabric, even if its underlying internet circuits are still active.

A. A device power loss or reboot would generate a DEVICEUNREACHABLE or DEVICEREBOOTED alarm, which is distinct from a site-level connectivity failure.

B. The failure of a single internet circuit triggers a CIRCUITDOWN or PATHDOWN alarm. The site would remain connected through its other active circuits.

D. Exceeding licensed bandwidth triggers a licensing-specific alarm and does not indicate a loss of network connectivity.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section on monitoring alarms, the SITECONNECTIVITYDOWN alarm is explicitly defined.

Source: Palo Alto Networks TechDocs, "Monitor Alarms".

Reference: The table listing "System-Generated Alarms" specifies the trigger for SITECONNECTIVITYDOWN as "All Secure Fabric links from the site are down." This confirms that the loss of all VPNs, not just one circuit or a device reboot, is the specific condition.

The Prisma SD-WAN architecture is built on a centralized management model where the controller maintains a persistent and secure connection with all managed ION devices. When an administrator creates or modifies a configuration element, such as a custom application definition, the change is saved on the controller. The controller then automatically and immediately pushes the updated configuration to all ION devices in the network. This ensures configuration consistency across the SD-WAN fabric without requiring manual intervention, device reboots, or waiting for a scheduled update cycle.

A. No manual "Push" action is required for this type of configuration change; the controller propagates it automatically upon saving.

B. Rebooting an ION device is a service-impacting action and is not required for applying configuration updates like application definitions.

D. Custom application definitions are user-defined configuration objects, distinct from the global Palo Alto Networks App-ID signature database, which is updated on a schedule.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section on Application Definitions, the process of creating and managing custom applications is described. The guide states, "When you define a custom application, the controller automatically distributes this definition to all ION devices." This confirms the automatic and immediate propagation of the change. (Reference: Prisma SD-WAN Administrator's Guide, section "Define a Custom Application").

2. Palo Alto Networks Prisma SD-WAN Design and Sizing Guide: This guide describes the architecture, noting that the controller is the single source of truth for policy and configuration. It explains that "Configuration and policy changes are made centrally on the controller and are automatically propagated to the ION devices," which supports the immediate and automated nature of the update process. (Reference: Prisma SD-WAN Design and Sizing Guide, section "Prisma SD-WAN Controller Architecture").

The Event Logs > System page is the primary location within the Prisma SD-WAN portal for troubleshooting control plane issues, such as VPN tunnel failures. This log captures detailed system-level messages, including the step-by-step Internet Key Exchange (IKE) negotiation process. When a tunnel fails to establish due to a misconfiguration, such as a mismatched pre-shared key or incompatible crypto proposals, specific error codes like "AUTHFAILED" or "NOPROPOSALCHOSEN" are recorded here. This provides the granular detail necessary to diagnose the root cause of the "VPNDOWN" alarm.

A. Flow Browser: This tool is used for inspecting individual data plane traffic flows (sessions) after a tunnel is established, not for diagnosing control plane tunnel negotiation failures.

C. Site Summary > Topology: This provides a high-level visual representation of tunnel status (up or down) but lacks the detailed error logs needed to determine why the tunnel is down.

D. Link Quality Graphs: These graphs display performance metrics like latency, jitter, and loss for the underlying WAN circuits, not the specific error codes from the IKE negotiation process.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section "Monitor Events," the guide specifies the purpose of different event logs. It states for the System log: "View system events such as device and network events, VPN status, and so on." This confirms it is the correct location for VPN status and related diagnostic messages. (Reference: Prisma SD-WAN Administrator's Guide, Chapter: Monitor, Section: Events).

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the troubleshooting section for VPNs, the standard procedure involves examining system events for detailed error messages. The guide explains that alarms like "VPNDOWN" are high-level indicators, and the root cause analysis requires inspecting the detailed logs generated during the connection attempt, which are found in Monitor > Events > System. (Reference: Prisma SD-WAN Administrator's Guide, Chapter: Troubleshoot, Section: Troubleshoot VPNs).

Site templates are fundamental to automating and scaling Prisma SD-WAN deployments.

Option C is correct because templates are integral to the Zero Touch Provisioning (ZTP) workflow. They allow an administrator to pre-stage configurations for numerous sites within the controller. These configurations act as "device shells," which are claimed by the physical ION devices upon connection, enabling rapid and consistent site rollouts without manual intervention at the branch.

Option D is correct within the context of automation and best practices for large-scale management. While the controller does not maintain a persistent link between a site and its template after creation, templates are used for lifecycle management. Administrators can modify a master template (e.g., a Jinja2 file) and use automation tools to push the updated configuration to existing sites via the Prisma SD-WAN API.

A. This statement is incorrect. Prisma SD-WAN explicitly supports the use of Jinja2 templates, which allow for advanced logic, including conditional statements, to create dynamic and flexible site configurations.

B. This is incorrect because the ION software version is not a mandatory template variable. Software versions are managed globally through software upgrade policies assigned to sites, not within the site creation template itself.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide, "Site and Device Templates": This section details the use of templates for creating multiple sites with similar configurations. It explicitly mentions, "For advanced configuration, you can use Jinja2 templates to create sites," which refutes option A. It also states, "Once a site is created from a template, it is no longer associated with the template," which highlights why API-based methods (as described for option D) are necessary for updates.

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide, "Zero Touch Provisioning for ION Devices": This section describes the ZTP process, which relies on pre-provisioning sites. The guide explains how an ION device can be "auto-claimed to a pre-provisioned site in the controller." This pre-provisioned site is the "device shell" created from a template, supporting option C.

3. Palo Alto Networks Developer Portal, Prisma SD-WAN API Reference Guide, "Update a site": The API documentation specifies endpoints such as PUT /api/sdwan/v4.5/api/sites/{siteid}. This endpoint allows for the programmatic update of an entire site's configuration. This capability is the foundation for the automation workflow described in option D, where an updated template is processed by a script to generate a new configuration that is then applied via the API.

Upon the failure of the active ION device, the standby device transitions to the active state. For LAN high availability, Palo Alto Networks SD-WAN uses VRRP. The new active device takes ownership of the VRRP Virtual IP (VIP) address for any configured Switched Virtual Interfaces (SVIs), ensuring LAN clients have a consistent gateway.

For WAN high availability, physical connectivity is required on both devices. As shown in the topology, the ISP A connection is cabled to both IONs and will remain usable after failover. However, the LTE/5G connection is physically cabled only to the original active device. When this device loses power, the physical connection is severed, making the LTE/5G path unusable by the newly active ION.

A. The LTE/5G connection is physically connected only to the failed device and will become unavailable after the power loss.

C. Sending a gratuitous ARP is a transient action performed during the failover process to update network tables, not a description of the final "end-state".

1. Palo Alto Networks, Prisma SD-WAN Administrator’s Guide 6.2, "High Availability for ION Devices" section, "HA Failover" subsection.

This section states: "When a failover occurs, the backup ION device assumes the role of the active device. It takes over the virtual IP (VIP) addresses for the LAN interfaces and sends gratuitous ARPs (GARPs) to update the ARP caches of the connected devices." This supports that the VIP is moved (Answer B) and that GARP is sent (the action described in C).

2. Palo Alto Networks, Prisma SD-WAN Administrator’s Guide 6.2, "High Availability for ION Devices" section, "High Availability Requirements and Prerequisites" subsection.

This section clarifies WAN connectivity requirements: "For WAN high availability, you must connect the WAN links to both ION devices in the HA pair. If a WAN link is connected to only one of the ION devices, that link is not highly available." This directly supports the reasoning for Answer D, where the LTE/5G link fails because it is not connected to the standby device.

The CloudBlade platform is a core component of the Prisma SD-WAN architecture designed for extensibility and integration. It functions as a cloud-based, API-driven integration layer. When connecting to third-party services (like Zscaler or Check Point) or Palo Alto Networks' own Prisma Access, CloudBlades automate the entire workflow. This includes provisioning IPsec tunnels, configuring routing, and managing API keys, thereby eliminating complex manual configuration on both the ION devices and the remote cloud service. This automation simplifies and accelerates the deployment of secure access service edge (SASE) and multi-cloud architectures.

A. CloudBlade is a cloud-based software platform, not a physical hardware line card that adds interfaces to an ION device.

B. Deep Packet Inspection (DPI) is a native function of the ION device's Layer 7 application engine, not a separate containerized application managed by CloudBlade.

D. The Prisma SD-WAN controller provides comprehensive monitoring dashboards; CloudBlade's primary role is automation and integration, not just viewing flow records.

1. Palo Alto Networks, "Prisma SD-WAN Administrator's Guide," section "Integrate with Third-Party Services using CloudBlades." The guide states, "The CloudBlade platform provides for a seamless, automated, and API-based integration of the branch to the cloud."

2. Palo Alto Networks, "CloudBlades for Prisma SD-WAN At-a-Glance" Datasheet. This document describes the platform: "The CloudBlades platform provides a unique, cloud-delivered approach for integrating branch services... without needing to update branch software or deploy additional hardware... This API-based integration automates complex workflows..." (Page 1, "Product Overview").

3. Palo Alto Networks, "Prisma SD-WAN Datasheet." In the feature description, it mentions, "CloudBlades platform enables API-based integration of the branch with cloud services, eliminating the need for complex service chaining." (Page 2, "Key Features").

A Prisma SD-WAN branch device (ION) can be deployed in one of three distinct operational modes. Control mode is the standard operational state where the device is fully managed, builds secure fabric tunnels, and actively forwards traffic based on policy. Analytics mode places the device in a passive, monitoring-only state; it collects and reports network and application data to the controller but does not build tunnels or enforce policy. Disabled mode effectively takes the device offline, ceasing all communication with the controller and participation in the SD-WAN fabric.

A. "Testing" and "POV" (Proof of Value) describe deployment phases or use cases, not configurable operational modes within the Prisma SD-WAN system.

B. "Production" is a deployment stage, not a specific device mode. While a device in "Control" mode is typically in production, "Production" itself is not the mode name.

D. "POV" and "Production" are terms for deployment stages or environments, not the technical configuration states of an ION device.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide. (2023). Device Modes. "An ION device can be in one of the following modes: Control Mode, Analytics Mode, Disabled Mode." This section details the function of each of the three official modes. Retrieved from the Palo Alto Networks TechDocs portal.

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide. (2023). Add a Site. In the workflow for adding a new site, the documentation specifies selecting the device mode, listing "Control," "Analytics," and "Disabled" as the available options for the ION device at that site. Retrieved from the Palo Alto Networks TechDocs portal.