The Prisma SD-WAN Application Experience (AppX) Score is a composite metric designed to provide a holistic view of end-user experience for a specific application. It is calculated by combining three distinct performance indicators. These are the Network Transfer Time (NTT), which measures the round-trip network latency; the Server Response Time (SRT), which measures the time the application server takes to process a request; and the Transaction Failure Rate, which quantifies the percentage of failed application transactions. Together, these metrics accurately represent the end-to-end performance from the client to the application server and back.

D. Bandwidth Utilization: This metric reflects the consumption of link capacity. While it can impact performance, it is not a direct input into the AppX score calculation itself.

E. Jitter: Jitter measures the variation in packet delay. It is a key metric for assessing path quality, especially for real-time traffic like VoIP, but it is not a component of the AppX score.

1. Palo Alto Networks. (2023). Prisma SD-WAN Administrator's Guide 6.2. Monitor Application Performance. "Prisma SD-WAN calculates the Application Experience (AppX) Score for an application based on the following metrics: Network Transfer Time (NTT), Server Response Time (SRT), and Transaction Failure Rate." Retrieved from https://docs.paloaltonetworks.com/prisma-sd-wan/6-2/prisma-sd-wan-admin/monitor/monitor-application-performance

2. Palo Alto Networks. (2023). Prisma SD-WAN Administrator's Guide 6.2. Monitor Application Performance > Application Health - Summary. The section details the AppX Score and explicitly lists its three components: "Network Transfer Time (NTT)", "Server Response Time (SRT)", and "Transaction Failure Rate". Retrieved from https://docs.paloaltonetworks.com/prisma-sd-wan/6-2/prisma-sd-wan-admin/monitor/monitor-application-performance/application-health-summary

User-ID based zone-based firewall policies in Prisma SD-WAN are enforced on the ION device where the user's traffic originates and the user-to-IP mapping is available. In this scenario, the Branch-1 ION has the mapping for User-1. Therefore, it can apply source User-ID based policies to any traffic initiated by User-1. This includes traffic going directly to the internet for a SaaS application (A) and traffic destined for a private application within the local branch (B). The policy is enforced at the source ION based on the user initiating the connection.

C. The policy on the DC ION would be based on the source user (User-1), whose identity is propagated across the overlay, not on a destination User-ID rule.

D. Similar to option C, the policy on the Branch-2 ION would enforce rules based on the originating source user (User-1), not a destination User-ID.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide (23.1): In the "User-ID Based Policy" section, it states, "When a user attempts to access a resource, the ION device queries the directory service for the user and group mapping information for the source IP address of the user." This confirms that policies are based on the source user. The guide further explains, "The ION device at the branch where the user is located performs the User-ID mapping and enforces the policy." This directly supports the enforcement of policies at Branch-1 for traffic originating from User-1, as described in options A and B.

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide (23.1): The section "Configure a Security Policy Set" details the creation of security rules. The match criteria for users is explicitly labeled "Source User," indicating that policies are designed to identify the initiator of the traffic. There is no equivalent "Destination User" field for this type of policy, making options C and D invalid as described.

3. Palo Alto Networks Prisma SD-WAN Design and Sizing Guide: The "User-ID" section discusses the architecture, explaining that User-ID agents or IONs themselves collect IP-to-user mappings. This information is then used by the local ION to enforce source-based policies. It also describes the propagation of this identity information to remote IONs for consistent policy enforcement across the fabric, but the policy logic at the remote site still applies to the original source user.

Prisma SD-WAN implements a class-based Quality of Service (QoS) system on each WAN interface. This system is structured around four predefined traffic classes: Class 1 (Real-time), Class 2 (Interactive), Class 3 (Default), and Class 4 (Bulk). Within each of these four classes, traffic can be further categorized by four application criteria: High, Medium, Low, and Lowest. This hierarchical structure creates a 4x4 matrix, resulting in a total of 16 distinct queues that are used to prioritize and manage traffic, ensuring that critical applications receive the appropriate network resources.

A. This option is incorrect because Prisma SD-WAN uses four application criteria within each class, not three, which would only result in 12 queues.

C. This option incorrectly describes the queue structure; Prisma SD-WAN uses a 16-queue, class-based system, not a simple 1 priority plus 7 non-priority queue model.

D. This option is incorrect as it states there are only two classes. The Prisma SD-WAN QoS model is built upon four distinct traffic classes.

1. Palo Alto Networks. (2023). Prisma SD-WAN Administrator's Guide. Palo Alto Networks TechDocs. In the section "Policies > Quality of Service (QoS) > Traffic Classes," the guide states, "Prisma SD-WAN provides four predefined traffic classes... Within each of these four classes, you can define four application criteria: High, Medium, Low, and Lowest. This results in 16 queues for traffic prioritization."

The integration between Prisma SD-WAN and Prisma Access utilizes standard IKEv2/IPSec protocols for tunnel creation. A core component of this is Dead Peer Detection (DPD), which is used to verify the liveness of the IPSec peer. The branch ION device periodically sends IKEv2 informational messages (keepalives) to the Prisma Access Security Processing Node (SPN). If the SPN fails to respond after a set number of retries, the ION device declares the peer dead and can attempt to re-establish the tunnel. This mechanism ensures tunnel state is maintained even when there is no active user data traversing the link.

A. Requiring a manual ping script on a client PC is an unreliable and unscalable method, contrary to the automated, enterprise-grade design of the Prisma SD-WAN solution.

B. Synthetic Probes are used by Prisma SD-WAN for path performance monitoring (measuring latency, jitter, and loss) to make intelligent path selection decisions, not primarily for IPSec tunnel state maintenance.

D. In a standard branch-to-cloud connection model, the branch ION device is the initiator of the IPSec tunnel to the Prisma Access SPN, not the other way around.

1. Palo Alto Networks - Prisma Access Administrator's Guide: In the section describing remote network connections, the guide specifies the mechanism for tunnel health monitoring. It states, "Prisma Access uses Dead Peer Detection (DPD) to monitor the health of the IPsec tunnel." This confirms DPD is the standard method used. (Reference: Prisma Access Administrator's Guide, section "Set Up Remote Network Connections > Tunnel Monitoring").

2. Palo Alto Networks - Prisma SD-WAN Administrator's Guide: When configuring IPSec tunnels, the guide details the IKE Gateway settings, which include Dead Peer Detection. It describes DPD as the mechanism where the device "periodically sends messages to its peer to verify that the peer is available." The CloudBlade automates the configuration of this standard feature. (Reference: Prisma SD-WAN 9.1 Administrator's Guide, section "IPsec Tunnels > Configure an IKE Gateway", Page 435).

Prisma SD-WAN employs a sophisticated hierarchical queuing mechanism to manage Quality of Service (QoS). This system, based on principles of a Hierarchical Token Bucket (HTB) or Hierarchical Fair Service Curve (HFSC), allows for granular control over bandwidth allocation. For the "Platinum" class, which is reserved for the most critical, real-time traffic like VoIP, a guaranteed minimum bandwidth is allocated. This ensures that even when the circuit is saturated with lower-priority traffic, the Platinum queue receives the resources it needs, preventing packet drops and maintaining performance. This hierarchical scheduler provides strict priority for real-time needs while also enabling fair bandwidth distribution for other classes.

A. Strict Priority Queuing (SPQ): While the Platinum class receives the highest priority, SPQ alone is a simplistic model that can lead to the starvation of all lower-priority queues, which is not how the Prisma SD-WAN scheduler operates.

B. Weighted Round Robin (WRR): WRR is designed for fair bandwidth distribution based on weights but does not provide the strict, low-latency priority required for real-time applications like VoIP in the Platinum class.

D. First-In, First-Out (FIFO): FIFO is a non-prioritized queuing method where packets are processed in the order they arrive. It is the default behavior without QoS and would result in VoIP traffic being dropped during congestion.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section on Quality of Service (QoS), the guide explains the use of a hierarchical scheduler. "Prisma SD-WAN uses a Hierarchical Fair Service Curve (HFSC) scheduler to provide QoS. HFSC allows you to specify real-time, link-sharing, and priority-based policies." HTB is a similar and commonly referenced type of hierarchical scheduler that provides these capabilities. (Reference: Prisma SD-WAN Administrator's Guide, "Quality of Service (QoS)" section).

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide: The configuration options for QoS directly support the concept of guaranteed bandwidth. "For each traffic class, you can configure a Guaranteed Bandwidth Minimum as a percentage of the circuit’s provisioned bandwidth... This ensures that the traffic class is guaranteed a minimum amount of bandwidth." This directly aligns with the functionality described in option C. (Reference: Prisma SD-WAN Administrator's Guide, "Configure QoS" -> "QoS for Circuits" subsection).

A Service Connection (SC) is a dedicated, high-bandwidth IPSec VPN tunnel that links the Prisma Access cloud infrastructure to a customer's headquarters or data center. Its specific purpose is to provide secure access to internal, private resources (such as Active Directory, DNS, or internal applications) for all users and sites connected to the Prisma Access service. This ensures that traffic from remote networks and mobile users, once secured by Prisma Access, can be safely routed back to the corporate network to access necessary services that are not in the cloud.

B. This describes a Remote Network (RN) connection, which is the IPSec tunnel from a branch site (like a Prisma SD-WAN ION device) to the Prisma Access Security Processing Node (SPN).

C. This describes the GlobalProtect portal for mobile user VPNs, which is a separate component of Prisma Access focused on individual remote user connectivity, not site-to-site infrastructure links.

D. This describes the internal, high-speed backbone that Palo Alto Networks manages to interconnect its global Prisma Access locations. This is not a customer-configured component.

1. Palo Alto Networks. (2023). Prisma Access Administrator’s Guide. "Plan for Service Connections". The guide states, "A service connection provides access to services in your headquarters or data center for your mobile users and remote networks... Prisma Access secures the connection between your mobile users and remote networks and the services in your headquarters or data center."

2. Palo Alto Networks. (2023). Integrate Prisma SD-WAN with Prisma Access for Remote Networks. "Prisma Access for Remote Networks with Prisma SD-WAN Integration Overview". This document specifies the components: "Service Connections—Connects your corporate headquarters or data center to Prisma Access. This connection allows your mobile users and remote network sites to securely access the internal resources at your headquarters or data center."

3. Palo Alto Networks. (2024). Prisma Access Fundamentals. "Prisma Access Components". This documentation clearly distinguishes between the three main connection types: Mobile User connections, Remote Network connections, and Service Connections, defining the Service Connection as the link to the corporate headquarters or data center.

Palo Alto Networks Prisma SD-WAN is designed to maximize application availability and performance. When all available active paths for an application fail to meet the criteria defined in a Path Quality Profile (SLA), the system does not drop the traffic. Instead, it enters a "best-effort" mode. It will select the path that is performing the best relative to the others, even though it technically violates the configured threshold. In this scenario, it would choose the active path with the lowest packet loss (e.g., 1.5% loss over a path with 2% loss) to maintain connectivity and minimize the impact on the application. This ensures graceful degradation rather than a complete service outage.

A. Dropping traffic is a last-resort action and contradicts the primary SD-WAN goal of ensuring application resiliency and high availability.

C. Queuing traffic indefinitely is not a viable network strategy, as it would lead to severe latency, buffer exhaustion, and application timeouts.

D. A Backup path is used if it is available and meets the SLA. However, the fundamental behavior when all paths are degraded is to choose the "best of the worst," which could still be an active path.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section "Define Application Path and Quality Policies," the guide specifies the system's behavior for path selection. It states, "If no path meets the policy requirements, Prisma SD-WAN forwards the traffic on the best available path based on the path selection criteria." This directly supports the principle of selecting the "best of the worst" path. (Reference: Prisma SD-WAN Administrator's Guide, section on Application Path and Quality Policies).

2. Palo Alto Networks Prisma SD-WAN Design Guide: The design guide elaborates on failover and brownout scenarios. It explains that the system is designed to always forward traffic if a path is available, selecting the one that most closely aligns with policy objectives even during periods of degradation, which prevents "black-holing" traffic when all links are performing poorly. (Reference: Prisma SD-WAN Design Guide, section on High Availability and Path Failover).

The High Availability (HA) control interface is a dedicated link used for heartbeats, configuration synchronization, and session state exchange between the active and passive ION devices. To ensure low latency and reliability for these critical functions, the connection must be Layer 2 adjacent. This is achieved either through a direct physical cable connecting the two devices or by placing both interfaces on the same dedicated, untagged VLAN on a switch. Routing is explicitly not permitted on this control link as it would introduce unacceptable delay and complexity for the failover mechanism.

A. A Layer 3 routed network is not supported for the HA control link, which must be a direct Layer 2 connection to ensure timely heartbeats and state synchronization.

C. The HA control link is mandatory for the HA pair to function; the Cloud Controller manages configuration but does not handle the real-time failover process.

D. The HA control interface is a dedicated port, distinct from the management port, and is used for private communication between the HA peers, not for internet connectivity.

1. Palo Alto Networks. (2023). Prisma SD-WAN Administrator's Guide. "High Availability" section, "Configure High Availability" subsection. The guide states, "The HA control link is a dedicated link between the two ION devices in an HA pair. This link can be a direct physical connection or a Layer 2 adjacent connection on a dedicated VLAN. The HA control link must not have any routing between the two ION devices."

The SITECONNECTIVITYDOWN alarm is a critical alert in Prisma SD-WAN that signifies a complete loss of overlay connectivity for a specific site. This alarm is triggered precisely when all Secure Fabric Links (the VPN tunnels that form the SD-WAN overlay) from the site to all its remote peers (like data centers or other branches) have gone down. This means the site is effectively isolated from the rest of the SD-WAN fabric, even if its underlying internet circuits are still active.

A. A device power loss or reboot would generate a DEVICEUNREACHABLE or DEVICEREBOOTED alarm, which is distinct from a site-level connectivity failure.

B. The failure of a single internet circuit triggers a CIRCUITDOWN or PATHDOWN alarm. The site would remain connected through its other active circuits.

D. Exceeding licensed bandwidth triggers a licensing-specific alarm and does not indicate a loss of network connectivity.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section on monitoring alarms, the SITECONNECTIVITYDOWN alarm is explicitly defined.

Source: Palo Alto Networks TechDocs, "Monitor Alarms".

Reference: The table listing "System-Generated Alarms" specifies the trigger for SITECONNECTIVITYDOWN as "All Secure Fabric links from the site are down." This confirms that the loss of all VPNs, not just one circuit or a device reboot, is the specific condition.

The Prisma SD-WAN architecture is built on a centralized management model where the controller maintains a persistent and secure connection with all managed ION devices. When an administrator creates or modifies a configuration element, such as a custom application definition, the change is saved on the controller. The controller then automatically and immediately pushes the updated configuration to all ION devices in the network. This ensures configuration consistency across the SD-WAN fabric without requiring manual intervention, device reboots, or waiting for a scheduled update cycle.

A. No manual "Push" action is required for this type of configuration change; the controller propagates it automatically upon saving.

B. Rebooting an ION device is a service-impacting action and is not required for applying configuration updates like application definitions.

D. Custom application definitions are user-defined configuration objects, distinct from the global Palo Alto Networks App-ID signature database, which is updated on a schedule.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section on Application Definitions, the process of creating and managing custom applications is described. The guide states, "When you define a custom application, the controller automatically distributes this definition to all ION devices." This confirms the automatic and immediate propagation of the change. (Reference: Prisma SD-WAN Administrator's Guide, section "Define a Custom Application").

2. Palo Alto Networks Prisma SD-WAN Design and Sizing Guide: This guide describes the architecture, noting that the controller is the single source of truth for policy and configuration. It explains that "Configuration and policy changes are made centrally on the controller and are automatically propagated to the ION devices," which supports the immediate and automated nature of the update process. (Reference: Prisma SD-WAN Design and Sizing Guide, section "Prisma SD-WAN Controller Architecture").