The Event Logs > System page is the primary location within the Prisma SD-WAN portal for troubleshooting control plane issues, such as VPN tunnel failures. This log captures detailed system-level messages, including the step-by-step Internet Key Exchange (IKE) negotiation process. When a tunnel fails to establish due to a misconfiguration, such as a mismatched pre-shared key or incompatible crypto proposals, specific error codes like "AUTHFAILED" or "NOPROPOSALCHOSEN" are recorded here. This provides the granular detail necessary to diagnose the root cause of the "VPNDOWN" alarm.

A. Flow Browser: This tool is used for inspecting individual data plane traffic flows (sessions) after a tunnel is established, not for diagnosing control plane tunnel negotiation failures.

C. Site Summary > Topology: This provides a high-level visual representation of tunnel status (up or down) but lacks the detailed error logs needed to determine why the tunnel is down.

D. Link Quality Graphs: These graphs display performance metrics like latency, jitter, and loss for the underlying WAN circuits, not the specific error codes from the IKE negotiation process.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section "Monitor Events," the guide specifies the purpose of different event logs. It states for the System log: "View system events such as device and network events, VPN status, and so on." This confirms it is the correct location for VPN status and related diagnostic messages. (Reference: Prisma SD-WAN Administrator's Guide, Chapter: Monitor, Section: Events).

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the troubleshooting section for VPNs, the standard procedure involves examining system events for detailed error messages. The guide explains that alarms like "VPNDOWN" are high-level indicators, and the root cause analysis requires inspecting the detailed logs generated during the connection attempt, which are found in Monitor > Events > System. (Reference: Prisma SD-WAN Administrator's Guide, Chapter: Troubleshoot, Section: Troubleshoot VPNs).

Site templates are fundamental to automating and scaling Prisma SD-WAN deployments.

Option C is correct because templates are integral to the Zero Touch Provisioning (ZTP) workflow. They allow an administrator to pre-stage configurations for numerous sites within the controller. These configurations act as "device shells," which are claimed by the physical ION devices upon connection, enabling rapid and consistent site rollouts without manual intervention at the branch.

Option D is correct within the context of automation and best practices for large-scale management. While the controller does not maintain a persistent link between a site and its template after creation, templates are used for lifecycle management. Administrators can modify a master template (e.g., a Jinja2 file) and use automation tools to push the updated configuration to existing sites via the Prisma SD-WAN API.

A. This statement is incorrect. Prisma SD-WAN explicitly supports the use of Jinja2 templates, which allow for advanced logic, including conditional statements, to create dynamic and flexible site configurations.

B. This is incorrect because the ION software version is not a mandatory template variable. Software versions are managed globally through software upgrade policies assigned to sites, not within the site creation template itself.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide, "Site and Device Templates": This section details the use of templates for creating multiple sites with similar configurations. It explicitly mentions, "For advanced configuration, you can use Jinja2 templates to create sites," which refutes option A. It also states, "Once a site is created from a template, it is no longer associated with the template," which highlights why API-based methods (as described for option D) are necessary for updates.

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide, "Zero Touch Provisioning for ION Devices": This section describes the ZTP process, which relies on pre-provisioning sites. The guide explains how an ION device can be "auto-claimed to a pre-provisioned site in the controller." This pre-provisioned site is the "device shell" created from a template, supporting option C.

3. Palo Alto Networks Developer Portal, Prisma SD-WAN API Reference Guide, "Update a site": The API documentation specifies endpoints such as PUT /api/sdwan/v4.5/api/sites/{siteid}. This endpoint allows for the programmatic update of an entire site's configuration. This capability is the foundation for the automation workflow described in option D, where an updated template is processed by a script to generate a new configuration that is then applied via the API.

Upon the failure of the active ION device, the standby device transitions to the active state. For LAN high availability, Palo Alto Networks SD-WAN uses VRRP. The new active device takes ownership of the VRRP Virtual IP (VIP) address for any configured Switched Virtual Interfaces (SVIs), ensuring LAN clients have a consistent gateway.

For WAN high availability, physical connectivity is required on both devices. As shown in the topology, the ISP A connection is cabled to both IONs and will remain usable after failover. However, the LTE/5G connection is physically cabled only to the original active device. When this device loses power, the physical connection is severed, making the LTE/5G path unusable by the newly active ION.

A. The LTE/5G connection is physically connected only to the failed device and will become unavailable after the power loss.

C. Sending a gratuitous ARP is a transient action performed during the failover process to update network tables, not a description of the final "end-state".

1. Palo Alto Networks, Prisma SD-WAN Administrator’s Guide 6.2, "High Availability for ION Devices" section, "HA Failover" subsection.

This section states: "When a failover occurs, the backup ION device assumes the role of the active device. It takes over the virtual IP (VIP) addresses for the LAN interfaces and sends gratuitous ARPs (GARPs) to update the ARP caches of the connected devices." This supports that the VIP is moved (Answer B) and that GARP is sent (the action described in C).

2. Palo Alto Networks, Prisma SD-WAN Administrator’s Guide 6.2, "High Availability for ION Devices" section, "High Availability Requirements and Prerequisites" subsection.

This section clarifies WAN connectivity requirements: "For WAN high availability, you must connect the WAN links to both ION devices in the HA pair. If a WAN link is connected to only one of the ION devices, that link is not highly available." This directly supports the reasoning for Answer D, where the LTE/5G link fails because it is not connected to the standby device.

The CloudBlade platform is a core component of the Prisma SD-WAN architecture designed for extensibility and integration. It functions as a cloud-based, API-driven integration layer. When connecting to third-party services (like Zscaler or Check Point) or Palo Alto Networks' own Prisma Access, CloudBlades automate the entire workflow. This includes provisioning IPsec tunnels, configuring routing, and managing API keys, thereby eliminating complex manual configuration on both the ION devices and the remote cloud service. This automation simplifies and accelerates the deployment of secure access service edge (SASE) and multi-cloud architectures.

A. CloudBlade is a cloud-based software platform, not a physical hardware line card that adds interfaces to an ION device.

B. Deep Packet Inspection (DPI) is a native function of the ION device's Layer 7 application engine, not a separate containerized application managed by CloudBlade.

D. The Prisma SD-WAN controller provides comprehensive monitoring dashboards; CloudBlade's primary role is automation and integration, not just viewing flow records.

1. Palo Alto Networks, "Prisma SD-WAN Administrator's Guide," section "Integrate with Third-Party Services using CloudBlades." The guide states, "The CloudBlade platform provides for a seamless, automated, and API-based integration of the branch to the cloud."

2. Palo Alto Networks, "CloudBlades for Prisma SD-WAN At-a-Glance" Datasheet. This document describes the platform: "The CloudBlades platform provides a unique, cloud-delivered approach for integrating branch services... without needing to update branch software or deploy additional hardware... This API-based integration automates complex workflows..." (Page 1, "Product Overview").

3. Palo Alto Networks, "Prisma SD-WAN Datasheet." In the feature description, it mentions, "CloudBlades platform enables API-based integration of the branch with cloud services, eliminating the need for complex service chaining." (Page 2, "Key Features").

A Prisma SD-WAN branch device (ION) can be deployed in one of three distinct operational modes. Control mode is the standard operational state where the device is fully managed, builds secure fabric tunnels, and actively forwards traffic based on policy. Analytics mode places the device in a passive, monitoring-only state; it collects and reports network and application data to the controller but does not build tunnels or enforce policy. Disabled mode effectively takes the device offline, ceasing all communication with the controller and participation in the SD-WAN fabric.

A. "Testing" and "POV" (Proof of Value) describe deployment phases or use cases, not configurable operational modes within the Prisma SD-WAN system.

B. "Production" is a deployment stage, not a specific device mode. While a device in "Control" mode is typically in production, "Production" itself is not the mode name.

D. "POV" and "Production" are terms for deployment stages or environments, not the technical configuration states of an ION device.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide. (2023). Device Modes. "An ION device can be in one of the following modes: Control Mode, Analytics Mode, Disabled Mode." This section details the function of each of the three official modes. Retrieved from the Palo Alto Networks TechDocs portal.

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide. (2023). Add a Site. In the workflow for adding a new site, the documentation specifies selecting the device mode, listing "Control," "Analytics," and "Disabled" as the available options for the ION device at that site. Retrieved from the Palo Alto Networks TechDocs portal.