Q: 3
A company has a Prisma Access deployment for mobile users in North America and Europe. Service
connections are deployed to the data centers on these continents, and the data centers are
connected by private links.
With default routing mode, which action will verify that traffic being delivered to mobile users
traverses the service connection in the appropriate regions?
Options
Discussion
Option B
B is what I saw in practice questions and official guide. Filtering prefixes out on service connections gives strict geo-boundary enforcement. Path metrics like MED (C) or ASN prepending (D) just influence preference, not enforce it. If you checked this in a lab, let me know if you got different results!
Option B is correct. Filtering the prefixes at each service connection makes sure each data center only knows about local mobile user pools, which keeps traffic in the right region. Seen this in Palo docs, but open if someone has a different perspective.
Pretty clear it's B. Filtering the prefixes at each service connection makes sure only the right region's user pools are visible to that region's data center, so traffic can't go the wrong way. I saw this logic in a similar exam question. Disagree?
B , D is more of a trap since AS path prepending just makes the route less attractive but can't guarantee path separation like filtering would. Filters at service connections block the cross-region prefixes, so B.
I don’t think C works, B is the right one here. Filtering the prefixes at each service connection actually blocks data centers from learning about other regions' pools, so you're forcing the correct traffic path. Using MED or communities would only influence preference but not strictly enforce it. Pretty sure that's how Palo Alto wants it set up for this scenario, but correct me if I'm missing anything.
I don’t think D is right, B. Filtering out the mobile user prefixes at the service connection directly stops cross-region routing, which is what "verify" in the question gets at. Seems like the only option that truly enforces region boundaries for traffic, pretty sure that's Palo Alto's intent.
A is wrong, B. Filtering out the mobile user prefixes at the service connection actually blocks cross-region advertisements, which enforces strict traffic separation. C (MED) only influences preference, doesn't guarantee proper regional flow. That's why B fits best here. If you see it differently let me know.
Option B not fully sure but filtering seems stricter than just preferring a path.
B here, not C. C (using MED) is for path preference but doesn't guarantee strict separation. Default mode expects filters to enforce the region split, pretty sure that's what they want. If anyone sees it differently let me know.
Be respectful. No spam.
