SD-WAN Quiz - Page 4

Question 31: On which virtual system must SD-WAN be configured if Panorama manages a multi-vsys firewall?

a) Any vsys b) The vsys designated for management c) vsys1 d) A dedicated SD-WAN vsys

Question 32: Which firewall platform does NOT support Aggregate Ethernet (AE) interfaces for SD-WAN?

a) PA-400 Series b) PA-3400 Series c) PA-5400 Series d) VM-Series

Question 33: What is the recommended best practice for handling traffic that does not match any specific SD-WAN policy rule?

a) Let it be dropped by default security policy. b) Allow it to use the default round-robin distribution. c) Create a catch-all SD-WAN policy rule with a defined TDP. d) Route it via standard static routes only.

Question 34: What is the purpose of using 'Shared' Link Tags in Panorama?

a) They are automatically created by Auto VPN. b) They can be referenced across multiple Device Groups and Templates. c) They are required for BGP configuration. d) They encrypt the link tag name.

Question 35: Which path monitoring mode is generally recommended for metered links like LTE or Satellite?

a) Aggressive b) Relaxed c) Disabled d) Static

Question 36: What feature allows SD-WAN branches to securely connect to cloud-based security nodes managed by Palo Alto Networks?

a) DIA AnyPath b) Auto VPN Full Mesh c) Prisma Access Integration d) SaaS Quality Profiles

Question 37: When using certificate-based authentication for Auto VPN, what is a critical requirement for the device certificates?

a) They must all be self-signed. b) They must have identical Common Names. c) Each device certificate must be unique but signed by the same Root CA. d) Key usage must be set to 'Key Encipherment' only.

Question 38: What does enabling 'Eligible for Error Correction Profile Interface Selection' in an SD-WAN Interface Profile allow?

a) The interface to automatically select the best PQP. b) The interface to be used for FEC or Packet Duplication if selected by policy. c) The interface to ignore path monitoring. d) The interface to support higher bandwidth.

Question 39: What is the function of the 'Refresh IKE Key' button in the Auto VPN cluster configuration?

a) To update the SD-WAN plugin. b) To change the authentication type to Certificates. c) To generate a new Pre-Shared Key for all tunnels in the cluster. d) To refresh the BGP peerings.

Question 40: In the SD-WAN Monitoring > Site Detail view, what does the 'SaaS Monitoring' column indicate?

a) The number of SaaS applications detected. b) Whether an application is configured with and monitored by a SaaS Quality Profile. c) The latency to major SaaS providers. d) If the firewall has a SaaS Security license.

Palo Alto Networks SD-WAN Quiz

Page 4 of 5 (Questions 31-40)