Free Palo Alto Networks SD-WAN Engineer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Palo Alto Networks SD-WAN Engineer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An engineer compares branch forwarding devices using an isolated laboratory test. Which benchmark describes the fastest offered frame rate at which every test frame is forwarded?

   1. A.Frame loss rate
   2. B.ThroughputCorrect answer: B
   3. C.Forwarding latency
   4. D.Back-to-back burst size

   Explanation: RFC 2544 defines throughput as "the fastest rate at which the count of test frames transmitted by the DUT is equal to the number of test frames sent to it by the test equipment." This zero-loss rate is the requested benchmark.

   Reference: RFC 2544: Benchmarking Methodology for Network Interconnect Devices — Section 26.1, Throughput

2. 2A network engineer establishes IPsec ESP protection for traffic flowing both ways between two sites, using one ESP transform and no nested associations. What is the minimum number of directional IPsec security associations needed for the exchange?

   1. A.One security association
   2. B.Two security associationsCorrect answer: B
   3. C.Three security associations
   4. D.Four security associations

   Explanation: RFC 4301 defines a security association as "A simplex (uni-directional) logical connection". One association for each of the two directions therefore requires two.

   Reference: RFC 4301: Security Architecture for the Internet Protocol — Appendix A, Glossary, Security Association

3. 3An engineer monitors a packet-oriented branch interface and wants to count inbound packets whose errors prevented delivery to a higher-layer protocol. Which standard interface counter should be inspected?

   1. A.ifInErrorsCorrect answer: A
   2. B.ifInDiscards
   3. C.ifOutErrors
   4. D.ifOutDiscards

   Explanation: RFC 2863 defines this counter as "the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol." Inbound discards instead count packets discarded without detected delivery-preventing errors.

   Reference: RFC 2863: The Interfaces Group MIB — Section 6, ifInErrors

4. 4For application experience monitoring, an engineer generates a dedicated stream of probe packets to measure a site's path delay. Under the IETF measurement classification, what type of method is this?

   1. A.Active measurementCorrect answer: A
   2. B.Passive measurement
   3. C.Hybrid Type I measurement
   4. D.Hybrid Type II measurement

   Explanation: RFC 7799 states that "Active Methods generate packet streams" and that the stream of interest is commonly generated for measurement. A dedicated probe stream is therefore active.

   Reference: RFC 7799: Active and Passive Metrics and Methods — Section 3.4, Active Methods

5. 5A TCP application traverses a 100 Mbps path with a 40 ms round-trip time. Its receive window is 160,000 bytes, and assume the receive window is the limiting factor. Using the RFC 6349 estimate, what throughput should the engineer expect?

   1. A.4 Mbps
   2. B.16 Mbps
   3. C.32 MbpsCorrect answer: C
   4. D.64 Mbps

   Explanation: RFC 6349 gives "TCP Throughput = TCP RWND X 8 / RTT" for this estimate. Thus 160,000 × 8 / 0.040 = 32,000,000 bits per second.

   Reference: RFC 6349: Framework for TCP Throughput Testing — Section 3.3.1, Minimum TCP RWND

6. 6A branch WAN link has 100 Mbps of capacity. Its current simultaneous traffic totals 85 Mbps, and a new application will add 35 Mbps over the same link. How much will the combined load exceed the link capacity?

   1. A.15 Mbps
   2. B.20 MbpsCorrect answer: B
   3. C.35 Mbps
   4. D.85 Mbps

   Explanation: RFC 9522 describes congestion as when "the arrival rate of packets exceeds the output capacity of the resource." The combined offered rate is 120 Mbps, which exceeds the 100 Mbps output capacity by 20 Mbps.

   Reference: RFC 9522: Overview and Principles of Internet Traffic Engineering — Section 2.2, Network Domain Context

7. 7A branch router has four feasible BGP paths to the same prefix with LOCAL_PREF values of 80, 100, 150, and 200. If all other relevant selection criteria are equal, which value belongs to the preferred path?

   1. A.80
   2. B.100
   3. C.150
   4. D.200Correct answer: D

   Explanation: RFC 4271 specifies that "The higher degree of preference MUST be preferred." With the stated ties, the path with LOCAL_PREF 200 is preferred.

   Reference: RFC 4271: A Border Gateway Protocol 4 (BGP-4) — Section 5.1.5, LOCAL_PREF

8. 8A controller exports a log event marked with standard syslog severity code 2. Which severity does the code represent?

   1. A.Emergency
   2. B.Alert
   3. C.CriticalCorrect answer: C
   4. D.Error

   Explanation: RFC 5424's severity table lists "2 Critical: critical conditions". Codes 0, 1, and 3 represent the other named severities.

   Reference: RFC 5424: The Syslog Protocol — Section 6.2.1, PRI

9. 9A security policy evaluates a requesting user's assigned role before allowing a connection. In an attribute-based access control model, how is that role classified?

   1. A.Subject attributeCorrect answer: A
   2. B.Object attribute
   3. C.Environment condition
   4. D.Requested operation

   Explanation: NIST describes a user as a subject whose attributes can include "a name, a role, and an organization affiliation." The user's role is a subject attribute.

   Reference: NIST SP 800-162: Guide to Attribute Based Access Control Definition and Considerations — Section 2.3, Basic ABAC Concepts, p. 10

10. 10While troubleshooting IPv4 connectivity between sites, an engineer receives an ICMP Type 11, Code 0 message for a probe. Which condition does this code identify?

    1. A.Time to live exceeded in transitCorrect answer: A
    2. B.Fragment reassembly time exceeded
    3. C.Destination port unreachable
    4. D.Fragmentation needed but prohibited

    Explanation: RFC 792 assigns ICMP Time Exceeded code "0 = time to live exceeded in transit"; code 1 refers to fragment reassembly time.

    Reference: RFC 792: Internet Control Message Protocol — Time Exceeded Message, ICMP Fields