PA-SDWAN practice test: what's covered

• Prisma SD-WAN Architecture & Operation

Free PA-SDWAN sample questions

1. A senior network security engineer is implementing administration policies for a Prisma SD-WAN tenant portal. The organization requires that administrators only access features needed for their roles and that logins require a password and TOTP code. Which IAM practices are applied here?

   • A. Least privilege access control paired with Multi-Factor Authentication (MFA)
   • B. Single Sign-On (SSO) integration paired with static BGP routing tables
   • C. Biometric authorization paired with Data Loss Prevention (DLP) filters
   • D. IPsec tunnel encapsulation paired with MAC address access filtering
   Show answer

   Correct: A. Least privilege restricts permissions to the minimum necessary for job duties, while Multi-Factor Authentication (MFA) requires two distinct verification factors (password and TOTP code). Option B is incorrect because SSO and static routing do not enforce role-based access. Option C is wrong because biometrics and DLP are not authentication controls for portal logins. Option D is incorrect because IPsec and MAC filtering operate at lower network layers rather than user IAM.

2. During a hybrid WAN architecture planning session, a security architect explains the difference between endpoint protection and network security at branch offices. Which statement accurately describes this distinction?

   • A. Endpoint security protects local user workstation processes, whereas network security controls and inspects in-flight data traffic across WAN links
   • B. Network security exclusively secures physical access to host hardware, whereas endpoint security manages external domain routing
   • C. Endpoint security manages wide area broadband connections, whereas network security scans workstation memory for malware
   • D. Network security applies only to internal 802.11 wireless networks, whereas endpoint security manages cloud hypervisors
   Show answer

   Correct: A. Endpoint security safeguards individual host hardware and workstation processes, whereas network security inspects, filters, and routes data traffic across communication channels. Option B is incorrect because network security does not manage physical device access. Option C is wrong because endpoint security does not handle broadband WAN routing. Option D is incorrect because network security extends far beyond wireless networks to include wired, cloud, and SD-WAN fabrics.

3. A network deployment team is architecting a new branch office topology using Prisma SD-WAN ION appliances. Which two network devices operate primarily at Layers 3 and 4 of the OSI model to manage routing and stateful transport filtering? (Choose two)

   • A. Enterprise WAN Router operating with dynamic routing protocols
   • B. Layer 1 Physical Ethernet Hub providing multi-port bit repeating
   • C. Next-Generation Stateful Firewall enforcing transport-layer security rules
   • D. Physical Layer 1 Signal Repeater extending copper cable distance
   Show answer

   Correct: A and C. Enterprise WAN Routers operate at Layer 3 (Network) to forward IP packets, while Stateful Firewalls operate across Layers 3 and 4 (Transport) to inspect state tables and enforce security rules. Option B is incorrect because hubs operate strictly at Layer 1 (Physical). Option D is wrong because signal repeaters operate exclusively at Layer 1 without analyzing network or transport headers.

4. A cybersecurity analyst is investigating pre-attack reconnaissance logs captured at the enterprise WAN perimeter. Which two activities are typical of the initial reconnaissance stage of a targeted cyber attack? (Choose two)

   • A. Executing malicious ransomware payloads to encrypt local file shares
   • B. Performing automated port scans against public IP ranges to discover open services
   • C. Harvesting corporate employee email addresses from open-source intelligence sources
   • D. Establishing persistent encrypted C2 channels inside target internal subnets
   Show answer

   Correct: B and C. Reconnaissance involves gathering intelligence on target systems before attempting exploitation; port scanning discovers active network services and OSINT email harvesting targets users for spear-phishing. Option A is incorrect because encrypting files occurs during the post-exploitation impact phase. Option D is wrong because establishing C2 channels occurs after initial access and lateral movement.

5. A network operations team is replacing static branch routing with dynamic routing protocols like BGP and OSPF on their Prisma SD-WAN ION devices. Which characteristic represents a primary advantage of dynamic routing protocols?

   • A. Dynamic routing protocols automatically adapt to topology changes and reroute traffic around link failures
   • B. Dynamic routing protocols require manual route creation for every destination network subnet
   • C. Dynamic routing protocols operate exclusively at Layer 7 to analyze HTTP application headers
   • D. Dynamic routing protocols are designed solely for point-to-point Wi-Fi mesh connections
   Show answer

   Correct: A. Dynamic routing protocols exchange topology updates between routers to dynamically compute optimal paths and automatically recover from link outages without manual administrator intervention. Option B is incorrect because manual route entry defines static routing. Option C is wrong because dynamic routing protocols operate at Layer 3 (Network). Option D is incorrect because dynamic routing protocols are deployed across LAN, WAN, and cloud infrastructure.

Last updated: 2026-10-19

PA-SDWAN practice test FAQ

Related practice tests

• Palo Alto Networks PCXSA practice test
• Palo Alto Networks XSOAR-ANALYST practice test
• Palo Alto Networks NetSec-Pro practice test
• Palo Alto Networks NGFW practice test
• Palo Alto PCCET practice test
• Palo Alto Networks PCCSE practice test