Reinforce SD-WAN-Engineer concepts with active-recall study cards covering all 5 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For SD-WAN-Engineer preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the SD-WAN-Engineer question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your SD-WAN-Engineer flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real SD-WAN-Engineer exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass SD-WAN-Engineer.
Sample cards from the SD-WAN-Engineer flashcard bank. Read the question, think of the answer, then read the explanation below.
Which log file on the ION device provides the most detailed information about WAN interface flapping?
system.log
The system.log on the ION device is the general-purpose system log that records interface state changes, including WAN link up/down (flapping) events, along with daemon and kernel messages. Because interface state transitions are logged by the system/interface management subsystem, system.log provides the most detailed and chronologically complete record of WAN flapping.
Which command or interface action is used to verify the current status of the SD-WAN overlay tunnels?
Show tunnels view in the Controller
The 'Show tunnels' view in the SD-WAN Controller (Orchestrator) provides a real-time, centralized display of all overlay tunnel status, including up/down state, latency, jitter, and packet loss for each tunnel. This is the authoritative interface for verifying overlay tunnel health because the controller maintains the tunnel state database for all edges.
A network administrator is configuring Prisma SD-WAN to integrate with Prisma Access using the Automated Service Connection. During the onboarding process, which specific parameter must be configured in the ION device's service route to ensure traffic is correctly steered to the Prisma Access Service Infrastructure?
The specific Service Connection object representing the Prisma Access tunnel
When integrating Prisma SD-WAN with Prisma Access via Automated Service Connection, the ION device's service route must reference the specific Service Connection object that represents the Prisma Access tunnel. This object tells the ION how to steer traffic into the Prisma Access service infrastructure.
A branch office uses both MPLS and Broadband. The design requires that business-critical traffic prefers MPLS, failing over to Broadband only if the MPLS path experiences packet loss exceeding 1%. Which metric should the PFR policy utilize?
Packet Loss
Performance Routing policies rely on path metrics like loss, latency, and jitter to make routing decisions.
When configuring Data Center Interconnect (DCI) between two sites, you notice that routing loops are occurring. What is the most effective way to prevent this in a dual-homed DCI scenario?
Implement Site-of-Origin (SoO) extended communities on the DCI links.
Setting appropriate OMP administrative distances or using site-of-origin tags prevents routing loops in DCI.
A network administrator needs to monitor real-time application performance and path quality metrics for a specific site in Cisco vManage. Which menu should the administrator navigate to?
Monitor > Applications
The Monitor > Applications section in vManage is specifically designed to display application performance and path quality metrics such as latency, jitter, and packet loss. It aggregates data from Application Aware Routing and provides per-application and per-path visibility, making it the correct choice for real-time monitoring of application experience at a site.
A network architect is planning a Prisma SD-WAN deployment for a retail chain with 400 small branches. Each branch will have two broadband circuits from different providers and must be able to fail over to a cellular modem during an outage. The architect wants to minimize hardware footprint and central management overhead. Which design element should be included in the plan to meet these requirements?
Use a virtual ION instance on an existing branch compute platform, with cellular access provided by a supported external modem.
The design must balance small branch footprint with dual broadband and cellular failover. A virtual ION on existing branch compute with an external modem satisfies the hardware and management constraints while preserving Prisma SD-WAN transport flexibility. Physical appliances add cost and logistics, static-only designs lose dynamic policy, and data center backhauling defeats local failover and cloud access goals.
When performing a 'Soft Shutdown' on an HA device, what is the expected behavior?
The device gracefully transitions the active state to the standby device.
A soft shutdown allows the active unit to relinquish its role gracefully to the standby unit.
A network engineer is troubleshooting a site where traffic from a specific VLAN is not being forwarded to the correct VPN overlay. The engineer suspects a misconfiguration in the network policy. Which tool in the Prisma SD-WAN Orchestrator should the engineer use to view the effective policy applied to that site and verify the path selection decisions?
Policy Browser
The Policy Browser is designed to show the effective policies applied to a site, including how traffic is classified and which path it should take. It allows engineers to verify if a VLAN's traffic is matching the intended rules and being forwarded correctly. Other tools like Flow Analytics, Topology View, and Event Log provide different perspectives but lack the policy evaluation detail required.
An enterprise is designing Prisma SD-WAN for a data center that hosts business-critical applications. The design requires that traffic from branch sites to these applications be steered over a specific set of high-performance circuits, while all other internet-bound traffic uses a different set of circuits. The solution must be scalable and not require per-application static routes on every branch device. What should be used in the design?
Define application definitions and use a Prisma SD-WAN policy set with path selection criteria to steer the business-critical applications over the desired circuits.
Application definitions combined with policy sets are the native Prisma SD-WAN mechanism for classifying traffic and steering it over selected paths. Policies can specify preferred circuit types, performance thresholds, and priorities, and they are applied centrally to all sites. This scales without per-device static routes and provides dynamic, application-aware path selection, which is exactly what the data center steering design requires.
A financial services company is designing a Prisma SD-WAN deployment for its headquarters and 50 branch offices. The security team requires that all traffic from branches to the internet be inspected by a cloud-based security service without backhauling to headquarters. Which Prisma SD-WAN design element should you use to meet this requirement?
Local internet breakout at each branch with CloudBlades integration
Local internet breakout with CloudBlades integration allows branch traffic to be sent directly to the internet and then redirected to a cloud security service for inspection. This meets the security requirement without backhauling traffic to headquarters, reducing latency and WAN usage. It is the most efficient and scalable design for cloud-based security.
A network engineer is deploying a new branch ION device at a site with dual WAN circuits: a primary 500 Mbps fiber link and a secondary 100 Mbps LTE link. The design requires that the LTE link only carry traffic when the fiber link fails, and that all traffic return to the fiber link automatically once it recovers. Which configuration should the engineer apply on the ION device?
Create a failover WAN bundle with the fiber interface as the primary and the LTE interface as the standby member.
The requirement describes an active/standby WAN design with automatic failback. A failover WAN bundle keeps the secondary member idle until the primary path is declared down, then shifts traffic and reverts when health returns. Load balancing, static routing with manipulated distance, or per-packet distribution all keep both links active or fail to provide monitored automatic failback.
A network engineer is troubleshooting a Unified SASE deployment where branch users report that access to internal applications is slow after enabling Prisma Access inspection. The engineer confirms that internal traffic is being sent to Prisma Access instead of directly over the SD-WAN fabric. Which configuration change should the engineer make to resolve the issue?
Modify the application-based policy to send internal application prefixes over a direct SD-WAN path instead of the Service Connection.
The slowness is caused by internal traffic being backhauled to Prisma Access for inspection. The correct fix is to adjust the application-based policy so that internal application prefixes are matched and sent over a direct SD-WAN path, while internet-bound traffic continues to use the Service Connection. Bandwidth increases, disabling path selection, or static routes to Prisma Access do not correct the misrouting.
An engineer notices that an ION device at a branch site shows a WAN interface status of 'up' in the Prisma SD-WAN orchestrator, but no traffic is being forwarded over that interface. The interface is configured for DHCP. Which troubleshooting step should be performed first to determine why the interface is not passing traffic?
Verify that the DHCP server is reachable and has provided a valid IP address, default gateway, and DNS servers.
When a WAN interface is up but not passing traffic, the most common cause is a failure to obtain a valid IP configuration via DHCP. Verifying the DHCP lease ensures the interface has an IP address, default gateway, and DNS servers, which are prerequisites for any traffic forwarding. Other options, like checking BGP or restarting, are either premature or irrelevant.
An engineer is troubleshooting a scenario where users at a branch office cannot access SaaS applications via Prisma Access. The SD-WAN path is active, but the traffic is not reaching the Cloud SWG. What is the most likely cause related to the Unified SASE policy?
The Security Policy rule for the branch traffic is set to 'Direct to Internet' instead of 'Service Connection'
In Prisma Access Unified SASE, the Security Policy rule determines whether branch traffic is sent to the Cloud SWG (Service Connection) or sent directly to the internet. If the rule is set to 'Direct to Internet', traffic bypasses the Cloud SWG entirely, so users cannot reach SaaS applications through the security service. The SD-WAN path being active only means the underlay is up; the policy action controls the security inspection path.
A network administrator is troubleshooting a site that is experiencing poor voice quality over the SD-WAN. The administrator suspects that the voice traffic is not being prioritized correctly. Which SD-WAN feature should be verified to ensure that voice packets are marked and queued appropriately across the WAN?
QoS policy
Voice quality depends on proper prioritization across the WAN, which is achieved through QoS policies. These policies classify voice traffic, mark it with appropriate DSCP values, and place it in priority queues. Verifying the QoS policy ensures that voice packets are treated with the necessary urgency to maintain low latency and jitter.
A network engineer is troubleshooting why a branch ION device is not receiving any traffic from the data center. The engineer suspects that a firewall rule on the ION device is blocking traffic. Which log should the engineer check to see if traffic is being dropped by the firewall?
Firewall log
The Firewall log is the correct choice. It specifically logs traffic that matches firewall rules, including denies. By examining this log, the engineer can see if traffic from the data center is being dropped and which rule is responsible. This is a fundamental step in troubleshooting firewall-related connectivity issues.
When integrating Prisma SD-WAN with a cloud-based security service provider (CSSP) via CloudBlades, which setting must be verified to ensure proper traffic redirection?
Service-to-Tunnel Mapping
The service mapping in CloudBlades ensures that traffic classified for security inspection is steered to the correct CSSP node.
You are troubleshooting an SD-WAN environment where a branch site's vEdge reports that the BFD sessions to the remote data center are flapping every few minutes. The underlay transport is stable, and the WAN interface counters show no errors. You run 'show tunnel statistics' and observe periodic drops in the tunnel. Which action should you take FIRST to isolate the cause?
Run 'show bfd sessions' and 'show tunnel statistics' with timestamps to correlate drops with specific tunnel and path.
The first step in troubleshooting flapping BFD sessions is to gather data that correlates the flapping with specific tunnels and paths. Running 'show bfd sessions' alongside 'show tunnel statistics' with timestamps reveals which TLOC or transport is affected. This evidence-based approach avoids premature configuration changes and directs subsequent remediation to the actual faulty path.
A site deployment requires specific traffic to be exempted from the SD-WAN optimization process to ensure compatibility with a legacy application. Which policy should be updated?
Application Policy
Application Policy rules allow you to specify traffic types that should bypass optimization.
You are designing a hub-and-spoke topology where spokes need to communicate directly under specific conditions. Which feature should be enabled to optimize latency and minimize load on the regional hub?
Dynamic Mesh
Dynamic Mesh in an SD-WAN hub-and-spoke design allows spoke-to-spoke traffic to be forwarded directly between branch sites when policy permits, rather than hairpinning through the regional hub. This reduces latency (no extra hop through the hub) and offloads the hub's forwarding and encryption resources. It is the standard feature for optimizing east-west branch traffic while preserving the hub for centralized policy and internet breakout.
The SD-WAN-Engineer flashcard bank covers all 5 official blueprint domains published by Palo Alto Networks. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Troubleshooting
Deployment And Configuration
Unified SASE
Planning And Design
Operations And Monitoring
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that SD-WAN-Engineer questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.SD-WAN-Engineer questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective SD-WAN-Engineer study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free SD-WAN-Engineer flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 303+ original SD-WAN-Engineer flashcards across all 5 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are checked against the official Palo Alto Networks exam objectives, with editorial oversight from an experienced network and security engineer.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official SD-WAN-Engineer exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included