SD-WAN-Engineer Practice Test 10 — 10 Questions

Question 1

An ION device has experienced a configuration drift. How can you restore the last known good configuration?

Accepted Answer

Revert Configuration in the Orchestrator. The Orchestrator in Prisma SD-WAN maintains a version history of configurations for each ION device. The 'Revert Configuration' function allows you to roll back to a previous known-good configuration, restoring the device to a stable state without manual intervention. This is the designed method for recovering from configuration drift.

Answer

Copy config from another site

Answer

Factory reset

Answer

Manually re-configure everything

Question 2

A network administrator is troubleshooting an ION device that is experiencing intermittent packet loss on its WAN interface. The administrator wants to determine whether the issue is due to physical layer errors or congestion. Which CLI command provides the most detailed statistics for identifying such problems?

Accepted Answer

show interface counters. Intermittent packet loss can stem from physical layer problems or congestion. The 'show interface counters' command provides detailed statistics such as CRC errors, input/output drops, and queue overruns. These metrics allow the administrator to determine whether the loss is due to cabling issues, duplex mismatches, or bandwidth saturation, enabling targeted remediation.

Answer

show interface

Answer

show system status

Answer

show log system

Question 3

What information is provided by the 'Controller Status' widget on the dashboard?

Accepted Answer

Connectivity between ION and Controller. It confirms the connectivity status between the ION and the controller.

Answer

LAN port status

Answer

Site-to-site VPN health

Answer

ISP latency

Question 4

You are deploying Cloud Identity Engine (CIE) to enable identity-based security policies across your SD-WAN and SASE environment. Which configuration step is required to ensure that user identity information is successfully propagated from the enterprise directory to the Prisma Access security nodes?

Accepted Answer

Link the Prisma Access instance to the CIE instance using the API Key and Tenant ID. To propagate identity from the enterprise directory to Prisma Access security nodes, the Prisma Access tenant must be linked to the Cloud Identity Engine instance using the API Key and Tenant ID. This linkage authorizes CIE to push user-to-IP mappings and group information into Prisma Access so identity-based security policies can be enforced at the enforcement nodes.

Answer

Configure a local user database on every ION device

Answer

Manually map IP addresses to usernames in the Cloud SWG UI

Answer

Enable the Identity Service on the Prisma SD-WAN Controller

Question 5

A company is deploying Unified SASE with Prisma SD-WAN and Prisma Access. The security team wants to ensure that traffic from branch ION devices is inspected by Prisma Access and that security logs from both products are correlated for unified reporting. Which TWO actions are required to achieve this integration? (Choose two.)

Accepted Answer

Enable the same Prisma Access tenant and Prisma SD-WAN tenant in the same Unified SASE portal.. To integrate Prisma SD-WAN with Prisma Access for Unified SASE, the branch ION device must have a Service Connection to Prisma Access, and both products must be managed in the same tenant or unified portal. These two actions enable traffic inspection and log correlation. GRE tunnels, explicit proxies, or manual log import do not provide the required integrated behavior.

Answer

Configure a GRE tunnel between the ION device and the Prisma Access service infrastructure.

Answer

Manually export Prisma Access logs and import them into the Prisma SD-WAN controller.

Answer

Deploy a Cloud SWG explicit proxy at the branch and point all traffic to it.

Question 6

Which feature should you examine if traffic is not being steered based on the application category?

Accepted Answer

Application Identification Settings. Application identification in SD-WAN is driven by the Application Identification Settings, which define how the system recognizes applications (signatures, heuristics, IP/port mappings) and how they map to application categories. If traffic is not being steered by category, the first place to inspect is these settings — the signature database may be outdated, the category mapping may be misconfigured, or the application may be unrecognized and falling into a default bucket.

Answer

NAT Settings

Answer

VLAN Configuration

Answer

DHCP Settings

Question 7

A user is complaining about high latency for a SaaS app. The Path Quality dashboard shows low latency. What is the next logical step?

Accepted Answer

Check LAN-side connectivity and local congestion. If the WAN path is healthy, the latency might be internal to the LAN or at the application server level.

Answer

Enable more security policies

Answer

Change ISP provider

Answer

Restart the ION device

Question 8

A design team is planning a Prisma SD-WAN rollout and needs to document how branch sites will learn routes to remote subnets without manually defining every prefix. They want the fabric to automatically exchange reachability information between sites. Which capability should the design rely on?

Accepted Answer

The Prisma SD-WAN fabric's built-in route learning and propagation between sites.. The Prisma SD-WAN fabric learns and propagates site prefixes automatically, so branches gain reachability to remote subnets without hand-built static routes or an added routing domain. That automatic exchange is what allows the design to scale as new sites and subnets appear.

Answer

Manually redistributing connected networks into OSPF at every branch.

Answer

Publishing all site prefixes into public DNS so devices can resolve next hops.

Answer

Static routes configured individually on each ION device through the controller.

Question 9

Which THREE components are involved in the process of applying a user-based policy in a Unified SASE architecture?

Accepted Answer

Prisma SD-WAN Controller (for policy distribution). In a Unified SASE architecture, applying a user-based policy requires three cooperating components: the Cloud Identity Engine (E) acts as the identity source, aggregating user and group information from directories such as Active Directory, Microsoft Entra ID, or Okta so that policies can be written against users/groups rather than just IP addresses. Prisma Access (C) is the security enforcement point, where the identity-aware policy is evaluated and applied to traffic in the cloud-delivered security stack (e.g., URL filtering, threat prevention, and App-ID rules). The Prisma SD-WAN Controller (A) is responsible for policy distribution, pushing the user-based policy configuration down to the SD-WAN fabric so that branch and ION devices forward traffic with the correct policy context toward Prisma Access. The local ISP's routing tables (B) are irrelevant because SASE policy enforcement is independent of ISP routing, and a custom user agent on the ION device (D) is not required since identity is sourced from the Cloud Identity Engine rather than an agent on the SD-WAN device.

Answer

The local ISP's routing tables

Answer

A custom user agent installed on the ION device

Question 10

When configuring 'NAT', what is the difference between 'Source NAT' and 'Destination NAT'?

Accepted Answer

Source NAT hides internal IPs; Destination NAT directs inbound traffic. Source NAT modifies the source IP for outbound traffic; Destination NAT modifies the destination IP for inbound traffic.

Answer

Destination NAT hides internal IPs

Answer

Only Source NAT is supported

Answer

They are the same