SD-WAN-Engineer Practice Test 11 — 15 Questions

Question 1

Which TWO features are used to monitor the performance of an application across the SD-WAN?

Accepted Answer

Path performance metrics. Path performance metrics (A) are correct because SD-WAN solutions continuously measure per-tunnel characteristics such as latency, jitter, packet loss, and bandwidth on each WAN path, which directly reflects how an application's traffic performs across the overlay. Application-level flow data (C) is also correct because SD-WAN devices perform deep packet inspection and application-aware routing, exporting flow records (e.g., via IPFIX/NetFlow) that identify which applications are traversing which paths and their quality, enabling application performance monitoring. Physical port speed (B) only describes the link's raw capacity and does not reflect end-to-end application experience. Device power consumption (D) is a hardware/environmental metric unrelated to application performance. User social media activity (E) is a user behavior/policy concern, not a performance monitoring feature of the SD-WAN fabric.

Answer

Physical port speed

Answer

Device power consumption

Answer

User social media activity

Question 2

Which of the following are components of the Prisma SD-WAN Controller interface? (Choose TWO)

Accepted Answer

Dashboard. The Prisma SD-WAN Controller (formerly CloudGenix Controller) web interface is organized around a Dashboard view, which provides the top-level summary of network health, site status, link performance, and alarms, so option A is correct. It also includes a Monitoring section that offers detailed drill-down views such as topology, flows, link quality metrics, events, and device-level statistics, making option D correct. Option B is not a Controller interface component; speed testing is performed via link performance monitoring or CLI tools, not as a named interface element. Option C is documentation delivered separately, not part of the Controller UI. Option E relates to physical data center facilities and has no place in the Prisma SD-WAN Controller interface.

Answer

Internet Speed Test

Answer

Hardware installation manual

Answer

Physical server room temperature

Question 3

A branch loses connectivity to the internet, but local LAN traffic is fine. What should you troubleshoot first?

Accepted Answer

ISP connection and WAN interface. If local traffic works, the LAN is fine. The focus should be on the WAN edge.

Answer

Device power supply

Answer

DHCP server settings

Answer

Core Switch configuration

Question 4

When using Prisma SD-WAN with Prisma Access, how is the secure tunnel established?

Accepted Answer

Automated tunnel provisioning via the Controller. The ION device automatically provisions an IPsec tunnel to the Prisma Access Cloud Service Edge (CSE).

Answer

Manual IPsec configuration

Answer

Using a BGP peer

Answer

Via a physical cable link

Question 5

Which component manages the configuration and policy definition for a fleet of Prisma SD-WAN ION devices?

Accepted Answer

The Prisma SD-WAN Controller. The Prisma SD-WAN Controller is the single pane of glass for managing all ION devices and policies.

Answer

Prisma Access

Answer

The Cloud Identity Engine

Answer

The ION device web UI

Question 6

Which of the following is a benefit of a Unified SASE architecture?

Accepted Answer

Unified management and consistent policy enforcement. Unified SASE combines networking (SD-WAN) and security (SASE) into a single management plane, simplifying operations.

Answer

Total replacement of physical branch routers

Answer

Removal of the need for internet connectivity

Answer

Increased hardware complexity at the branch

Question 7

A network engineer is deploying a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer needs to ensure that branch traffic destined for the internet is inspected by Prisma Access cloud security services, while traffic to internal data center applications goes directly over the SD-WAN fabric without inspection. Which configuration on the ION device accomplishes this?

Accepted Answer

Use a service connection with a policy that matches traffic based on application or destination and steers internet-bound traffic to the Prisma Access service connection, while internal traffic uses the direct SD-WAN path.. The ION device uses policy-based routing to direct traffic to a service connection. By defining a policy that matches internet-bound traffic and steering it to Prisma Access, while allowing internal traffic to use the direct SD-WAN path, the engineer achieves selective security inspection. This is a core capability of Unified SASE with Prisma SD-WAN, ensuring that only traffic requiring inspection is sent to the cloud security service, optimizing performance and security.

Answer

Create a policy rule that directs all traffic to the Prisma Access service connection and relies on Prisma Access to send internal traffic back over the SD-WAN.

Answer

Configure a static route on the ION device that points all traffic to the Prisma Access service connection and rely on Prisma Access to enforce security policies.

Answer

Enable the 'Secure Internet Gateway' feature on the ION device, which automatically inspects all traffic and forwards it to Prisma Access.

Question 8

An administrator wants to limit the bandwidth used by a specific application when routed to Prisma Access. Where is this configured?

Accepted Answer

In the SD-WAN Application Policy. Bandwidth limits for specific applications routed to Prisma Access are configured within the SD-WAN Application Policy on the Prisma SD-WAN Controller. This policy defines application-based rules including path selection, QoS, and bandwidth allocation that apply when traffic is steered to Prisma Access. The Application Policy is the centralized mechanism for controlling how applications are treated across the SD-WAN fabric.

Answer

In the Cloud Identity Engine

Answer

In the Prisma Access cloud settings

Answer

On the ION device physical port setting

Question 9

An engineer is designing monitoring for a dual-router branch where each router has two WAN transports. The requirement is to detect a degradation on a single transport before end users report poor application experience, and to distinguish a transport-wide problem from a single-site problem. Which two capabilities of the SD-WAN monitoring stack should be used to meet these requirements? (Choose two.)

Accepted Answer

Configure per-tunnel BFD and application-aware enhanced SLA thresholds on the tunnel interfaces so that brownout conditions are detected and acted upon before a full tunnel failure.. Per-tunnel BFD with application-aware enhanced SLA classes detects brownouts on individual transports and triggers steering before a hard failure. ADEM scoring and synthetic probes provide experience baselines that let operators compare a site against a reference, separating transport-wide problems from single-site problems. Control-plane state, log volume, and byte counters do not measure per-transport quality at the granularity required.

Answer

Enable syslog forwarding of all severity informational messages to a collector and alert on any message volume increase, since degradation increases log volume.

Answer

Schedule a daily report of interface byte counters and treat any counter deviation from the previous day as a transport degradation event.

Answer

Rely on the OMP session state between the branch routers and the controllers, since a degraded transport will always tear down the OMP session and raise an alarm.

Question 10

A healthcare provider is planning a Prisma SD-WAN rollout across 80 clinics. Each clinic has two broadband circuits from different ISPs and a requirement that telehealth video traffic maintain latency below 100 ms and jitter below 30 ms. The design must automatically steer telehealth traffic to the best-performing circuit and fail over if thresholds are breached. Which Prisma SD-WAN design element is required?

Accepted Answer

Define a Prisma SD-WAN policy with path selection based on performance thresholds for latency and jitter, applied to the telehealth application.. Performance-based path selection policies are the Prisma SD-WAN mechanism that monitors latency and jitter and steers traffic to the best circuit. By applying such a policy to the telehealth application, the design ensures automatic best-path selection and failover when thresholds are breached. Static routes, BGP timers, and ECMP cannot react to application-level performance, so they do not satisfy the requirement.

Answer

Use BGP with timers tuned for fast convergence between the clinic ION devices and the ISP routers.

Answer

Enable equal-cost multipath routing on the clinic ION devices so both ISPs are used simultaneously for all traffic.

Answer

Configure a static default route on each clinic ION device that prefers ISP1, with ISP2 as a floating static backup.

Question 11

A network operations team is troubleshooting an intermittent connectivity issue between two branch sites. The ION devices at both sites are managed by Prisma SD-WAN. The team suspects that the issue is related to the underlay network. Which two actions should the team perform to gather relevant troubleshooting data? (Choose two.)

Accepted Answer

Review the WAN interface statistics for errors, drops, and utilization on both ION devices.. To troubleshoot underlay issues, the team should run traceroute to trace the path and identify drop points, and review WAN interface statistics for errors and utilization. These actions directly assess the underlay network's health. Other options focus on overlay or higher-layer protocols, which may be affected but do not provide direct underlay diagnostics.

Answer

Check the ION device's IPsec tunnel status to see if the tunnel is flapping.

Answer

Examine the BGP routing table to see if routes are being withdrawn and re-advertised.

Answer

Verify the application SLA policies to ensure they are not incorrectly steering traffic.

Question 12

When defining an Application Steering Policy in a Unified SASE environment, what is the advantage of using 'Application Groups'?

Accepted Answer

They enable consistent policy application across multiple applications. Application groups allow for policy abstraction, so multiple apps can be steered using a single policy definition.

Answer

They are required for local internet breakout

Answer

They reduce the amount of bandwidth consumed

Answer

They bypass the security inspection

Question 13

A financial services company is designing a Prisma SD-WAN deployment with strict compliance requirements. The design must ensure that branch-to-branch traffic carrying cardholder data is encrypted end-to-end and that the SD-WAN fabric can prove which path was used for auditing. Which combination of Prisma SD-WAN features should be included in the design?

Accepted Answer

Prisma SD-WAN secure fabric tunnels between all sites, with application policies that log path selection events and forward them to a central logging system.. Prisma SD-WAN secure fabric tunnels encrypt traffic between sites, and application policies can generate detailed path selection logs. Sending those logs to a central system gives auditors evidence of which path was used for cardholder data. Together, these features satisfy both the end-to-end encryption and the path-level audit requirements, unlike designs that rely only on data center termination or non-SD-WAN overlays.

Answer

GRE tunnels between branches with IPsec encryption applied only at the data center edge, plus syslog from branch devices.

Answer

DMVPN with mGRE and IPsec profiles on branch routers, with SNMP polling for path monitoring.

Answer

IPsec tunnels between each branch and the data center only, with no branch-to-branch tunnels, plus NetFlow export to a SIEM.

Question 14

Which TWO functions are performed by the Cloud Identity Engine (CIE) within a Unified SASE environment?

Accepted Answer

Mapping IP addresses to user identities for policy enforcement. Option B is correct because the Cloud Identity Engine's core purpose is to aggregate identity data and provide user-to-IP mapping (via sources such as GlobalProtect, Prisma Access, and directory logs) so that security policy can be enforced against users rather than just IP addresses. Option E is correct because CIE synchronizes users and groups from directory services such as Active Directory, Microsoft Entra ID, and Okta, then distributes that identity information to enforcement points in the Unified SASE environment. Option A is incorrect because URL filtering is enforced by the SASE security service (e.g., Prisma Access/Cloud SWG), not by CIE itself, which supplies identity context. Option C is incorrect because POP selection and traffic steering are handled by the SASE infrastructure's routing and GlobalProtect/App Connector mechanisms, not by CIE. Option D is incorrect because physical interface speed settings are a networking/device configuration concern unrelated to CIE's identity functions.

Answer

Enforcing URL filtering policies

Answer

Directing traffic to the nearest SASE POP

Answer

Managing physical interface speed settings

Question 15

A network engineer is planning the Prisma SD-WAN deployment for a new campus site. The site will use two ISP circuits and must support direct internet breakout for guest traffic while keeping corporate traffic on the VPN overlay. Which site configuration element is required to enable this design?

Accepted Answer

A transport interface for each ISP circuit and a policy set that directs guest traffic to the internet.. The design requires two ISP transports and selective internet breakout for guest traffic while corporate traffic uses the VPN overlay. Configuring transport interfaces for each ISP and a policy set that directs guest traffic to the internet achieves this. Service links, full VPN tunnels, and static routes do not provide the required selective breakout and overlay separation.

Answer

A VPN tunnel to the data center for all traffic, including guest.

Answer

A service link configured for the guest network.

Answer

A static route on the branch ION pointing all traffic to the primary ISP.