SD-WAN-Engineer Practice Test 12 — 15 Questions

Question 1

A network engineer is troubleshooting an issue where a vEdge device shows as unreachable in vManage, but the device is still forwarding traffic. The engineer suspects a problem with the control plane. Which CLI command on the vEdge should be used to check the status of its control connections to the vSmart controllers?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show control connections. On a vEdge, the command 'show control connections' lists all control plane connections to vSmart controllers and their states. If vManage shows the device as unreachable, checking this command helps determine if the control connections are down. Other commands like 'show interface' or 'show ip route' do not provide control connection status, and 'show omp peers' is more specific to OMP peering rather than the underlying control connection.

Answer

show interface

Answer

show omp peers

Answer

show ip route

Question 2

A network engineer is analyzing a recurring issue where a specific site experiences intermittent packet loss on its WAN circuit. The engineer wants to determine whether the packet loss is occurring on the underlay or within the overlay tunnel. Which vManage monitoring feature provides the most direct insight into this?

Accepted Answer

Tunnel Health dashboard, which shows BFD session status and SLA metrics per tunnel.. The Tunnel Health dashboard uses BFD to measure packet loss, latency, and jitter on each tunnel. This data is specific to the overlay and can be compared across tunnels to determine if the issue is with the underlay or a particular tunnel. Interface statistics, application monitoring, and syslog do not provide the same level of direct insight into overlay packet loss.

Answer

Interface Statistics, which show error counters and discard rates on the physical WAN interface.

Answer

Application Monitoring, which shows per-application throughput and response times.

Answer

Syslog events, which may contain messages about packet drops on the WAN interface.

Question 3

Which log file on the ION device provides the most detailed information about WAN interface flapping?

Accepted Answer

system.log. The system.log on the ION device is the general-purpose system log that records interface state changes, including WAN link up/down (flapping) events, along with daemon and kernel messages. Because interface state transitions are logged by the system/interface management subsystem, system.log provides the most detailed and chronologically complete record of WAN flapping.

Answer

flow.log

Answer

controller.log

Answer

auth.log

Question 4

A company is migrating to a cloud-native architecture. How does Prisma SD-WAN support multi-cloud connectivity?

Accepted Answer

Virtual Gateways (vGateways). Through CloudBlades and virtual gateways (vGateways) deployed in public cloud VPCs/VNets.

Answer

Manual BGP peering with ISPs

Answer

Physical site-to-site VPNs only

Answer

Cloud-only routing protocols

Question 5

Which THREE items must be configured to ensure that traffic is correctly routed through a Service Connection for security inspection?

Accepted Answer

An Application Steering policy that selects the Service Connection path. Option A is correct because an Application Steering policy is what actually directs the matching traffic into the Service Connection path so it can be inspected, rather than being sent directly to the internet. Option B is correct because Prisma Access enforces security policy on the traffic traversing the Service Connection, so a firewall rule permitting that traffic must exist or the flow will be dropped. Option C is correct because the Service Connection itself depends on a valid tunnel configuration (the IPSec tunnel between the remote network and Prisma Access) to carry the traffic to the inspection point. Option D is not needed because routing is handled by the Service Connection and steering policy, not by manual route entries on each workstation. Option E is not required because the WAN port does not need a static IP address for Service Connection traffic to be routed and inspected.

Answer

A manual route entry on every workstation

Answer

A static IP address for the WAN port

Question 6

During a Prisma SD-WAN design review, a team must decide how branch users will authenticate to the corporate identity provider for policy-based access to SaaS applications, without deploying a separate identity appliance at each branch. Which design approach should be recommended?

Accepted Answer

Integrate the Prisma SD-WAN fabric with the corporate identity provider so user and group context is available for policy.. Consuming identity from the existing corporate provider lets the fabric apply user- and group-aware policy centrally, so branches need no local identity hardware. Local device databases and per-SaaS authentication cannot supply consistent enterprise identity context, and per-branch servers contradict the design constraint.

Answer

Deploy a dedicated identity server at every branch to authenticate local users.

Answer

Require users to authenticate directly against each SaaS provider's own directory.

Answer

Configure each branch ION device with a local user database for SaaS access.

Question 7

A network engineer is analyzing a Prisma SD-WAN network where a critical SaaS application is experiencing intermittent performance degradation. The engineer suspects that the SD-WAN policy is not correctly steering traffic to the optimal path. Which feature in the Prisma SD-WAN orchestrator should the engineer use to verify the path selection decisions made for the application's traffic flows?

Accepted Answer

The 'Flow Analytics' dashboard, filtering by the application and viewing the 'Path' column.. Flow Analytics is the tool designed to provide granular visibility into traffic flows, including the path each flow takes. By filtering for the specific SaaS application, the engineer can directly observe the path selection decisions and determine if the SD-WAN policy is steering traffic optimally.

Answer

The 'Alarms' tab, looking for path selection alerts.

Answer

The 'Link Quality' report, checking the jitter and latency for each WAN link.

Answer

The 'Application Dashboard' under Monitoring, sorting by bandwidth usage.

Question 8

A network engineer is deploying a new branch office with a Prisma SD-WAN ION device that will connect to Prisma Access for Unified SASE. The engineer needs to configure the ION device to establish a secure tunnel to the Prisma Access service infrastructure. Which protocol is used for this tunnel?

Accepted Answer

IPsec. The secure tunnel between a Prisma SD-WAN ION device and Prisma Access service infrastructure is established using IPsec. This protocol ensures encryption and authentication for traffic over the public internet, which is essential for Unified SASE. GRE, SSL/TLS, and L2TP are not used for this purpose in Prisma SD-WAN.

Answer

GRE

Answer

L2TP

Answer

SSL/TLS

Question 9

A network administrator is designing a Unified SASE solution for a retail company with many small branches. The company wants to reduce the complexity of managing separate security and networking policies. Which primary benefit of Unified SASE should the administrator highlight to the management team?

Accepted Answer

Consolidation of networking and security functions into a single cloud-delivered service, simplifying policy management.. Unified SASE's core value is the convergence of networking and security into a single cloud service, which streamlines policy administration and enforcement. For a multi-branch retailer, this means consistent security and connectivity policies can be deployed rapidly without managing separate systems. The other options either overstate capabilities or focus on secondary benefits rather than the primary advantage of simplified, unified management.

Answer

Ability to replace all MPLS circuits with broadband internet connections without any impact on application performance.

Answer

Guaranteed lower latency for all internet-bound traffic due to optimized routing.

Answer

Elimination of the need for any on-premises hardware at branch locations.

Question 10

When configuring a security policy, what is the purpose of an 'Application' object?

Accepted Answer

To identify traffic by application signatures rather than just ports. Application objects identify traffic by signature, allowing for specific policy control.

Answer

To set the bandwidth limit

Answer

To define the physical interface

Answer

To define the user identity

Question 11

A company is designing a Prisma SD-WAN deployment for a branch that has a single MPLS circuit and a single internet circuit. The design requires that voice traffic use MPLS and fail over to internet only if MPLS latency exceeds 150 ms. Which Prisma SD-WAN policy configuration should be used to meet this requirement?

Accepted Answer

Configure a path selection policy that sets MPLS as the preferred path for voice and defines a latency threshold of 150 ms to fail over to internet.. Prisma SD-WAN path selection policies allow you to define preferred and fallback paths based on path quality metrics such as latency, jitter, and loss. For voice traffic, you can set MPLS as the preferred path and configure a latency threshold of 150 ms. When MPLS latency exceeds this threshold, the ION device automatically redirects voice traffic to the internet path. This provides the required conditional failover without manual intervention.

Answer

Create a static route for voice traffic pointing to the MPLS next-hop with a backup static route to internet.

Answer

Create a priority policy that places voice traffic in a high-priority queue on the MPLS interface.

Answer

Use a QoS policy to mark voice traffic with DSCP EF and trust the MPLS provider to route it correctly.

Question 12

A multinational enterprise is designing a Prisma SD-WAN topology with hubs in North America, Europe, and Asia. The design requires that branch-to-branch traffic within the same region use direct tunnels, while inter-region traffic must traverse a regional hub for security inspection. Which Prisma SD-WAN design element should be used to enforce this traffic flow?

Accepted Answer

Define a custom topology with regional hubs and use policies to direct inter-region traffic through the hub.. Prisma SD-WAN allows administrators to define custom topologies where specific sites act as hubs and others as spokes. Policy rules can then dictate that inter-region traffic must transit a hub, while intra-region traffic can use direct tunnels. This provides the required security inspection for inter-region flows without forcing all traffic through hubs. Pure hub-and-spoke or full mesh topologies do not satisfy both conditions simultaneously.

Answer

Enable dynamic multipoint VPN (DMVPN) on the ION devices to create on-demand tunnels.

Answer

Use a full mesh topology with all branches connected directly to each other.

Answer

Configure a hub-and-spoke topology with all branches connected only to their regional hub.

Question 13

When implementing a CloudBlade for a cloud security service, what must be configured? (Choose THREE)

Accepted Answer

Automated tunnel configuration. Option C (Automated tunnel configuration) is correct because a CloudBlade must establish the secure connectivity (e.g., IPsec/GRE tunnels) between the on-premises enforcement point and the cloud security service so that traffic can be redirected to it. Option D (Service-specific parameters) is correct because each cloud security service requires its own unique settings — such as tenant IDs, API tokens, region endpoints, and licensing details — to authenticate and integrate properly. Option E (Traffic steering policy) is correct because the CloudBlade must define which traffic is redirected to the cloud service (based on source/destination, application, or user criteria) and how it is handled, otherwise the service cannot inspect or protect the intended flows. Options A (Hardware reboot schedule) and B (Local printer settings) are incorrect because they are unrelated to cloud security service integration; a CloudBlade is a software/integration construct and does not require configuring physical hardware reboot timing or printer configuration.

Answer

Hardware reboot schedule

Answer

Local printer settings

Question 14

A network engineer is troubleshooting a branch ION device that fails to establish a control connection to the Prisma SD-WAN controller. The engineer verifies that the WAN interface has a valid IP address and can ping the default gateway. Which configuration issue is most likely preventing the control connection?

Accepted Answer

The ION device cannot resolve the controller's hostname due to a missing DNS server.. The most likely cause is a DNS resolution failure. The ION device must resolve the controller's hostname to establish the control connection. Even with a valid IP and gateway, missing DNS prevents resolution. NTP issues, public IP usage, and site assignment do not typically block the initial control connection.

Answer

The ION device is using a public IP address on its WAN interface.

Answer

The ION device is configured with an incorrect NTP server.

Answer

The ION device has not been assigned to a site in the Prisma SD-WAN portal.

Question 15

A financial services firm is designing Prisma SD-WAN for a hub-and-spoke topology where 25 regional offices connect to two data centers. The design must ensure that if a regional office loses its primary path to Data Center A, traffic can reach Data Center B without requiring a full mesh of tunnels between every branch pair. Which Prisma SD-WAN capability should the design rely on?

Accepted Answer

Using the fabric's any-to-any overlay so a branch's traffic to the secondary data center is carried over tunnels negotiated with the data center ION devices when the primary path fails. Prisma SD-WAN provides an any-to-any secure overlay among fabric sites, so branch traffic can be forwarded through tunnels negotiated with the data center ION devices. When the primary path to Data Center A becomes unhealthy, path selection shifts traffic toward Data Center B using those overlay tunnels, delivering the required failover without provisioning a full mesh of branch-to-branch tunnels.

Answer

Enabling dynamic branch-to-branch tunnel establishment through the Prisma SD-WAN fabric so spokes can reach either data center over available paths

Answer

Advertising branch subnets into BGP at each data center and letting the underlay reroute traffic when the primary path fails

Answer

Configuring each branch with a full mesh of IPSec tunnels to every other branch