SD-WAN-Engineer Practice Test 14 — 15 Questions

Question 1

A branch office requires local breakout for SaaS traffic. How do you configure the policy to ensure this traffic does not traverse the data center?

Accepted Answer

Configure a destination-based policy with a Local Breakout action. The destination-based policy for direct internet access (DIA) ensures local traffic exits locally.

Answer

Set the VRF to global

Answer

Apply a hub-and-spoke routing policy

Answer

Enable NAT on the WAN interface

Question 2

Which TWO of the following are benefits of using Prisma SD-WAN?

Accepted Answer

Simplified management through a centralized Controller. Option B is correct because Prisma SD-WAN uses a centralized controller (the Prisma SD-WAN Controller, hosted in the cloud) to provision, monitor, and manage all branches and data centers from a single pane of glass, replacing per-device CLI configuration with policy-driven orchestration. Option C is correct because Prisma SD-WAN continuously measures path quality (latency, jitter, packet loss) across all WAN links and automatically steers application traffic over the best-performing path using application-defined policies, which is a core SD-WAN capability. Option A is not a real benefit since no networking product can bypass the laws of physics. Option D is not a guaranteed benefit of Prisma SD-WAN, as reduced power consumption is not a marketed feature of the solution. Option E is incorrect because Prisma SD-WAN still requires physical cabling and underlay connectivity; it virtualizes and overlays the WAN rather than eliminating physical wiring.

Answer

Ability to bypass all laws of physics

Answer

Reduction of total electricity consumption

Answer

Elimination of all physical wiring

Question 3

Which dashboard provides the most detailed information regarding the health of individual tunnels within an SD-WAN fabric?

Accepted Answer

Tunnel Health Dashboard.. The Tunnel Health dashboard is designed specifically to aggregate and report on tunnel performance metrics.

Answer

Device Health.

Answer

Application Health.

Answer

System Health.

Question 4

If a device is stuck in 'In-Progress' during a template push, what is the first troubleshooting step?

Accepted Answer

Check the Device Tasks in vManage to view the specific error log.. The device task view provides specific error messages explaining why a push is stalling.

Answer

Reboot the vManage server.

Answer

Perform a factory reset on the device.

Answer

Change the vBond address.

Question 5

Which TWO indicators would lead you to believe that a site's WAN transport is oversubscribed?

Accepted Answer

Increased packet loss during peak business hours.. Option C is correct because when a WAN transport is oversubscribed, the provider's committed rate (CIR) is exceeded during busy periods, causing queue overflow and packet drops that manifest as increased packet loss during peak business hours. Option E is correct because oversubscription leads to bufferbloat and queuing delays in the provider network, producing high latency spikes precisely when demand peaks. Options A and D are not indicators of oversubscription: a constant low device temperature and low CPU utilization on the edge device simply show the local hardware is not stressed and say nothing about WAN circuit saturation. Option B is also not a valid indicator, since consistent BGP session drops typically point to link flaps, keepalive timer mismatches, or routing issues rather than bandwidth oversubscription.

Answer

Constant low temperature on the device.

Answer

Consistent BGP session drops.

Answer

Low CPU utilization on the edge device.

Question 6

Which log is used to view denied traffic attempts?

Accepted Answer

Security Logs. Security logs capture events related to security policies, including denies.

Answer

Flow Logs

Answer

Audit Logs

Answer

System Logs

Question 7

Which TWO items are considered 'Underlay' resources in a Prisma SD-WAN configuration?

Accepted Answer

Public Internet broadband. In Prisma SD-WAN, the Underlay refers to the physical transport networks that carry traffic between sites before any SD-WAN overlay is built, so the two correct answers are B (Public Internet broadband) and C (MPLS circuit), since both are WAN transport links that provide the underlying connectivity for the fabric. Public Internet broadband and MPLS circuits are exactly the types of circuits/links that Prisma SD-WAN models as underlay resources and binds to interfaces on the ION devices. By contrast, A (VLAN configuration) is a Layer 2 segmentation construct used on the LAN/interface side rather than a WAN transport, D (VRF ID) is a routing/segmentation identifier used to separate virtual routing instances, and E (IPsec tunnel) is an overlay construct that Prisma SD-WAN builds on top of the underlay to create the secure fabric between sites.

Answer

VLAN configuration

Answer

VRF ID

Answer

IPsec tunnel

Question 8

A network administrator is configuring a Prisma SD-WAN branch ION device that will connect to the internet via a single ISP link. The administrator needs to ensure that the device can establish a secure control plane connection to the Prisma SD-WAN controller. Which configuration is required on the ION device?

Accepted Answer

Configure the ION device with the correct controller IP address or FQDN and ensure outbound TCP port 443 is allowed.. The control plane connection between an ION device and the Prisma SD-WAN controller uses TCP port 443. This secure connection is essential for device registration, policy retrieval, and ongoing management. Therefore, outbound TCP 443 must be allowed for the device to be operational.

Answer

Configure the ION device with the correct controller IP address or FQDN and ensure outbound UDP port 500 and 4500 are allowed.

Answer

Configure the ION device with a static route to the controller and enable OSPF on the WAN interface.

Answer

Configure the ION device with the correct controller IP address or FQDN and ensure outbound UDP port 4501 is allowed.

Question 9

Which TWO tools are available in the ION CLI for network connectivity testing?

Accepted Answer

traceroute. The ION CLI provides traceroute (option C) as a built-in diagnostic tool to trace the hop-by-hop path packets take to a destination, using incrementing TTL values to reveal each router along the route. It also provides ping (option D), which sends ICMP Echo Request packets to verify basic IP reachability and measure round-trip latency to a target host. Both are standard, lightweight connectivity-testing utilities integrated into the ION command set. The other options are not part of the ION CLI: wireshark (A) is a graphical packet-capture and protocol-analysis application, nmap (E) is an external network scanning/port-discovery tool, and telnet (B) is a remote terminal protocol rather than a connectivity-testing utility bundled in the ION CLI.

Answer

wireshark

Answer

telnet

Answer

nmap

Question 10

A user reports slow speeds. You see that the interface is not hitting the configured throughput limit. What could be the issue?

Accepted Answer

ISP side congestion. If the interface is not the bottleneck, the bottleneck may exist further upstream in the ISP network.

Answer

QoS priority too high

Answer

Incorrect IP address

Answer

Too many VLANs

Question 11

What is the purpose of 'Bandwidth Groups' in Prisma SD-WAN?

Accepted Answer

To manage aggregated capacity for path policies. Bandwidth Groups in Prisma SD-WAN aggregate the total capacity of multiple WAN links (or portions of links) into a single logical pool that path policies can reference. This lets you define policies against the combined bandwidth of several circuits rather than per-link capacity, so traffic steering decisions account for the aggregate available bandwidth across all member links.

Answer

To set the time zone

Answer

To define VLANs

Answer

To limit internal file transfers

Question 12

Where do you check the status of active control connections in vManage?

Accepted Answer

Monitor > Network > [Device] > Control Connections.. In vManage, active control connections between WAN Edge devices and vSmart controllers (and between vManage/vBond) are viewed under Monitor > Network > [Device] > Control Connections. This view shows the peer system IP, local/remote color, state (up/down), and uptime for each control-plane session. It is the standard operational location for verifying OMP/control-plane reachability in a Cisco SD-WAN fabric.

Answer

Administration > Maintenance.

Answer

Configuration > Policies > Security.

Answer

Tools > Network.

Question 13

What is the purpose of the 'Zone' configuration on an ION device in a Unified SASE context?

Accepted Answer

To apply different security and routing policies based on traffic origin. The Zone configuration on an ION device defines logical groupings of interfaces so that security and routing policies can be applied based on the origin of traffic. Zones enable policy differentiation, such as treating traffic from a guest network differently from corporate traffic. This is fundamental to how Unified SASE enforces context-aware policies.

Answer

To define the physical location of the device

Answer

To increase the encryption level of the tunnel

Answer

To bypass the SD-WAN controller

Question 14

In a Unified SASE architecture, an administrator needs to ensure that branch offices prioritize voice traffic while using Prisma Access. Where should the Quality of Service (QoS) policy be defined to ensure consistent application performance?

Accepted Answer

On the Prisma SD-WAN Controller under Application QoS Policy. In a Prisma SD-WAN + Prisma Access Unified SASE deployment, application-level QoS is defined centrally on the Prisma SD-WAN Controller as an Application QoS Policy. This policy is then pushed to the ION devices at the branch, where it enforces prioritization (e.g., real-time voice in a high-priority queue) before traffic is steered to Prisma Access. Centralizing QoS at the Controller ensures consistent policy across all branches rather than per-device configuration drift.

Answer

On the local ION device CLI only

Answer

Inside the Prisma Access Security Policy

Answer

Within the Cloud Identity Engine

Question 15

Which mechanism would explain why traffic is taking a sub-optimal path despite a policy favoring a different link?

Accepted Answer

Path health failure. Path health failure directly causes the SD-WAN controller to mark a preferred link as unusable, forcing traffic onto a sub-optimal path even if policy favors the original link. The policy remains intact, but the health monitor's decision overrides it until the link recovers. This is a core SD-WAN behavior where real-time link quality dictates forwarding.

Answer

BGP route dampening

Answer

QoS policy override

Answer

Duplicate IP address