SD-WAN-Engineer Practice Test 15 — 15 Questions

Question 1

A branch site reports intermittent application slowness. Which tool in the Prisma SD-WAN ION dashboard is best for viewing real-time latency and jitter metrics per path?

Accepted Answer

Path Quality. The Path Quality tool in the Prisma SD-WAN ION dashboard provides real-time and historical metrics for each WAN path, including latency, jitter, packet loss, and MOS scores. It is specifically designed to monitor the performance of individual paths and is the best choice for diagnosing intermittent application slowness caused by path degradation.

Answer

BGP Neighbors

Answer

Flow Summary

Answer

Security Events

Question 2

When analyzing a PCAP from an ION device, you see 'ICMP Destination Unreachable'. Which policy is most likely causing this?

Accepted Answer

Security Policy. Security policies or access control lists (ACLs) blocking traffic will trigger ICMP unreachable messages.

Answer

NAT Policy

Answer

QoS Policy

Answer

Path Selection Policy

Question 3

A customer wants to prioritize Office 365 traffic over general web traffic. What is the most efficient way to achieve this?

Accepted Answer

Create an application-aware policy. Creating an application-aware policy is the most efficient way to prioritize Office 365 traffic because Prisma SD-WAN can identify Office 365 by application signature (not just port/IP) and steer it onto preferred paths with higher priority. This leverages built-in application identification and SLA-based path selection.

Answer

Manually route all traffic to a specific ISP

Answer

Set a global rate limit

Answer

Configure port-based QoS

Question 4

You are implementing a QoS policy. Why would you configure a 'Shaping' rate on a WAN interface?

Accepted Answer

To manage congestion and match the provider's provisioned rate. A shaping rate on a WAN interface is configured to match the provider's provisioned (contract) rate, which is often lower than the physical interface speed. Shaping smooths traffic to that rate to avoid overwhelming the provider's policer, which would drop packets and cause TCP collapse. It manages congestion by buffering and pacing egress traffic.

Answer

To enable load balancing

Answer

To increase the circuit bandwidth

Answer

To match the physical interface speed

Question 5

You are designing an SD-WAN path for a high-bandwidth application that is sensitive to out-of-order packets. Which configuration setting minimizes packet reordering in a multi-path environment?

Accepted Answer

Flow-based load balancing. Flow-based load balancing keeps all packets of a single flow (same 5-tuple) on one path, preserving packet order end-to-end. Packet-based load balancing distributes individual packets across multiple paths, which can cause out-of-order delivery and retransmissions for latency-sensitive, high-bandwidth applications. For an application sensitive to reordering, flow-based is the correct choice.

Answer

Jitter Buffer increase

Answer

Aggressive TCP acceleration

Answer

Packet-based load balancing

Question 6

When setting up a branch, you need to define the 'Underlay' transport. What does this refer to?

Accepted Answer

The physical/logical circuits provided by the ISP. The underlay in SD-WAN refers to the physical or logical transport circuits provided by the ISP — the raw IP connectivity (MPLS, broadband, LTE, etc.) over which the SD-WAN overlay tunnels are built. It is the foundation network that carries encapsulated overlay traffic.

Answer

The internal VLAN structure

Answer

The encrypted VPN tunnels

Answer

The routing protocol used internally

Question 7

If a user is incorrectly identified in a SASE security log, which part of the Unified SASE architecture should be investigated first?

Accepted Answer

The Cloud Identity Engine. The Cloud Identity Engine is the component in Palo Alto's Unified SASE architecture that resolves user identity by integrating with identity providers (Entra ID, Okta, LDAP, etc.) and mapping users to IP addresses and groups. If a user is misidentified in a security log, the identity mapping is the first thing to verify, making the Cloud Identity Engine the correct starting point.

Answer

The ION device WAN interface

Answer

The DNS settings

Answer

The Prisma SD-WAN Controller

Question 8

What is the primary function of the CloudBlades platform in the Prisma SD-WAN architecture?

Accepted Answer

API-based service integration. CloudBlades is the API integration platform that allows for seamless integration with third-party cloud services.

Answer

Encryption key rotation

Answer

Hardware acceleration

Answer

Local breakout management

Question 9

Which aspects of a site's network are required for configuring the SD-WAN Controller? (Choose TWO)

Accepted Answer

Management IP address. Option B (Management IP address) is correct because the SD-WAN Controller must be reachable at a known, routable address so that edge devices can establish their control-plane connections (e.g., DTLS/TLS over port 443 or 12346) to register and receive policy. Option D (LAN subnet range) is correct because the controller needs the site's local subnet information to build the network topology, define VPN/service segments, and push correct routing and policy to the edge devices at that site. Option A (the name of the branch manager) is irrelevant, as personnel names are not network parameters used in controller configuration. Option C (the office zip code) is a geographic/administrative detail that does not affect SD-WAN control-plane or data-plane configuration. Option E (the color of the Ethernet cables) is a physical attribute with no bearing on logical network configuration.

Answer

The name of the branch manager

Answer

The office zip code

Answer

The color of the Ethernet cables

Question 10

A network architect is designing a branch site deployment requiring sub-second failover. Which Prisma SD-WAN component must be configured to prioritize real-time traffic across multiple transport paths based on path quality metrics?

Accepted Answer

Performance Routing (PFR) Policy. Performance Routing (PFR) policies are configured to monitor path quality and dynamically steer traffic.

Answer

Traffic Policing Rule

Answer

NAT Control Policy

Answer

Access Control List (ACL)

Question 11

How are security logs from Prisma Access and Prisma SD-WAN correlated in a Unified SASE environment?

Accepted Answer

Through the unified logging service. In a Unified SASE environment, Prisma Access and Prisma SD-WAN logs are correlated through the unified logging service, which normalizes and joins events from both products using common context such as user, device, and session identifiers. This allows a single pane of glass for security and network events.

Answer

By manually exporting logs to a CSV

Answer

Via the Cloud Identity Engine

Answer

They cannot be correlated

Question 12

Which THREE logs or reports should be reviewed to troubleshoot a security policy drop?

Accepted Answer

Security Logs. Security Logs (A) are correct because they record the policy rule that matched and the action taken (allow/deny/drop), including the rule name, source/destination, and application, which directly identifies why traffic was dropped. Session Monitor (B) is correct because it shows the session details and the security policy evaluation for a specific flow, letting you trace the exact rule and drop reason for that session. Flow Reports (C) is correct because it provides aggregated flow data (source, destination, application, bytes, and action) that reveals whether traffic is being dropped and by which policy. Hardware Inventory (D) is not relevant because it lists device components and serial numbers, not policy enforcement events. BGP Neighbors (E) is not relevant because it shows routing peer status and routes, not security policy drop decisions.

Answer

Hardware Inventory

Answer

BGP Neighbors

Question 13

Which TWO of the following are required to successfully establish a Service Connection to Prisma Access?

Accepted Answer

Prisma Access gateway IP addresses or FQDNs. Option B is correct because a Service Connection requires the remote peer to know the Prisma Access gateway IP addresses or FQDNs to establish the IPSec tunnel to the correct Prisma Access location. Option E is correct because the Service Connection must be configured and active on the SD-WAN controller (e.g., Prisma SD-WAN ION device or Panorama-managed firewall) so the tunnel parameters, routing, and termination are properly defined. Option A is not required because BGP is optional; static routing can be used for the Service Connection. Option C is not required because a local root CA for the SD-WAN controller is not a prerequisite for the Service Connection itself. Option D is not required because a physical cross-connect is not needed; the Service Connection runs over the existing internet or private WAN transport.

Answer

An on-premise BGP router

Answer

A local root CA certificate for the SD-WAN controller

Answer

A valid physical cross-connect to the cloud provider

Question 14

Which THREE factors must be considered when designing a high-availability (HA) Service Connection to Prisma Access?

Accepted Answer

Properly configured path steering policies for automatic failover. Option A is correct because path steering policies (such as those based on probe-based monitoring with failover thresholds) are required for the Service Connection to automatically detect a degraded or failed path and redirect traffic to a healthy tunnel without manual intervention. Option C is correct because defining multiple Service Connection definitions that terminate at different Prisma Access POPs provides redundancy at the Prisma Access side, so if one POP or its associated infrastructure becomes unavailable, traffic can be re-routed to an alternate POP. Option E is correct because using multiple WAN transports (for example, Broadband plus LTE) ensures physical and link-layer diversity, so a failure of one ISP or transport medium does not take down the entire Service Connection. Option B is incorrect because HA design aims for automatic failover, not manual tunnel switching, which would introduce downtime and human error. Option D is incorrect because an on-premise secondary firewall is not a required factor for a Prisma Access Service Connection HA design; redundancy is achieved through multiple tunnels, POPs, and WAN transports rather than a second physical firewall.

Answer

Manual switching of tunnels in the event of failure

Answer

An on-premise secondary firewall

Question 15

In a multi-tenant Prisma SD-WAN design, what can be partitioned per tenant? (Choose THREE)

Accepted Answer

Administrative roles. In Prisma SD-WAN multi-tenant deployments, administrative roles (B) can be partitioned per tenant so that each tenant's operators only manage their own resources with scoped RBAC permissions. Virtual Networks (VNets) (C) are tenant-scoped logical segmentation constructs, allowing each tenant to define its own VNet topology and policies independently. Security policies (D) are also tenant-specific, so each tenant can enforce its own zone-based firewall and security rules without affecting others. Global hardware warranty status (A) is an account-wide/global attribute tied to the physical device inventory, not a per-tenant partitionable object. Physical office furniture (E) is not an IT resource managed by Prisma SD-WAN and is irrelevant to tenant partitioning.

Answer

Global hardware warranty status

Answer

Physical office furniture