SD-WAN-Engineer Practice Test 16 — 15 Questions

Question 1

Which TWO types of traffic are typically steered to Prisma Access in a Unified SASE architecture?

Accepted Answer

SaaS application traffic. Option C (SaaS application traffic) is correct because in a Unified SASE architecture, Prisma Access provides secure web gateway (SWG) and CASB capabilities that inspect and secure traffic to cloud-delivered SaaS applications such as Microsoft 365, Salesforce, and Google Workspace. Option D (Public internet-bound traffic) is correct because Prisma Access acts as the internet security enforcement point, steering all web and internet-bound traffic through its security processing nodes for threat prevention, URL filtering, and DNS security. Options A and B are incorrect because traffic to a local server rack or a local printer on the same subnet stays on the local LAN and is handled by the on-premises network, not steered to Prisma Access. Option E is incorrect because branch-to-branch traffic is typically handled by the SD-WAN fabric or Prisma SD-WAN, not by Prisma Access, which focuses on securing user and branch traffic to SaaS, internet, and private applications.

Answer

Traffic destined to a local server rack

Answer

Local printer traffic on the same subnet

Answer

Traffic between two branch offices

Question 2

Which THREE items are required to successfully deploy a new branch ION device with zero-touch provisioning for a Unified SASE environment?

Accepted Answer

The device serial number registered in the controller. Option A is correct because zero-touch provisioning requires the ION device's serial number to be pre-registered in the controller (e.g., Prisma SASE / Prisma SD-WAN controller) so the device can be authenticated and claimed automatically when it first comes online. Option B is correct because the branch device must reach the controller over the internet to receive its configuration; without WAN/internet connectivity, the zero-touch bootstrap process cannot occur. Option C is correct because a predefined policy template (or device/stack template) must be assigned to the device in the controller so that, once it authenticates, it automatically receives its intended configuration and policies. Option D is not required because zero-touch provisioning relies on DHCP or controller-delivered configuration rather than a manually pre-configured static WAN IP address. Option E is not required because the device communicates with the cloud controller over the internet, not via a physical connection to the company datacenter.

Answer

A pre-configured local IP address on the WAN port

Answer

A physical connection to the company datacenter

Question 3

Which TWO dashboards are most useful for a daily operational health check?

Accepted Answer

Device Health Dashboard.. The Device Health Dashboard (A) is correct because it surfaces real-time status of managed endpoints—such as compliance state, encryption, and agent connectivity—which is exactly what a daily operational health check needs to catch failing or non-reporting devices. The Network Health Dashboard (D) is also correct because it monitors connectivity, latency, and link/interface status, giving immediate visibility into infrastructure issues that affect operations day to day. Together these two dashboards cover the endpoint and network layers that define routine operational health. SaaS Application Performance (B) is more about application-level user experience and is typically reviewed for service issues rather than a general daily health check. Policy Audit Dashboard (C) is focused on compliance and policy violations over time, not immediate operational status, and Inventory Report (E) is a periodic asset listing rather than a live health indicator.

Answer

SaaS Application Performance.

Answer

Policy Audit Dashboard.

Answer

Inventory Report.

Question 4

Which THREE parameters are essential when troubleshooting a Service Connection tunnel status?

Accepted Answer

Tunnel interface MTU settings. Option A is correct because the tunnel interface MTU directly affects whether encapsulated packets can traverse the Service Connection without fragmentation or drops, so mismatched or too-low MTU values are a common cause of a tunnel that shows up but passes no traffic. Option C is correct because the ION WAN port must have working public IP connectivity (reachable gateway, correct IP, and UDP 500/4500 or TCP 443 reachability to the peer) for the tunnel to establish at all. Option D is correct because IKE phase 1 and phase 2 policy settings (encryption, hashing, DH group, lifetime, and matching proposals/selectors) must align on both peers; any mismatch prevents the IPsec SA from coming up. Option B is not essential because the count of active users is a capacity/load metric and does not determine whether the tunnel itself establishes. Option E is not essential because the ION serial number is an inventory/identity detail, not a parameter that governs tunnel negotiation or data flow.

Answer

The number of users currently active

Answer

The serial number of the ION device

Question 5

Which TWO factors contribute to the 'Path Health' score?

Accepted Answer

Packet loss. Path Health is a composite metric that reflects the real-time quality of a network path, and it is driven primarily by transport-level performance measurements such as packet loss (option B) and latency (option C). Packet loss is correct because dropped packets directly degrade path quality and are a core input into the health calculation, typically expressed as a percentage of lost traffic. Latency is correct because round-trip or one-way delay is another fundamental indicator of path performance, and higher latency lowers the Path Health score. Device firmware version (option A) is a configuration/software attribute, not a dynamic path-quality measurement, so it does not contribute to the score. The number of connected users (option D) is a load or capacity metric rather than a direct measure of path integrity, and the site name (option E) is merely a label used for identification, so neither affects Path Health.

Answer

Device firmware version

Answer

Number of connected users

Answer

Site name

Question 6

When setting up a branch site, what is the purpose of the 'Underlay' configuration?

Accepted Answer

To configure the ISP circuit details. Underlay configuration defines the physical WAN circuit parameters (ISP, bandwidth, etc.) for the SD-WAN tunnel overlay.

Answer

To define the routing protocol

Answer

To manage internal LAN switches

Answer

To configure DHCP

Question 7

You have configured two different DCI paths. You want to load balance traffic across both paths. What OMP configuration must be set?

Accepted Answer

Ensure TLOC preference and OMP costs are identical on both paths.. Equal cost multi-path (ECMP) requires identical OMP attributes.

Answer

Disable BFD on both paths.

Answer

Configure a unique site ID for each path.

Answer

Set the OMP administrative distance to 1.

Question 8

Which criteria can be used to steer traffic in a Performance Routing policy? (Choose TWO)

Accepted Answer

Packet Loss. Performance Routing (PfR) is a Cisco IOS feature that optimizes path selection by monitoring and reacting to network performance metrics, so Packet Loss (D) and Latency (E) are both valid steering criteria — PfR tracks these live measurements via IP SLA probes and can move traffic to a better path when thresholds for loss or delay are exceeded. Latency and packet loss are core PfR performance parameters (along with jitter, reachability, and MOS), which is why they are marked correct. Time of day (A) is not a PfR performance criterion; it is used in Policy-Based Routing (PBR) or time-based ACLs, not PfR path selection. Device serial number (B) is a hardware identifier and plays no role in traffic steering decisions. User's physical weight (C) is nonsensical in networking and clearly not a PfR criterion.

Answer

Time of day

Answer

Device serial number

Answer

User's physical weight

Question 9

What does the 'App-ID' feature provide in a security policy?

Accepted Answer

Dynamic identification of applications. App-ID performs dynamic, context-based application identification by inspecting traffic flows (signatures, heuristics, decryption) rather than relying on static port/protocol mappings. This lets the firewall enforce security policy on the actual application (e.g., Facebook, BitTorrent) regardless of port, IP, or evasion technique. It is the foundation for application-aware policy, QoS, and Safe Search enforcement in next-gen firewalls.

Answer

A list of blocked URLs

Answer

Device inventory

Answer

A list of IP addresses

Question 10

A network operations center (NOC) engineer is investigating a performance issue at a branch site. The engineer needs to identify which application is consuming the most bandwidth on the WAN link. Which dashboard in the Prisma SD-WAN orchestrator should the engineer use?

Accepted Answer

Top Applications. The Top Applications dashboard is specifically designed to show applications ranked by bandwidth consumption. It provides a clear, immediate view of which applications are using the most WAN bandwidth, enabling the NOC engineer to quickly identify the source of the performance issue without manual analysis.

Answer

Flow Dashboard

Answer

Interface Dashboard

Answer

Site Dashboard

Question 11

A network administrator is troubleshooting a branch site that is experiencing poor voice quality. The administrator suspects that the SD-WAN fabric is not prioritizing voice traffic correctly. Which dashboard in the Prisma SD-WAN Orchestrator provides a real-time view of application performance, including latency, jitter, and packet loss per application?

Accepted Answer

Application Dashboard. The Application Dashboard is the correct tool because it provides detailed performance metrics per application, which are essential for diagnosing voice quality issues. It shows latency, jitter, and packet loss, allowing administrators to verify if voice traffic is being prioritized correctly. The other dashboards focus on different aspects and do not offer the required application-level detail.

Answer

Security Dashboard

Answer

System Dashboard

Answer

Network Dashboard

Question 12

A network administrator is examining the Prisma SD-WAN orchestrator dashboard to identify which sites are consuming the most bandwidth. Which dashboard widget should the administrator use to quickly see the top bandwidth consumers?

Accepted Answer

Top Sites. The orchestrator dashboard provides several widgets for monitoring network traffic. To identify the top bandwidth-consuming sites, the 'Top Sites' widget is specifically designed to rank sites by their bandwidth usage. This allows administrators to quickly pinpoint sites that may require attention, such as those with unusually high traffic or potential bottlenecks.

Answer

Top Interfaces

Answer

Top Applications

Answer

Top Flows

Question 13

A network administrator is troubleshooting an ION device at a branch site that intermittently loses connectivity to the Prisma SD-WAN Controller. The administrator suspects a problem with the underlying WAN link. Which CLI command provides the most direct real-time view of the interface status, IP address, and packet counters for the WAN interfaces?

Accepted Answer

show interfaces. The 'show interfaces' command is the correct choice because it provides real-time operational status, IP configuration, and packet counters for WAN interfaces, which are essential for diagnosing intermittent connectivity issues. Other commands focus on different aspects such as controller tunnel status, routing, or system resources, and do not offer the same interface-level detail needed here.

Answer

show controller status

Answer

show routing table

Answer

show system resources

Question 14

A network engineer has just deployed a new ION device at a branch office. The device has successfully established its control plane connection to the Prisma SD-WAN controller. The engineer now wants to enable secure web gateway (SWG) inspection for all internet-bound traffic from this branch without manually creating tunnels. Which Prisma SD-WAN feature should the engineer configure?

Accepted Answer

Service Connection. A Service Connection is a Prisma SD-WAN construct that automates the creation of secure tunnels from an ION device to Prisma Access. When configured, it enables the branch to forward internet-bound traffic to Prisma Access for SWG inspection without manual tunnel setup. This matches the engineer's goal of enabling SWG inspection without manual intervention.

Answer

Data Center Group

Answer

Virtual Interface

Answer

Network Policy Rule

Question 15

What does the 'Flow Monitor' tool primarily track?

Accepted Answer

Active sessions and traffic attributes. The Flow Monitor provides granular details on active traffic sessions.

Answer

Controller connection time

Answer

ISP bandwidth limits

Answer

CPU utilization