SD-WAN-Engineer Practice Test 17 — 15 Questions

Question 1

A network operations team is troubleshooting a Prisma SD-WAN network where a specific branch site is experiencing poor voice quality. The team suspects that the issue is due to the branch's WAN link not meeting the required SLA for jitter. Which tool in the Prisma SD-WAN orchestrator should the team use to verify the real-time jitter measurements for the branch's WAN link?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'Link Quality' report under the device's Monitoring tab.. The Link Quality report is specifically designed to show real-time and historical performance metrics for WAN links, including jitter, latency, and packet loss. For troubleshooting voice quality issues, this report allows the team to confirm whether the branch's WAN link is meeting the required SLA for jitter.

Answer

The 'Flow Analytics' section in the orchestrator.

Answer

The 'Application Dashboard' under Monitoring.

Answer

The 'Alarms' tab under the device's Monitoring section.

Question 2

A network engineer is troubleshooting an ION device that frequently reboots and loses its configuration. The engineer suspects a hardware or software issue. Which two commands should be used to gather relevant diagnostic information from the ION device? (Choose two.)

Accepted Answer

show tech-support. To diagnose frequent reboots and configuration loss, the engineer needs system logs and a comprehensive diagnostic snapshot. The 'show log system' command reveals boot and error messages, while 'show tech-support' collects all relevant data for analysis. Together, they provide the necessary information to identify hardware failures, software bugs, or other causes of instability.

Answer

show arp

Answer

show running-config

Answer

show interface counters

Question 3

An engineer is configuring a Prisma SD-WAN policy to route guest Wi-Fi traffic directly out of the local branch internet circuit instead of sending it to the data center. The guest traffic must not traverse the SD-WAN overlay. Which policy type should the engineer use?

Accepted Answer

An application policy that sets the action to direct internet breakout.. To keep guest Wi-Fi traffic local and off the SD-WAN overlay, the engineer needs a policy action that performs direct internet breakout. An application policy with that action tells the ION device to forward matching flows out of the local WAN circuit. Path policies, QoS markings, and NAT do not remove traffic from the overlay, so they cannot satisfy the requirement.

Answer

A QoS policy that marks guest traffic as best effort.

Answer

A path policy that prefers the data center VPN path for guest traffic.

Answer

A NAT policy that translates guest traffic to the branch WAN IP address.

Question 4

A network engineer is investigating why a branch site is not receiving any traffic from the data center after a recent change. The engineer suspects that the SD-WAN fabric is not advertising the branch's subnet correctly. Which CLI command on the ION device can be used to verify the routes being advertised to and received from the SD-WAN fabric?

Accepted Answer

show sdwan route. The SD-WAN fabric maintains its own routing table that includes prefixes advertised by each site. The 'show sdwan route' command reveals these fabric routes, enabling the engineer to confirm whether the branch's subnet is being advertised and whether the branch is learning data center routes. This directly addresses the suspected routing advertisement issue.

Answer

show ip route

Answer

show arp

Answer

show bgp summary

Question 5

A global enterprise is designing Prisma SD-WAN for regions with unreliable broadband. The design must ensure that if the primary WAN transport degrades beyond acceptable thresholds, traffic automatically moves to the secondary transport without manual intervention. Which design element should be specified?

Accepted Answer

Policy-based path selection with performance thresholds and a secondary transport defined. Policy-based path selection in Prisma SD-WAN continuously measures transport quality and compares it to configured thresholds. When the primary transport exceeds those thresholds for latency, jitter, or loss, the fabric automatically moves traffic to the secondary transport. This provides the automatic, quality-driven failover the design requires, unlike static routing which only reacts to link failure.

Answer

Static routes with administrative distance differences between the two transports

Answer

A floating static route on the secondary transport with a higher metric than the primary

Answer

Equal-cost multipath routing across both transports with per-packet load balancing

Question 6

A network engineer is deploying a new ION device at a branch that uses a DSL circuit with a dynamic public IP address from the ISP. The branch must establish SD-WAN tunnels to the controller and to other sites. Which configuration must the engineer verify to ensure the tunnels come up reliably?

Accepted Answer

The WAN interface is configured to obtain its IP address via DHCP and the correct WAN label is applied.. For a dynamic ISP circuit, the ION WAN interface must use DHCP to learn its public address and must carry the correct WAN label so the controller can map it to the right transport role. With those settings, the device registers and tunnels form reliably even when the ISP changes the address. Static addressing, loopback bundling, or disabling the overlay all prevent or break tunnel establishment.

Answer

The WAN interface is configured as a static IP with the ISP-provided address.

Answer

The WAN interface is configured with a private IP address and the SD-WAN overlay is disabled.

Answer

The WAN interface is placed in a failover bundle with a loopback interface.

Question 7

A global enterprise is designing Prisma SD-WAN for regions with limited bandwidth and high latency. The design must ensure that voice traffic receives priority over bulk data transfers and that the WAN links are not oversubscribed. Which combination of design elements should be included in the plan?

Accepted Answer

QoS policies with guaranteed bandwidth for voice and a traffic shaper to limit bulk data.. The design must prioritize voice over bulk data and prevent WAN oversubscription in constrained regions. QoS policies with guaranteed bandwidth for voice and a traffic shaper for bulk data achieve both goals. Adaptive path selection, path steering alone, and FEC do not provide the required prioritization and utilization control, so they are insufficient.

Answer

Adaptive path selection with a latency threshold and no QoS configuration.

Answer

A policy set that steers all voice traffic to the MPLS transport and bulk data to broadband.

Answer

Enable forward error correction on all transports and disable QoS to reduce overhead.

Question 8

An engineer is designing a Prisma SD-WAN topology for a company with a primary data center, a secondary data center, and 200 branches. The requirement is that branch-to-data-center traffic must traverse the primary data center under normal conditions and only use the secondary data center if the primary becomes unreachable. Which design element should be used to express this preference?

Accepted Answer

Configure the primary data center as a preferred data center site with the secondary as backup in the branch policy set.. Expressing the primary data center as preferred with the secondary as backup within the branch policy set gives the exact ordered behavior required, including automatic use of the secondary when the primary is unreachable. Equal priority, single static routes, and tenant separation all fail to produce that deterministic preference with failover.

Answer

Place the secondary data center in a separate tenant and route branch traffic to it by default.

Answer

Assign both data centers the same site priority value and rely on equal-cost load balancing.

Answer

Create a static route on each branch pointing only to the primary data center.

Question 9

A logistics company is designing Prisma SD-WAN for a hub-and-spoke topology with a primary data center and a secondary data center for disaster recovery. The design must ensure that branch traffic reaches the primary data center under normal conditions and automatically uses the secondary data center if the primary becomes unreachable. Which two design elements are required to meet these requirements? (Choose two.)

Accepted Answer

Define both data centers as service endpoints or data center groups in the Prisma SD-WAN controller.. To steer branch traffic to a primary data center and fail over to a secondary, the design must define both data centers in the controller and apply a policy that prefers the primary and falls back to the secondary. These two elements together provide the required automatic failover. Routing protocols, static routes, and controller redundancy do not by themselves deliver the application-aware data plane behavior needed for this hub-and-spoke design.

Answer

Deploy a Prisma SD-WAN controller in the secondary data center to act as a backup controller for branch devices.

Answer

Create static routes on each branch ION device pointing to both data centers with different administrative distances.

Answer

Enable OSPF on all branch ION devices and advertise branch prefixes into the data center routing domains.

Question 10

If an ION device is not receiving DHCP addresses from an upstream provider, where should you look first?

Accepted Answer

WAN Interface settings. The WAN interface is the physical/logical uplink that requests an IP address from the upstream provider via DHCP. If the ION device isn't receiving a DHCP lease, the first place to verify is the WAN interface configuration — checking that it's set to DHCP client mode, that the correct physical port is bound, and that link status is up. LAN DHCP server settings govern address assignment to downstream clients, not the device's own WAN lease, so they're irrelevant to this symptom.

Answer

Routing policies

Answer

LAN DHCP Server settings

Answer

Firewall rules

Question 11

You need to ensure that traffic from a specific subnet is placed into a unique VRF. How is this achieved?

Accepted Answer

By assigning the interface to the desired VRF. To place traffic from a specific subnet into a unique VRF, you assign the interface associated with that subnet to the desired VRF. In Prisma SD-WAN, VRF membership is determined by interface configuration, so the subnet's traffic inherits the VRF of the interface it enters or exits through.

Answer

By rebooting the device

Answer

By setting a firewall rule

Answer

By modifying the global routing table

Question 12

Which TWO actions can be performed by the SD-WAN controller to manage SASE security policy?

Accepted Answer

Associate specific applications with security policies. Option D is correct because the SD-WAN controller can associate specific applications with security policies, allowing application-aware traffic steering and enforcement so that identified applications are matched to the appropriate security rules. Option E is correct because the controller defines security policies that are pushed to the Prisma Access nodes, enabling centralized policy management and consistent enforcement across the SASE fabric. Options A, B, and C are not SD-WAN controller SASE policy actions: resetting Active Directory passwords is a directory/identity administration task, configuring physical internal switch ports on an ION device is a local device/interface configuration, and performing firmware upgrades on the Cloud Identity Engine is a lifecycle/update operation rather than security policy management.

Answer

Manually reset user passwords in the Active Directory

Answer

Configure the physical internal switch ports of the ION device

Answer

Perform firmware upgrades on the Cloud Identity Engine

Question 13

An energy company is planning a Prisma SD-WAN design for a remote drilling site that has intermittent satellite connectivity and only occasional on-site staff. The design must minimize on-site configuration effort and ensure the device can be replaced by non-technical personnel if it fails. Which design approach best meets these constraints?

Accepted Answer

Register the site and device serial in the Controller and rely on zero-touch provisioning so the replacement ION device claims its configuration automatically when it reaches the internet. Zero-touch provisioning is the Prisma SD-WAN model that matches a remote, intermittently connected site with non-technical staff. Pre-registering the site and device serial in the Controller lets a replacement ION device authenticate, claim its configuration, and build tunnels automatically once it reaches the internet, eliminating on-site CLI work and making field swaps practical.

Answer

Deploy a generic ION device image and let the device discover its role by listening for Controller broadcasts on the local subnet

Answer

Configure the site only after the device is online, using a temporary out-of-band cellular link that a technician establishes on site

Answer

Pre-stage the ION device at headquarters with a full site configuration and ship it, requiring a technician to run a CLI setup script on arrival

Question 14

A branch ION device is being deployed with a single WAN circuit that is provisioned as a DHCP client. The engineer needs the device to be reachable from the corporate management system for ongoing monitoring, but the ISP does not offer a static IP. Which configuration should the engineer apply on the ION device to meet this requirement?

Accepted Answer

Enable the ION device to establish an outbound management tunnel to the controller.. Because ION devices originate management connectivity to the controller, a dynamically assigned WAN address is sufficient for monitoring and orchestration. The device maintains an outbound tunnel and periodically reports health, so no inbound reachability or static IP is required. This is the standard deployment model for branches on DHCP-provisioned circuits.

Answer

Configure the WAN interface with a static IP address supplied by the ISP.

Answer

Bind the WAN interface to a secondary management VLAN with a static address.

Answer

Configure a destination NAT rule on the ISP router to forward management traffic to the ION device.

Question 15

You need to restrict administrative access to the ION device. Where is this configured?

Accepted Answer

Device Configuration / Access Control. Management access policies are defined under the device configuration settings in the Controller.

Answer

In the routing table

Answer

In the CloudBlades menu

Answer

On the WAN interface