SD-WAN-Engineer Practice Test 18 — 15 Questions

Question 1

A network architect is planning a Prisma SD-WAN deployment for a company with 20 branch offices. The company wants to ensure that if a branch's primary internet circuit fails, traffic automatically switches to a secondary LTE circuit. Which Prisma SD-WAN feature should be configured to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic path selection with tunnel failover. Dynamic path selection with tunnel failover is the Prisma SD-WAN feature that continuously monitors tunnel health and automatically redirects traffic to a backup path when the primary fails. This directly satisfies the requirement for automatic failover to the LTE circuit. The other options either do not provide failover or are not the primary mechanism for circuit redundancy in Prisma SD-WAN.

Answer

Static routing with administrative distance

Answer

Policy-based forwarding with application SLA profiles

Answer

Quality of Service (QoS) policies with priority queuing

Question 2

A junior engineer needs to confirm that a specific branch router's control connections to all controllers are currently established and encrypted. Which vManage view should the engineer open for that single device to see the state of each control connection and the TLOC it uses?

Accepted Answer

Monitor > Network > the device > Control Connections, which lists each controller connection, its protocol, and its current state.. Control connections are per-device sessions to the vBond, vManage, and vSmart controllers. The device-level Control Connections view under Monitor > Network enumerates each session with its state and the TLOC carrying it, giving a direct answer about establishment and encryption for that router. Interface state, templates, and the audit log describe other concerns and cannot confirm live control-plane sessions.

Answer

Configuration > Templates, which shows the feature templates attached to the device and their variable values.

Answer

Monitor > Network > the device > Interfaces, which shows operational state and counters for every physical and logical interface.

Answer

Monitor > Logs > Audit Log, which records configuration changes made to the device over time.

Question 3

During pre-deployment planning for a high-security site, you must implement an identity-aware firewall policy. Where is this configuration mapped in the Prisma SD-WAN Controller?

Accepted Answer

Identity-Based Security Policy. Identity-Based Security Policy in the Prisma SD-WAN Controller is where you configure firewall rules that use identity information (such as user, group, or device posture) as match criteria. This is the correct location for mapping an identity-aware firewall policy for a high-security site.

Answer

NAT Policy

Answer

Routing Policy

Answer

Quality of Service Policy

Question 4

How does Prisma SD-WAN handle DNS queries for branch users?

Accepted Answer

It can intercept and proxy DNS requests. Prisma SD-WAN can intercept and proxy DNS requests from branch users, allowing the controller to apply DNS-based policies, enforce security filtering, and direct queries to appropriate resolvers. This interception is part of its application-aware traffic handling and enables DNS-based steering and threat protection.

Answer

It ignores DNS traffic

Answer

It blocks all DNS queries

Answer

It forces all DNS to public servers

Question 5

During an incident, an engineer observes that a WAN edge device is dropping traffic on a specific tunnel, and wants to verify the BFD session state and the measured loss and latency for that tunnel. Which operational command on a Cisco IOS XE SD-WAN device provides this per-tunnel BFD detail?

Accepted Answer

show sdwan bfd sessions. BFD sessions provide the liveness and quality measurements that SD-WAN uses for path selection and failover. The BFD sessions command on a Cisco IOS XE SD-WAN device lists each session with its state and the measured latency, loss, and jitter, which is exactly the detail required to diagnose a tunnel that is dropping traffic. OMP peers, data policy, and local control properties address other aspects of the control and policy planes.

Answer

show sdwan control local-properties

Answer

show sdwan policy data-policy

Answer

show sdwan omp peers

Question 6

When configuring an ION device as a gateway for a cloud environment, what is the primary role of a 'Service' interface?

Accepted Answer

To provide connectivity to LAN-side services or segments. A 'Service' interface on an ION device configured as a cloud gateway provides connectivity to LAN-side services or segments, effectively acting as the internal-facing interface for the cloud environment. It connects the cloud workload segments to the SD-WAN fabric for policy-driven routing.

Answer

To provide management access

Answer

To update firmware

Answer

To connect to the ISP modem

Question 7

A network administrator is troubleshooting why a specific application flow is being routed over a less desirable WAN link despite the configured application-aware routing policy preferring a different link. The administrator has verified that the application is recognized correctly. Which vManage monitoring tool should be used to examine the per-flow path selection and the reason for the chosen path?

Accepted Answer

Flow Analytics. Flow Analytics in vManage captures detailed flow records, including the selected path, application identification, and the policy decision that led to that path. It allows drilling down into a specific flow to see why it egressed a particular interface. Other monitoring tools like Interface Statistics, Control Connections, or Alarms lack the per-flow granularity and policy reasoning needed to diagnose application-aware routing decisions.

Answer

Interface Statistics

Answer

Control Connections

Answer

Alarms

Question 8

A network engineer is configuring a Prisma SD-WAN branch site with two WAN links: a primary MPLS link and a secondary broadband link. The engineer wants to ensure that business-critical traffic uses the MPLS link and fails over to broadband only when the MPLS link's latency exceeds 100 ms. Which configuration is required to achieve this?

Accepted Answer

Create a traffic policy with a path preference for MPLS and a failover condition based on latency threshold.. The correct configuration is a traffic policy with a path preference for MPLS and a failover condition based on latency threshold. Prisma SD-WAN traffic policies support performance-based failover, allowing the engineer to define thresholds for latency, jitter, and packet loss. This ensures that business-critical traffic uses MPLS until latency exceeds 100 ms, then switches to broadband.

Answer

Set up a static route for business-critical traffic pointing to the MPLS interface and a floating static route to broadband.

Answer

Enable 'Forward Error Correction' on the MPLS link to reduce latency and avoid failover.

Answer

Configure a QoS policy to prioritize MPLS traffic and set a latency threshold for broadband.

Question 9

A multinational enterprise is designing a Prisma SD-WAN deployment across 50 sites in North America, Europe, and Asia. The company wants to ensure that each region uses a local Prisma SD-WAN Controller to reduce management latency, while still allowing global policy enforcement. Which design approach should you recommend?

Accepted Answer

Use Prisma SD-WAN's multi-region controller architecture, where each region has its own controller cluster and policies are synchronized globally.. Prisma SD-WAN's multi-region controller architecture allows regional controller clusters to serve local sites, reducing management latency. Global policies are synchronized across controllers, so enforcement remains consistent. The other options either introduce latency, are unsupported, or rely on third-party components, making them incorrect for this multinational design.

Answer

Deploy a standalone Prisma SD-WAN Controller at each site to eliminate management latency entirely.

Answer

Configure all sites to use a third-party SD-WAN controller that supports multi-region deployments and integrate it with Prisma SD-WAN.

Answer

Deploy a single Prisma SD-WAN Controller in North America and have all sites connect to it over the internet.

Question 10

A network engineer is deploying a Prisma SD-WAN solution at a branch site with two WAN links: a primary MPLS link and a secondary broadband link. The engineer wants to ensure that if the MPLS link fails, all traffic automatically switches to the broadband link without manual intervention. Which configuration should be applied?

Accepted Answer

Configure a path selection policy with a failover action to the broadband link when the MPLS link is down.. A path selection policy with a failover action is the correct solution because it continuously monitors link health and automatically redirects traffic to the secondary link when the primary link fails. This ensures seamless failover without manual intervention.

Answer

Enable Forward Error Correction on the MPLS link to prevent failures.

Answer

Configure a static route with a higher administrative distance for the broadband link.

Answer

Configure a QoS policy that prioritizes traffic on the broadband link.

Question 11

A network engineer is deploying a new branch office with a Prisma SD-WAN ION device. The branch requires direct internet access for guest users, but corporate traffic must be inspected by Prisma Access. The engineer wants to minimize configuration overhead and ensure that only corporate traffic is redirected to Prisma Access while guest traffic goes directly to the internet. Which feature should the engineer configure on the ION device to achieve this?

Accepted Answer

Policy-Based Forwarding (PBF) with a traffic policy that matches corporate subnets and directs them to the Prisma Access tunnel.. The requirement is to selectively redirect only corporate traffic to Prisma Access while allowing guest traffic direct internet access. Policy-Based Forwarding (PBF) on the ION device enables matching traffic by subnet or other criteria and steering it into the Prisma Access tunnel. This provides granular control without affecting guest traffic, and it is the standard method in Prisma SD-WAN for traffic engineering to Prisma Access.

Answer

Enable split tunneling on the ION device and configure the Prisma Access tunnel as the default route.

Answer

Create a virtual interface for guest traffic and bind it to a separate WAN interface, then route corporate traffic through the Prisma Access tunnel using OSPF.

Answer

Configure a static route on the ION device that points all traffic to the Prisma Access tunnel, and use NAT to exempt guest traffic.

Question 12

Which Prisma SD-WAN tool is used to monitor real-time health and performance of the SD-WAN fabric during the deployment phase?

Accepted Answer

Controller Dashboard. The Controller Dashboard in Prisma SD-WAN provides a centralized, real-time view of fabric health, including device status, link performance, and overlay tunnel states. During deployment, it is the primary tool for monitoring whether ION devices are online, tunnels are up, and policies are being enforced. It aggregates telemetry from all IONs and presents it in a single pane of glass.

Answer

SNMP Traps

Answer

CLI Debugging

Answer

Packet Capture (PCAP)

Question 13

What is the effect of changing the 'Path Selection' strategy from 'Latency' to 'Lowest Cost' in a policy?

Accepted Answer

It prioritize links based on configured cost parameters. Changing the Path Selection strategy to 'Lowest Cost' makes the SD-WAN controller choose the WAN link with the lowest configured cost metric (e.g., cost per Mbps or provider preference) rather than the lowest latency. This is a policy-level decision that affects which tunnel carries traffic, and it is useful when bandwidth economics matter more than latency. The other options describe unrelated or incorrect effects.

Answer

It disables all tunnels

Answer

It forces traffic to the internet

Answer

It improves jitter

Question 14

When planning for a large-scale deployment, which items are required for the initial site information gather? (Choose THREE)

Accepted Answer

Total bandwidth per link. Option A (Total bandwidth per link) is correct because sizing WAN circuits and QoS/traffic shaping for a large-scale deployment requires knowing the capacity of each link. Option B (Public WAN IP addresses) is correct because public WAN IPs are needed for site-to-site VPN peering, NAT, and firewall/routing configuration at each site. Option E (Internal LAN subnets) is correct because the internal subnet scheme is essential for routing, DHCP scopes, and avoiding address overlap between sites. Options C (Local desk configurations) and D (Employee names) are not part of initial site information gathering, as they are endpoint/user-level details rather than network topology and connectivity data needed for deployment planning.

Answer

Local desk configurations

Answer

Employee names

Question 15

Which THREE pieces of information are critical when opening a support ticket for a suspected SD-WAN bug?

Accepted Answer

Support bundle/logs. Option A (Support bundle/logs) is correct because a support bundle collects the SD-WAN device's configuration, control-plane state, and system logs, giving TAC the diagnostic evidence needed to reproduce and root-cause a suspected software bug. Option D (Packet capture of the issue) is correct because a pcap on the relevant overlay/underlay interfaces shows the actual data-plane and control-plane traffic (e.g., IPsec, BFD, OMP, DTLS), which is essential for proving whether packets are dropped, malformed, or mishandled by the code. Option E (Device serial number) is correct because the serial number uniquely identifies the hardware/software asset, allowing support to pull the exact model, firmware version, and entitlement records tied to that device. Option B (Internal employee names) is not needed and raises privacy concerns, since the ticket should reference the device and symptoms rather than personnel. Option C (User passwords) must never be included, as credentials are sensitive and irrelevant to diagnosing an SD-WAN bug.

Answer

Internal employee names

Answer

User passwords