SD-WAN-Engineer Practice Test 19 — 15 Questions

Question 1

What is the purpose of the 'site-id' in the Prisma SD-WAN branch configuration?

Accepted Answer

To uniquely identify the site within the fabric. The site-id is a unique identifier used to manage and reference the site within the SD-WAN fabric.

Answer

To define the management VLAN

Answer

To configure the local gateway IP

Answer

To identify the physical location on a map

Question 2

You are verifying the status of a Service Connection between a branch ION and Prisma Access. Which command or dashboard view provides the most accurate status of the tunnel reachability?

Accepted Answer

The Controller Service Connection Status Dashboard. The Prisma SD-WAN Controller dashboard provides a clear Service Connection status widget that shows tunnel up/down state.

Answer

The ION device hardware health tab

Answer

The local device ARP table

Answer

The cloud provider logs

Question 3

A network engineer is deploying a Prisma SD-WAN solution at a branch site with two WAN links. The engineer wants to ensure that the branch can automatically fail over from the primary link to the secondary link when the primary link experiences high latency or packet loss. Which TWO configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Create a path selection policy that includes latency and packet loss thresholds.. To achieve automatic failover based on latency and packet loss, you must create a path selection policy that defines those thresholds and configure a failover action to redirect traffic to the secondary link when the thresholds are exceeded. These two steps together ensure dynamic, performance-based failover.

Answer

Set up a QoS policy to prioritize traffic on the secondary link.

Answer

Enable Forward Error Correction on both WAN interfaces.

Answer

Configure a static route with a higher administrative distance for the secondary link.

Question 4

A network operations team is troubleshooting a Prisma SD-WAN environment where multiple sites are reporting intermittent connectivity to critical cloud applications. The team suspects an issue with the SD-WAN fabric's path selection or link quality. Which two actions should the team perform to gather the most relevant data for diagnosis? (Choose two.)

Accepted Answer

Check the Event Log for path selection changes and link state transitions.. To diagnose intermittent connectivity to cloud applications, the team should focus on data that reveals path quality and selection decisions. The Application Dashboard provides per-application latency, jitter, and loss, while the Event Log shows path changes and link transitions. Together, they offer a comprehensive view of the SD-WAN fabric's behavior, enabling correlation between performance degradation and path selection events.

Answer

Verify the BGP peering status on all ION devices to ensure routing adjacencies are stable.

Answer

Restart the ION devices at the affected sites to clear any transient issues.

Answer

Run a packet capture on the ION device's WAN interface to analyze all traffic.

Question 5

A network administrator is investigating why a specific SaaS application is being blocked for users at a branch site. The security policy in the orchestrator does not show any hits for that application. The administrator suspects that the ION device is not correctly identifying the application. Which feature should be verified to ensure the application is recognized and allowed?

Accepted Answer

Application identification and signature database version. When a SaaS application is blocked but no security policy hits are seen, the likely cause is that the ION device is not identifying the application correctly. This often stems from an outdated application signature database. Ensuring the database is current allows the device to recognize the application and apply the correct policy, resolving the block.

Answer

WAN interface load balancing algorithm

Answer

BGP route advertisements

Answer

Quality of Service (QoS) policy configuration

Question 6

In a scenario where a branch office loses its internet connection, what happens to the Unified SASE connection?

Accepted Answer

The SD-WAN system automatically fails over to an available secondary path. Prisma SD-WAN is built around multiple transport links and continuous path monitoring, so when the primary internet circuit fails, the fabric automatically steers traffic onto a secondary path (LTE, secondary broadband, or MPLS) without operator intervention. The Unified SASE tunnel is re-established or maintained over the surviving path, preserving security inspection. This is the core resilience promise of the SD-WAN overlay.

Answer

The SD-WAN controller disables the branch

Answer

The traffic is automatically dropped

Answer

Traffic is sent to the default gateway without security

Question 7

Which TWO metrics are displayed in the Path Quality dashboard?

Accepted Answer

Latency. The Path Quality dashboard in SD-WAN/network monitoring tools focuses on link and path performance characteristics, and Latency (C) is a core metric it displays because it measures the round-trip time for packets traversing a path, directly reflecting path health. Jitter (E) is also displayed because it quantifies the variation in packet delay between consecutive packets, which is critical for real-time traffic quality such as VoIP and video. These two metrics, along with packet loss, form the standard trio used to evaluate path quality and drive dynamic path selection. Options A (Total number of users), B (Fan speed), and D (Power supply voltage) are not path-performance metrics: user count is an adoption/usage statistic, while fan speed and power supply voltage are hardware telemetry values reported by device sensors, not by the Path Quality dashboard.

Answer

Total number of users

Answer

Fan speed

Answer

Power supply voltage

Question 8

Which protocol is utilized for the auto-discovery of Prisma SD-WAN Gateways during site provisioning?

Accepted Answer

ZTP (Zero Touch Provisioning). The Zero-Touch Provisioning (ZTP) process uses the controller to push configurations after the gateway registers via the secure cloud portal.

Answer

SNMP

Answer

RIPv2

Answer

TFTP

Question 9

A financial services company is designing a Prisma SD-WAN topology for a data center that hosts a trading application. The application requires sub-10 ms latency to a specific colocation facility and must not traverse any public internet path. The design team needs to enforce this requirement across all branches. Which Prisma SD-WAN design approach should be used?

Accepted Answer

Create a custom application definition and a path policy that only allows the private WAN transport for that application.. The design must guarantee that the trading application uses only the private WAN and avoids public internet. A custom application definition combined with a path policy that permits only the private transport enforces this at the SD-WAN policy layer. Adaptive path selection, QoS, and service insertion do not provide the strict transport restriction required, so they cannot satisfy the business constraint.

Answer

Configure a QoS policy that marks the trading application as high priority and trusts the underlay to route it correctly.

Answer

Enable adaptive path selection with a latency threshold and let the controller choose the best path dynamically.

Answer

Use a service insertion policy to redirect the trading application to a cloud security provider for inspection.

Question 10

An administrator is troubleshooting a routing loop that occurs intermittently between two branch sites. The administrator suspects that the BGP route advertisements received by one of the ION devices are causing the loop. Which tool in the Prisma SD-WAN orchestrator can be used to view the BGP routes received by an ION device?

Accepted Answer

BGP Neighbors. The BGP Neighbors tool in the Prisma SD-WAN orchestrator provides a detailed view of BGP sessions and the routes received from each neighbor. By examining the received routes, the administrator can identify if a neighbor is advertising a route that causes a loop, such as a route with an unexpected AS path or a route that should have been filtered.

Answer

Flow Monitor

Answer

Alarms

Answer

Routing Table

Question 11

Which Prisma SD-WAN interface is used to connect to the local LAN?

Accepted Answer

LAN Interface. The LAN-side interface connects to switches, servers, and internal users.

Answer

Tunnel Interface

Answer

Management Interface

Answer

WAN Interface

Question 12

A branch office uses both MPLS and Broadband. The design requires that business-critical traffic prefers MPLS, failing over to Broadband only if the MPLS path experiences packet loss exceeding 1%. Which metric should the PFR policy utilize?

Accepted Answer

Packet Loss. Performance Routing policies rely on path metrics like loss, latency, and jitter to make routing decisions.

Answer

Bandwidth Utilization

Answer

Jitter

Answer

Round Trip Time (RTT)

Question 13

An operator must prove to an auditor that traffic from a branch to a business-critical SaaS application used the preferred low-latency transport over the last 24 hours, and that failover to the backup transport occurred only during a documented outage window. Which vManage monitoring capability provides the per-application, time-correlated evidence needed?

Accepted Answer

The Application-Aware Routing dashboard under Monitor, which shows per-application path selection, SLA compliance, and transport usage over a selectable time range.. The Application-Aware Routing dashboard ties application traffic to the selected transport and SLA status over a selectable time range, producing exactly the time-correlated per-application evidence requested. DPI byte rankings, alarms, and audit records each capture a different dimension and cannot, alone, show continuous preferred-path usage with a bounded failover interval.

Answer

The Alarm view filtered to major severity, which lists transport-down events with timestamps for the branch.

Answer

The DPI Applications report under Monitor, which ranks applications by total bytes transferred per site over the selected period.

Answer

The vManage Audit Log, which records policy and configuration changes applied to the branch device during the period.

Question 14

A network engineer is deploying a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer wants to ensure that traffic from a specific branch is inspected by Prisma Access, but traffic to a critical internal application must bypass Prisma Access and go directly over the Prisma SD-WAN fabric. The branch has two ION devices for redundancy. Which configuration should the engineer use to achieve this?

Accepted Answer

Configure a Prisma SD-WAN policy with a destination-based rule that steers traffic for the internal application directly over the SD-WAN fabric and sends all other traffic to Prisma Access.. A Prisma SD-WAN policy with destination-based rules allows precise control over which traffic is sent to Prisma Access and which bypasses it. By matching the internal application's destination and setting the action to direct, and setting a default action to send other traffic to Prisma Access, the engineer achieves the desired split. This is more granular and maintainable than subnet-based split tunneling.

Answer

Create a Prisma Access service connection and configure a static route on the ION devices to send all traffic to Prisma Access.

Answer

Use Prisma Access Service Connection with a split-tunnel configuration on the ION devices, where the internal application subnet is excluded from the tunnel.

Answer

Enable Prisma Access Explicit Proxy on the ION devices and configure the internal application as a bypass in the proxy settings.

Question 15

A network security administrator is configuring Prisma Access to integrate with Prisma SD-WAN for Unified SASE. The administrator needs to ensure that security logs from Prisma Access can be correlated with traffic logs from Prisma SD-WAN to troubleshoot an incident. Which configuration is required to enable this correlation?

Accepted Answer

Enable the Prisma SD-WAN CloudBlade for Prisma Access and ensure that the same tenant and correlation ID are used.. Log correlation between Prisma Access and Prisma SD-WAN is achieved through the CloudBlade integration, which shares a tenant and uses a correlation ID. This identifier is included in logs from both systems, enabling a unified view for troubleshooting. Simply forwarding logs to the same destination or enabling user identification does not provide the necessary linkage.

Answer

Enable User-ID and IP-tagging in Prisma Access and Prisma SD-WAN.

Answer

Configure the same log forwarding destination for both Prisma Access and Prisma SD-WAN.

Answer

Configure a shared service connection and enable logging on the ION devices.