SD-WAN-Engineer Practice Test 2 — 10 Questions

Question 1

A network engineer is deploying a new branch ION device at a site with dual WAN circuits: a primary 500 Mbps fiber link and a secondary 100 Mbps LTE link. The design requires that the LTE link only carry traffic when the fiber link fails, and that all traffic return to the fiber link automatically once it recovers. Which configuration should the engineer apply on the ION device?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a failover WAN bundle with the fiber interface as the primary and the LTE interface as the standby member.. The requirement describes an active/standby WAN design with automatic failback. A failover WAN bundle keeps the secondary member idle until the primary path is declared down, then shifts traffic and reverts when health returns. Load balancing, static routing with manipulated distance, or per-packet distribution all keep both links active or fail to provide monitored automatic failback.

Answer

Configure both WAN interfaces in a single load-balanced WAN bundle with per-flow hashing.

Answer

Enable per-packet load balancing on both WAN interfaces so traffic is distributed based on current utilization.

Answer

Configure a static route for 0.0.0.0/0 pointing to the LTE next-hop with a lower administrative distance than the fiber route.

Question 2

A network engineer is troubleshooting a Unified SASE deployment where branch users report that access to internal applications is slow after enabling Prisma Access inspection. The engineer confirms that internal traffic is being sent to Prisma Access instead of directly over the SD-WAN fabric. Which configuration change should the engineer make to resolve the issue?

Accepted Answer

Modify the application-based policy to send internal application prefixes over a direct SD-WAN path instead of the Service Connection.. The slowness is caused by internal traffic being backhauled to Prisma Access for inspection. The correct fix is to adjust the application-based policy so that internal application prefixes are matched and sent over a direct SD-WAN path, while internet-bound traffic continues to use the Service Connection. Bandwidth increases, disabling path selection, or static routes to Prisma Access do not correct the misrouting.

Answer

Increase the bandwidth of the ISP link used by the Service Connection to Prisma Access.

Answer

Disable Dynamic Path Selection on the Service Connection to force traffic over a single path.

Answer

Configure a static route on the ION device that points internal prefixes to the Prisma Access tunnel.

Question 3

An engineer notices that an ION device at a branch site shows a WAN interface status of 'up' in the Prisma SD-WAN orchestrator, but no traffic is being forwarded over that interface. The interface is configured for DHCP. Which troubleshooting step should be performed first to determine why the interface is not passing traffic?

Accepted Answer

Verify that the DHCP server is reachable and has provided a valid IP address, default gateway, and DNS servers.. When a WAN interface is up but not passing traffic, the most common cause is a failure to obtain a valid IP configuration via DHCP. Verifying the DHCP lease ensures the interface has an IP address, default gateway, and DNS servers, which are prerequisites for any traffic forwarding. Other options, like checking BGP or restarting, are either premature or irrelevant.

Answer

Review the application performance dashboard to see if any applications are experiencing latency.

Answer

Check the BGP neighbor state to ensure the peering session with the service provider is established.

Answer

Restart the ION device to force a renegotiation of the interface and DHCP lease.

Question 4

An engineer is troubleshooting a scenario where users at a branch office cannot access SaaS applications via Prisma Access. The SD-WAN path is active, but the traffic is not reaching the Cloud SWG. What is the most likely cause related to the Unified SASE policy?

Accepted Answer

The Security Policy rule for the branch traffic is set to 'Direct to Internet' instead of 'Service Connection'. In Prisma Access Unified SASE, the Security Policy rule determines whether branch traffic is sent to the Cloud SWG (Service Connection) or sent directly to the internet. If the rule is set to 'Direct to Internet', traffic bypasses the Cloud SWG entirely, so users cannot reach SaaS applications through the security service. The SD-WAN path being active only means the underlay is up; the policy action controls the security inspection path.

Answer

The ION device is missing the latest firmware

Answer

The Cloud Identity Engine is not reachable

Answer

The WAN port is set to DHCP

Question 5

Which types of traffic should ideally be prioritized via QoS policies? (Choose TWO)

Accepted Answer

Real-time video conferencing. Option A (real-time video conferencing) is correct because interactive video requires low latency, low jitter, and consistent bandwidth, so QoS should mark it with a high-priority class such as EF or AF41 to keep the call usable. Option B (Voice over IP) is correct because VoIP is highly delay-sensitive and typically uses small UDP packets with RTP; QoS should give it strict priority or a low-latency queue (often DSCP EF, 46) to prevent jitter and packet loss. Options C and D are not correct because background system backups and operating system updates are bulk, non-interactive traffic that can tolerate delay and should be placed in a lower-priority or scavenger class. Option E is not correct because social media browsing is generally non-critical, elastic traffic that does not warrant preferential QoS treatment over real-time communications.

Answer

Background system backups

Answer

Operating system updates

Answer

Social media browsing

Question 6

A network administrator is troubleshooting a site that is experiencing poor voice quality over the SD-WAN. The administrator suspects that the voice traffic is not being prioritized correctly. Which SD-WAN feature should be verified to ensure that voice packets are marked and queued appropriately across the WAN?

Accepted Answer

QoS policy. Voice quality depends on proper prioritization across the WAN, which is achieved through QoS policies. These policies classify voice traffic, mark it with appropriate DSCP values, and place it in priority queues. Verifying the QoS policy ensures that voice packets are treated with the necessary urgency to maintain low latency and jitter.

Answer

Application definitions

Answer

Security policy

Answer

Path selection policy

Question 7

Which THREE items are included in a Prisma SD-WAN 'Site' configuration?

Accepted Answer

Interface configuration. In Prisma SD-WAN, a Site object is the logical container that binds together the physical location and the devices deployed there, so Interface configuration (B) is correct because each site defines its WAN/LAN interfaces (e.g., IP addressing, WAN labels, and link settings) used by the SD-WAN devices at that location. Site location details (C) are also correct, since a Site stores geographic/address information (such as address, latitude/longitude, and timezone) that is used for topology mapping, policy, and path selection. Device assignment (D) is correct as well, because ION devices must be assigned to a Site so they inherit that site's interfaces, policies, and routing context. ISP contract end date (A) is a commercial/administrative detail not part of the Site configuration object, and user password history (E) is an authentication/security setting unrelated to SD-WAN site definition.

Answer

ISP contract end date

Answer

User password history

Question 8

A network engineer is troubleshooting why a branch ION device is not receiving any traffic from the data center. The engineer suspects that a firewall rule on the ION device is blocking traffic. Which log should the engineer check to see if traffic is being dropped by the firewall?

Accepted Answer

Firewall log. The Firewall log is the correct choice. It specifically logs traffic that matches firewall rules, including denies. By examining this log, the engineer can see if traffic from the data center is being dropped and which rule is responsible. This is a fundamental step in troubleshooting firewall-related connectivity issues.

Answer

Traffic log

Answer

Event log

Answer

System log

Question 9

When integrating Prisma SD-WAN with a cloud-based security service provider (CSSP) via CloudBlades, which setting must be verified to ensure proper traffic redirection?

Accepted Answer

Service-to-Tunnel Mapping. The service mapping in CloudBlades ensures that traffic classified for security inspection is steered to the correct CSSP node.

Answer

Local ISP DNS settings

Answer

DHCP Server scope

Answer

VLAN ID matching

Question 10

You are troubleshooting an SD-WAN environment where a branch site's vEdge reports that the BFD sessions to the remote data center are flapping every few minutes. The underlay transport is stable, and the WAN interface counters show no errors. You run 'show tunnel statistics' and observe periodic drops in the tunnel. Which action should you take FIRST to isolate the cause?

Accepted Answer

Run 'show bfd sessions' and 'show tunnel statistics' with timestamps to correlate drops with specific tunnel and path.. The first step in troubleshooting flapping BFD sessions is to gather data that correlates the flapping with specific tunnels and paths. Running 'show bfd sessions' alongside 'show tunnel statistics' with timestamps reveals which TLOC or transport is affected. This evidence-based approach avoids premature configuration changes and directs subsequent remediation to the actual faulty path.

Answer

Increase the BFD hello interval on the tunnel interface to reduce sensitivity to transient latency.

Answer

Apply a QoS policy to prioritize BFD packets on the WAN interface to prevent drops.

Answer

Disable BFD on the tunnel and rely on IPsec DPD to detect failures instead.