SD-WAN-Engineer Practice Test 20 — 15 Questions

Question 1

A customer is experiencing intermittent connectivity to internal applications after enabling Unified SASE. Traffic is being routed through Prisma Access. What is the most likely cause?

Accepted Answer

MTU size mismatch leading to packet fragmentation. MTU size mismatch is a common cause of intermittent connectivity when traffic is routed through Prisma Access. If the MTU on the ION device or the tunnel is larger than the path MTU, packets may be fragmented or dropped, leading to intermittent failures, especially for applications that do not handle fragmentation well. This is a typical issue after enabling Unified SASE because the additional encapsulation (e.g., IPsec) reduces the effective MTU.

Answer

The ION device is overheating

Answer

Incorrect DNS server configuration

Answer

Identity cache expiration in CIE

Question 2

You need to ensure that branch office voice traffic always has the lowest latency. Which QoS classification strategy is recommended?

Accepted Answer

DSCP Marking and Queueing. DSCP marking and queueing is the recommended strategy because it classifies voice traffic into a high-priority class (typically EF, DSCP 46) at the edge, allowing every downstream SD-WAN device to place it in a low-latency priority queue. This end-to-end classification ensures voice packets are dequeued ahead of bulk data even when the WAN link is congested, which is the only way to guarantee consistently low latency.

Answer

Flow Control

Answer

Bandwidth Reservation

Answer

Rate Limiting

Question 3

Which TWO factors are used by Prisma SD-WAN to determine the health of a WAN path?

Accepted Answer

Packet loss. Prisma SD-WAN continuously probes each WAN path and evaluates its health using measured network-quality metrics, and packet loss (option D) is one of these core metrics because dropped packets directly indicate path degradation and trigger path selection or failover decisions. Latency (option E) is the other correct factor, since round-trip delay thresholds determine whether a path meets the SLA for applications such as voice and video. Options A (physical cable color) and B (power supply status) are physical-layer or hardware attributes that have no bearing on the dynamic health scoring of a WAN path, and option C (ISP name) is merely an administrative label that does not itself measure path quality.

Answer

Physical cable color

Answer

Power supply status

Answer

ISP name

Question 4

Which of the following are valid transport types that can be defined in a Prisma SD-WAN site configuration? (Choose TWO)

Accepted Answer

MPLS. In Prisma SD-WAN, a site's transport types define the WAN circuit categories that the branch can use for overlay connectivity, and MPLS (option A) is a valid transport type representing a private, carrier-provided L3 VPN circuit that can carry VPN overlays with SLA-based policies. Public Internet (option E) is also a valid transport type, representing broadband/ISP circuits used for VPN overlays and direct internet breakout, and it is commonly paired with MPLS in active/active or active/backup designs. Bluetooth (option B) is a short-range personal-area wireless technology, not a WAN transport that Prisma SD-WAN sites can define. Fiber Optic (option C) describes a physical medium/link layer rather than a Prisma SD-WAN transport category, and Serial (option D) is a legacy WAN interface type not offered as a site transport type in Prisma SD-WAN.

Answer

Bluetooth

Answer

Fiber Optic

Answer

Serial

Question 5

What is the primary function of the 'Controller' dashboard in the Prisma SD-WAN UI?

Accepted Answer

To provide visibility into fabric health and status. The dashboard provides a high-level view of health, status, and traffic analytics.

Answer

To configure individual PC settings

Answer

To update user passwords

Answer

To manage ISP billing

Question 6

A manufacturing company is designing its Prisma SD-WAN topology. The design team wants a simple hub-and-spoke model where all branch-to-branch traffic flows through the data center hub for inspection. Which topology design should be specified in the fabric?

Accepted Answer

A hub-and-spoke topology where branches connect through the data center hub. A hub-and-spoke topology forces branch-to-branch traffic through the central data center hub, which is exactly where the company wants inspection to occur. This design provides centralized control and predictable traffic flows, ensuring no inter-branch traffic bypasses the inspection point, which is the core requirement of the scenario.

Answer

A full mesh topology where every branch connects directly to every other branch

Answer

A point-to-point topology where each branch connects only to one other branch

Answer

A partial mesh topology where branches connect directly to each other and to the hub

Question 7

A junior engineer wants to quickly confirm whether a specific WAN edge device has established control connections to all three controller roles (vBond, vSmart, and vManage) after onboarding. Which vManage location provides this per-device control connection status view?

Accepted Answer

Monitor > Network > WAN Edge > Real Time > Control Connections. The real-time Control Connections view for a WAN edge device enumerates the DTLS connections to the vBond orchestrator, vSmart controllers, and vManage, showing their state. This is the most direct way to confirm that onboarding completed and all controller roles are reachable. Templates, cluster management, and interface views address configuration, management-plane health, and link counters respectively.

Answer

Configuration > Templates

Answer

Monitor > Network > WAN Edge > Real Time > Interface

Answer

Administration > Cluster Management

Question 8

An engineer is configuring a Prisma SD-WAN policy to ensure that voice traffic from a branch is always sent over the MPLS circuit, while all other traffic uses the internet circuit. The engineer creates an application policy with a match on voice applications and sets the action to use the MPLS path. However, after deployment, voice traffic is still traversing the internet circuit. Which configuration issue is the most likely cause?

Accepted Answer

The policy is not ordered correctly; a higher-priority policy is matching the voice traffic first and sending it to the internet.. In Prisma SD-WAN, policies are evaluated top-down, and the first matching policy determines the action. If a broader policy above the voice-specific policy matches voice traffic and sends it to the internet, the voice policy is bypassed. The most likely cause is incorrect policy ordering, where a higher-priority rule is intercepting the traffic before the voice rule is evaluated.

Answer

The MPLS interface is not configured as a WAN interface in the device template.

Answer

The voice application is not included in the application definition used by the policy.

Answer

The internet circuit has a lower cost metric than the MPLS circuit, causing the SD-WAN fabric to prefer it.

Question 9

An administrator is configuring a Unified SASE deployment with Prisma SD-WAN and Prisma Access. The administrator wants to verify that the service connection between the branch ION device and Prisma Access is operational and that traffic is being inspected. Which Prisma SD-WAN dashboard view should the administrator use to see the status of the service connection and the amount of traffic being sent to Prisma Access?

Accepted Answer

Monitor > Service Connections. The Monitor > Service Connections view is specifically designed to show the status and traffic statistics of service connections between ION devices and Prisma Access. It provides the necessary information to verify that the connection is operational and that traffic is being sent for inspection. Other views either focus on device health or individual flows, not the aggregated service connection status.

Answer

Monitor > Flows

Answer

Monitor > Prisma Access

Answer

Monitor > ION Health

Question 10

A network engineer is troubleshooting a Prisma SD-WAN environment where a branch site is experiencing intermittent connectivity to a critical cloud application. The engineer suspects that the issue is related to the SD-WAN fabric's handling of the application's traffic. Which of the following tools should the engineer use to capture and analyze the actual packets traversing the ION device to determine if packets are being dropped or modified?

Accepted Answer

The ION device's built-in packet capture utility, accessible via the CLI.. To determine if packets are being dropped or modified, the engineer needs to capture and analyze the actual packets. The ION device's built-in packet capture utility allows for this level of detail, enabling inspection of headers and payloads. Other tools like Flow Analytics or system logs provide summarized or event-based information but lack the granularity of raw packet captures.

Answer

The Prisma SD-WAN Orchestrator's topology view.

Answer

The ION device's system logs.

Answer

The Prisma SD-WAN Controller's Flow Analytics dashboard.

Question 11

What is the impact of assigning a site to a specific 'Site Group' in a Prisma SD-WAN policy?

Accepted Answer

It allows the application of policy sets to multiple sites simultaneously. Site Groups allow for scalable policy application across multiple sites with similar requirements.

Answer

It creates a new physical network

Answer

It forces all sites into the same VRF

Answer

It limits the number of peers

Question 12

A network architect is designing a Prisma SD-WAN deployment for a retail customer with 200 small branches. Each branch has a single ION device and one broadband circuit. The customer wants centralized policy management and minimal on-site configuration. Which TWO deployment components are required to meet these goals? (Choose two.)

Accepted Answer

Prisma SD-WAN ION devices at each branch for data-plane forwarding.. A Prisma SD-WAN deployment requires the cloud-hosted controller for centralized policy and configuration management, plus branch ION devices to forward and secure traffic. Together they deliver centralized orchestration with minimal on-site work. Dedicated MPLS, local management servers, and separate firewalls are not required and would raise cost and complexity.

Answer

A physical firewall appliance at each branch to enforce security policy.

Answer

A local management server installed at each branch for policy distribution.

Answer

A dedicated MPLS circuit at every branch for underlay transport.

Question 13

A design team is planning the underlay for a Prisma SD-WAN branch that will use two independent internet circuits plus an LTE link. They must decide which transport configuration characteristics to document for the ION device. (Choose two.)

Accepted Answer

Each WAN transport is bound to a physical or logical interface on the ION device and identified by a unique transport label.. Each transport is bound to an interface and carries a unique label, and those labels are what policy references to steer applications across the two internet circuits and the LTE link. Shared addressing, management-only LTE, and single-active-transport assumptions all misstate how the fabric handles multiple transports.

Answer

All three transports must share a single public IP address to participate in the overlay.

Answer

The LTE transport must be configured as a management-only interface and cannot carry user traffic.

Answer

Only one transport per ION device can be active at any time, with the others held in standby.

Question 14

You need to see the exact DSCP markings on packets exiting the ION. Which tool should you use?

Accepted Answer

Packet Capture. Packet Capture on the ION device allows you to capture actual packet headers and payloads, including the DSCP field in the IP header. By analyzing the capture, you can see the exact DSCP markings on packets exiting the ION. This is the most precise tool for verifying QoS markings.

Answer

Flow Monitor

Answer

Path Quality

Answer

Interface Stats

Question 15

Which THREE types of information are displayed in the Prisma SD-WAN 'Flow Monitoring' view?

Accepted Answer

Source and destination IP. Option A is correct because the Flow Monitoring view in Prisma SD-WAN displays the source and destination IP addresses for each flow, allowing administrators to identify the endpoints of traffic traversing the fabric. Option B is correct because path metrics such as packet loss and latency are shown per flow, which is essential for understanding the quality of the selected path and for troubleshooting performance issues. Option E is correct because the Application name is displayed, since Prisma SD-WAN identifies and classifies traffic by application to support application-aware routing and policy enforcement. Option C is not correct because ISP billing records are not part of flow telemetry; they belong to billing or cost-management systems, not the Flow Monitoring view. Option D is not correct because router CPU temperature is device health telemetry, not flow-level information, and would appear in device monitoring rather than Flow Monitoring.

Answer

ISP billing records

Answer

Router CPU temperature