SD-WAN-Engineer Practice Exam 1 — 20 Questions

Question 1

Which THREE actions can be performed by a Prisma SD-WAN 'Policy' object?

Accepted Answer

Path selection. In Prisma SD-WAN, a Policy object is the mechanism that defines how traffic is handled across the fabric, and it directly performs path selection (B) by choosing which WAN path or paths (e.g., VPN, Direct Internet, or specific circuit) a flow should use based on application, source/destination, and path-quality conditions. It also performs traffic prioritization/QoS (D) by assigning traffic classes and priority levels so latency-sensitive or business-critical applications receive appropriate bandwidth and forwarding treatment. Security filtering (E) is likewise enforced through policy, since Prisma SD-WAN policies can reference security zones and service/security rule sets to permit, deny, or redirect traffic to security services. Hardware replacement (A) and firmware updates (C) are not policy actions; they are operational/lifecycle tasks handled through device management, software upgrade workflows, and the Prisma SD-WAN controller, not through the Policy object.

Answer

Hardware replacement

Answer

Firmware updates

Question 2

A network administrator needs to monitor real-time application performance and path quality metrics for a specific site in Cisco vManage. Which menu should the administrator navigate to?

Accepted Answer

Monitor > Applications. The Monitor > Applications section in vManage is specifically designed to display application performance and path quality metrics such as latency, jitter, and packet loss. It aggregates data from Application Aware Routing and provides per-application and per-path visibility, making it the correct choice for real-time monitoring of application experience at a site.

Answer

Monitor > Network

Answer

Monitor > Alarms

Answer

Monitor > Logs

Question 3

A network architect is planning a Prisma SD-WAN deployment for a retail chain with 400 small branches. Each branch will have two broadband circuits from different providers and must be able to fail over to a cellular modem during an outage. The architect wants to minimize hardware footprint and central management overhead. Which design element should be included in the plan to meet these requirements?

Accepted Answer

Use a virtual ION instance on an existing branch compute platform, with cellular access provided by a supported external modem.. The design must balance small branch footprint with dual broadband and cellular failover. A virtual ION on existing branch compute with an external modem satisfies the hardware and management constraints while preserving Prisma SD-WAN transport flexibility. Physical appliances add cost and logistics, static-only designs lose dynamic policy, and data center backhauling defeats local failover and cloud access goals.

Answer

Deploy a dedicated physical ION device at each branch with dual power supplies.

Answer

Deploy a single ION device at the data center and backhaul all branch traffic through it.

Answer

Configure all branches as static-only sites and rely on the underlay routing for failover.

Question 4

When performing a 'Soft Shutdown' on an HA device, what is the expected behavior?

Accepted Answer

The device gracefully transitions the active state to the standby device.. A soft shutdown allows the active unit to relinquish its role gracefully to the standby unit.

Answer

The device disables all interfaces without notifying the peer.

Answer

The device immediately reboots.

Answer

The device enters a maintenance mode that clears all routes.

Question 5

A network engineer is troubleshooting a site where traffic from a specific VLAN is not being forwarded to the correct VPN overlay. The engineer suspects a misconfiguration in the network policy. Which tool in the Prisma SD-WAN Orchestrator should the engineer use to view the effective policy applied to that site and verify the path selection decisions?

Accepted Answer

Policy Browser. The Policy Browser is designed to show the effective policies applied to a site, including how traffic is classified and which path it should take. It allows engineers to verify if a VLAN's traffic is matching the intended rules and being forwarded correctly. Other tools like Flow Analytics, Topology View, and Event Log provide different perspectives but lack the policy evaluation detail required.

Answer

Topology View

Answer

Event Log

Answer

Flow Analytics

Question 6

A network engineer is troubleshooting an SD-WAN deployment where an ION device at a branch site is not forming a control connection to the Prisma SD-WAN Controller. The device is powered on and has a link light on its WAN port. The engineer suspects a certificate or licensing issue. Which two items should the engineer verify to confirm the device's identity and authorization with the controller? (Choose two.)

Accepted Answer

The device has a valid license assigned to its serial number in the portal.. The control connection between an ION device and the Prisma SD-WAN Controller relies on the device being properly registered and licensed in the portal. The serial number serves as the unique identity, and a valid license authorizes the device to join the network. Without these, the controller will reject the connection, preventing the device from receiving configuration or participating in the overlay.

Answer

The device's management interface is configured with a static IP address.

Answer

The device's local firewall is allowing outbound UDP port 4500.

Answer

The device's software version matches the controller's version exactly.

Question 7

An enterprise is designing Prisma SD-WAN for a data center that hosts business-critical applications. The design requires that traffic from branch sites to these applications be steered over a specific set of high-performance circuits, while all other internet-bound traffic uses a different set of circuits. The solution must be scalable and not require per-application static routes on every branch device. What should be used in the design?

Accepted Answer

Define application definitions and use a Prisma SD-WAN policy set with path selection criteria to steer the business-critical applications over the desired circuits.. Application definitions combined with policy sets are the native Prisma SD-WAN mechanism for classifying traffic and steering it over selected paths. Policies can specify preferred circuit types, performance thresholds, and priorities, and they are applied centrally to all sites. This scales without per-device static routes and provides dynamic, application-aware path selection, which is exactly what the data center steering design requires.

Answer

Configure static routes on each branch ION device that point business-critical prefixes to the high-performance circuits.

Answer

Use BGP communities to tag business-critical prefixes and rely on the data center routers to prefer the high-performance circuits for those tags.

Answer

Create separate virtual routing and forwarding instances per application on every branch device and map each VRF to a specific circuit.

Question 8

A financial services company is designing a Prisma SD-WAN deployment for its headquarters and 50 branch offices. The security team requires that all traffic from branches to the internet be inspected by a cloud-based security service without backhauling to headquarters. Which Prisma SD-WAN design element should you use to meet this requirement?

Accepted Answer

Local internet breakout at each branch with CloudBlades integration. Local internet breakout with CloudBlades integration allows branch traffic to be sent directly to the internet and then redirected to a cloud security service for inspection. This meets the security requirement without backhauling traffic to headquarters, reducing latency and WAN usage. It is the most efficient and scalable design for cloud-based security.

Answer

Full mesh VPN between all branches and headquarters

Answer

Centralized internet breakout at headquarters with policy-based routing

Answer

Dedicated MPLS circuits from each branch to a security data center

Question 9

A network administrator is configuring Prisma SD-WAN to integrate with Prisma Access using the Automated Service Connection. During the onboarding process, which specific parameter must be configured in the ION device's service route to ensure traffic is correctly steered to the Prisma Access Service Infrastructure?

Accepted Answer

The specific Service Connection object representing the Prisma Access tunnel. When integrating Prisma SD-WAN with Prisma Access via Automated Service Connection, the ION device's service route must reference the specific Service Connection object that represents the Prisma Access tunnel. This object tells the ION how to steer traffic into the Prisma Access service infrastructure.

Answer

The WAN interface MTU size exclusively

Answer

The BGP AS number of the remote Prisma Access node

Answer

The local controller's IP address

Question 10

Which command or interface action is used to verify the current status of the SD-WAN overlay tunnels?

Accepted Answer

Show tunnels view in the Controller. The 'Show tunnels' view in the SD-WAN Controller (Orchestrator) provides a real-time, centralized display of all overlay tunnel status, including up/down state, latency, jitter, and packet loss for each tunnel. This is the authoritative interface for verifying overlay tunnel health because the controller maintains the tunnel state database for all edges.

Answer

show routing table

Answer

show interface status

Answer

ping gateway

Question 11

A network engineer is deploying a new branch ION device at a site with dual WAN circuits: a primary 500 Mbps fiber link and a secondary 100 Mbps LTE link. The design requires that the LTE link only carry traffic when the fiber link fails, and that all traffic return to the fiber link automatically once it recovers. Which configuration should the engineer apply on the ION device?

Accepted Answer

Create a failover WAN bundle with the fiber interface as the primary and the LTE interface as the standby member.. The requirement describes an active/standby WAN design with automatic failback. A failover WAN bundle keeps the secondary member idle until the primary path is declared down, then shifts traffic and reverts when health returns. Load balancing, static routing with manipulated distance, or per-packet distribution all keep both links active or fail to provide monitored automatic failback.

Answer

Configure both WAN interfaces in a single load-balanced WAN bundle with per-flow hashing.

Answer

Enable per-packet load balancing on both WAN interfaces so traffic is distributed based on current utilization.

Answer

Configure a static route for 0.0.0.0/0 pointing to the LTE next-hop with a lower administrative distance than the fiber route.

Question 12

A network engineer is troubleshooting a Unified SASE deployment where branch users report that access to internal applications is slow after enabling Prisma Access inspection. The engineer confirms that internal traffic is being sent to Prisma Access instead of directly over the SD-WAN fabric. Which configuration change should the engineer make to resolve the issue?

Accepted Answer

Modify the application-based policy to send internal application prefixes over a direct SD-WAN path instead of the Service Connection.. The slowness is caused by internal traffic being backhauled to Prisma Access for inspection. The correct fix is to adjust the application-based policy so that internal application prefixes are matched and sent over a direct SD-WAN path, while internet-bound traffic continues to use the Service Connection. Bandwidth increases, disabling path selection, or static routes to Prisma Access do not correct the misrouting.

Answer

Increase the bandwidth of the ISP link used by the Service Connection to Prisma Access.

Answer

Disable Dynamic Path Selection on the Service Connection to force traffic over a single path.

Answer

Configure a static route on the ION device that points internal prefixes to the Prisma Access tunnel.

Question 13

An engineer notices that an ION device at a branch site shows a WAN interface status of 'up' in the Prisma SD-WAN orchestrator, but no traffic is being forwarded over that interface. The interface is configured for DHCP. Which troubleshooting step should be performed first to determine why the interface is not passing traffic?

Accepted Answer

Verify that the DHCP server is reachable and has provided a valid IP address, default gateway, and DNS servers.. When a WAN interface is up but not passing traffic, the most common cause is a failure to obtain a valid IP configuration via DHCP. Verifying the DHCP lease ensures the interface has an IP address, default gateway, and DNS servers, which are prerequisites for any traffic forwarding. Other options, like checking BGP or restarting, are either premature or irrelevant.

Answer

Review the application performance dashboard to see if any applications are experiencing latency.

Answer

Check the BGP neighbor state to ensure the peering session with the service provider is established.

Answer

Restart the ION device to force a renegotiation of the interface and DHCP lease.

Question 14

An engineer is troubleshooting a scenario where users at a branch office cannot access SaaS applications via Prisma Access. The SD-WAN path is active, but the traffic is not reaching the Cloud SWG. What is the most likely cause related to the Unified SASE policy?

Accepted Answer

The Security Policy rule for the branch traffic is set to 'Direct to Internet' instead of 'Service Connection'. In Prisma Access Unified SASE, the Security Policy rule determines whether branch traffic is sent to the Cloud SWG (Service Connection) or sent directly to the internet. If the rule is set to 'Direct to Internet', traffic bypasses the Cloud SWG entirely, so users cannot reach SaaS applications through the security service. The SD-WAN path being active only means the underlay is up; the policy action controls the security inspection path.

Answer

The ION device is missing the latest firmware

Answer

The Cloud Identity Engine is not reachable

Answer

The WAN port is set to DHCP

Question 15

Which types of traffic should ideally be prioritized via QoS policies? (Choose TWO)

Accepted Answer

Real-time video conferencing. Option A (real-time video conferencing) is correct because interactive video requires low latency, low jitter, and consistent bandwidth, so QoS should mark it with a high-priority class such as EF or AF41 to keep the call usable. Option B (Voice over IP) is correct because VoIP is highly delay-sensitive and typically uses small UDP packets with RTP; QoS should give it strict priority or a low-latency queue (often DSCP EF, 46) to prevent jitter and packet loss. Options C and D are not correct because background system backups and operating system updates are bulk, non-interactive traffic that can tolerate delay and should be placed in a lower-priority or scavenger class. Option E is not correct because social media browsing is generally non-critical, elastic traffic that does not warrant preferential QoS treatment over real-time communications.

Answer

Background system backups

Answer

Operating system updates

Answer

Social media browsing

Question 16

A network administrator is troubleshooting a site that is experiencing poor voice quality over the SD-WAN. The administrator suspects that the voice traffic is not being prioritized correctly. Which SD-WAN feature should be verified to ensure that voice packets are marked and queued appropriately across the WAN?

Accepted Answer

QoS policy. Voice quality depends on proper prioritization across the WAN, which is achieved through QoS policies. These policies classify voice traffic, mark it with appropriate DSCP values, and place it in priority queues. Verifying the QoS policy ensures that voice packets are treated with the necessary urgency to maintain low latency and jitter.

Answer

Application definitions

Answer

Security policy

Answer

Path selection policy

Question 17

Which THREE items are included in a Prisma SD-WAN 'Site' configuration?

Accepted Answer

Interface configuration. In Prisma SD-WAN, a Site object is the logical container that binds together the physical location and the devices deployed there, so Interface configuration (B) is correct because each site defines its WAN/LAN interfaces (e.g., IP addressing, WAN labels, and link settings) used by the SD-WAN devices at that location. Site location details (C) are also correct, since a Site stores geographic/address information (such as address, latitude/longitude, and timezone) that is used for topology mapping, policy, and path selection. Device assignment (D) is correct as well, because ION devices must be assigned to a Site so they inherit that site's interfaces, policies, and routing context. ISP contract end date (A) is a commercial/administrative detail not part of the Site configuration object, and user password history (E) is an authentication/security setting unrelated to SD-WAN site definition.

Answer

ISP contract end date

Answer

User password history

Question 18

A network engineer is troubleshooting why a branch ION device is not receiving any traffic from the data center. The engineer suspects that a firewall rule on the ION device is blocking traffic. Which log should the engineer check to see if traffic is being dropped by the firewall?

Accepted Answer

Firewall log. The Firewall log is the correct choice. It specifically logs traffic that matches firewall rules, including denies. By examining this log, the engineer can see if traffic from the data center is being dropped and which rule is responsible. This is a fundamental step in troubleshooting firewall-related connectivity issues.

Answer

Traffic log

Answer

Event log

Answer

System log

Question 19

When integrating Prisma SD-WAN with a cloud-based security service provider (CSSP) via CloudBlades, which setting must be verified to ensure proper traffic redirection?

Accepted Answer

Service-to-Tunnel Mapping. The service mapping in CloudBlades ensures that traffic classified for security inspection is steered to the correct CSSP node.

Answer

Local ISP DNS settings

Answer

DHCP Server scope

Answer

VLAN ID matching

Question 20

You are troubleshooting an SD-WAN environment where a branch site's vEdge reports that the BFD sessions to the remote data center are flapping every few minutes. The underlay transport is stable, and the WAN interface counters show no errors. You run 'show tunnel statistics' and observe periodic drops in the tunnel. Which action should you take FIRST to isolate the cause?

Accepted Answer

Run 'show bfd sessions' and 'show tunnel statistics' with timestamps to correlate drops with specific tunnel and path.. The first step in troubleshooting flapping BFD sessions is to gather data that correlates the flapping with specific tunnels and paths. Running 'show bfd sessions' alongside 'show tunnel statistics' with timestamps reveals which TLOC or transport is affected. This evidence-based approach avoids premature configuration changes and directs subsequent remediation to the actual faulty path.

Answer

Increase the BFD hello interval on the tunnel interface to reduce sensitivity to transient latency.

Answer

Apply a QoS policy to prioritize BFD packets on the WAN interface to prevent drops.

Answer

Disable BFD on the tunnel and rely on IPsec DPD to detect failures instead.