SD-WAN-Engineer Practice Exam 2 — 20 Questions

Question 1

A healthcare organization is planning a Prisma SD-WAN design for its clinics. The design must ensure that each clinic can reach the internet directly for guest traffic while also reaching internal applications through the SD-WAN fabric. Which two design elements should be included in the site configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A local internet breakout on the clinic CPE for guest traffic. Meeting both requirements means giving the clinic two distinct paths: a local internet breakout for guest traffic so it exits directly to the internet, and a service link to the data center so internal applications are reached over the SD-WAN fabric. Together these elements let the design separate guest internet access from internal application access without backhauling guest traffic.

Answer

A BGP peer between the clinic CPE and the guest Wi-Fi controller

Answer

A NAT pool on the data center CPE for all clinic guest traffic

Answer

A static route on the clinic CPE pointing all traffic to the data center gateway

Question 2

Which TWO of these are valid ways to verify the status of an ION device's WAN interface?

Accepted Answer

Check the Interface dashboard in the orchestrator. Option A is correct because the orchestrator's Interface dashboard provides a centralized, real-time view of each ION device's WAN interface status, including link state, IP addressing, and operational health. Option C is correct because running 'show interface' via the CLI on the ION device directly displays the WAN interface's administrative and operational status, counters, and errors. Option B is incorrect because BIOS logs record hardware POST and boot events, not WAN interface state. Option D is incorrect because pinging the device from the internet only tests reachability and does not confirm the WAN interface's status. Option E is incorrect because DNS logs relate to name resolution queries, not WAN interface status.

Answer

Review the BIOS logs

Answer

Ping the device from the internet

Answer

Check the DNS logs

Question 3

A site deployment requires specific traffic to be exempted from the SD-WAN optimization process to ensure compatibility with a legacy application. Which policy should be updated?

Accepted Answer

Application Policy. Application Policy rules allow you to specify traffic types that should bypass optimization.

Answer

NAT Policy

Answer

Security Policy

Answer

Interface Policy

Question 4

Which TWO items are checked by the ION device to determine if a WAN path is healthy?

Accepted Answer

Packet loss. The ION device evaluates WAN path health using performance metrics that directly reflect the quality of the link, and packet loss (option A) is one of them because dropped packets indicate congestion, errors, or a degraded path that affects application delivery. Latency (option C) is also checked because round-trip delay directly impacts WAN performance and is a core metric in path health monitoring and SLA verification. Device temperature (option B) is a hardware/environmental status, not a WAN path metric, so it is not used to judge path health. User authentication status (option D) relates to access control and identity, not link quality, and local disk space (option E) is a local storage resource that has no bearing on whether a WAN path is healthy.

Answer

Device temperature

Answer

User authentication status

Answer

Local disk space

Question 5

You are designing a hub-and-spoke topology where spokes need to communicate directly under specific conditions. Which feature should be enabled to optimize latency and minimize load on the regional hub?

Accepted Answer

Dynamic Mesh. Dynamic Mesh in an SD-WAN hub-and-spoke design allows spoke-to-spoke traffic to be forwarded directly between branch sites when policy permits, rather than hairpinning through the regional hub. This reduces latency (no extra hop through the hub) and offloads the hub's forwarding and encryption resources. It is the standard feature for optimizing east-west branch traffic while preserving the hub for centralized policy and internet breakout.

Answer

Hub-to-Hub Transit

Answer

BGP Route Reflector

Answer

Global VPN Overlay

Question 6

A network administrator is investigating why application traffic from a branch site is being routed over the less-preferred MPLS transport instead of the local broadband circuit, even though the application-aware routing policy is configured to prefer broadband for that application. The administrator has already verified that the application is correctly identified and that both TLOCs are up. Which vManage monitoring view should the administrator check first to see the per-application path selection decisions and the reason a particular path was chosen?

Accepted Answer

Monitor > Applications > App Route. Application-aware routing decisions are made per flow based on the configured SLA classes and path preferences. To understand why a specific application took a particular path, the administrator needs visibility into the policy evaluation. The App Route monitoring view provides that per-application breakdown, showing the matched policy, the chosen path, and the alternative paths with their SLA metrics, which directly answers the question.

Answer

Monitor > Devices > WAN Edge

Answer

Monitor > Network > Topology

Answer

Monitor > Network > Interfaces

Question 7

An engineer is analyzing an application-aware routing policy on a Cisco SD-WAN fabric. The policy is configured to steer business-critical traffic based on the best path according to BFD probes. After a recent change, the engineer notices that traffic is being forwarded over a path that has a higher latency than an alternative path, even though the BFD probes indicate the alternative path is better. The engineer verifies that the BFD sessions are up and the policy is applied to the correct VPN. What is the most likely cause of this behavior?

Accepted Answer

The application-aware routing policy is using the wrong SLA class.. The correct answer is that the application-aware routing policy is using the wrong SLA class. The SLA class defines the thresholds for latency, jitter, and loss that determine which path is considered best. If the SLA class is misconfigured, the policy may select a path that meets the (incorrect) criteria but is not the optimal path. The engineer should review the SLA class settings and ensure they match the intended performance requirements.

Answer

The BFD probes are using the wrong color.

Answer

The OMP route for the better path is not being advertised.

Answer

The BFD sessions are flapping, causing path instability.

Question 8

When deploying a new ION device, which Prisma SD-WAN component is primarily used to initiate the zero-touch provisioning process?

Accepted Answer

Controller. The ION device reaches out to the Controller during the initial bootstrap process to pull its configuration and firmware.

Answer

Prisma Access

Answer

CloudBlades

Answer

Prisma SD-WAN Plugin

Question 9

An administrator is deploying Prisma SD-WAN with Unified SASE. The administrator needs to ensure that the ION device can establish a service connection to Prisma Access. Which of the following must be configured on the ION device to allow the service connection to be established?

Accepted Answer

A service connection with the Prisma Access tenant information and a public IP address or NAT traversal.. The essential configuration on the ION device for a service connection is the Prisma Access tenant information and ensuring the device can reach Prisma Access, which requires a public IP or NAT traversal. These elements enable the IPsec tunnel to be established. Other items like static routes or firewall rules are either not required or are configured on other devices. Therefore, the correct answer is the one that includes tenant information and reachability.

Answer

A static route to the Prisma Access service IP and a DNS server for name resolution.

Answer

A firewall rule allowing IPsec traffic and a NAT policy for outbound traffic.

Answer

An IKEv2 pre-shared key and a certificate for authentication.

Question 10

A network engineer is troubleshooting a Prisma SD-WAN deployment where a new ION device at a remote site fails to establish any data plane tunnels to other sites. The engineer has verified that the control connection to the controller is up and the device is showing as 'Connected' in the orchestrator. Which step should the engineer take next to diagnose the data plane tunnel issue?

Accepted Answer

Verify that the device's WAN interfaces have the correct IP addresses and are not behind a NAT that blocks IPsec.. Data plane tunnels in Prisma SD-WAN are IPsec-based. Even if the control connection is up, IPsec tunnels can fail to establish due to NAT devices that do not properly handle IPsec traffic or due to incorrect WAN interface configurations. Verifying these elements is a direct way to diagnose the issue.

Answer

Restart the ION device to force re-establishment of tunnels.

Answer

Check the device's local routing table for a default route.

Answer

Review the controller's logs for errors related to the device.

Question 11

Which protocol is primarily used for the tunnel between the ION device and the Prisma Access Service Infrastructure?

Accepted Answer

IPSec. IPSec is the standard protocol for creating secure tunnels between SD-WAN devices and cloud service infrastructure.

Answer

SSL

Answer

GRE

Answer

MPLS

Question 12

An engineer needs to view real-time application-aware routing statistics for a specific site in vManage. Which menu path should the engineer use?

Accepted Answer

Monitor > Network > App Route. To view real-time application-aware routing statistics in vManage, navigate to Monitor > Network > App Route. This view displays the metrics used by AAR, such as latency, loss, and jitter per application and path, allowing engineers to confirm path selection and troubleshoot routing decisions.

Answer

Monitor > Network > WAN Clarity

Answer

Monitor > Network > Real Time

Answer

Monitor > Network > Applications

Question 13

A network architect is reviewing the SD-WAN fabric's high availability design. The architect wants to ensure that if a vSmart controller becomes unavailable, the WAN Edge routers continue to forward traffic without interruption. Which statement accurately describes the behavior of WAN Edge routers when a vSmart controller fails in a multi-controller deployment?

Accepted Answer

WAN Edge routers continue to forward traffic using existing OMP routes and locally cached policies, and they attempt to reconnect to a surviving vSmart controller.. In a multi-controller vSmart deployment, WAN Edge routers establish control connections to multiple vSmart controllers for redundancy. If one vSmart fails, the routers retain their cached OMP routes and policies and continue forwarding traffic without interruption. They simultaneously attempt to reconnect to a surviving vSmart controller to maintain control plane updates. This design ensures high availability and uninterrupted data plane operation.

Answer

WAN Edge routers immediately drop all data plane traffic until they reconnect to a surviving vSmart controller.

Answer

WAN Edge routers stop advertising their TLOCs to other sites until a vSmart controller is reachable again.

Answer

WAN Edge routers revert to a default route and forward all traffic to the vBond orchestrator until a vSmart controller is available.

Question 14

A customer requires a granular segmentation strategy where HR, Engineering, and Guest traffic must remain isolated across the SD-WAN fabric. Which configuration construct provides this logical separation?

Accepted Answer

Virtual Networks (VNets). Virtual Networks (VNets) allow for the logical segmentation of traffic throughout the fabric.

Answer

IPsec Tunnel Groups

Answer

Subnet Masking

Answer

VLAN Tagging

Question 15

You notice an ION device is showing as 'Disconnected' in the Controller UI. What is the first step you should take?

Accepted Answer

Check physical interface status and WAN connectivity. Verifying WAN connectivity and local interface status is the logical first step in troubleshooting connectivity.

Answer

Upgrade the device firmware

Answer

Reboot the ION device

Answer

Delete and recreate the site

Question 16

Which THREE components are verified during the ION device 'check' sequence at startup?

Accepted Answer

Link status. The ION device 'check' sequence at startup validates the operational readiness of the device's own resources and its management connectivity. Option C (Link status) is correct because the device verifies that its WAN/LAN interfaces have physical link up before proceeding. Option D (Configuration integrity) is correct because the startup check confirms the stored configuration is valid and not corrupted so the device can apply it. Option E (Controller reachability) is correct because the ION device must confirm it can reach its management controller/orchestrator to register and receive policy. Options A (Cloud application popularity) and B (User browser history) are not part of the device startup check sequence; these are traffic/analytics data unrelated to local device health and management readiness.

Answer

Cloud application popularity

Answer

User browser history

Question 17

A network engineer is deploying a new branch ION device at a site with two WAN links and wants to guarantee that business-critical voice traffic always uses the lowest-latency path, even when one link degrades. Which Prisma SD-WAN configuration should be applied to the branch ION device to meet this requirement?

Accepted Answer

Create a policy set with a path selection policy that uses the lowest-latency path for voice traffic and a failover action to the secondary link.. A path selection policy with lowest-latency criteria and a failover action is the correct approach because it continuously monitors WAN link performance and dynamically routes voice traffic over the best available path, with automatic failover if the primary link degrades. This ensures the required low-latency treatment without manual intervention.

Answer

Configure a static route for the voice subnet pointing to the primary WAN interface.

Answer

Enable Forward Error Correction on both WAN interfaces to reduce latency for voice traffic.

Answer

Set up a QoS policy that prioritizes voice traffic in the queue on the primary WAN link.

Question 18

A network administrator is troubleshooting a Prisma SD-WAN environment where an ION device is experiencing intermittent packet loss on a business-critical application. The administrator suspects that the issue is related to a policy misconfiguration. Which two actions should the administrator take to verify that the correct policies are being applied to the traffic? (Choose two.)

Accepted Answer

Use the Flow Analytics dashboard to examine the path and policy applied to the specific application flow.. To verify that the correct application policies are applied, the administrator should review the policy stack order to ensure no shadowing occurs and use Flow Analytics to inspect the actual policy and path for the specific flow. These actions directly confirm whether the intended policy is enforced, which is crucial for troubleshooting intermittent packet loss caused by policy misconfiguration.

Answer

Check the ION device's system logs for policy deny messages.

Answer

Verify that the ION device has the latest software version installed.

Answer

Run a traceroute from the ION device to the application server to identify the path taken.

Question 19

A network operations center (NOC) engineer is monitoring a Prisma SD-WAN deployment and notices that one ION device at a remote site is consistently showing high latency on its broadband link, while the LTE link is performing well. The engineer wants to quickly identify whether the high latency is due to an ISP issue or a device problem. Which of the following should the engineer check first?

Accepted Answer

The Prisma SD-WAN Controller's path quality metrics for the broadband link.. The Prisma SD-WAN Controller continuously monitors path quality for each WAN link, providing latency, jitter, and loss metrics. By comparing the controller's measurements with the device's local observations, the engineer can quickly ascertain whether the high latency is consistent across the path (indicating an ISP issue) or isolated to the device (suggesting a local problem). This is the most efficient first step.

Answer

The ION device's CPU utilization and memory usage.

Answer

The ION device's interface statistics for errors and discards.

Answer

The broadband ISP's public status page for outages.

Question 20

A network engineer is deploying a new branch office with a single Prisma SD-WAN ION device. The branch has two WAN links: a primary fiber circuit and a backup LTE connection. The engineer wants the ION device to automatically establish secure tunnels to the Prisma SD-WAN controller and to the nearest data center without manual intervention. Which deployment method should the engineer use?

Accepted Answer

Zero-Touch Provisioning (ZTP) with a claim code. Zero-Touch Provisioning (ZTP) with a claim code enables the ION device to automatically register with the Prisma SD-WAN controller, retrieve its configuration, and establish secure tunnels to data centers and other branches. This method eliminates manual configuration and is the standard for branch deployments.

Answer

Configuring a DHCP option 43 on the branch router to point to the controller

Answer

Manual CLI configuration of IPsec tunnels and controller IP addresses

Answer

Pre-staging the device by copying a configuration file to a USB drive and booting the device