SD-WAN-Engineer Practice Exam 3 — 20 Questions

Question 1

An engineer is deploying a new branch ION device that will connect to two different ISPs. The design requires that return traffic from the data center follows the same WAN path that the outbound session used, so that stateful inspection appliances in the data center see both directions of every flow. Which configuration on the branch ION device satisfies this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable path affinity so that return traffic uses the same WAN path as the originating flow.. Symmetric flow handling requires that both directions of a session traverse the same WAN path. Path affinity binds a flow to its chosen path so return traffic is not redirected to a different ISP link. This preserves stateful inspection in the data center and avoids broken sessions caused by asymmetric routing across the two ISP connections.

Answer

Configure policy-based forwarding with a unique path for each application.

Answer

Enable Forward Error Correction on both WAN interfaces.

Answer

Enable IPsec tunnel bonding across both WAN interfaces.

Question 2

A network engineer is deploying a new branch location with a Prisma SD-WAN ION device. The branch has two WAN circuits: a primary fiber link and a backup LTE link. The engineer wants the ION device to automatically use the LTE link only when the fiber link fails. Which configuration should be applied to achieve this behavior?

Accepted Answer

Create a path selection policy that sets the fiber link as primary and the LTE link as backup, with failover triggered by link health.. Prisma SD-WAN uses path selection policies to define primary and backup WAN links based on health and performance. By configuring the fiber link as primary and LTE as backup with health-based failover, the branch will use LTE only when the fiber link fails. This ensures efficient use of the primary circuit and automatic redundancy.

Answer

Configure a static route for the LTE interface with a higher administrative distance than the fiber interface.

Answer

Configure a policy that sets the LTE interface as the preferred egress for all traffic, with the fiber interface as secondary.

Answer

Enable per-packet load balancing across both WAN interfaces to distribute traffic evenly.

Question 3

A network engineer is investigating a performance issue in a Prisma SD-WAN environment where an ION device is showing high jitter on a business-critical VoIP call. The engineer has verified that the WAN link quality is good and that no policies are misconfigured. The engineer suspects that the issue might be due to the ION device's handling of the traffic. Which of the following should the engineer check next to determine if the ION device is correctly marking and prioritizing the VoIP traffic?

Accepted Answer

The ION device's QoS configuration, specifically the mapping of VoIP traffic to the correct queue.. High jitter on VoIP traffic, despite good WAN link quality, often points to QoS misconfiguration. The ION device's QoS settings determine how VoIP packets are classified, marked, and queued. If they are not placed in a low-latency queue, jitter can occur. Therefore, checking the QoS configuration is the most direct next step to ensure proper prioritization.

Answer

The ION device's CPU utilization to see if it is overloaded.

Answer

The ION device's interface statistics for errors and discards on the VoIP VLAN.

Answer

The ION device's routing table to ensure the VoIP traffic is taking the correct path.

Question 4

A multinational company is deploying Prisma SD-WAN at a branch that has a single MPLS circuit and a broadband internet link. The security team requires that all traffic destined to the corporate data center must traverse the MPLS circuit, while internet-bound traffic should use the broadband link. However, if the MPLS circuit fails, data center traffic should fail over to the broadband link with IPsec encryption. Which configuration achieves this requirement?

Accepted Answer

Create a path selection policy that matches data center traffic and sets MPLS as primary and broadband as backup with IPsec enabled for the backup path.. A path selection policy in Prisma SD-WAN can match traffic destined to the data center, set MPLS as the primary path, and broadband as the backup with IPsec encryption. This provides dynamic failover based on link health, ensuring data center traffic uses MPLS normally and securely switches to broadband only when MPLS fails.

Answer

Set up a QoS policy that marks data center traffic as high priority and forces it over the MPLS link, with a backup policy for broadband.

Answer

Enable per-packet load balancing across both MPLS and broadband links for data center traffic, with IPsec on the broadband link.

Answer

Configure a static route for the data center subnet pointing to the MPLS interface, and a floating static route with a higher metric pointing to the broadband interface with IPsec.

Question 5

An engineer is configuring a Prisma SD-WAN ION device at a branch. The branch has a single WAN link with a public IP address. The internal LAN uses private IP addresses. The engineer needs to allow internal users to access the internet while hiding their private IP addresses. Which configuration is required?

Accepted Answer

Configure a source NAT policy that translates the private LAN IP addresses to the public WAN IP address for internet-bound traffic.. Source NAT translates private LAN IP addresses to the public WAN IP address for outbound internet traffic. This allows internal users to access the internet while hiding their private addresses, and ensures return traffic is correctly routed back through the NAT device.

Answer

Enable dynamic routing between the LAN and WAN interfaces to allow private IP addresses to be routed to the internet.

Answer

Configure a destination NAT policy that translates the public WAN IP address to an internal server IP for inbound traffic.

Answer

Create a static route for the default gateway pointing to the WAN interface, and enable proxy ARP on the LAN interface.

Question 6

A network administrator is configuring a new ION device at a branch. The administrator wants the device to obtain its IP address, default gateway, and DNS server automatically from the local ISP's DHCP server on the WAN interface. Which WAN interface configuration mode should be selected?

Accepted Answer

DHCP Client. To automatically receive WAN addressing from the ISP, the ION device must operate as a DHCP client on that interface. DHCP Client mode requests an IP address, gateway, and DNS settings from the service provider's DHCP server, requiring no manual entry. Static IP, PPPoE, and DHCP Server modes do not provide this automatic client behavior.

Answer

DHCP Server

Answer

Static IP

Answer

PPPoE

Question 7

You have a DCI configuration where two data centers are connected via a dedicated link. You want to ensure the DCI link is only used if the primary WAN transport fails. How do you achieve this?

Accepted Answer

Configure a lower TLOC preference on the DCI link routes.. OMP TLOC preference can be used to steer traffic to specific paths based on preference values.

Answer

Disable OMP on the primary link.

Answer

Set the OMP cost to zero.

Answer

Use a static route with a high administrative distance.

Question 8

Which TWO features are included in the vManage 'Monitor' menu?

Accepted Answer

Device health and status.. The Monitor menu is the central hub for observing the SD-WAN fabric performance.

Answer

User management.

Answer

Policy configuration.

Answer

Software image repository.

Question 9

You are debugging a routing loop. Which tool can you use to see the BGP route advertisements received by an ION device?

Accepted Answer

Route Monitoring. The BGP neighbor status and route tables in the device monitoring show learned routes.

Answer

Path Quality

Answer

Flow Summary

Answer

Interface Stats

Question 10

A network engineer is deploying a new branch office with a Prisma SD-WAN ION device. The security team requires that all internet-bound traffic from the branch be inspected by Prisma Access Cloud SWG, while traffic to internal SaaS applications should use direct internet breakouts. The engineer must configure the ION to steer traffic appropriately. Which action should the engineer take to meet these requirements?

Accepted Answer

Configure application-based policy rules to direct SaaS traffic to a local breakout and all other internet traffic to the Service Connection.. The requirement is to inspect general internet traffic with Cloud SWG while allowing direct SaaS breakouts. Application-based policy rules on the ION device can identify SaaS applications and steer them to a local breakout, while all other internet traffic is sent to the Service Connection for inspection. This provides the necessary granularity and meets both security and performance goals.

Answer

Enable 'Cloud Security' on the ION device and set the default route to the Service Connection.

Answer

Set up a static route for each SaaS application's IP range pointing to the local internet circuit and a default route to the Service Connection.

Answer

Create a policy rule that matches all traffic and set the action to 'Service Connection' for the Cloud SWG.

Question 11

A security administrator is troubleshooting a Unified SASE deployment where branch users cannot access a critical internal application hosted in an on-premises data center. The application is reachable from other sites, but branch traffic destined to the application's IP is being routed to Prisma Access instead of the data center. The ION device has a Service Connection configured to Prisma Access and a VPN connection to the data center. What is the most likely cause of this issue?

Accepted Answer

The ION device's routing table has a more specific route to the application via the Service Connection than via the VPN connection.. The ION device selects routes based on longest prefix match. If the Service Connection advertises a more specific route to the application's IP than the VPN connection, the ION will forward that traffic to Prisma Access. This misrouting prevents branch users from reaching the internal application. The administrator should verify the advertised routes from both connections and adjust route preferences or filters to ensure internal traffic uses the VPN.

Answer

The VPN connection to the data center is using a different encryption domain than the branch.

Answer

The Service Connection is down, causing all traffic to be dropped.

Answer

The application's IP is included in the local breakout policy, sending it directly to the internet.

Question 12

What are the primary benefits of implementing a hub-and-spoke design with Prisma SD-WAN? (Choose THREE)

Accepted Answer

Simplified management and visibility. Option C is correct because a Prisma SD-WAN hub-and-spoke topology lets administrators manage all branch sites from a central controller (the Prisma SD-WAN portal) and gain unified visibility into WAN health, application performance, and link status across every spoke. Option D is correct because branch traffic destined for other branches or the internet is groomed through the hub, allowing the hub to aggregate, prioritize, and forward flows efficiently rather than maintaining full-mesh tunnels between every site. Option E is correct because the hub acts as a central chokepoint where security policy (e.g., zone-based firewall, IPS, URL filtering) can be consistently enforced for all spoke traffic before it reaches the data center or internet. Option A is not correct because Prisma SD-WAN still requires branch CPE (ION devices or virtual IONs), so deployments are not hardware-less. Option B is not correct because no SD-WAN architecture provides infinite bandwidth at the branch; bandwidth remains bounded by the physical links and licensed throughput.

Answer

Hardware-less branch deployments

Answer

Infinite bandwidth at the branch

Question 13

A site has two ISPs. Traffic is only using one. What is the best way to verify if both paths are available?

Accepted Answer

Check Path Quality dashboard. The Path Quality dashboard displays the health status of all defined paths.

Answer

Ping from the LAN

Answer

Review firewall rules

Answer

Check the BGP summary

Question 14

A network architect is designing a Prisma SD-WAN deployment for a company with 50 branches. Each branch has two internet links from different ISPs. The architect wants to ensure that business-critical applications always use the best-performing link based on real-time latency, jitter, and packet loss. Additionally, the architect wants to avoid using a link that is experiencing high packet loss. Which Prisma SD-WAN feature should be configured to meet these requirements?

Accepted Answer

Application-based path selection policies with health thresholds for latency, jitter, and packet loss.. Application-based path selection policies with health thresholds allow Prisma SD-WAN to monitor real-time latency, jitter, and packet loss on each WAN link. The system then steers business-critical applications to the best-performing link and avoids links that exceed the configured thresholds, ensuring optimal application performance.

Answer

Load balancing across both ISP links using per-flow distribution.

Answer

QoS policies with strict priority queues for business-critical applications.

Answer

Static routes with administrative distance to prefer one ISP over the other.

Question 15

Where do you view the history of configuration changes pushed to an ION device?

Accepted Answer

Audit Logs. The audit log records all configuration modifications and administrative actions.

Answer

Error Reports

Answer

Event Viewer

Answer

System Logs

Question 16

Which dashboard is most useful for identifying top bandwidth consumers in the network?

Accepted Answer

Application/Flow Monitoring. The App/Flow dashboard identifies top applications and users by bandwidth.

Answer

Path Quality

Answer

System Health

Answer

Security Events

Question 17

A network administrator is deploying a new branch with a Prisma SD-WAN ION device and wants to leverage Unified SASE for security inspection. The administrator has already configured the Service Connection to Prisma Access. Which additional step is required to ensure that traffic from the branch is inspected by Prisma Access?

Accepted Answer

Create a policy on the ION device that directs traffic to the Service Connection.. After establishing the Service Connection, the ION device must have a policy that directs specific traffic to that connection. This policy ensures that traffic is encapsulated and sent to Prisma Access for inspection. Without it, traffic will use the default internet path and bypass security inspection.

Answer

Assign a security zone to the branch ION device in Prisma Access.

Answer

Configure a security policy in Prisma Access that allows traffic from the branch.

Answer

Enable 'Unified SASE' in the Prisma SD-WAN portal for the branch site.

Question 18

In the context of the SD-WAN Controller, what does the 'Template' object represent?

Accepted Answer

A reusable configuration baseline. A template is a reusable configuration set applied to multiple gateways to ensure consistency.

Answer

A single device configuration file

Answer

A firmware update package

Answer

A hardware specification sheet

Question 19

A network engineer is deploying a new branch with two ION devices for high availability. The engineer wants both devices to share a single virtual IP address on the LAN side so that hosts use a consistent default gateway even if one device fails. Which LAN-side configuration should be implemented?

Accepted Answer

Configure VRRP on the LAN interfaces of both ION devices.. To provide a redundant default gateway for LAN hosts, the ION devices must share a virtual IP address. VRRP is the standard protocol for this, allowing one device to act as master and another as backup. DHCP Relay, BGP, and duplicate static IPs do not achieve gateway redundancy and would either not provide a virtual IP or cause conflicts.

Answer

Create a BGP peering session between the two ION devices.

Answer

Assign both ION devices the same static IP address on their LAN interfaces.

Answer

Enable DHCP Relay on both ION devices.

Question 20

What is the function of the 'Reachability' check in the ION device configuration?

Accepted Answer

To verify ISP link status. It tests if the path is actually capable of reaching the destination, confirming path health.

Answer

To update firmware

Answer

To backup configuration

Answer

To check CPU load