SD-WAN-Engineer Practice Test 21 — 15 Questions

Question 1

An operations team is investigating why a specific application flow between two branches is taking a suboptimal path through a hub site. They suspect the application-aware routing policy is not steering the flow as intended. Which vManage operational view should the engineer use to examine the per-flow path chosen by the SD-WAN fabric for this traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitor > Network > WAN Edge > Real Time > Flows. To confirm which path the SD-WAN fabric selected for a particular application flow, the engineer must look at the real-time flow information for the WAN edge. That view correlates flow tuples with the chosen TLOC or path, letting the engineer validate application-aware routing behavior. Control connections, interface counters, and BFD sessions describe other layers and cannot show the per-flow decision.

Answer

Monitor > Network > WAN Edge > Real Time > Interface

Answer

Monitor > Network > WAN Edge > Real Time > BFD Sessions

Answer

Monitor > Network > WAN Edge > Real Time > Control Connections

Question 2

A network engineer is configuring a new Prisma SD-WAN branch site. The branch has two WAN circuits from different providers. The engineer wants to ensure that if one circuit degrades in performance, traffic is automatically moved to the other circuit without manual intervention. Which feature should the engineer configure to achieve this?

Accepted Answer

Path quality monitoring with thresholds and failover actions.. Path quality monitoring is the Prisma SD-WAN feature that continuously evaluates latency, jitter, and packet loss on each WAN path. When thresholds are breached, the system can automatically fail over to a healthier path. This directly meets the requirement of automatic traffic movement upon performance degradation without manual intervention.

Answer

Static routes with administrative distance.

Answer

BGP with route reflectors.

Answer

Quality of Service (QoS) policies with priority queuing.

Question 3

How does a 'Failover' policy differ from a 'Load Balancing' policy in Prisma SD-WAN?

Accepted Answer

Failover uses only one link at a time. A Failover policy in Prisma SD-WAN uses one active path at a time and switches to a backup path only when the primary fails or degrades beyond thresholds. A Load Balancing policy distributes traffic across multiple paths simultaneously. The key differentiator is that failover is active/standby, not active/active.

Answer

Load balancing only works on LAN

Answer

Load balancing is not supported

Answer

Failover requires more bandwidth

Question 4

A network engineer is troubleshooting a site that is experiencing intermittent connectivity issues. The ION device shows the WAN interface flapping. Which two CLI commands should the engineer use to gather information about the interface flapping? (Choose two.)

Accepted Answer

show interface history. The commands 'show log messages' and 'show interface history' are the most effective for diagnosing interface flapping. The log messages provide detailed events with timestamps, while the interface history gives a concise record of state changes. Together, they allow the engineer to correlate flapping with potential causes such as link errors or physical issues.

Answer

show wan status

Answer

show interface <interface-name>

Answer

show system alarms

Question 5

A network administrator is preparing to bring a new branch online with Prisma SD-WAN. The branch has no IT staff, and the administrator wants the ION device to receive its full configuration automatically when it is powered on and connected to the internet. Which feature should the administrator use?

Accepted Answer

Zero-Touch Provisioning with a pre-staged device claim in the controller.. Zero-Touch Provisioning is designed for branches without IT staff. When the ION device powers on with internet connectivity, it contacts the controller, authenticates using its pre-staged claim, and downloads its configuration and policies. Manual console work, USB imports, and LAN DHCP do not provide this automated, centralized onboarding.

Answer

Importing a full configuration file from a USB drive during boot.

Answer

Enabling a DHCP server on the branch LAN to assign the ION device a management address.

Answer

Manual console configuration of the WAN interface and controller address.

Question 6

Which THREE factors influence the 'Path Selection' decision for traffic in a Unified SASE architecture?

Accepted Answer

User department or group. Option A is correct because Unified SASE path selection can be policy-driven by identity attributes such as user department or group, so traffic from different groups can be steered over different paths (for example, guest traffic to a direct internet breakout while finance traffic goes through a secure web gateway). Option B is correct because path selection continuously monitors application latency and jitter (often via probes such as HTTP ping or synthetic transactions) and chooses the WAN link or overlay path that best meets the application's SLA. Option E is correct because the required security inspection determines the path: traffic needing full inspection must be routed through the security service chain (SWG, CASB, FWaaS, ZTNA), while traffic that can bypass inspection may take a more direct path. Option C is not a factor because cable color is purely cosmetic and has no bearing on routing or path selection. Option D is not a factor because the count of users logged into a local ION device is not a path-selection criterion; decisions are based on policy, application performance, and security requirements rather than local session counts.

Answer

The physical color of the WAN cable

Answer

The number of users logged into the local ION device

Question 7

A financial services firm is designing Prisma SD-WAN for a data center that must advertise its internal subnets to the SD-WAN fabric. The design requires dynamic route exchange with the SD-WAN Controller and automatic propagation of learned routes to branch sites. Which routing approach should be specified on the data center CPE?

Accepted Answer

Configure BGP on the data center CPE to peer with the Prisma SD-WAN Controller and advertise internal prefixes. Prisma SD-WAN relies on BGP for dynamic route exchange between CPEs and the Controller. Peering BGP on the data center CPE and advertising the internal subnets allows the Controller to learn those prefixes and distribute them automatically to branch sites. This provides the dynamic, scalable route propagation the design requires without manual static route maintenance on every branch.

Answer

Configure static routes on every branch CPE pointing to the data center subnets

Answer

Configure OSPF on the LAN side of the data center CPE and redistribute into the SD-WAN fabric

Answer

Configure RIP version 2 on the data center CPE to advertise internal prefixes to the fabric

Question 8

A hospital network team is planning a Prisma SD-WAN rollout and needs to confirm which component is responsible for maintaining the authoritative configuration and distributing policy to all ION devices across 60 clinics. Which component performs this role?

Accepted Answer

The Prisma SD-WAN Controller (management plane). In Prisma SD-WAN the Controller is the management plane: it holds the authoritative configuration, generates policy, and distributes it to all ION devices. ION devices enforce that policy locally in the data plane. Distinguishing the management plane from the data plane is fundamental to planning a multi-site rollout, because it determines where configuration changes are made and how consistency is maintained across every clinic.

Answer

The Prisma SD-WAN CloudBlade framework

Answer

The branch next-generation firewall managed by the security team

Answer

The ION device at each clinic

Question 9

A network engineer is troubleshooting an SD-WAN overlay where a branch router's BFD sessions to two WAN transports keep flapping every few minutes. The engineer suspects the issue is related to the BFD hello interval and multiplier settings configured in the vManage feature template. Which CLI command on the branch router displays the current BFD session state and the negotiated transmit/receive intervals for each WAN transport?

Accepted Answer

show sdwan bfd sessions. BFD liveness detection in an SD-WAN overlay is configured through feature templates and negotiated per session. When sessions flap, the engineer must inspect the actual session state and the negotiated timers on the device. The command that lists BFD sessions along with their transmit/receive intervals and multiplier gives the precise data needed to compare against the intended template values and confirm whether a mismatch or transport issue is causing the flaps.

Answer

show ip route vrf 1

Answer

show sdwan omp routes

Answer

show sdwan control connections

Question 10

Which factors should be considered when designing the placement of a regional hub in a Prisma SD-WAN architecture? (Choose TWO)

Accepted Answer

Latency to branch locations. Option B (Latency to branch locations) is correct because a regional hub in Prisma SD-WAN aggregates branch traffic and forwards it to the data center or internet, so the hub must be placed to keep round-trip latency to its branches low enough to meet application SLAs and to allow the hub to serve as an efficient traffic-steering and policy-enforcement point. Option D (Proximity to central data center resources) is correct because branch traffic typically traverses the hub toward centralized applications and services, so physical or network proximity to the data center reduces WAN transit latency and backhaul distance for that traffic. Option A (The ISP's billing cycle) is irrelevant, since billing periods have no bearing on topology or performance design. Option C (The color of the hardware) is irrelevant, as hardware color has no impact on network design. Option E (The number of local users) is not a primary hub-placement factor, because Prisma SD-WAN sizing is driven by aggregate branch traffic and tunnel/bandwidth requirements rather than the count of users at a single site.

Answer

The ISP's billing cycle

Answer

The color of the hardware

Answer

The number of local users

Question 11

A network engineer is preparing to deploy a new branch ION device that will use a single LTE circuit as its only WAN connection. The design requires that the device not consume the metered data plan during initial software staging, and that it validate its configuration against the controller before carrying production traffic. Which deployment approach best meets these requirements?

Accepted Answer

Stage the device on a wired staging network first, then ship it to the branch for LTE activation.. Staging a device on a wired network before branch activation lets software downloads and configuration validation occur without touching the metered LTE plan. Once the device is staged and confirmed against the controller, it can be relocated and brought online on the LTE circuit. This preserves the data plan while still validating the deployment before production traffic flows.

Answer

Deploy the device with a temporary wired circuit and leave it permanently for management traffic.

Answer

Activate the device directly on the LTE circuit and let it download all software over the metered link.

Answer

Configure the device offline with a local configuration file and skip controller validation entirely.

Question 12

Which are valid methods to connect a branch to the SD-WAN fabric? (Choose TWO)

Accepted Answer

Virtual Gateway (vGateway). Option C, Virtual Gateway (vGateway), is correct because a vGateway is a software-based SD-WAN endpoint that can be deployed as a VM in a branch, cloud, or data center to terminate the SD-WAN fabric and participate in the overlay. Option D, Hardware Appliance (CPE), is correct because a physical SD-WAN CPE device at the branch provides the required WAN edge functionality, encryption, and overlay participation to join the SD-WAN fabric. Option A, a simple hub, is not a valid SD-WAN branch connection method because a hub is a topology role, not a connection mechanism, and it lacks the SD-WAN edge capabilities needed to join the fabric. Option B, a standard home router without SD-WAN software, cannot join the SD-WAN fabric because it lacks the required SD-WAN overlay protocols, certificates, and tunnel termination. Option E, a physical bridge only, is incorrect because a Layer 2 bridge does not provide the SD-WAN edge functions, routing, or secure overlay membership required to connect a branch to the fabric.

Answer

A simple hub

Answer

A standard home router without SD-WAN software

Answer

A physical bridge only

Question 13

A security architect is designing a Unified SASE deployment where branch users must access both SaaS applications and internal data center resources. The requirement is that SaaS traffic be inspected by Prisma Access while internal traffic goes directly over the SD-WAN fabric without backhauling to the cloud. Which Prisma SD-WAN feature should be used to enforce this traffic separation?

Accepted Answer

Application-based policy with a service connection for internet-bound traffic and a direct path for internal prefixes.. Application-based policy in Prisma SD-WAN lets the administrator define which traffic goes to Prisma Access for inspection and which stays on the SD-WAN fabric. By steering internet-bound SaaS flows through the Service Connection and sending internal prefixes directly, the design satisfies both security inspection and no-backhaul goals. A default route or reversed policy would either backhaul internal traffic or leave SaaS uninspected.

Answer

A Cloud SWG explicit proxy configuration for SaaS traffic and a direct internet breakout for internal applications.

Answer

A single default route from the branch to Prisma Access for all traffic, including internal applications.

Answer

Policy-based forwarding that sends all RFC 1918 traffic to Prisma Access and all public traffic directly to the internet.

Question 14

A network engineer is configuring a Cisco SD-WAN solution with two vSmart controllers in a high-availability pair. The engineer wants to ensure that if one vSmart controller fails, the WAN Edge devices automatically switch to the other controller without manual intervention. Which mechanism should the engineer verify is properly configured?

Accepted Answer

WAN Edge devices are configured with both vSmart controller IP addresses in their control connection list.. Cisco SD-WAN high availability for vSmart controllers is achieved by deploying multiple controllers and ensuring WAN Edge devices have their addresses. The WAN Edge learns the vSmart list from vBond and establishes control connections to all of them. If one vSmart fails, the WAN Edge continues using the remaining connections, providing seamless failover without manual intervention or reliance on external load balancers.

Answer

vSmart controllers are placed behind a load balancer that distributes traffic evenly.

Answer

vSmart controllers are configured with the same system IP address.

Answer

The vManage server is configured to automatically restart a failed vSmart controller.

Question 15

Which TWO benefits does an automated Service Connection provide over a manual tunnel configuration?

Accepted Answer

Reduced manual configuration steps and lower risk of error. Option D is correct because an automated Service Connection provisions the tunnel end-to-end through orchestration, eliminating the repetitive CLI/GUI entry of peer IPs, pre-shared keys, and encryption domains that manual tunnel configuration requires, which directly lowers the chance of typos and misconfigured parameters. Option E is correct because automation handles the dynamic exchange of tunnel parameters (such as IKE/IPsec proposals, keys, and endpoint addresses) and continuously runs health monitoring (for example DPD or BFD-style liveness checks) so the tunnel can be re-established without operator intervention. Options A, B, and C are not benefits of an automated Service Connection: firewall policies are still required to permit the underlying traffic, the connection remains a logical overlay tunnel rather than a physical link to the datacenter, and an SD-WAN controller is typically the component that enables this automation rather than being made unnecessary by it.

Answer

It replaces the need for firewall policies

Answer

It provides a physical connection to the datacenter

Answer

It removes the need for an SD-WAN controller