SD-WAN-Engineer Practice Test 22 — 15 Questions

Question 1

A security administrator is troubleshooting a Unified SASE deployment where branch users cannot access a cloud-based CRM application. The traffic is being steered to Prisma Access for inspection, but users report timeouts. The administrator checks the ION device and sees that the service connection to Prisma Access is up, and the CRM application is allowed in the security policy. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The return traffic from the CRM application is not being routed back through the same Prisma Access location, causing asymmetric routing.. The most likely cause is asymmetric routing of return traffic. In a Unified SASE architecture, traffic steered to Prisma Access must have its return traffic follow the same path to ensure stateful inspection. If the CRM application's return traffic takes a different route, the session may be dropped. This is a common pitfall when integrating cloud security services with SD-WAN. The administrator should verify that return traffic is also directed through Prisma Access, possibly by ensuring that the CRM's IP addresses are advertised or routed appropriately.

Answer

The ION device's service connection is using an outdated encryption algorithm that Prisma Access no longer supports.

Answer

The ION device's policy for the CRM application is incorrectly matching and sending traffic to the direct internet path instead of the service connection.

Answer

The Prisma Access security policy is blocking the CRM application due to a misconfigured rule or application signature.

Question 2

An SD-WAN engineer is configuring syslog and SNMP traps for proactive monitoring of WAN Edge devices. The engineer wants to ensure that critical events such as control connection failures and BFD session flaps are reported to the central monitoring server. Which two actions must be performed on the WAN Edge devices to achieve this? (Choose two.)

Accepted Answer

Enable SNMP traps for the relevant OIDs and configure the SNMP trap receiver.. To proactively monitor critical events like control connection failures and BFD flaps on WAN Edge devices, the engineer must configure both syslog and SNMP traps. Syslog sends event messages to a central server, while SNMP traps push asynchronous alerts for specific OIDs. Together, they provide comprehensive event visibility. NetFlow, vManage log forwarding, and BFD echo mode do not deliver the required device-level event notifications.

Answer

Enable BFD echo mode on all tunnels to generate additional syslog messages.

Answer

Configure NetFlow export to the monitoring server for all interfaces.

Answer

Set up a syslog server on the vManage controller and forward all logs from vManage.

Question 3

A network engineer needs to monitor the health of an SD-WAN fabric and wants to receive alerts when any WAN Edge device loses its connection to the vSmart controller for more than five minutes. Which vManage feature should the engineer use to configure this alert?

Accepted Answer

vManage Administration > Alarms > Alarm Notifications. vManage Administration > Alarms > Alarm Notifications is the feature used to configure alarm rules and notification methods for events such as control connection loss. The engineer can set a threshold (e.g., five minutes) and choose how to be notified. Other views are for monitoring status, defining policies, or auditing changes, and none provide proactive alerting based on connection loss duration.

Answer

vManage Configuration > Policies > Centralized Policy

Answer

vManage Monitor > Logs > Audit Logs

Answer

vManage Monitor > Network > Control Connections

Question 4

A design team is planning a Prisma SD-WAN deployment for a manufacturing company with 25 factories. Each factory has industrial control systems that must remain isolated from corporate IT traffic, and the company wants to avoid extending Layer 2 across the WAN. Which two design elements should be included in the plan? (Choose two.)

Accepted Answer

Use policy sets that permit only required industrial protocols between zones.. The design must isolate industrial control systems from corporate IT without extending Layer 2. Defining separate zones on the branch ION and using policy sets that permit only required industrial protocols between zones achieves this segmentation at Layer 3/L4. Layer 2 VPNs, flat subnets, and dedicated firewalls either violate the no-Layer-2 requirement or add unnecessary complexity.

Answer

Configure a Layer 2 VPN to stretch the industrial VLAN across all factories.

Answer

Deploy a dedicated physical firewall at each factory to segment traffic.

Answer

Enable a single flat subnet for all factory devices to simplify routing.

Question 5

You are designing a Prisma SD-WAN solution for a multinational enterprise with sites in North America, Europe, and Asia. The company wants to ensure that real-time voice traffic is prioritized over bulk data transfers across the SD-WAN fabric. Which two design elements should you include to achieve this? (Choose two.)

Accepted Answer

Configure QoS policies that mark voice traffic with high priority and queue it accordingly. To prioritize voice over bulk data, you need both application SLA profiles to monitor and select paths that meet voice quality requirements, and QoS policies to mark and queue voice traffic with high priority. These elements work together to ensure low latency and jitter for real-time traffic across the SD-WAN fabric.

Answer

Enable equal-cost multipath (ECMP) routing for all traffic

Answer

Use a single WAN link per site to simplify path selection

Answer

Apply rate limiting to all traffic to prevent congestion

Question 6

In a Unified SASE deployment, what is the significance of the ION device serial number?

Accepted Answer

It is used for device onboarding and policy assignment. The serial number is the unique identifier used to register the device to the controller and associate it with the SASE tenant.

Answer

It is required for user authentication

Answer

It determines the tunnel MTU

Answer

It is needed for local WAN port configuration

Question 7

A help desk technician reports that users at a remote site are experiencing slow access to a SaaS application. The SD-WAN engineer wants to quickly verify whether the issue is due to high latency on the WAN transport or due to packet loss. Which vManage monitoring dashboard provides a real-time view of latency, jitter, and packet loss per tunnel and per application?

Accepted Answer

Monitor > Network > Tunnel. To quickly determine whether slow SaaS access is due to WAN transport latency or packet loss, the engineer needs a view that displays per-tunnel performance metrics in real time. The Tunnel monitoring view in vManage provides exactly that, showing latency, jitter, loss, and throughput for each tunnel. This allows immediate comparison across transports and confirms whether the issue is transport-related.

Answer

Monitor > Network > WAN Clarity

Answer

Monitor > Applications > App Route

Answer

Monitor > Devices > WAN Edge

Question 8

A branch router shows its OMP peerings to the vSmart controllers as up, but routes learned from other sites are not appearing in its routing table, and the overlay has stopped forwarding between sites. The engineer suspects the data plane rather than the control plane. Which check best isolates whether the issue is a data-plane tunnel problem rather than an OMP or routing-policy problem?

Accepted Answer

Verify the BFD session state and the data-plane tunnel status to each remote TLOC, confirming whether encrypted tunnels are established independently of the OMP session.. OMP is the control-plane protocol that advertises routes, while BFD and the encrypted tunnels carry the data plane. When OMP peerings are healthy but inter-site forwarding fails, checking BFD and data-plane tunnel state to remote TLOCs isolates whether the fault is in tunnel establishment rather than route advertisement or policy. Timers, policy order, and identity values address different layers.

Answer

Recheck the OMP session timers and the administrative distance of the OMP routes on the device to confirm route preference.

Answer

Compare the device's system IP and site ID against the values configured in the vManage device template for the branch.

Answer

Inspect the applied centralized route policy in vManage and confirm the sequence order of the route manipulation entries.

Question 9

A retail customer needs to prioritize POS (Point of Sale) traffic over guest WiFi. Which policy type governs this bandwidth allocation?

Accepted Answer

QoS Policy. QoS Policy is the correct answer because QoS (Quality of Service) policies are specifically designed to classify, mark, and prioritize traffic based on application, user, or source/destination criteria, ensuring POS traffic receives preferential bandwidth treatment over guest WiFi. In SD-WAN environments, QoS policies map traffic to forwarding classes and apply scheduling, shaping, and queuing to guarantee latency-sensitive POS transactions get priority. Security, Route, and Access policies do not control bandwidth allocation or prioritization.

Answer

Security Policy

Answer

Route Policy

Answer

Access Policy

Question 10

You are monitoring traffic in a Unified SASE environment. You notice that traffic from a branch is taking a non-optimal path to Prisma Access. Which tool would you use to verify the path selection logic?

Accepted Answer

The flow diagnostic tool on the SD-WAN controller. The flow diagnostic tool on the SD-WAN controller provides visibility into the path selection decisions.

Answer

The WAN interface stats

Answer

The ION device ping tool

Answer

The Prisma Access logs

Question 11

Which THREE settings are typically defined during the initial ION site provisioning?

Accepted Answer

WAN interface settings. During initial ION site provisioning, the WAN interface settings (A) must be defined so the device can establish its uplink connectivity to the provider or internet, including IP addressing, VLAN, and link parameters. The site name (C) is also required at provisioning time because it identifies the location within the management/controller hierarchy and is used for configuration and reporting. Service interface assignments (E) are configured during provisioning to map LAN ports or VLANs to the services (e.g., internet, MPLS, VPN) that the site will use. Annual maintenance schedule (B) is an administrative/operational task handled later, not part of initial provisioning, and global DNS server settings (D) are typically inherited from a template or profile rather than defined per-site during initial provisioning.

Answer

Annual maintenance schedule

Answer

Global DNS server settings

Question 12

Which TWO components are essential for maintaining the SD-WAN control plane?

Accepted Answer

Controller. Option A (Controller) is correct because the SD-WAN control plane is logically centralized in one or more controllers that maintain the network topology, distribute routing/policy information, and manage the overlay fabric, so no control plane can function without them. Option E (Secure communication channel, e.g., TLS) is correct because control-plane elements such as controllers and edge devices must exchange sensitive routing, policy, and key material over an authenticated, encrypted channel like TLS (or DTLS) to prevent tampering and eavesdropping. Option B (Physical cable length) is incorrect because it is a Layer 1/2 physical consideration that does not participate in the SD-WAN control plane. Option C (Local switch ports) is incorrect because access switch ports are data-forwarding interfaces, not control-plane components. Option D (CloudBlades API key) is incorrect because an API key is a vendor-specific management/authentication credential, not an essential control-plane component of SD-WAN.

Answer

Physical cable length

Answer

Local switch ports

Answer

CloudBlades API key

Question 13

Which THREE methods can be used to troubleshoot application identification issues?

Accepted Answer

Perform a Packet Capture. Option A (Perform a Packet Capture) is correct because capturing traffic lets you inspect the actual packets on the wire, including ports, payload patterns, and TLS SNI or HTTP Host headers, which is essential for determining why an application is not being identified correctly by the engine. Option B (Review application signatures in the orchestrator) is correct because application identification relies on signature definitions; if the signature is missing, outdated, or misconfigured in the orchestrator, the app will not be recognized, so verifying the signature set is a valid troubleshooting step. Option E (Check the Flow Monitor) is correct because flow monitoring shows how traffic is being classified per flow, including the application ID assigned, bytes, and session details, which directly reveals whether identification succeeded or failed. Option C (Check the BGP table) is not relevant because BGP is a routing protocol and does not affect application identification logic. Option D (Reboot the router) is not a targeted troubleshooting method and does not address the root cause of application identification issues.

Answer

Check the BGP table

Answer

Reboot the router

Question 14

A network engineer is configuring a Prisma SD-WAN ION device at a branch that has a single WAN link with a public IP address. The branch also has a local subnet of 192.168.10.0/24. The engineer wants to ensure that all traffic from the local subnet to the internet is translated to the WAN IP address. Which type of NAT should be configured?

Accepted Answer

Source NAT (SNAT) with a translation to the WAN interface IP. Source NAT (SNAT) translates the private source IP addresses of the local subnet to the public WAN IP, enabling outbound internet access. This is the correct choice for hiding internal addresses behind a single public IP, as required in the scenario.

Answer

Static NAT with a one-to-one mapping between each local host and the WAN IP

Answer

Port Address Translation (PAT) using a pool of public IP addresses

Answer

Destination NAT (DNAT) with a translation to the WAN interface IP

Question 15

A network engineer is troubleshooting a Prisma SD-WAN environment where a branch ION device is not forming a control-plane connection to the controller. The engineer has verified that the underlay WAN interface is up and can ping the internet. Which step should the engineer take next to diagnose the control-plane issue?

Accepted Answer

Check the ION device's controller connectivity status and verify that outbound TCP port 443 to the controller is allowed.. The control-plane connection between an ION device and the Prisma SD-WAN controller relies on outbound TCP port 443. When the underlay is up but the control plane is down, the most likely causes are a firewall blocking the port or a routing issue to the controller. Verifying connectivity to the controller on that port is the correct next diagnostic step.

Answer

Confirm that the ION device has a valid license and that the license is not expired.

Answer

Restart the ION device to force it to re-establish the control-plane connection.

Answer

Verify that the branch LAN interface is configured with the correct VLAN and that DHCP is operational.