SD-WAN-Engineer Practice Test 23 — 15 Questions

Question 1

A network engineer is troubleshooting a Unified SASE deployment where a branch ION device has established a control connection to Prisma Access, but application traffic from the branch is not being inspected by Prisma Access security services. The engineer confirms that the ION device is online and the service connection is active. Which configuration element should the engineer verify to ensure that traffic is steered to Prisma Access for inspection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The service connection configuration on the ION device that maps traffic to Prisma Access.. In a Unified SASE architecture, branch traffic is steered to Prisma Access through service connections configured on the ION device. Even if the control connection is up, the service connection must be properly configured with the correct traffic selectors to direct application traffic to Prisma Access. Without this, traffic will bypass security inspection. Verifying the service connection configuration is essential to ensure that traffic is correctly forwarded for inspection.

Answer

The Cloud Identity Engine (CIE) integration that provides user identity information to Prisma Access.

Answer

The Prisma Access security policy rule that defines which applications require inspection.

Answer

The ION device's routing table to ensure that default routes point to the internet.

Question 2

A network engineer is troubleshooting a Unified SASE deployment where a branch ION device has established a control connection to Prisma Access, but application traffic from the branch is not being inspected by Prisma Access security services. The engineer confirms that the ION device is online and the service connection is active. Which configuration element should the engineer verify to ensure that traffic is steered to Prisma Access for inspection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inspect the Prisma SD-WAN application definition and the associated traffic steering policy.. Traffic steering in Unified SASE is application-aware. The engineer should first verify that the application is properly defined and that the steering policy is correctly applied. This ensures that the specific SaaS traffic is identified and directed to Prisma Access for inspection, addressing the intermittent failure.

Answer

Check the Prisma SD-WAN policy configuration for the application's IP address and port.

Answer

Examine the branch ION device's routing table for a default route to Prisma Access.

Answer

Review the Prisma Access service connection status to ensure it is up.

Question 3

A network operations team is using Cisco vManage to monitor the health of their SD-WAN fabric. They want to create a custom dashboard that provides a quick overview of the most critical operational metrics for daily health checks. Which three widgets should they include to effectively monitor the overall health and performance of the SD-WAN fabric? (Choose three.)

Accepted Answer

Control Plane Health. The Control Plane Health, Application Awareness, and WAN Edge Health widgets together provide a comprehensive view of the SD-WAN fabric's operational status. Control Plane Health ensures that routing and policies are functioning, Application Awareness verifies that critical applications meet performance SLAs, and WAN Edge Health monitors device resource utilization and connectivity. These three cover the essential layers: control, application, and device.

Answer

Alarm Summary

Answer

BFD Session Status

Question 4

A healthcare organization is designing a Prisma SD-WAN deployment for 25 clinics. Each clinic will have two broadband circuits and a single ION device. The security team requires that all internet-bound traffic from the clinics be inspected by a cloud-delivered security service, and that traffic be automatically rerouted if the primary circuit degrades. Which design element should the engineer include to meet these requirements?

Accepted Answer

Configure a service link to a CloudBlade for security inspection and enable path quality monitoring with forwarding rules.. The requirement for cloud-delivered security inspection is met by a service link to a CloudBlade, which sends traffic to the cloud security service. Automatic rerouting when the primary circuit degrades requires path quality monitoring and forwarding rules that act on those metrics. Together, these elements provide both security and resiliency without extra hardware or backhauling.

Answer

Create a static route to the data center and advertise it via BGP to force all internet traffic through the hub.

Answer

Enable application-based traffic steering without a service link, relying on the ION device's built-in firewall.

Answer

Deploy a second ION device at each clinic and configure VRRP for high availability.

Question 5

A financial institution is designing a Prisma SD-WAN deployment across 40 branches and two data centers. The design must ensure that branch-to-branch traffic takes the most efficient path and that the network can automatically recover from a data center failure. Which two design elements should be included? (Choose two.)

Accepted Answer

Enable dynamic branch-to-branch tunnels using Prisma SD-WAN's autonomous mesh capability.. Efficient branch-to-branch traffic is achieved through Prisma SD-WAN's autonomous mesh, which dynamically creates direct tunnels between branches. Automatic recovery from a data center failure requires redundant ION devices configured for high availability at each data center. Together, these elements provide both optimal path selection and resilience.

Answer

Use static routes to direct all branch-to-branch traffic through the primary data center.

Answer

Configure BGP on all branch ION devices to advertise branch subnets to each other.

Answer

Configure a full mesh of IPsec tunnels between all branch ION devices.

Question 6

A network engineer is troubleshooting a Unified SASE deployment where a branch ION device has established a control connection to Prisma Access, but application traffic from the branch is not being inspected by Prisma Access security services. The engineer confirms that the ION device is online and the service connection is active. Which configuration element should the engineer verify to ensure that traffic is steered to Prisma Access for inspection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device's serial number is correctly entered in the Prisma SD-WAN portal and associated with the correct site.. The correct answer is that the device's serial number must be correctly entered and associated with a site. In Prisma SD-WAN, an ION device only receives configuration after it is claimed in the portal and assigned to a site. The control connection being up indicates basic connectivity and authentication are working, so the next logical step is to verify the device's registration and assignment.

Answer

The device's NTP settings are misconfigured, causing a time drift.

Answer

The device's WAN interface is configured with the correct IP address and default gateway.

Answer

The device's firewall is blocking outbound TCP port 443 to the controller.

Question 7

A network engineer is deploying Prisma SD-WAN with Unified SASE and wants to ensure that branch traffic destined for the internet is inspected by Prisma Access. The engineer has already configured the service connection on the ION device. Which additional configuration is required on the ION device to direct internet-bound traffic to Prisma Access?

Accepted Answer

Create a policy rule that matches internet-bound traffic and sets the action to forward to the service connection.. To steer internet-bound traffic to Prisma Access, a policy rule must be configured on the ION device that matches the desired traffic and specifies the action to forward it via the service connection. The service connection itself only defines the tunnel; the policy rule determines which traffic uses it. Without this rule, traffic will follow the default path and bypass Prisma Access, leaving it uninspected.

Answer

Configure a static route on the ION device pointing to Prisma Access for all internet traffic.

Answer

Set the ION device's default gateway to the Prisma Access service IP.

Answer

Enable the 'Secure Internet Gateway' option in the ION device's WAN interface settings.

Question 8

A network administrator is troubleshooting a performance issue where voice traffic is being routed over a less optimal path despite a better path being available. The administrator has verified that the application-aware routing policy is correctly configured to prefer the lower-latency path for voice traffic. Which action should the administrator take next to identify the cause?

Accepted Answer

Inspect the application-aware routing policy statistics to see which path is being selected and why.. Inspecting the application-aware routing policy statistics is the correct next step because it provides visibility into the policy's decision-making process. The statistics show which path is selected, the SLA class that was matched, and any fallback actions. This information is crucial to determine why the better path is not being chosen, such as a misconfigured SLA class, traffic not matching the policy, or a path not meeting the SLA criteria due to temporary fluctuations.

Answer

Restart the BFD sessions on the WAN Edge devices.

Answer

Check the BFD session status for the better path.

Answer

Verify the OMP route for the better path is present in the routing table.

Question 9

A security architect is designing a Unified SASE solution with Prisma SD-WAN and Prisma Access. The company requires that all traffic from branch ION devices to the internet be inspected by Prisma Access, but they also want to optimize performance for Microsoft 365 traffic by using local internet breakout. Which Prisma SD-WAN feature should the architect use to achieve this?

Accepted Answer

Policy-based forwarding with application-based rules. Policy-based forwarding enables granular control, allowing specific applications like Microsoft 365 to use local internet breakout while all other traffic is steered to Prisma Access for inspection. This balances security and performance, meeting both requirements.

Answer

Application SLA profiles with path quality thresholds

Answer

Service connection with BGP route filtering

Answer

CloudBlade for Microsoft 365 with automatic optimization

Question 10

A network engineer is configuring a Unified SASE deployment with Prisma SD-WAN and Prisma Access. The engineer needs to ensure that user traffic from branch offices is securely forwarded to Prisma Access for inspection. Which TWO components are required to establish this secure forwarding? (Choose two.)

Accepted Answer

Service connection between the ION device and Prisma Access. To forward traffic to Prisma Access, a service connection must be established to carry the traffic, and a traffic steering policy must be configured to select which traffic is sent. These two components work together to ensure secure forwarding for inspection.

Answer

Application SLA profile to monitor path quality

Answer

Cloud Identity Engine for user authentication

Answer

BGP peering between the ION device and Prisma Access

Question 11

A network administrator is troubleshooting a Prisma SD-WAN environment where a branch ION device is configured with two WAN interfaces: one primary and one secondary. The administrator notices that all traffic is being sent over the secondary WAN interface even though the primary interface is up and has better path quality. Which of the following is the most likely cause?

Accepted Answer

A policy is configured that forces traffic over the secondary WAN interface, overriding the default path selection.. The correct answer is that a policy is forcing traffic over the secondary WAN interface. In Prisma SD-WAN, policies are evaluated before default path selection, so a policy can override quality-based decisions. The administrator should check for any policy that might be directing traffic to the secondary interface, such as a business policy or a path preference rule.

Answer

The primary WAN interface is configured with a higher cost than the secondary interface in the WAN interface settings.

Answer

The primary WAN interface is experiencing a high level of packet loss that is not reflected in the path quality metrics.

Answer

The primary WAN interface is configured as a 'standby' interface, so it is only used when the secondary fails.

Question 12

A network administrator is troubleshooting a Prisma SD-WAN environment and needs to view the current status of all WAN interfaces on a specific ION device. Which section of the Prisma SD-WAN portal should the administrator navigate to?

Accepted Answer

Monitor > Devices > [Select Device] > Interfaces. The correct location is Monitor > Devices > [Select Device] > Interfaces. This section provides real-time operational status of all interfaces on the selected ION device, including WAN interfaces. The Monitor section is specifically designed for viewing current and historical data, making it the right choice for troubleshooting interface status.

Answer

Manage > Devices > [Select Device] > Interfaces

Answer

Monitor > Sites > [Select Site] > Topology

Answer

Manage > Sites > [Select Site] > WAN Interfaces

Question 13

A healthcare organization is designing a Prisma SD-WAN deployment for 80 clinics. Each clinic has two broadband circuits from different ISPs. The design must ensure that if one circuit fails, all traffic automatically reroutes to the other circuit without manual intervention, and that the SD-WAN fabric continuously monitors both paths. Which Prisma SD-WAN feature should be included in the design to meet these requirements?

Accepted Answer

Path quality monitoring with automatic failover. Path quality monitoring with automatic failover is the correct feature because it continuously assesses each WAN link's health and automatically redirects traffic when a circuit fails or degrades. This ensures uninterrupted connectivity for all clinics without manual intervention, meeting the design's requirement for resilient dual-broadband connectivity in a Prisma SD-WAN fabric.

Answer

BGP with bidirectional forwarding detection (BFD)

Answer

Policy-based path selection using application SLAs

Answer

Static routing with floating static routes

Question 14

A company is designing a Prisma SD-WAN deployment for its data center and 100 branches. The design team needs to ensure that the data center can provide high availability and that branch traffic is securely encrypted. Which two design elements should be included to meet these requirements? (Choose two.)

Accepted Answer

Use dual Prisma SD-WAN devices at the data center in a high-availability pair. Using dual Prisma SD-WAN devices at the data center in a high-availability pair ensures redundancy and failover, while configuring IPsec VPN tunnels from each branch to the data center ensures that all branch traffic is encrypted. Together, these elements meet the requirements for data center high availability and secure branch connectivity.

Answer

Deploy redundant Prisma SD-WAN controllers in the data center

Answer

Implement dynamic routing with OSPF between branches and the data center

Answer

Enable split tunneling at branches to reduce data center load

Question 15

An engineer is configuring a Prisma SD-WAN ION device at a branch with two WAN interfaces: one for internet and one for MPLS. The engineer wants to ensure that the ION uses the MPLS link for traffic to the data center and the internet link for cloud applications. What should the engineer configure?

Accepted Answer

Create a policy with a matching condition for data center prefixes and set the action to use the MPLS link.. Prisma SD-WAN uses policies to steer traffic based on application or destination. A policy with a match condition for data center prefixes and an action to use the MPLS link ensures that only that traffic takes the MPLS path. This provides granular control and leverages the SD-WAN's monitoring capabilities.

Answer

Enable BGP on the MPLS interface and advertise the data center prefixes.

Answer

Set the MPLS interface as the primary WAN and the internet interface as backup in the device settings.

Answer

Configure static routes on the ION for the data center prefixes pointing to the MPLS next-hop.