SD-WAN-Engineer Practice Test 2 — 25 Questions

Question 1

A network administrator is investigating why application traffic from a branch site is being routed over the less-preferred MPLS transport instead of the local broadband circuit, even though the application-aware routing policy is configured to prefer broadband for that application. The administrator has already verified that the application is correctly identified and that both TLOCs are up. Which vManage monitoring view should the administrator check first to see the per-application path selection decisions and the reason a particular path was chosen?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitor > Applications > App Route. Application-aware routing decisions are made per flow based on the configured SLA classes and path preferences. To understand why a specific application took a particular path, the administrator needs visibility into the policy evaluation. The App Route monitoring view provides that per-application breakdown, showing the matched policy, the chosen path, and the alternative paths with their SLA metrics, which directly answers the question.

Answer

Monitor > Devices > WAN Edge

Answer

Monitor > Network > Topology

Answer

Monitor > Network > Interfaces

Question 2

An engineer is analyzing an application-aware routing policy on a Cisco SD-WAN fabric. The policy is configured to steer business-critical traffic based on the best path according to BFD probes. After a recent change, the engineer notices that traffic is being forwarded over a path that has a higher latency than an alternative path, even though the BFD probes indicate the alternative path is better. The engineer verifies that the BFD sessions are up and the policy is applied to the correct VPN. What is the most likely cause of this behavior?

Accepted Answer

The application-aware routing policy is using the wrong SLA class.. The correct answer is that the application-aware routing policy is using the wrong SLA class. The SLA class defines the thresholds for latency, jitter, and loss that determine which path is considered best. If the SLA class is misconfigured, the policy may select a path that meets the (incorrect) criteria but is not the optimal path. The engineer should review the SLA class settings and ensure they match the intended performance requirements.

Answer

The BFD probes are using the wrong color.

Answer

The OMP route for the better path is not being advertised.

Answer

The BFD sessions are flapping, causing path instability.

Question 3

When deploying a new ION device, which Prisma SD-WAN component is primarily used to initiate the zero-touch provisioning process?

Accepted Answer

Controller. The ION device reaches out to the Controller during the initial bootstrap process to pull its configuration and firmware.

Answer

Prisma Access

Answer

CloudBlades

Answer

Prisma SD-WAN Plugin

Question 4

An administrator is deploying Prisma SD-WAN with Unified SASE. The administrator needs to ensure that the ION device can establish a service connection to Prisma Access. Which of the following must be configured on the ION device to allow the service connection to be established?

Accepted Answer

A service connection with the Prisma Access tenant information and a public IP address or NAT traversal.. The essential configuration on the ION device for a service connection is the Prisma Access tenant information and ensuring the device can reach Prisma Access, which requires a public IP or NAT traversal. These elements enable the IPsec tunnel to be established. Other items like static routes or firewall rules are either not required or are configured on other devices. Therefore, the correct answer is the one that includes tenant information and reachability.

Answer

A static route to the Prisma Access service IP and a DNS server for name resolution.

Answer

A firewall rule allowing IPsec traffic and a NAT policy for outbound traffic.

Answer

An IKEv2 pre-shared key and a certificate for authentication.

Question 5

A network engineer is troubleshooting a Prisma SD-WAN deployment where a new ION device at a remote site fails to establish any data plane tunnels to other sites. The engineer has verified that the control connection to the controller is up and the device is showing as 'Connected' in the orchestrator. Which step should the engineer take next to diagnose the data plane tunnel issue?

Accepted Answer

Verify that the device's WAN interfaces have the correct IP addresses and are not behind a NAT that blocks IPsec.. Data plane tunnels in Prisma SD-WAN are IPsec-based. Even if the control connection is up, IPsec tunnels can fail to establish due to NAT devices that do not properly handle IPsec traffic or due to incorrect WAN interface configurations. Verifying these elements is a direct way to diagnose the issue.

Answer

Restart the ION device to force re-establishment of tunnels.

Answer

Check the device's local routing table for a default route.

Answer

Review the controller's logs for errors related to the device.

Question 6

Which protocol is primarily used for the tunnel between the ION device and the Prisma Access Service Infrastructure?

Accepted Answer

IPSec. IPSec is the standard protocol for creating secure tunnels between SD-WAN devices and cloud service infrastructure.

Answer

SSL

Answer

GRE

Answer

MPLS

Question 7

An engineer needs to view real-time application-aware routing statistics for a specific site in vManage. Which menu path should the engineer use?

Accepted Answer

Monitor > Network > App Route. To view real-time application-aware routing statistics in vManage, navigate to Monitor > Network > App Route. This view displays the metrics used by AAR, such as latency, loss, and jitter per application and path, allowing engineers to confirm path selection and troubleshoot routing decisions.

Answer

Monitor > Network > WAN Clarity

Answer

Monitor > Network > Real Time

Answer

Monitor > Network > Applications

Question 8

A network architect is reviewing the SD-WAN fabric's high availability design. The architect wants to ensure that if a vSmart controller becomes unavailable, the WAN Edge routers continue to forward traffic without interruption. Which statement accurately describes the behavior of WAN Edge routers when a vSmart controller fails in a multi-controller deployment?

Accepted Answer

WAN Edge routers continue to forward traffic using existing OMP routes and locally cached policies, and they attempt to reconnect to a surviving vSmart controller.. In a multi-controller vSmart deployment, WAN Edge routers establish control connections to multiple vSmart controllers for redundancy. If one vSmart fails, the routers retain their cached OMP routes and policies and continue forwarding traffic without interruption. They simultaneously attempt to reconnect to a surviving vSmart controller to maintain control plane updates. This design ensures high availability and uninterrupted data plane operation.

Answer

WAN Edge routers immediately drop all data plane traffic until they reconnect to a surviving vSmart controller.

Answer

WAN Edge routers stop advertising their TLOCs to other sites until a vSmart controller is reachable again.

Answer

WAN Edge routers revert to a default route and forward all traffic to the vBond orchestrator until a vSmart controller is available.

Question 9

A customer requires a granular segmentation strategy where HR, Engineering, and Guest traffic must remain isolated across the SD-WAN fabric. Which configuration construct provides this logical separation?

Accepted Answer

Virtual Networks (VNets). Virtual Networks (VNets) allow for the logical segmentation of traffic throughout the fabric.

Answer

IPsec Tunnel Groups

Answer

Subnet Masking

Answer

VLAN Tagging

Question 10

You notice an ION device is showing as 'Disconnected' in the Controller UI. What is the first step you should take?

Accepted Answer

Check physical interface status and WAN connectivity. Verifying WAN connectivity and local interface status is the logical first step in troubleshooting connectivity.

Answer

Upgrade the device firmware

Answer

Reboot the ION device

Answer

Delete and recreate the site

Question 11

Which THREE components are verified during the ION device 'check' sequence at startup?

Accepted Answer

Link status. The ION device 'check' sequence at startup validates the operational readiness of the device's own resources and its management connectivity. Option C (Link status) is correct because the device verifies that its WAN/LAN interfaces have physical link up before proceeding. Option D (Configuration integrity) is correct because the startup check confirms the stored configuration is valid and not corrupted so the device can apply it. Option E (Controller reachability) is correct because the ION device must confirm it can reach its management controller/orchestrator to register and receive policy. Options A (Cloud application popularity) and B (User browser history) are not part of the device startup check sequence; these are traffic/analytics data unrelated to local device health and management readiness.

Answer

Cloud application popularity

Answer

User browser history

Question 12

A network engineer is deploying a new branch ION device at a site with two WAN links and wants to guarantee that business-critical voice traffic always uses the lowest-latency path, even when one link degrades. Which Prisma SD-WAN configuration should be applied to the branch ION device to meet this requirement?

Accepted Answer

Create a policy set with a path selection policy that uses the lowest-latency path for voice traffic and a failover action to the secondary link.. A path selection policy with lowest-latency criteria and a failover action is the correct approach because it continuously monitors WAN link performance and dynamically routes voice traffic over the best available path, with automatic failover if the primary link degrades. This ensures the required low-latency treatment without manual intervention.

Answer

Configure a static route for the voice subnet pointing to the primary WAN interface.

Answer

Enable Forward Error Correction on both WAN interfaces to reduce latency for voice traffic.

Answer

Set up a QoS policy that prioritizes voice traffic in the queue on the primary WAN link.

Question 13

A network administrator is troubleshooting a Prisma SD-WAN environment where an ION device is experiencing intermittent packet loss on a business-critical application. The administrator suspects that the issue is related to a policy misconfiguration. Which two actions should the administrator take to verify that the correct policies are being applied to the traffic? (Choose two.)

Accepted Answer

Use the Flow Analytics dashboard to examine the path and policy applied to the specific application flow.. To verify that the correct application policies are applied, the administrator should review the policy stack order to ensure no shadowing occurs and use Flow Analytics to inspect the actual policy and path for the specific flow. These actions directly confirm whether the intended policy is enforced, which is crucial for troubleshooting intermittent packet loss caused by policy misconfiguration.

Answer

Check the ION device's system logs for policy deny messages.

Answer

Verify that the ION device has the latest software version installed.

Answer

Run a traceroute from the ION device to the application server to identify the path taken.

Question 14

A network operations center (NOC) engineer is monitoring a Prisma SD-WAN deployment and notices that one ION device at a remote site is consistently showing high latency on its broadband link, while the LTE link is performing well. The engineer wants to quickly identify whether the high latency is due to an ISP issue or a device problem. Which of the following should the engineer check first?

Accepted Answer

The Prisma SD-WAN Controller's path quality metrics for the broadband link.. The Prisma SD-WAN Controller continuously monitors path quality for each WAN link, providing latency, jitter, and loss metrics. By comparing the controller's measurements with the device's local observations, the engineer can quickly ascertain whether the high latency is consistent across the path (indicating an ISP issue) or isolated to the device (suggesting a local problem). This is the most efficient first step.

Answer

The ION device's CPU utilization and memory usage.

Answer

The ION device's interface statistics for errors and discards.

Answer

The broadband ISP's public status page for outages.

Question 15

A network engineer is deploying a new branch office with a single Prisma SD-WAN ION device. The branch has two WAN links: a primary fiber circuit and a backup LTE connection. The engineer wants the ION device to automatically establish secure tunnels to the Prisma SD-WAN controller and to the nearest data center without manual intervention. Which deployment method should the engineer use?

Accepted Answer

Zero-Touch Provisioning (ZTP) with a claim code. Zero-Touch Provisioning (ZTP) with a claim code enables the ION device to automatically register with the Prisma SD-WAN controller, retrieve its configuration, and establish secure tunnels to data centers and other branches. This method eliminates manual configuration and is the standard for branch deployments.

Answer

Configuring a DHCP option 43 on the branch router to point to the controller

Answer

Manual CLI configuration of IPsec tunnels and controller IP addresses

Answer

Pre-staging the device by copying a configuration file to a USB drive and booting the device

Question 16

An engineer is deploying a new branch ION device that will connect to two different ISPs. The design requires that return traffic from the data center follows the same WAN path that the outbound session used, so that stateful inspection appliances in the data center see both directions of every flow. Which configuration on the branch ION device satisfies this requirement?

Accepted Answer

Enable path affinity so that return traffic uses the same WAN path as the originating flow.. Symmetric flow handling requires that both directions of a session traverse the same WAN path. Path affinity binds a flow to its chosen path so return traffic is not redirected to a different ISP link. This preserves stateful inspection in the data center and avoids broken sessions caused by asymmetric routing across the two ISP connections.

Answer

Configure policy-based forwarding with a unique path for each application.

Answer

Enable Forward Error Correction on both WAN interfaces.

Answer

Enable IPsec tunnel bonding across both WAN interfaces.

Question 17

A network engineer is deploying a new branch location with a Prisma SD-WAN ION device. The branch has two WAN circuits: a primary fiber link and a backup LTE link. The engineer wants the ION device to automatically use the LTE link only when the fiber link fails. Which configuration should be applied to achieve this behavior?

Accepted Answer

Create a path selection policy that sets the fiber link as primary and the LTE link as backup, with failover triggered by link health.. Prisma SD-WAN uses path selection policies to define primary and backup WAN links based on health and performance. By configuring the fiber link as primary and LTE as backup with health-based failover, the branch will use LTE only when the fiber link fails. This ensures efficient use of the primary circuit and automatic redundancy.

Answer

Configure a static route for the LTE interface with a higher administrative distance than the fiber interface.

Answer

Configure a policy that sets the LTE interface as the preferred egress for all traffic, with the fiber interface as secondary.

Answer

Enable per-packet load balancing across both WAN interfaces to distribute traffic evenly.

Question 18

A network engineer is investigating a performance issue in a Prisma SD-WAN environment where an ION device is showing high jitter on a business-critical VoIP call. The engineer has verified that the WAN link quality is good and that no policies are misconfigured. The engineer suspects that the issue might be due to the ION device's handling of the traffic. Which of the following should the engineer check next to determine if the ION device is correctly marking and prioritizing the VoIP traffic?

Accepted Answer

The ION device's QoS configuration, specifically the mapping of VoIP traffic to the correct queue.. High jitter on VoIP traffic, despite good WAN link quality, often points to QoS misconfiguration. The ION device's QoS settings determine how VoIP packets are classified, marked, and queued. If they are not placed in a low-latency queue, jitter can occur. Therefore, checking the QoS configuration is the most direct next step to ensure proper prioritization.

Answer

The ION device's CPU utilization to see if it is overloaded.

Answer

The ION device's interface statistics for errors and discards on the VoIP VLAN.

Answer

The ION device's routing table to ensure the VoIP traffic is taking the correct path.

Question 19

A multinational company is deploying Prisma SD-WAN at a branch that has a single MPLS circuit and a broadband internet link. The security team requires that all traffic destined to the corporate data center must traverse the MPLS circuit, while internet-bound traffic should use the broadband link. However, if the MPLS circuit fails, data center traffic should fail over to the broadband link with IPsec encryption. Which configuration achieves this requirement?

Accepted Answer

Create a path selection policy that matches data center traffic and sets MPLS as primary and broadband as backup with IPsec enabled for the backup path.. A path selection policy in Prisma SD-WAN can match traffic destined to the data center, set MPLS as the primary path, and broadband as the backup with IPsec encryption. This provides dynamic failover based on link health, ensuring data center traffic uses MPLS normally and securely switches to broadband only when MPLS fails.

Answer

Set up a QoS policy that marks data center traffic as high priority and forces it over the MPLS link, with a backup policy for broadband.

Answer

Enable per-packet load balancing across both MPLS and broadband links for data center traffic, with IPsec on the broadband link.

Answer

Configure a static route for the data center subnet pointing to the MPLS interface, and a floating static route with a higher metric pointing to the broadband interface with IPsec.

Question 20

An engineer is configuring a Prisma SD-WAN ION device at a branch. The branch has a single WAN link with a public IP address. The internal LAN uses private IP addresses. The engineer needs to allow internal users to access the internet while hiding their private IP addresses. Which configuration is required?

Accepted Answer

Configure a source NAT policy that translates the private LAN IP addresses to the public WAN IP address for internet-bound traffic.. Source NAT translates private LAN IP addresses to the public WAN IP address for outbound internet traffic. This allows internal users to access the internet while hiding their private addresses, and ensures return traffic is correctly routed back through the NAT device.

Answer

Enable dynamic routing between the LAN and WAN interfaces to allow private IP addresses to be routed to the internet.

Answer

Configure a destination NAT policy that translates the public WAN IP address to an internal server IP for inbound traffic.

Answer

Create a static route for the default gateway pointing to the WAN interface, and enable proxy ARP on the LAN interface.