SD-WAN-Engineer Practice Test 4 — 25 Questions

Question 1

A network administrator is troubleshooting a performance issue where voice traffic is being routed over a less optimal path despite a better path being available. The administrator suspects that the Application-Aware Routing policy is not functioning as intended. Which two actions should be taken to verify that the policy is correctly applied and the SLA is being met? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the 'App Route' statistics in vManage for the site to see the path chosen for the voice application.. To verify application-aware routing for voice, you must confirm that the policy is selecting the correct path based on SLA. The App Route statistics in vManage show the chosen path per application, and BFD/SLA status confirms that the path meets the required thresholds. Without both, the policy cannot function as intended. Packet capture, OMP routes, and syslog do not directly show policy effectiveness.

Answer

Review the OMP routes to ensure the voice prefix is advertised with the correct TLOC.

Answer

Check the syslog on the branch router for messages about policy failures.

Answer

Run a packet capture on the voice VLAN to analyze the RTP stream.

Question 2

A network operations engineer is troubleshooting a Cisco SD-WAN overlay where a branch site's WAN Edge router has lost its control plane connectivity to the vSmart controllers. The engineer runs the command `show control connections` on the WAN Edge and sees that all control connections are in a 'connect' state rather than 'up'. Which action should the engineer take first to diagnose the issue?

Accepted Answer

Check the WAN Edge's `show control local-properties` output to confirm the organization name and VBOND/controller IPs are correctly configured.. When control connections are stuck in 'connect', the most likely cause is a misconfiguration of the WAN Edge's control plane parameters such as organization name, VBOND, or controller IPs. The `show control local-properties` command provides a quick snapshot of these settings, allowing the engineer to verify them against the intended configuration before investigating underlay or certificate issues.

Answer

Verify the WAN Edge's system IP is reachable by pinging the vSmart controller's system IP from the WAN Edge.

Answer

Verify that the WAN Edge has a valid certificate and that the root CA is installed.

Answer

Restart the vSmart controller to force a new DTLS session with the WAN Edge.

Question 3

A network engineer is validating the health of an SD-WAN fabric after a controller upgrade. The engineer needs to verify that the control plane and data plane are operating correctly across all devices. Which two vManage monitoring screens should be checked to confirm that all control connections are up and that the data plane tunnels are established? (Choose two.)

Accepted Answer

Tunnels. To verify control plane health, the Control Connections screen lists all control connections and their states. For data plane health, the Tunnels screen shows the status of data plane tunnels between devices. Together, these screens confirm that both planes are operational after the controller upgrade. Other screens like Interface Statistics, Alarms, or Application Awareness provide different metrics and do not directly show control connection or tunnel status.

Answer

Alarms

Answer

Interface Statistics

Answer

Application Awareness

Question 4

Which menu path is used to view the real-time tunnel statistics for a specific vEdge router?

Accepted Answer

Monitor > Network > [Device] > Tunnel.. Monitor > Network allows you to select a specific device and view its tunnel performance.

Answer

Administration > Settings.

Answer

Tools > Real-time monitoring.

Answer

Configuration > Devices.

Question 5

A network operations team is using Cisco vManage to manage a large SD-WAN fabric. They need to view a real-time, hop-by-hop path trace between a branch router and a data center application server to pinpoint where latency is being introduced. Which vManage feature should they use to capture this information?

Accepted Answer

vManage Real-Time Monitoring > Device > Troubleshooting > Path Trace. The Path Trace tool under Real-Time Monitoring is designed specifically for on-demand, hop-by-hop diagnostics across the SD-WAN overlay. It shows each device and interface traversed, along with latency and loss per hop, enabling the team to isolate the exact segment causing delay. Other monitoring views provide aggregate or single-device data and cannot replace a live path trace for this purpose.

Answer

Application-Aware Routing (AAR) policy

Answer

vManage Monitor > Network > Interface statistics

Answer

vManage Monitor > Applications > App Route statistics

Question 6

An engineer is troubleshooting why a WAN edge device shows an out-of-sync state with the vSmart controller in vManage, even though the control connection appears to be up. Which TWO conditions should the engineer verify to explain an out-of-sync policy or configuration state? (Choose two.)

Accepted Answer

The device has not yet accepted or applied the pending configuration change.. Out-of-sync status in vManage indicates that the device's applied configuration or policy differs from the intended state. The usual causes are that a template or policy update has not been delivered, or that a pending change has not been accepted and applied. Certificate expiry, version differences, and NTP drift affect connectivity or validity but do not directly produce this configuration mismatch.

Answer

The vSmart controller is running a software version older than the WAN edge device.

Answer

The device's clock is not synchronized with an NTP server.

Answer

The device's certificate has expired and it is operating in a degraded mode.

Question 7

A network operations team is troubleshooting an intermittent voice-quality complaint at a branch. In vManage they open the Troubleshooting pane for the affected device and run a bidirectional application-aware traffic flow test between the branch and the voice gateway. The test completes successfully, but the team wants to confirm which physical WAN transport and which local interface the simulated flow actually traversed. Where should they look in the test results?

Accepted Answer

The Flow Details section of the test output, which lists the ingress and egress interface names and the selected WAN transport for each direction of the simulated flow.. An application-aware flow test returns per-direction forwarding detail, including the egress interface and the WAN transport selected by the data plane. Reviewing that detail confirms the actual path rather than assuming the test used the same transport as production voice. Control connection status, system events, and interface counters describe other layers and cannot identify the transport of the simulated flow.

Answer

The Interface Utilization widget on the Monitor dashboard, which correlates the test timestamp with the busiest interface on the device.

Answer

The Control Connections table on the device dashboard, which shows the system IP of each vBond and the TLOC color currently in use.

Answer

The Events log filtered by severity level major, which records every packet-forwarding decision made by the data plane.

Question 8

A network administrator is troubleshooting a performance issue where voice traffic is being routed over a less optimal path despite a better path being available. The administrator suspects that the Application-Aware Routing policy is not functioning as intended. Which two actions should be taken to verify that the policy is correctly applied and the SLA is being met? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitor > Network > WAN Edge > Tunnel. The Tunnel view under Monitor > Network > WAN Edge is the correct place to check BFD session status and performance metrics such as latency, jitter, and loss for each tunnel. Since Application-Aware Routing relies on BFD to measure path quality, this view directly supports diagnosing voice quality issues. Other views lack the combination of BFD state and per-tunnel performance data.

Answer

Monitor > Network > WAN Edge > Interface

Answer

Monitor > Network > WAN Edge > Control Connections

Answer

Monitor > Applications > Application-Aware Routing

Question 9

Where do you go in vManage to generate a report on historical bandwidth utilization for a specific site?

Accepted Answer

Monitor > Reports.. In vManage, historical bandwidth utilization reports for a specific site are generated from Monitor > Reports. This section provides pre-built and custom reports on bandwidth, application usage, and other historical data, with filters for site, time range, and other parameters.

Answer

Configuration > Templates.

Answer

Administration > Maintenance.

Answer

Tools > Logs.

Question 10

A network administrator needs to generate a report that shows the top ten applications by bandwidth consumption over the past week for a specific site. Which vManage feature should be used?

Accepted Answer

Tools > Reports. The Tools > Reports feature in vManage is designed for generating historical reports. It allows you to select a time range, site, and specific metrics such as application bandwidth. This directly fulfills the requirement for a weekly top-ten application report. Other monitoring views are more real-time or focus on different metrics.

Answer

Monitor > Network

Answer

Monitor > Applications

Answer

Monitor > Tunnel Health

Question 11

You want to audit who changed a policy on the Controller. Where is this information logged?

Accepted Answer

Controller Audit Logs. The Audit logs record all administrative actions, including policy changes.

Answer

Performance Monitoring

Answer

Security Policy Hits

Answer

System Event Logs

Question 12

You are configuring a path policy to prioritize VoIP traffic. Which specific metric should you leverage to ensure the best call quality when multiple paths are available?

Accepted Answer

Path performance metric. Jitter and latency are critical for voice; the policy uses performance metrics to steer traffic dynamically.

Answer

DSCP marking

Answer

Bandwidth consumption

Answer

Source IP address

Question 13

A branch is failing to load-balance traffic across two ISPs. Both are active. Which setting controls the load-balancing algorithm?

Accepted Answer

Path Selection Policy. The Path Selection policy defines how traffic is distributed across available paths.

Answer

NAT Policy

Answer

Interface Bandwidth Settings

Answer

QoS Policy

Question 14

When troubleshooting QoS, what does a high 'drop' count in the interface statistics imply?

Accepted Answer

Interface congestion. High drop counts indicate that the interface is congested and exceeding the configured bandwidth limit.

Answer

Hardware failure

Answer

Security policy blocking

Answer

The ISP is down

Question 15

During the design of a large-scale data center migration, you need to extend Layer 2 domains across the SD-WAN fabric. Which mechanism supports this requirement?

Accepted Answer

L2-Over-SD-WAN (L2VPN). L2-Over-SD-WAN (L2VPN) is the correct mechanism because it encapsulates Layer 2 frames (Ethernet) inside the SD-WAN overlay tunnels, effectively extending a single broadcast domain across geographically dispersed sites. This allows the data center migration to preserve VLANs, IP subnets, and MAC addresses without re-IPing workloads. It is a native SD-WAN feature designed specifically for Layer 2 extension use cases.

Answer

STP Bridge Group

Answer

Proxy ARP

Answer

BGP EVPN

Question 16

An ION device has experienced a configuration drift. How can you restore the last known good configuration?

Accepted Answer

Revert Configuration in the Orchestrator. The Orchestrator in Prisma SD-WAN maintains a version history of configurations for each ION device. The 'Revert Configuration' function allows you to roll back to a previous known-good configuration, restoring the device to a stable state without manual intervention. This is the designed method for recovering from configuration drift.

Answer

Copy config from another site

Answer

Factory reset

Answer

Manually re-configure everything

Question 17

A network administrator is troubleshooting a performance issue where voice traffic is being routed over a less optimal path despite a better path being available. The administrator suspects that the Application-Aware Routing policy is not functioning as intended. Which two actions should be taken to verify that the policy is correctly applied and the SLA is being met? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show interface counters. Intermittent packet loss can stem from physical layer problems or congestion. The 'show interface counters' command provides detailed statistics such as CRC errors, input/output drops, and queue overruns. These metrics allow the administrator to determine whether the loss is due to cabling issues, duplex mismatches, or bandwidth saturation, enabling targeted remediation.

Answer

show interface

Answer

show system status

Answer

show log system

Question 18

What information is provided by the 'Controller Status' widget on the dashboard?

Accepted Answer

Connectivity between ION and Controller. It confirms the connectivity status between the ION and the controller.

Answer

LAN port status

Answer

Site-to-site VPN health

Answer

ISP latency

Question 19

You are deploying Cloud Identity Engine (CIE) to enable identity-based security policies across your SD-WAN and SASE environment. Which configuration step is required to ensure that user identity information is successfully propagated from the enterprise directory to the Prisma Access security nodes?

Accepted Answer

Link the Prisma Access instance to the CIE instance using the API Key and Tenant ID. To propagate identity from the enterprise directory to Prisma Access security nodes, the Prisma Access tenant must be linked to the Cloud Identity Engine instance using the API Key and Tenant ID. This linkage authorizes CIE to push user-to-IP mappings and group information into Prisma Access so identity-based security policies can be enforced at the enforcement nodes.

Answer

Configure a local user database on every ION device

Answer

Manually map IP addresses to usernames in the Cloud SWG UI

Answer

Enable the Identity Service on the Prisma SD-WAN Controller

Question 20

A company is deploying Unified SASE with Prisma SD-WAN and Prisma Access. The security team wants to ensure that traffic from branch ION devices is inspected by Prisma Access and that security logs from both products are correlated for unified reporting. Which TWO actions are required to achieve this integration? (Choose two.)

Accepted Answer

Enable the same Prisma Access tenant and Prisma SD-WAN tenant in the same Unified SASE portal.. To integrate Prisma SD-WAN with Prisma Access for Unified SASE, the branch ION device must have a Service Connection to Prisma Access, and both products must be managed in the same tenant or unified portal. These two actions enable traffic inspection and log correlation. GRE tunnels, explicit proxies, or manual log import do not provide the required integrated behavior.

Answer

Configure a GRE tunnel between the ION device and the Prisma Access service infrastructure.

Answer

Manually export Prisma Access logs and import them into the Prisma SD-WAN controller.

Answer

Deploy a Cloud SWG explicit proxy at the branch and point all traffic to it.