SD-WAN-Engineer Practice Test 4 — 25 Questions

Question 1

You are monitoring traffic in a Unified SASE environment. You notice that traffic from a branch is taking a non-optimal path to Prisma Access. Which tool would you use to verify the path selection logic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The flow diagnostic tool on the SD-WAN controller. The flow diagnostic tool on the SD-WAN controller provides visibility into the path selection decisions.

Answer

The WAN interface stats

Answer

The ION device ping tool

Answer

The Prisma Access logs

Question 2

Which protocol is primarily used for the tunnel between the ION device and the Prisma Access Service Infrastructure?

Accepted Answer

IPSec. IPSec is the standard protocol for creating secure tunnels between SD-WAN devices and cloud service infrastructure.

Answer

SSL

Answer

GRE

Answer

MPLS

Question 3

A user is complaining about high latency for a SaaS app. The Path Quality dashboard shows low latency. What is the next logical step?

Accepted Answer

Check LAN-side connectivity and local congestion. If the WAN path is healthy, the latency might be internal to the LAN or at the application server level.

Answer

Enable more security policies

Answer

Change ISP provider

Answer

Restart the ION device

Question 4

What is the function of the 'Reachability' check in the ION device configuration?

Accepted Answer

To verify ISP link status. It tests if the path is actually capable of reaching the destination, confirming path health.

Answer

To update firmware

Answer

To backup configuration

Answer

To check CPU load

Question 5

Which THREE factors can cause a site to go into 'Disconnected' state in the orchestrator?

Accepted Answer

Controller certificate mismatch. Loss of internet, controller reachability issues, and incorrect time settings are common causes.

Answer

High CPU load

Answer

Local VLAN misconfiguration

Question 6

Which TWO tools are available in the ION CLI for network connectivity testing?

Accepted Answer

traceroute. ping and traceroute are the standard tools available in the ION CLI.

Answer

wireshark

Answer

telnet

Answer

nmap

Question 7

What does the 'Flow Monitor' tool primarily track?

Accepted Answer

Active sessions and traffic attributes. The Flow Monitor provides granular details on active traffic sessions.

Answer

Controller connection time

Answer

ISP bandwidth limits

Answer

CPU utilization

Question 8

A user reports slow speeds. You see that the interface is not hitting the configured throughput limit. What could be the issue?

Accepted Answer

ISP side congestion. If the interface is not the bottleneck, the bottleneck may exist further upstream in the ISP network.

Answer

QoS priority too high

Answer

Incorrect IP address

Answer

Too many VLANs

Question 9

An organization is migrating to Unified SASE. When configuring the 'Direct to App' policy for branch offices, what is the primary benefit of leveraging the Prisma SD-WAN integration with Prisma Access?

Accepted Answer

It provides unified visibility and automated steering based on security requirements. The integration allows for dynamic path selection and security enforcement, ensuring that traffic is sent directly to the app when possible, or via Prisma Access when security inspection is required.

Answer

It allows the ION device to run full security stack analysis locally

Answer

It eliminates the need for DNS

Answer

It bypasses the need for WAN optimization

Question 10

When defining an Application Steering Policy in a Unified SASE environment, what is the advantage of using 'Application Groups'?

Accepted Answer

They enable consistent policy application across multiple applications. Application groups allow for policy abstraction, so multiple apps can be steered using a single policy definition.

Answer

They are required for local internet breakout

Answer

They reduce the amount of bandwidth consumed

Answer

They bypass the security inspection

Question 11

Which TWO of these are valid ways to verify the status of an ION device's WAN interface?

Accepted Answer

Check the Interface dashboard in the orchestrator. Checking the UI interface dashboard and using the CLI 'show interface' command are both standard verification methods.

Answer

Review the BIOS logs

Answer

Ping the device from the internet

Answer

Check the DNS logs

Question 12

Which THREE areas of configuration should you verify if a site cannot reach the local LAN gateway?

Accepted Answer

Interface IP/Mask. Interface settings, VLAN tagging, and ARP resolution are critical for local LAN communication.

Answer

Application security policy

Answer

Controller tunnel status

Question 13

What is the primary function of the 'Cloud Identity Engine' in the Unified SASE architecture?

Accepted Answer

To act as a central identity source for security policies. CIE centralizes identity across all SASE components, enabling consistent user-based policies.

Answer

To accelerate SaaS application traffic

Answer

To manage SD-WAN tunnel keys

Answer

To store traffic logs

Question 14

When using a Service Connection, what happens if the Prisma Access node is unreachable?

Accepted Answer

The system falls back to the configured backup path. The SD-WAN policy will trigger a failover action based on the configured policy, such as direct internet breakout or alternate tunnel.

Answer

The user is forced to re-authenticate

Answer

The ION device restarts

Answer

The traffic is dropped

Question 15

A branch loses connectivity to the internet, but local LAN traffic is fine. What should you troubleshoot first?

Accepted Answer

ISP connection and WAN interface. If local traffic works, the LAN is fine. The focus should be on the WAN edge.

Answer

Device power supply

Answer

DHCP server settings

Answer

Core Switch configuration

Question 16

When troubleshooting a persistent 'Service Connection Down' status, which log type is most relevant?

Accepted Answer

Service Connection event logs. The event logs on the SD-WAN controller provide detailed status changes and errors related to Service Connection tunnels.

Answer

System health logs

Answer

User activity logs

Answer

Application performance logs

Question 17

An administrator needs to exclude specific traffic from being inspected by Prisma Access in a Unified SASE environment. Where is this defined?

Accepted Answer

In the Prisma SD-WAN Application Policy. This is defined in the Application Steering Policy by selecting a different path (e.g., direct internet) for the specific app.

Answer

In the ION device firmware settings

Answer

In the Cloud Identity Engine

Answer

Inside the Prisma Access Security Policy

Question 18

Which TWO factors contribute to the 'Path Health' score?

Accepted Answer

Packet loss. The path health score is calculated based on packet loss and latency.

Answer

Device firmware version

Answer

Number of connected users

Answer

Site name

Question 19

When integrating Prisma SD-WAN with Prisma Access, how does the system ensure that the security policy is applied to the traffic correctly based on the user's identity?

Accepted Answer

User identity is mapped via CIE and passed as metadata. The ION device retrieves user identity context, which is passed through the tunnel to Prisma Access, where the security policy is applied.

Answer

The ION device performs DPI and injects user info

Answer

Prisma Access performs IP-based reverse lookups

Answer

The SD-WAN controller acts as the identity proxy

Question 20

In a Unified SASE deployment, what is the significance of the ION device serial number?

Accepted Answer

It is used for device onboarding and policy assignment. The serial number is the unique identifier used to register the device to the controller and associate it with the SASE tenant.

Answer

It is required for user authentication

Answer

It determines the tunnel MTU

Answer

It is needed for local WAN port configuration