SD-WAN-Engineer Practice Test 3 — 10 Questions

Question 1

A healthcare organization is planning a Prisma SD-WAN design for its clinics. The design must ensure that each clinic can reach the internet directly for guest traffic while also reaching internal applications through the SD-WAN fabric. Which two design elements should be included in the site configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A local internet breakout on the clinic CPE for guest traffic. Meeting both requirements means giving the clinic two distinct paths: a local internet breakout for guest traffic so it exits directly to the internet, and a service link to the data center so internal applications are reached over the SD-WAN fabric. Together these elements let the design separate guest internet access from internal application access without backhauling guest traffic.

Answer

A BGP peer between the clinic CPE and the guest Wi-Fi controller

Answer

A NAT pool on the data center CPE for all clinic guest traffic

Answer

A static route on the clinic CPE pointing all traffic to the data center gateway

Question 2

Which TWO of these are valid ways to verify the status of an ION device's WAN interface?

Accepted Answer

Check the Interface dashboard in the orchestrator. Option A is correct because the orchestrator's Interface dashboard provides a centralized, real-time view of each ION device's WAN interface status, including link state, IP addressing, and operational health. Option C is correct because running 'show interface' via the CLI on the ION device directly displays the WAN interface's administrative and operational status, counters, and errors. Option B is incorrect because BIOS logs record hardware POST and boot events, not WAN interface state. Option D is incorrect because pinging the device from the internet only tests reachability and does not confirm the WAN interface's status. Option E is incorrect because DNS logs relate to name resolution queries, not WAN interface status.

Answer

Review the BIOS logs

Answer

Ping the device from the internet

Answer

Check the DNS logs

Question 3

A site deployment requires specific traffic to be exempted from the SD-WAN optimization process to ensure compatibility with a legacy application. Which policy should be updated?

Accepted Answer

Application Policy. Application Policy rules allow you to specify traffic types that should bypass optimization.

Answer

NAT Policy

Answer

Security Policy

Answer

Interface Policy

Question 4

Which TWO items are checked by the ION device to determine if a WAN path is healthy?

Accepted Answer

Packet loss. The ION device evaluates WAN path health using performance metrics that directly reflect the quality of the link, and packet loss (option A) is one of them because dropped packets indicate congestion, errors, or a degraded path that affects application delivery. Latency (option C) is also checked because round-trip delay directly impacts WAN performance and is a core metric in path health monitoring and SLA verification. Device temperature (option B) is a hardware/environmental status, not a WAN path metric, so it is not used to judge path health. User authentication status (option D) relates to access control and identity, not link quality, and local disk space (option E) is a local storage resource that has no bearing on whether a WAN path is healthy.

Answer

Device temperature

Answer

User authentication status

Answer

Local disk space

Question 5

You are designing a hub-and-spoke topology where spokes need to communicate directly under specific conditions. Which feature should be enabled to optimize latency and minimize load on the regional hub?

Accepted Answer

Dynamic Mesh. Dynamic Mesh in an SD-WAN hub-and-spoke design allows spoke-to-spoke traffic to be forwarded directly between branch sites when policy permits, rather than hairpinning through the regional hub. This reduces latency (no extra hop through the hub) and offloads the hub's forwarding and encryption resources. It is the standard feature for optimizing east-west branch traffic while preserving the hub for centralized policy and internet breakout.

Answer

Hub-to-Hub Transit

Answer

BGP Route Reflector

Answer

Global VPN Overlay

Question 6

A network administrator is investigating why application traffic from a branch site is being routed over the less-preferred MPLS transport instead of the local broadband circuit, even though the application-aware routing policy is configured to prefer broadband for that application. The administrator has already verified that the application is correctly identified and that both TLOCs are up. Which vManage monitoring view should the administrator check first to see the per-application path selection decisions and the reason a particular path was chosen?

Accepted Answer

Monitor > Applications > App Route. Application-aware routing decisions are made per flow based on the configured SLA classes and path preferences. To understand why a specific application took a particular path, the administrator needs visibility into the policy evaluation. The App Route monitoring view provides that per-application breakdown, showing the matched policy, the chosen path, and the alternative paths with their SLA metrics, which directly answers the question.

Answer

Monitor > Devices > WAN Edge

Answer

Monitor > Network > Topology

Answer

Monitor > Network > Interfaces

Question 7

An engineer is analyzing an application-aware routing policy on a Cisco SD-WAN fabric. The policy is configured to steer business-critical traffic based on the best path according to BFD probes. After a recent change, the engineer notices that traffic is being forwarded over a path that has a higher latency than an alternative path, even though the BFD probes indicate the alternative path is better. The engineer verifies that the BFD sessions are up and the policy is applied to the correct VPN. What is the most likely cause of this behavior?

Accepted Answer

The application-aware routing policy is using the wrong SLA class.. The correct answer is that the application-aware routing policy is using the wrong SLA class. The SLA class defines the thresholds for latency, jitter, and loss that determine which path is considered best. If the SLA class is misconfigured, the policy may select a path that meets the (incorrect) criteria but is not the optimal path. The engineer should review the SLA class settings and ensure they match the intended performance requirements.

Answer

The BFD probes are using the wrong color.

Answer

The OMP route for the better path is not being advertised.

Answer

The BFD sessions are flapping, causing path instability.

Question 8

When deploying a new ION device, which Prisma SD-WAN component is primarily used to initiate the zero-touch provisioning process?

Accepted Answer

Controller. The ION device reaches out to the Controller during the initial bootstrap process to pull its configuration and firmware.

Answer

Prisma Access

Answer

CloudBlades

Answer

Prisma SD-WAN Plugin

Question 9

An administrator is deploying Prisma SD-WAN with Unified SASE. The administrator needs to ensure that the ION device can establish a service connection to Prisma Access. Which of the following must be configured on the ION device to allow the service connection to be established?

Accepted Answer

A service connection with the Prisma Access tenant information and a public IP address or NAT traversal.. The essential configuration on the ION device for a service connection is the Prisma Access tenant information and ensuring the device can reach Prisma Access, which requires a public IP or NAT traversal. These elements enable the IPsec tunnel to be established. Other items like static routes or firewall rules are either not required or are configured on other devices. Therefore, the correct answer is the one that includes tenant information and reachability.

Answer

A static route to the Prisma Access service IP and a DNS server for name resolution.

Answer

A firewall rule allowing IPsec traffic and a NAT policy for outbound traffic.

Answer

An IKEv2 pre-shared key and a certificate for authentication.

Question 10

A network engineer is troubleshooting a Prisma SD-WAN deployment where a new ION device at a remote site fails to establish any data plane tunnels to other sites. The engineer has verified that the control connection to the controller is up and the device is showing as 'Connected' in the orchestrator. Which step should the engineer take next to diagnose the data plane tunnel issue?

Accepted Answer

Verify that the device's WAN interfaces have the correct IP addresses and are not behind a NAT that blocks IPsec.. Data plane tunnels in Prisma SD-WAN are IPsec-based. Even if the control connection is up, IPsec tunnels can fail to establish due to NAT devices that do not properly handle IPsec traffic or due to incorrect WAN interface configurations. Verifying these elements is a direct way to diagnose the issue.

Answer

Restart the ION device to force re-establishment of tunnels.

Answer

Check the device's local routing table for a default route.

Answer

Review the controller's logs for errors related to the device.