SD-WAN-Engineer Practice Test 2 — 30 Questions

Question 1

Which protocol is primarily used for the tunnel between the ION device and the Prisma Access Service Infrastructure?

Accepted Answer

IPSec. IPSec is the standard protocol for creating secure tunnels between SD-WAN devices and cloud service infrastructure.

Answer

SSL

Answer

GRE

Answer

MPLS

Question 2

An engineer needs to view real-time application-aware routing statistics for a specific site in vManage. Which menu path should the engineer use?

Accepted Answer

Monitor > Network > App Route. To view real-time application-aware routing statistics in vManage, navigate to Monitor > Network > App Route. This view displays the metrics used by AAR, such as latency, loss, and jitter per application and path, allowing engineers to confirm path selection and troubleshoot routing decisions.

Answer

Monitor > Network > WAN Clarity

Answer

Monitor > Network > Real Time

Answer

Monitor > Network > Applications

Question 3

A network architect is reviewing the SD-WAN fabric's high availability design. The architect wants to ensure that if a vSmart controller becomes unavailable, the WAN Edge routers continue to forward traffic without interruption. Which statement accurately describes the behavior of WAN Edge routers when a vSmart controller fails in a multi-controller deployment?

Accepted Answer

WAN Edge routers continue to forward traffic using existing OMP routes and locally cached policies, and they attempt to reconnect to a surviving vSmart controller.. In a multi-controller vSmart deployment, WAN Edge routers establish control connections to multiple vSmart controllers for redundancy. If one vSmart fails, the routers retain their cached OMP routes and policies and continue forwarding traffic without interruption. They simultaneously attempt to reconnect to a surviving vSmart controller to maintain control plane updates. This design ensures high availability and uninterrupted data plane operation.

Answer

WAN Edge routers immediately drop all data plane traffic until they reconnect to a surviving vSmart controller.

Answer

WAN Edge routers stop advertising their TLOCs to other sites until a vSmart controller is reachable again.

Answer

WAN Edge routers revert to a default route and forward all traffic to the vBond orchestrator until a vSmart controller is available.

Question 4

A customer requires a granular segmentation strategy where HR, Engineering, and Guest traffic must remain isolated across the SD-WAN fabric. Which configuration construct provides this logical separation?

Accepted Answer

Virtual Networks (VNets). Virtual Networks (VNets) allow for the logical segmentation of traffic throughout the fabric.

Answer

IPsec Tunnel Groups

Answer

Subnet Masking

Answer

VLAN Tagging

Question 5

You notice an ION device is showing as 'Disconnected' in the Controller UI. What is the first step you should take?

Accepted Answer

Check physical interface status and WAN connectivity. Verifying WAN connectivity and local interface status is the logical first step in troubleshooting connectivity.

Answer

Upgrade the device firmware

Answer

Reboot the ION device

Answer

Delete and recreate the site

Question 6

Which THREE components are verified during the ION device 'check' sequence at startup?

Accepted Answer

Link status. The ION device 'check' sequence at startup validates the operational readiness of the device's own resources and its management connectivity. Option C (Link status) is correct because the device verifies that its WAN/LAN interfaces have physical link up before proceeding. Option D (Configuration integrity) is correct because the startup check confirms the stored configuration is valid and not corrupted so the device can apply it. Option E (Controller reachability) is correct because the ION device must confirm it can reach its management controller/orchestrator to register and receive policy. Options A (Cloud application popularity) and B (User browser history) are not part of the device startup check sequence; these are traffic/analytics data unrelated to local device health and management readiness.

Answer

Cloud application popularity

Answer

User browser history

Question 7

A network engineer is deploying a new branch ION device at a site with two WAN links and wants to guarantee that business-critical voice traffic always uses the lowest-latency path, even when one link degrades. Which Prisma SD-WAN configuration should be applied to the branch ION device to meet this requirement?

Accepted Answer

Create a policy set with a path selection policy that uses the lowest-latency path for voice traffic and a failover action to the secondary link.. A path selection policy with lowest-latency criteria and a failover action is the correct approach because it continuously monitors WAN link performance and dynamically routes voice traffic over the best available path, with automatic failover if the primary link degrades. This ensures the required low-latency treatment without manual intervention.

Answer

Configure a static route for the voice subnet pointing to the primary WAN interface.

Answer

Enable Forward Error Correction on both WAN interfaces to reduce latency for voice traffic.

Answer

Set up a QoS policy that prioritizes voice traffic in the queue on the primary WAN link.

Question 8

A network administrator is troubleshooting a Prisma SD-WAN environment where an ION device is experiencing intermittent packet loss on a business-critical application. The administrator suspects that the issue is related to a policy misconfiguration. Which two actions should the administrator take to verify that the correct policies are being applied to the traffic? (Choose two.)

Accepted Answer

Use the Flow Analytics dashboard to examine the path and policy applied to the specific application flow.. To verify that the correct application policies are applied, the administrator should review the policy stack order to ensure no shadowing occurs and use Flow Analytics to inspect the actual policy and path for the specific flow. These actions directly confirm whether the intended policy is enforced, which is crucial for troubleshooting intermittent packet loss caused by policy misconfiguration.

Answer

Check the ION device's system logs for policy deny messages.

Answer

Verify that the ION device has the latest software version installed.

Answer

Run a traceroute from the ION device to the application server to identify the path taken.

Question 9

A network operations center (NOC) engineer is monitoring a Prisma SD-WAN deployment and notices that one ION device at a remote site is consistently showing high latency on its broadband link, while the LTE link is performing well. The engineer wants to quickly identify whether the high latency is due to an ISP issue or a device problem. Which of the following should the engineer check first?

Accepted Answer

The Prisma SD-WAN Controller's path quality metrics for the broadband link.. The Prisma SD-WAN Controller continuously monitors path quality for each WAN link, providing latency, jitter, and loss metrics. By comparing the controller's measurements with the device's local observations, the engineer can quickly ascertain whether the high latency is consistent across the path (indicating an ISP issue) or isolated to the device (suggesting a local problem). This is the most efficient first step.

Answer

The ION device's CPU utilization and memory usage.

Answer

The ION device's interface statistics for errors and discards.

Answer

The broadband ISP's public status page for outages.

Question 10

A network engineer is deploying a new branch office with a single Prisma SD-WAN ION device. The branch has two WAN links: a primary fiber circuit and a backup LTE connection. The engineer wants the ION device to automatically establish secure tunnels to the Prisma SD-WAN controller and to the nearest data center without manual intervention. Which deployment method should the engineer use?

Accepted Answer

Zero-Touch Provisioning (ZTP) with a claim code. Zero-Touch Provisioning (ZTP) with a claim code enables the ION device to automatically register with the Prisma SD-WAN controller, retrieve its configuration, and establish secure tunnels to data centers and other branches. This method eliminates manual configuration and is the standard for branch deployments.

Answer

Configuring a DHCP option 43 on the branch router to point to the controller

Answer

Manual CLI configuration of IPsec tunnels and controller IP addresses

Answer

Pre-staging the device by copying a configuration file to a USB drive and booting the device

Question 11

An engineer is deploying a new branch ION device that will connect to two different ISPs. The design requires that return traffic from the data center follows the same WAN path that the outbound session used, so that stateful inspection appliances in the data center see both directions of every flow. Which configuration on the branch ION device satisfies this requirement?

Accepted Answer

Enable path affinity so that return traffic uses the same WAN path as the originating flow.. Symmetric flow handling requires that both directions of a session traverse the same WAN path. Path affinity binds a flow to its chosen path so return traffic is not redirected to a different ISP link. This preserves stateful inspection in the data center and avoids broken sessions caused by asymmetric routing across the two ISP connections.

Answer

Configure policy-based forwarding with a unique path for each application.

Answer

Enable Forward Error Correction on both WAN interfaces.

Answer

Enable IPsec tunnel bonding across both WAN interfaces.

Question 12

A network engineer is deploying a new branch location with a Prisma SD-WAN ION device. The branch has two WAN circuits: a primary fiber link and a backup LTE link. The engineer wants the ION device to automatically use the LTE link only when the fiber link fails. Which configuration should be applied to achieve this behavior?

Accepted Answer

Create a path selection policy that sets the fiber link as primary and the LTE link as backup, with failover triggered by link health.. Prisma SD-WAN uses path selection policies to define primary and backup WAN links based on health and performance. By configuring the fiber link as primary and LTE as backup with health-based failover, the branch will use LTE only when the fiber link fails. This ensures efficient use of the primary circuit and automatic redundancy.

Answer

Configure a static route for the LTE interface with a higher administrative distance than the fiber interface.

Answer

Configure a policy that sets the LTE interface as the preferred egress for all traffic, with the fiber interface as secondary.

Answer

Enable per-packet load balancing across both WAN interfaces to distribute traffic evenly.

Question 13

A network engineer is investigating a performance issue in a Prisma SD-WAN environment where an ION device is showing high jitter on a business-critical VoIP call. The engineer has verified that the WAN link quality is good and that no policies are misconfigured. The engineer suspects that the issue might be due to the ION device's handling of the traffic. Which of the following should the engineer check next to determine if the ION device is correctly marking and prioritizing the VoIP traffic?

Accepted Answer

The ION device's QoS configuration, specifically the mapping of VoIP traffic to the correct queue.. High jitter on VoIP traffic, despite good WAN link quality, often points to QoS misconfiguration. The ION device's QoS settings determine how VoIP packets are classified, marked, and queued. If they are not placed in a low-latency queue, jitter can occur. Therefore, checking the QoS configuration is the most direct next step to ensure proper prioritization.

Answer

The ION device's CPU utilization to see if it is overloaded.

Answer

The ION device's interface statistics for errors and discards on the VoIP VLAN.

Answer

The ION device's routing table to ensure the VoIP traffic is taking the correct path.

Question 14

A multinational company is deploying Prisma SD-WAN at a branch that has a single MPLS circuit and a broadband internet link. The security team requires that all traffic destined to the corporate data center must traverse the MPLS circuit, while internet-bound traffic should use the broadband link. However, if the MPLS circuit fails, data center traffic should fail over to the broadband link with IPsec encryption. Which configuration achieves this requirement?

Accepted Answer

Create a path selection policy that matches data center traffic and sets MPLS as primary and broadband as backup with IPsec enabled for the backup path.. A path selection policy in Prisma SD-WAN can match traffic destined to the data center, set MPLS as the primary path, and broadband as the backup with IPsec encryption. This provides dynamic failover based on link health, ensuring data center traffic uses MPLS normally and securely switches to broadband only when MPLS fails.

Answer

Set up a QoS policy that marks data center traffic as high priority and forces it over the MPLS link, with a backup policy for broadband.

Answer

Enable per-packet load balancing across both MPLS and broadband links for data center traffic, with IPsec on the broadband link.

Answer

Configure a static route for the data center subnet pointing to the MPLS interface, and a floating static route with a higher metric pointing to the broadband interface with IPsec.

Question 15

An engineer is configuring a Prisma SD-WAN ION device at a branch. The branch has a single WAN link with a public IP address. The internal LAN uses private IP addresses. The engineer needs to allow internal users to access the internet while hiding their private IP addresses. Which configuration is required?

Accepted Answer

Configure a source NAT policy that translates the private LAN IP addresses to the public WAN IP address for internet-bound traffic.. Source NAT translates private LAN IP addresses to the public WAN IP address for outbound internet traffic. This allows internal users to access the internet while hiding their private addresses, and ensures return traffic is correctly routed back through the NAT device.

Answer

Enable dynamic routing between the LAN and WAN interfaces to allow private IP addresses to be routed to the internet.

Answer

Configure a destination NAT policy that translates the public WAN IP address to an internal server IP for inbound traffic.

Answer

Create a static route for the default gateway pointing to the WAN interface, and enable proxy ARP on the LAN interface.

Question 16

A network administrator is configuring a new ION device at a branch. The administrator wants the device to obtain its IP address, default gateway, and DNS server automatically from the local ISP's DHCP server on the WAN interface. Which WAN interface configuration mode should be selected?

Accepted Answer

DHCP Client. To automatically receive WAN addressing from the ISP, the ION device must operate as a DHCP client on that interface. DHCP Client mode requests an IP address, gateway, and DNS settings from the service provider's DHCP server, requiring no manual entry. Static IP, PPPoE, and DHCP Server modes do not provide this automatic client behavior.

Answer

DHCP Server

Answer

Static IP

Answer

PPPoE

Question 17

You have a DCI configuration where two data centers are connected via a dedicated link. You want to ensure the DCI link is only used if the primary WAN transport fails. How do you achieve this?

Accepted Answer

Configure a lower TLOC preference on the DCI link routes.. OMP TLOC preference can be used to steer traffic to specific paths based on preference values.

Answer

Disable OMP on the primary link.

Answer

Set the OMP cost to zero.

Answer

Use a static route with a high administrative distance.

Question 18

Which TWO features are included in the vManage 'Monitor' menu?

Accepted Answer

Device health and status.. The Monitor menu is the central hub for observing the SD-WAN fabric performance.

Answer

User management.

Answer

Policy configuration.

Answer

Software image repository.

Question 19

You are debugging a routing loop. Which tool can you use to see the BGP route advertisements received by an ION device?

Accepted Answer

Route Monitoring. The BGP neighbor status and route tables in the device monitoring show learned routes.

Answer

Path Quality

Answer

Flow Summary

Answer

Interface Stats

Question 20

A network engineer is deploying a new branch office with a Prisma SD-WAN ION device. The security team requires that all internet-bound traffic from the branch be inspected by Prisma Access Cloud SWG, while traffic to internal SaaS applications should use direct internet breakouts. The engineer must configure the ION to steer traffic appropriately. Which action should the engineer take to meet these requirements?

Accepted Answer

Configure application-based policy rules to direct SaaS traffic to a local breakout and all other internet traffic to the Service Connection.. The requirement is to inspect general internet traffic with Cloud SWG while allowing direct SaaS breakouts. Application-based policy rules on the ION device can identify SaaS applications and steer them to a local breakout, while all other internet traffic is sent to the Service Connection for inspection. This provides the necessary granularity and meets both security and performance goals.

Answer

Enable 'Cloud Security' on the ION device and set the default route to the Service Connection.

Answer

Set up a static route for each SaaS application's IP range pointing to the local internet circuit and a default route to the Service Connection.

Answer

Create a policy rule that matches all traffic and set the action to 'Service Connection' for the Cloud SWG.