SD-WAN-Engineer Practice Test 3 — 30 Questions

Question 1

An organization is migrating to Unified SASE. When configuring the 'Direct to App' policy for branch offices, what is the primary benefit of leveraging the Prisma SD-WAN integration with Prisma Access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It provides unified visibility and automated steering based on security requirements. The integration allows for dynamic path selection and security enforcement, ensuring that traffic is sent directly to the app when possible, or via Prisma Access when security inspection is required.

Answer

It allows the ION device to run full security stack analysis locally

Answer

It eliminates the need for DNS

Answer

It bypasses the need for WAN optimization

Question 2

What is the primary function of the 'Cloud Identity Engine' in the Unified SASE architecture?

Accepted Answer

To act as a central identity source for security policies. CIE centralizes identity across all SASE components, enabling consistent user-based policies.

Answer

To accelerate SaaS application traffic

Answer

To manage SD-WAN tunnel keys

Answer

To store traffic logs

Question 3

When troubleshooting a persistent 'Service Connection Down' status, which log type is most relevant?

Accepted Answer

Service Connection event logs. The event logs on the SD-WAN controller provide detailed status changes and errors related to Service Connection tunnels.

Answer

System health logs

Answer

User activity logs

Answer

Application performance logs

Question 4

Which component in the Unified SASE stack is responsible for enforcing URL filtering and threat prevention policies for remote users?

Accepted Answer

Prisma Access. Prisma Access is the SASE component that provides full security stack capabilities, including URL filtering and threat prevention.

Answer

Prisma SD-WAN ION device

Answer

Cloud Identity Engine

Answer

SD-WAN Controller

Question 5

A network engineer is troubleshooting a Unified SASE deployment where branch users report slow access to Microsoft 365. The engineer suspects that traffic is being backhauled to a data center for security inspection instead of being sent directly to Prisma Access. The ION device has a Service Connection configured and active. Which action should the engineer take to ensure that Microsoft 365 traffic is inspected by Prisma Access while other traffic follows the default route?

Accepted Answer

Create a Network Policy Rule that matches Microsoft 365 and sets the action to 'Service Connection' with a higher priority than the default rule.. To ensure Microsoft 365 traffic is inspected by Prisma Access while other traffic follows the default route, the engineer must create a specific Network Policy Rule that matches Microsoft 365 and directs it to the Service Connection. This rule must have a higher priority than the default rule so it is evaluated first and takes precedence.

Answer

Modify the default Network Policy Rule to use the Service Connection as the primary path for all traffic.

Answer

Enable 'Direct Internet Breakout' on the ION device for Microsoft 365 traffic.

Answer

Configure a static route on the ION device for Microsoft 365 IP ranges pointing to the Service Connection.

Question 6

A network architect is designing a Unified SASE solution for a company with multiple branches. The company wants to ensure that all internet-bound traffic from branches is inspected by Cloud SWG, while traffic to internal applications is routed through a data center. The architect plans to use Prisma SD-WAN with Service Connections to Prisma Access. Which configuration approach should the architect recommend to meet these requirements?

Accepted Answer

Configure a Service Connection on each ION device and create Network Policy Rules that direct internet-bound traffic to the Service Connection, while internal traffic follows a default route to the data center.. The recommended approach is to configure Service Connections on each ION device and create Network Policy Rules that match internet-bound traffic and direct it to the Service Connection. Internal traffic can follow the default route to the data center. This provides Cloud SWG inspection for internet traffic while maintaining efficient routing for internal applications, leveraging the distributed security of Prisma Access.

Answer

Configure Service Connections on each ION device and set the default route to use the Service Connection for all traffic.

Answer

Configure Service Connections on each ION device and use BGP to advertise routes to Prisma Access, ensuring all traffic is inspected.

Answer

Configure a single Service Connection at the data center and backhaul all branch internet traffic to the data center for inspection.

Question 7

A retail company is deploying Prisma SD-WAN at 300 branch sites. The design team wants to minimize the number of IP addresses used on the WAN side of each branch and avoid manually configuring static IPs on every CPE. Which WAN interface addressing method should be specified in the site design to meet these requirements?

Accepted Answer

DHCP client addressing on the WAN interface of each Prisma SD-WAN CPE. Using DHCP client addressing on the WAN interface allows each Prisma SD-WAN CPE to acquire its public address automatically from the service provider, which removes the need to manually assign static addresses at every branch and reduces the number of addresses the design team must plan and track. This directly satisfies the requirement to minimize WAN IP consumption and avoid per-site static configuration.

Answer

PPPoE client addressing with per-site credentials on each WAN interface

Answer

DHCP server addressing on the WAN interface of each Prisma SD-WAN CPE

Answer

Static IP addressing with a /30 subnet per WAN interface

Question 8

A network administrator is configuring a Service Connection between a branch ION device and Prisma Access. The administrator wants to ensure that all traffic from the branch to the internet is inspected by the cloud SWG, while traffic to private applications goes directly over the VPN. Which configuration element on the ION device is used to define which traffic is sent to the Service Connection?

Accepted Answer

Policy rules that match traffic based on application, domain, or IP address and specify the Service Connection as the path.. Policy rules on the ION device are used to classify traffic and direct it to the appropriate path, such as the Service Connection for internet-bound traffic or the VPN for private applications. This allows granular control based on application, domain, or IP. Static routes, QoS, and NAT do not provide the selective steering needed to meet the requirement.

Answer

Static routes configured on the ION device that point all default traffic to the Service Connection tunnel interface.

Answer

NAT rules that translate branch IP addresses to a public IP before sending traffic to the Service Connection.

Answer

QoS profiles that prioritize traffic based on application type and assign it to the Service Connection.

Question 9

You are designing a Prisma SD-WAN deployment for a retail chain with 300 small branch sites. Each site has a single broadband link and a 4G/LTE backup. The customer requires that the SD-WAN fabric automatically detect when the primary link degrades and switch traffic to the backup without manual intervention. Which Prisma SD-WAN feature should you include in the design to meet this requirement?

Accepted Answer

Policy-based path selection with application SLA profiles. The requirement is for automatic failover based on link degradation, not just link failure. Policy-based path selection with application SLA profiles continuously measures latency, jitter, and packet loss, and dynamically steers traffic to the best path. This ensures business continuity when the primary broadband link degrades, switching to the 4G/LTE backup without human intervention.

Answer

BGP route reflectors with graceful restart

Answer

VRRP with preemption enabled on the LAN side

Answer

Static route configuration with administrative distance

Question 10

A security architect is designing a Unified SASE deployment for a retail chain with 200 branch sites. The company wants to enforce consistent security policies for both internet-bound and private application traffic, while minimizing the number of separate management consoles. Which architectural component of Unified SASE directly provides this consolidation?

Accepted Answer

A single-pass parallel processing engine that combines networking and security functions in one cloud-delivered platform.. Unified SASE merges SD-WAN with cloud-delivered security services into a single platform, using a shared policy engine and single-pass processing. This architecture eliminates separate management consoles and ensures consistent enforcement for internet-bound and private application traffic. The other options describe point solutions or traditional models that do not achieve the required consolidation of networking and security.

Answer

A centralized logging server that aggregates syslog messages from all branch devices for compliance reporting.

Answer

An overlay routing protocol that automatically selects the best path based on real-time link quality metrics.

Answer

A dedicated physical firewall appliance deployed at each branch that forwards traffic to a central data center for inspection.

Question 11

A network architect is designing a Prisma SD-WAN deployment for a retail chain with 400 small branches. Each branch has a single broadband circuit and a 4G/LTE backup. The design must minimize hardware cost at the branch while still supporting the SD-WAN fabric. Which ION device deployment approach best fits this requirement?

Accepted Answer

Deploy a single ION device sized for the branch's aggregate WAN throughput at each branch.. Choosing a single ION appliance sized to the branch's combined WAN capacity keeps the fabric requirement satisfied while holding branch hardware, power, and licensing costs down, which is exactly what a 400-site retail rollout needs. Higher-capacity redundant pairs and full hypervisor stacks add expense and complexity the scenario does not justify.

Answer

Deploy a pair of ION 9000 devices at each branch for full redundancy.

Answer

Use only virtual ION instances hosted on third-party hypervisors at each branch.

Answer

Rely on the LTE circuit alone and skip any SD-WAN device at the branch.

Question 12

A network engineer is configuring a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer wants to ensure that traffic from a specific branch is inspected by Prisma Access, but also wants to avoid sending traffic to Prisma Access for destinations that are reachable via a direct SD-WAN path to the data center. Which Prisma SD-WAN feature allows the engineer to define which traffic should be sent to Prisma Access?

Accepted Answer

Policy Sets. Policy Sets are the correct feature. In Prisma SD-WAN, policy sets are applied to ION devices and contain rules that match traffic and define actions, including steering to a service connection. By creating a policy set with a rule that matches internet-bound traffic and steers it to the Prisma Access service connection, and another rule that allows data center traffic to use the direct path, the engineer achieves the desired behavior. This is the standard method for traffic engineering in Unified SASE.

Answer

Application Definition

Answer

Service Connection Groups

Answer

WAN Interface Profiles

Question 13

A network operations engineer needs to confirm whether the OMP routes advertised by a specific branch vEdge have been received by the vSmart controller and propagated to other sites. The engineer is already logged into the CLI of the vSmart controller. Which command should be used to display the OMP routes received from that branch?

Accepted Answer

show omp routes. On a vSmart controller, OMP routes are stored in the OMP route table. The command 'show omp routes' displays these routes along with attributes like originator, VPN, and path, allowing the engineer to confirm that the branch's routes were received and are being advertised. Other commands show IP or BGP routes, or only control connection status, and do not provide the required OMP route information.

Answer

show control connections

Answer

show bgp routes

Answer

show ip route

Question 14

You are designing branch connectivity for a manufacturer that requires deterministic failover between a primary MPLS circuit and a secondary internet circuit, and the security team mandates that traffic to a specific PCI-scoped subnet be inspected by a next-generation firewall appliance sitting inline at the branch. Which two Prisma SD-WAN design elements must you include to meet these requirements? (Choose two.)

Accepted Answer

Define the MPLS and internet circuits as separate WAN interfaces on the ION device and place them in a single active-backup path group ordered with MPLS first. Deterministic failover comes from a preference-ordered path group containing both WAN interfaces, with MPLS ranked first so internet is used only when MPLS health probes fail. Inline inspection of the PCI subnet comes from a service link to the attached firewall plus a policy set that redirects matching traffic to that service link. Together these elements satisfy both the availability and the security design constraints.

Answer

Enable ECMP across the MPLS and internet interfaces so both circuits forward PCI traffic simultaneously for higher availability

Answer

Configure a NAT pool on the internet interface and advertise it into the MPLS routing domain so the firewall sees a single source address

Answer

Apply a QoS policy that marks PCI traffic as real-time and maps it to the MPLS interface only

Question 15

A network architect is designing a Prisma SD-WAN deployment for a retail chain with 300 small branch sites, each with two broadband circuits and no MPLS. The design must ensure that if a branch's active tunnel degrades, traffic fails over within a few seconds without requiring BGP reconvergence. Which ION device configuration element should be included in the design to meet this requirement?

Accepted Answer

Enable path quality monitoring with a low failover threshold on each WAN interface.. Prisma SD-WAN uses continuous path quality monitoring to measure latency, jitter, and loss on each WAN interface. When thresholds are breached, the ION device instantly redirects traffic to a better path without waiting for routing protocol convergence. This is the native mechanism for sub-five-second failover in a dual-broadband branch design. Configuring BGP timers, static routes, or VRRP does not provide the same quality-based, rapid failover behavior.

Answer

Create a static route with a low administrative distance for the backup broadband circuit.

Answer

Deploy a redundant ION device at each branch and configure VRRP between them.

Answer

Configure BGP with a short keepalive and hold timer on the branch ION device.

Question 16

A network administrator is troubleshooting a performance issue where voice traffic is being routed over a less optimal path despite a better path being available. The administrator suspects that the Application-Aware Routing policy is not functioning as intended. Which two actions should be taken to verify that the policy is correctly applied and the SLA is being met? (Choose two.)

Accepted Answer

Check the 'App Route' statistics in vManage for the site to see the path chosen for the voice application.. To verify application-aware routing for voice, you must confirm that the policy is selecting the correct path based on SLA. The App Route statistics in vManage show the chosen path per application, and BFD/SLA status confirms that the path meets the required thresholds. Without both, the policy cannot function as intended. Packet capture, OMP routes, and syslog do not directly show policy effectiveness.

Answer

Review the OMP routes to ensure the voice prefix is advertised with the correct TLOC.

Answer

Check the syslog on the branch router for messages about policy failures.

Answer

Run a packet capture on the voice VLAN to analyze the RTP stream.

Question 17

A network operations engineer is troubleshooting a Cisco SD-WAN overlay where a branch site's WAN Edge router has lost its control plane connectivity to the vSmart controllers. The engineer runs the command `show control connections` on the WAN Edge and sees that all control connections are in a 'connect' state rather than 'up'. Which action should the engineer take first to diagnose the issue?

Accepted Answer

Check the WAN Edge's `show control local-properties` output to confirm the organization name and VBOND/controller IPs are correctly configured.. When control connections are stuck in 'connect', the most likely cause is a misconfiguration of the WAN Edge's control plane parameters such as organization name, VBOND, or controller IPs. The `show control local-properties` command provides a quick snapshot of these settings, allowing the engineer to verify them against the intended configuration before investigating underlay or certificate issues.

Answer

Verify the WAN Edge's system IP is reachable by pinging the vSmart controller's system IP from the WAN Edge.

Answer

Verify that the WAN Edge has a valid certificate and that the root CA is installed.

Answer

Restart the vSmart controller to force a new DTLS session with the WAN Edge.

Question 18

A network engineer is validating the health of an SD-WAN fabric after a controller upgrade. The engineer needs to verify that the control plane and data plane are operating correctly across all devices. Which two vManage monitoring screens should be checked to confirm that all control connections are up and that the data plane tunnels are established? (Choose two.)

Accepted Answer

Tunnels. To verify control plane health, the Control Connections screen lists all control connections and their states. For data plane health, the Tunnels screen shows the status of data plane tunnels between devices. Together, these screens confirm that both planes are operational after the controller upgrade. Other screens like Interface Statistics, Alarms, or Application Awareness provide different metrics and do not directly show control connection or tunnel status.

Answer

Alarms

Answer

Interface Statistics

Answer

Application Awareness

Question 19

Which menu path is used to view the real-time tunnel statistics for a specific vEdge router?

Accepted Answer

Monitor > Network > [Device] > Tunnel.. Monitor > Network allows you to select a specific device and view its tunnel performance.

Answer

Administration > Settings.

Answer

Tools > Real-time monitoring.

Answer

Configuration > Devices.

Question 20

A network operations team is using Cisco vManage to manage a large SD-WAN fabric. They need to view a real-time, hop-by-hop path trace between a branch router and a data center application server to pinpoint where latency is being introduced. Which vManage feature should they use to capture this information?

Accepted Answer

vManage Real-Time Monitoring > Device > Troubleshooting > Path Trace. The Path Trace tool under Real-Time Monitoring is designed specifically for on-demand, hop-by-hop diagnostics across the SD-WAN overlay. It shows each device and interface traversed, along with latency and loss per hop, enabling the team to isolate the exact segment causing delay. Other monitoring views provide aggregate or single-device data and cannot replace a live path trace for this purpose.

Answer

Application-Aware Routing (AAR) policy

Answer

vManage Monitor > Network > Interface statistics

Answer

vManage Monitor > Applications > App Route statistics