SD-WAN-Engineer Practice Test 4 — 10 Questions

Question 1

Which protocol is primarily used for the tunnel between the ION device and the Prisma Access Service Infrastructure?

Accepted Answer

IPSec. IPSec is the standard protocol for creating secure tunnels between SD-WAN devices and cloud service infrastructure.

Answer

SSL

Answer

GRE

Answer

MPLS

Question 2

An engineer needs to view real-time application-aware routing statistics for a specific site in vManage. Which menu path should the engineer use?

Accepted Answer

Monitor > Network > App Route. To view real-time application-aware routing statistics in vManage, navigate to Monitor > Network > App Route. This view displays the metrics used by AAR, such as latency, loss, and jitter per application and path, allowing engineers to confirm path selection and troubleshoot routing decisions.

Answer

Monitor > Network > WAN Clarity

Answer

Monitor > Network > Real Time

Answer

Monitor > Network > Applications

Question 3

A network architect is reviewing the SD-WAN fabric's high availability design. The architect wants to ensure that if a vSmart controller becomes unavailable, the WAN Edge routers continue to forward traffic without interruption. Which statement accurately describes the behavior of WAN Edge routers when a vSmart controller fails in a multi-controller deployment?

Accepted Answer

WAN Edge routers continue to forward traffic using existing OMP routes and locally cached policies, and they attempt to reconnect to a surviving vSmart controller.. In a multi-controller vSmart deployment, WAN Edge routers establish control connections to multiple vSmart controllers for redundancy. If one vSmart fails, the routers retain their cached OMP routes and policies and continue forwarding traffic without interruption. They simultaneously attempt to reconnect to a surviving vSmart controller to maintain control plane updates. This design ensures high availability and uninterrupted data plane operation.

Answer

WAN Edge routers immediately drop all data plane traffic until they reconnect to a surviving vSmart controller.

Answer

WAN Edge routers stop advertising their TLOCs to other sites until a vSmart controller is reachable again.

Answer

WAN Edge routers revert to a default route and forward all traffic to the vBond orchestrator until a vSmart controller is available.

Question 4

A customer requires a granular segmentation strategy where HR, Engineering, and Guest traffic must remain isolated across the SD-WAN fabric. Which configuration construct provides this logical separation?

Accepted Answer

Virtual Networks (VNets). Virtual Networks (VNets) allow for the logical segmentation of traffic throughout the fabric.

Answer

IPsec Tunnel Groups

Answer

Subnet Masking

Answer

VLAN Tagging

Question 5

You notice an ION device is showing as 'Disconnected' in the Controller UI. What is the first step you should take?

Accepted Answer

Check physical interface status and WAN connectivity. Verifying WAN connectivity and local interface status is the logical first step in troubleshooting connectivity.

Answer

Upgrade the device firmware

Answer

Reboot the ION device

Answer

Delete and recreate the site

Question 6

Which THREE components are verified during the ION device 'check' sequence at startup?

Accepted Answer

Link status. The ION device 'check' sequence at startup validates the operational readiness of the device's own resources and its management connectivity. Option C (Link status) is correct because the device verifies that its WAN/LAN interfaces have physical link up before proceeding. Option D (Configuration integrity) is correct because the startup check confirms the stored configuration is valid and not corrupted so the device can apply it. Option E (Controller reachability) is correct because the ION device must confirm it can reach its management controller/orchestrator to register and receive policy. Options A (Cloud application popularity) and B (User browser history) are not part of the device startup check sequence; these are traffic/analytics data unrelated to local device health and management readiness.

Answer

Cloud application popularity

Answer

User browser history

Question 7

A network engineer is deploying a new branch ION device at a site with two WAN links and wants to guarantee that business-critical voice traffic always uses the lowest-latency path, even when one link degrades. Which Prisma SD-WAN configuration should be applied to the branch ION device to meet this requirement?

Accepted Answer

Create a policy set with a path selection policy that uses the lowest-latency path for voice traffic and a failover action to the secondary link.. A path selection policy with lowest-latency criteria and a failover action is the correct approach because it continuously monitors WAN link performance and dynamically routes voice traffic over the best available path, with automatic failover if the primary link degrades. This ensures the required low-latency treatment without manual intervention.

Answer

Configure a static route for the voice subnet pointing to the primary WAN interface.

Answer

Enable Forward Error Correction on both WAN interfaces to reduce latency for voice traffic.

Answer

Set up a QoS policy that prioritizes voice traffic in the queue on the primary WAN link.

Question 8

A network administrator is troubleshooting a Prisma SD-WAN environment where an ION device is experiencing intermittent packet loss on a business-critical application. The administrator suspects that the issue is related to a policy misconfiguration. Which two actions should the administrator take to verify that the correct policies are being applied to the traffic? (Choose two.)

Accepted Answer

Use the Flow Analytics dashboard to examine the path and policy applied to the specific application flow.. To verify that the correct application policies are applied, the administrator should review the policy stack order to ensure no shadowing occurs and use Flow Analytics to inspect the actual policy and path for the specific flow. These actions directly confirm whether the intended policy is enforced, which is crucial for troubleshooting intermittent packet loss caused by policy misconfiguration.

Answer

Check the ION device's system logs for policy deny messages.

Answer

Verify that the ION device has the latest software version installed.

Answer

Run a traceroute from the ION device to the application server to identify the path taken.

Question 9

A network operations center (NOC) engineer is monitoring a Prisma SD-WAN deployment and notices that one ION device at a remote site is consistently showing high latency on its broadband link, while the LTE link is performing well. The engineer wants to quickly identify whether the high latency is due to an ISP issue or a device problem. Which of the following should the engineer check first?

Accepted Answer

The Prisma SD-WAN Controller's path quality metrics for the broadband link.. The Prisma SD-WAN Controller continuously monitors path quality for each WAN link, providing latency, jitter, and loss metrics. By comparing the controller's measurements with the device's local observations, the engineer can quickly ascertain whether the high latency is consistent across the path (indicating an ISP issue) or isolated to the device (suggesting a local problem). This is the most efficient first step.

Answer

The ION device's CPU utilization and memory usage.

Answer

The ION device's interface statistics for errors and discards.

Answer

The broadband ISP's public status page for outages.

Question 10

A network engineer is deploying a new branch office with a single Prisma SD-WAN ION device. The branch has two WAN links: a primary fiber circuit and a backup LTE connection. The engineer wants the ION device to automatically establish secure tunnels to the Prisma SD-WAN controller and to the nearest data center without manual intervention. Which deployment method should the engineer use?

Accepted Answer

Zero-Touch Provisioning (ZTP) with a claim code. Zero-Touch Provisioning (ZTP) with a claim code enables the ION device to automatically register with the Prisma SD-WAN controller, retrieve its configuration, and establish secure tunnels to data centers and other branches. This method eliminates manual configuration and is the standard for branch deployments.

Answer

Configuring a DHCP option 43 on the branch router to point to the controller

Answer

Manual CLI configuration of IPsec tunnels and controller IP addresses

Answer

Pre-staging the device by copying a configuration file to a USB drive and booting the device