SD-WAN-Engineer Practice Test 6 — 10 Questions

Question 1

A security administrator is troubleshooting a Unified SASE deployment where branch users cannot access a critical internal application hosted in an on-premises data center. The application is reachable from other sites, but branch traffic destined to the application's IP is being routed to Prisma Access instead of the data center. The ION device has a Service Connection configured to Prisma Access and a VPN connection to the data center. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ION device's routing table has a more specific route to the application via the Service Connection than via the VPN connection.. The ION device selects routes based on longest prefix match. If the Service Connection advertises a more specific route to the application's IP than the VPN connection, the ION will forward that traffic to Prisma Access. This misrouting prevents branch users from reaching the internal application. The administrator should verify the advertised routes from both connections and adjust route preferences or filters to ensure internal traffic uses the VPN.

Answer

The VPN connection to the data center is using a different encryption domain than the branch.

Answer

The Service Connection is down, causing all traffic to be dropped.

Answer

The application's IP is included in the local breakout policy, sending it directly to the internet.

Question 2

What are the primary benefits of implementing a hub-and-spoke design with Prisma SD-WAN? (Choose THREE)

Accepted Answer

Simplified management and visibility. Option C is correct because a Prisma SD-WAN hub-and-spoke topology lets administrators manage all branch sites from a central controller (the Prisma SD-WAN portal) and gain unified visibility into WAN health, application performance, and link status across every spoke. Option D is correct because branch traffic destined for other branches or the internet is groomed through the hub, allowing the hub to aggregate, prioritize, and forward flows efficiently rather than maintaining full-mesh tunnels between every site. Option E is correct because the hub acts as a central chokepoint where security policy (e.g., zone-based firewall, IPS, URL filtering) can be consistently enforced for all spoke traffic before it reaches the data center or internet. Option A is not correct because Prisma SD-WAN still requires branch CPE (ION devices or virtual IONs), so deployments are not hardware-less. Option B is not correct because no SD-WAN architecture provides infinite bandwidth at the branch; bandwidth remains bounded by the physical links and licensed throughput.

Answer

Hardware-less branch deployments

Answer

Infinite bandwidth at the branch

Question 3

A site has two ISPs. Traffic is only using one. What is the best way to verify if both paths are available?

Accepted Answer

Check Path Quality dashboard. The Path Quality dashboard displays the health status of all defined paths.

Answer

Ping from the LAN

Answer

Review firewall rules

Answer

Check the BGP summary

Question 4

A network architect is designing a Prisma SD-WAN deployment for a company with 50 branches. Each branch has two internet links from different ISPs. The architect wants to ensure that business-critical applications always use the best-performing link based on real-time latency, jitter, and packet loss. Additionally, the architect wants to avoid using a link that is experiencing high packet loss. Which Prisma SD-WAN feature should be configured to meet these requirements?

Accepted Answer

Application-based path selection policies with health thresholds for latency, jitter, and packet loss.. Application-based path selection policies with health thresholds allow Prisma SD-WAN to monitor real-time latency, jitter, and packet loss on each WAN link. The system then steers business-critical applications to the best-performing link and avoids links that exceed the configured thresholds, ensuring optimal application performance.

Answer

Load balancing across both ISP links using per-flow distribution.

Answer

QoS policies with strict priority queues for business-critical applications.

Answer

Static routes with administrative distance to prefer one ISP over the other.

Question 5

Where do you view the history of configuration changes pushed to an ION device?

Accepted Answer

Audit Logs. The audit log records all configuration modifications and administrative actions.

Answer

Error Reports

Answer

Event Viewer

Answer

System Logs

Question 6

Which dashboard is most useful for identifying top bandwidth consumers in the network?

Accepted Answer

Application/Flow Monitoring. The App/Flow dashboard identifies top applications and users by bandwidth.

Answer

Path Quality

Answer

System Health

Answer

Security Events

Question 7

A network administrator is deploying a new branch with a Prisma SD-WAN ION device and wants to leverage Unified SASE for security inspection. The administrator has already configured the Service Connection to Prisma Access. Which additional step is required to ensure that traffic from the branch is inspected by Prisma Access?

Accepted Answer

Create a policy on the ION device that directs traffic to the Service Connection.. After establishing the Service Connection, the ION device must have a policy that directs specific traffic to that connection. This policy ensures that traffic is encapsulated and sent to Prisma Access for inspection. Without it, traffic will use the default internet path and bypass security inspection.

Answer

Assign a security zone to the branch ION device in Prisma Access.

Answer

Configure a security policy in Prisma Access that allows traffic from the branch.

Answer

Enable 'Unified SASE' in the Prisma SD-WAN portal for the branch site.

Question 8

In the context of the SD-WAN Controller, what does the 'Template' object represent?

Accepted Answer

A reusable configuration baseline. A template is a reusable configuration set applied to multiple gateways to ensure consistency.

Answer

A single device configuration file

Answer

A firmware update package

Answer

A hardware specification sheet

Question 9

A network engineer is deploying a new branch with two ION devices for high availability. The engineer wants both devices to share a single virtual IP address on the LAN side so that hosts use a consistent default gateway even if one device fails. Which LAN-side configuration should be implemented?

Accepted Answer

Configure VRRP on the LAN interfaces of both ION devices.. To provide a redundant default gateway for LAN hosts, the ION devices must share a virtual IP address. VRRP is the standard protocol for this, allowing one device to act as master and another as backup. DHCP Relay, BGP, and duplicate static IPs do not achieve gateway redundancy and would either not provide a virtual IP or cause conflicts.

Answer

Create a BGP peering session between the two ION devices.

Answer

Assign both ION devices the same static IP address on their LAN interfaces.

Answer

Enable DHCP Relay on both ION devices.

Question 10

What is the function of the 'Reachability' check in the ION device configuration?

Accepted Answer

To verify ISP link status. It tests if the path is actually capable of reaching the destination, confirming path health.

Answer

To update firmware

Answer

To backup configuration

Answer

To check CPU load