SD-WAN-Engineer Practice Test 8 — 10 Questions

Question 1

A network architect is designing a Prisma SD-WAN deployment for a retail chain with 400 small branches. Each branch has a single broadband circuit and a 4G/LTE backup. The design must minimize hardware cost at the branch while still supporting the SD-WAN fabric. Which ION device deployment approach best fits this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a single ION device sized for the branch's aggregate WAN throughput at each branch.. Choosing a single ION appliance sized to the branch's combined WAN capacity keeps the fabric requirement satisfied while holding branch hardware, power, and licensing costs down, which is exactly what a 400-site retail rollout needs. Higher-capacity redundant pairs and full hypervisor stacks add expense and complexity the scenario does not justify.

Answer

Deploy a pair of ION 9000 devices at each branch for full redundancy.

Answer

Use only virtual ION instances hosted on third-party hypervisors at each branch.

Answer

Rely on the LTE circuit alone and skip any SD-WAN device at the branch.

Question 2

A network engineer is configuring a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer wants to ensure that traffic from a specific branch is inspected by Prisma Access, but also wants to avoid sending traffic to Prisma Access for destinations that are reachable via a direct SD-WAN path to the data center. Which Prisma SD-WAN feature allows the engineer to define which traffic should be sent to Prisma Access?

Accepted Answer

Policy Sets. Policy Sets are the correct feature. In Prisma SD-WAN, policy sets are applied to ION devices and contain rules that match traffic and define actions, including steering to a service connection. By creating a policy set with a rule that matches internet-bound traffic and steers it to the Prisma Access service connection, and another rule that allows data center traffic to use the direct path, the engineer achieves the desired behavior. This is the standard method for traffic engineering in Unified SASE.

Answer

Application Definition

Answer

Service Connection Groups

Answer

WAN Interface Profiles

Question 3

A network operations engineer needs to confirm whether the OMP routes advertised by a specific branch vEdge have been received by the vSmart controller and propagated to other sites. The engineer is already logged into the CLI of the vSmart controller. Which command should be used to display the OMP routes received from that branch?

Accepted Answer

show omp routes. On a vSmart controller, OMP routes are stored in the OMP route table. The command 'show omp routes' displays these routes along with attributes like originator, VPN, and path, allowing the engineer to confirm that the branch's routes were received and are being advertised. Other commands show IP or BGP routes, or only control connection status, and do not provide the required OMP route information.

Answer

show control connections

Answer

show bgp routes

Answer

show ip route

Question 4

You are designing branch connectivity for a manufacturer that requires deterministic failover between a primary MPLS circuit and a secondary internet circuit, and the security team mandates that traffic to a specific PCI-scoped subnet be inspected by a next-generation firewall appliance sitting inline at the branch. Which two Prisma SD-WAN design elements must you include to meet these requirements? (Choose two.)

Accepted Answer

Define the MPLS and internet circuits as separate WAN interfaces on the ION device and place them in a single active-backup path group ordered with MPLS first. Deterministic failover comes from a preference-ordered path group containing both WAN interfaces, with MPLS ranked first so internet is used only when MPLS health probes fail. Inline inspection of the PCI subnet comes from a service link to the attached firewall plus a policy set that redirects matching traffic to that service link. Together these elements satisfy both the availability and the security design constraints.

Answer

Enable ECMP across the MPLS and internet interfaces so both circuits forward PCI traffic simultaneously for higher availability

Answer

Configure a NAT pool on the internet interface and advertise it into the MPLS routing domain so the firewall sees a single source address

Answer

Apply a QoS policy that marks PCI traffic as real-time and maps it to the MPLS interface only

Question 5

A network architect is designing a Prisma SD-WAN deployment for a retail chain with 400 small branches. Each branch has a single broadband circuit and a 4G/LTE backup. The design must minimize hardware cost at the branch while still supporting the SD-WAN fabric. Which ION device deployment approach best fits this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable path quality monitoring with a low failover threshold on each WAN interface.. Prisma SD-WAN uses continuous path quality monitoring to measure latency, jitter, and loss on each WAN interface. When thresholds are breached, the ION device instantly redirects traffic to a better path without waiting for routing protocol convergence. This is the native mechanism for sub-five-second failover in a dual-broadband branch design. Configuring BGP timers, static routes, or VRRP does not provide the same quality-based, rapid failover behavior.

Answer

Create a static route with a low administrative distance for the backup broadband circuit.

Answer

Deploy a redundant ION device at each branch and configure VRRP between them.

Answer

Configure BGP with a short keepalive and hold timer on the branch ION device.

Question 6

A network administrator is troubleshooting a performance issue where voice traffic is being routed over a less optimal path despite a better path being available. The administrator suspects that the Application-Aware Routing policy is not functioning as intended. Which two actions should be taken to verify that the policy is correctly applied and the SLA is being met? (Choose two.)

Accepted Answer

Check the 'App Route' statistics in vManage for the site to see the path chosen for the voice application.. To verify application-aware routing for voice, you must confirm that the policy is selecting the correct path based on SLA. The App Route statistics in vManage show the chosen path per application, and BFD/SLA status confirms that the path meets the required thresholds. Without both, the policy cannot function as intended. Packet capture, OMP routes, and syslog do not directly show policy effectiveness.

Answer

Review the OMP routes to ensure the voice prefix is advertised with the correct TLOC.

Answer

Check the syslog on the branch router for messages about policy failures.

Answer

Run a packet capture on the voice VLAN to analyze the RTP stream.

Question 7

A network operations engineer is troubleshooting a Cisco SD-WAN overlay where a branch site's WAN Edge router has lost its control plane connectivity to the vSmart controllers. The engineer runs the command `show control connections` on the WAN Edge and sees that all control connections are in a 'connect' state rather than 'up'. Which action should the engineer take first to diagnose the issue?

Accepted Answer

Check the WAN Edge's `show control local-properties` output to confirm the organization name and VBOND/controller IPs are correctly configured.. When control connections are stuck in 'connect', the most likely cause is a misconfiguration of the WAN Edge's control plane parameters such as organization name, VBOND, or controller IPs. The `show control local-properties` command provides a quick snapshot of these settings, allowing the engineer to verify them against the intended configuration before investigating underlay or certificate issues.

Answer

Verify the WAN Edge's system IP is reachable by pinging the vSmart controller's system IP from the WAN Edge.

Answer

Verify that the WAN Edge has a valid certificate and that the root CA is installed.

Answer

Restart the vSmart controller to force a new DTLS session with the WAN Edge.

Question 8

A network engineer is validating the health of an SD-WAN fabric after a controller upgrade. The engineer needs to verify that the control plane and data plane are operating correctly across all devices. Which two vManage monitoring screens should be checked to confirm that all control connections are up and that the data plane tunnels are established? (Choose two.)

Accepted Answer

Tunnels. To verify control plane health, the Control Connections screen lists all control connections and their states. For data plane health, the Tunnels screen shows the status of data plane tunnels between devices. Together, these screens confirm that both planes are operational after the controller upgrade. Other screens like Interface Statistics, Alarms, or Application Awareness provide different metrics and do not directly show control connection or tunnel status.

Answer

Alarms

Answer

Interface Statistics

Answer

Application Awareness

Question 9

Which menu path is used to view the real-time tunnel statistics for a specific vEdge router?

Accepted Answer

Monitor > Network > [Device] > Tunnel.. Monitor > Network allows you to select a specific device and view its tunnel performance.

Answer

Administration > Settings.

Answer

Tools > Real-time monitoring.

Answer

Configuration > Devices.

Question 10

A network operations team is using Cisco vManage to manage a large SD-WAN fabric. They need to view a real-time, hop-by-hop path trace between a branch router and a data center application server to pinpoint where latency is being introduced. Which vManage feature should they use to capture this information?

Accepted Answer

vManage Real-Time Monitoring > Device > Troubleshooting > Path Trace. The Path Trace tool under Real-Time Monitoring is designed specifically for on-demand, hop-by-hop diagnostics across the SD-WAN overlay. It shows each device and interface traversed, along with latency and loss per hop, enabling the team to isolate the exact segment causing delay. Other monitoring views provide aggregate or single-device data and cannot replace a live path trace for this purpose.

Answer

Application-Aware Routing (AAR) policy

Answer

vManage Monitor > Network > Interface statistics

Answer

vManage Monitor > Applications > App Route statistics