SD-WAN-Engineer Deployment And Configuration — 15 Questions

Question 1

Which TWO steps are required to successfully deploy a new branch ION device using Zero-Touch Provisioning (ZTP)?

Accepted Answer

Ensure the WAN interface has internet connectivity. ZTP requires the device to be registered and connected to the internet to reach the Controller.

Answer

Create a manual IPsec tunnel to the hub

Answer

Install a local management agent

Question 2

Which command or interface action is used to verify the current status of the SD-WAN overlay tunnels?

Accepted Answer

Show tunnels view in the Controller. The Controller dashboard or the ION CLI provides real-time tunnel status.

Answer

show routing table

Answer

show interface status

Answer

ping gateway

Question 3

A branch office requires local breakout for SaaS traffic. How do you configure the policy to ensure this traffic does not traverse the data center?

Accepted Answer

Configure a destination-based policy with a Local Breakout action. The destination-based policy for direct internet access (DIA) ensures local traffic exits locally.

Answer

Set the VRF to global

Answer

Apply a hub-and-spoke routing policy

Answer

Enable NAT on the WAN interface

Question 4

You need to ensure that specific branch traffic is encrypted over a public internet link. Which configuration step is mandatory?

Accepted Answer

Enable Auto-VPN on the WAN interface. VPN tunnels are established automatically between ION devices when policies are defined, but the path must be categorized to allow tunnel formation.

Answer

Manually configure IPsec parameters

Answer

Disable firewall policies

Answer

Configure a static route to the peer

Question 5

You are implementing a QoS policy. Why would you configure a 'Shaping' rate on a WAN interface?

Accepted Answer

To manage congestion and match the provider's provisioned rate. Shaping limits the outbound rate of traffic to match the committed information rate (CIR) of the circuit.

Answer

To enable load balancing

Answer

To increase the circuit bandwidth

Answer

To match the physical interface speed

Question 6

What is the impact of assigning a site to a specific 'Site Group' in a Prisma SD-WAN policy?

Accepted Answer

It allows the application of policy sets to multiple sites simultaneously. Site Groups allow for scalable policy application across multiple sites with similar requirements.

Answer

It creates a new physical network

Answer

It forces all sites into the same VRF

Answer

It limits the number of peers

Question 7

You are configuring a path policy to prioritize VoIP traffic. Which specific metric should you leverage to ensure the best call quality when multiple paths are available?

Accepted Answer

Path performance metric. Jitter and latency are critical for voice; the policy uses performance metrics to steer traffic dynamically.

Answer

DSCP marking

Answer

Bandwidth consumption

Answer

Source IP address

Question 8

When configuring an ION device as a gateway for a cloud environment, what is the primary role of a 'Service' interface?

Accepted Answer

To provide connectivity to LAN-side services or segments. Service interfaces are designated for specific traffic flows or service chains within the SD-WAN fabric.

Answer

To provide management access

Answer

To update firmware

Answer

To connect to the ISP modem

Question 9

When deploying a new ION device, which Prisma SD-WAN component is primarily used to initiate the zero-touch provisioning process?

Accepted Answer

Controller. The ION device reaches out to the Controller during the initial bootstrap process to pull its configuration and firmware.

Answer

Prisma Access

Answer

CloudBlades

Answer

Prisma SD-WAN Plugin

Question 10

When configuring a security policy, what is the purpose of an 'Application' object?

Accepted Answer

To identify traffic by application signatures rather than just ports. Application objects identify traffic by signature, allowing for specific policy control.

Answer

To set the bandwidth limit

Answer

To define the physical interface

Answer

To define the user identity

Question 11

In a multi-VRF deployment, what must be configured to allow traffic to move between two different VRFs?

Accepted Answer

Configure inter-VRF routing policies. Cross-VRF communication requires explicit route leaking or inter-VRF routing policies.

Answer

Enable NAT on both interfaces

Answer

Assign both to the default VRF

Answer

Disable the firewall

Question 12

What does the 'App-ID' feature provide in a security policy?

Accepted Answer

Dynamic identification of applications. App-ID identifies the application regardless of the port being used.

Answer

A list of blocked URLs

Answer

Device inventory

Answer

A list of IP addresses

Question 13

What is the effect of changing the 'Path Selection' strategy from 'Latency' to 'Lowest Cost' in a policy?

Accepted Answer

It prioritize links based on configured cost parameters. 'Lowest Cost' prioritizes links with lower administrative or service costs rather than performance metrics.

Answer

It disables all tunnels

Answer

It forces traffic to the internet

Answer

It improves jitter

Question 14

How does a 'Failover' policy differ from a 'Load Balancing' policy in Prisma SD-WAN?

Accepted Answer

Failover uses only one link at a time. Failover is reactive to link loss, while load balancing distributes traffic across links simultaneously.

Answer

Load balancing only works on LAN

Answer

Load balancing is not supported

Answer

Failover requires more bandwidth

Question 15

When setting up a branch site, what is the purpose of the 'Underlay' configuration?

Accepted Answer

To configure the ISP circuit details. Underlay configuration defines the physical WAN circuit parameters (ISP, bandwidth, etc.) for the SD-WAN tunnel overlay.

Answer

To define the routing protocol

Answer

To manage internal LAN switches

Answer

To configure DHCP