SD-WAN-Engineer Deployment And Configuration — 40 Questions

Question 1

You need to ensure that specific branch traffic is encrypted over a public internet link. Which configuration step is mandatory?

Accepted Answer

Enable Auto-VPN on the WAN interface. VPN tunnels are established automatically between ION devices when policies are defined, but the path must be categorized to allow tunnel formation.

Answer

Manually configure IPsec parameters

Answer

Disable firewall policies

Answer

Configure a static route to the peer

Question 2

You are troubleshooting a performance issue where traffic is not taking the preferred path. Which tool in the Controller helps you visualize the path taken?

Accepted Answer

Flow Monitoring. The path visualization tool displays the real-time path selected by the SD-WAN engine.

Answer

Interface counters

Answer

System Logs

Answer

Packet Capture

Question 3

What is the primary benefit of enabling 'Forward Error Correction' (FEC) on a high-latency WAN link?

Accepted Answer

It improves performance for jitter-sensitive traffic. FEC adds redundant data to packets, allowing the receiver to reconstruct lost packets without retransmission.

Answer

It bypasses the firewall

Answer

It replaces the need for QoS

Answer

It reduces total bandwidth usage

Question 4

Which TWO steps are required to successfully deploy a new branch ION device using Zero-Touch Provisioning (ZTP)?

Accepted Answer

Ensure the WAN interface has internet connectivity. ZTP requires the device to be registered and connected to the internet to reach the Controller.

Answer

Create a manual IPsec tunnel to the hub

Answer

Install a local management agent

Question 5

Which TWO methods can be used to identify traffic for a policy?

Accepted Answer

Source/Destination IP addresses. Source/Destination IP addresses (A) are correct because firewall and security policies commonly match traffic by the Layer 3 header fields, i.e., the source and destination IP addresses in the packet, which uniquely identify the endpoints of a flow. Application signatures (C) are also correct because next-generation firewalls and IPS/IDS platforms use application signatures (deep packet inspection patterns) to identify the specific application or protocol generating the traffic, allowing policy enforcement based on application identity rather than just ports. Router model (B) is not a traffic identifier—it describes hardware and cannot distinguish one flow from another. Device serial number (D) identifies a physical device, not network traffic, so it cannot be used to match packets in a policy. Physical port location (E) may be used in some switch or port-based policies, but it is not one of the two standard methods for identifying traffic for a policy in this context.

Answer

Router model

Answer

Device serial number

Answer

Physical port location

Question 6

Which THREE types of traffic are commonly categorized for specific QoS treatment?

Accepted Answer

Mission-critical database traffic. Option A (mission-critical database traffic) is correct because transactional database flows require guaranteed low latency and jitter with high reliability, so they are typically placed in a high-priority QoS class such as AF31/AF32 or a priority queue to protect them from congestion. Option C (VoIP traffic) is correct because voice uses RTP over UDP and is extremely sensitive to latency, jitter, and packet loss, so it is commonly classified into the EF (Expedited Forwarding) per-hop behavior with priority queueing and CAC. Option E (video conferencing) is correct because interactive video is real-time, delay-sensitive traffic typically classified into AF41 or a dedicated real-time class to keep latency and jitter low. Option B (public guest Wi-Fi browsing) is not a standard QoS category because guest web traffic is generally treated as best-effort or scavenger-class traffic with no special treatment. Option D (idle background system updates) is not a specific QoS category because such bulk, non-time-sensitive traffic is typically placed in a low-priority or scavenger class rather than being a defined QoS treatment category.

Answer

Public guest Wi-Fi browsing

Answer

Idle background system updates

Question 7

A network administrator is configuring a Prisma SD-WAN policy to ensure that all voice traffic from a branch site is marked with DSCP EF when it egresses the WAN. The administrator has already created an application definition for voice and a policy rule. Which additional configuration element must be applied to the WAN interface to enforce the DSCP marking?

Accepted Answer

Apply a 'Rewrite DSCP' action in the policy rule.. To enforce a specific DSCP marking on voice traffic egressing the WAN, the policy rule must include a 'Rewrite DSCP' action. This action changes the DSCP field in the IP header of matching packets, ensuring they are marked with EF. Other options like DSCP Trust or FEC do not alter the marking; they serve different purposes such as trusting existing markings or adding redundancy.

Answer

Enable 'DSCP Trust' on the WAN interface.

Answer

Enable 'Forward Error Correction' on the WAN interface.

Answer

Configure a QoS policy with a 'Mark' action for the voice application.

Question 8

You are deploying a new Prisma SD-WAN branch site. The branch has two ISP circuits: a primary fiber connection and a backup LTE connection. The customer wants the LTE link to remain idle (no traffic) unless the fiber link fails completely. Which WAN interface configuration setting should you apply to the LTE interface to achieve this?

Accepted Answer

Set the LTE interface to 'Standby' mode.. Standby mode is the correct choice because it keeps the LTE interface ready but unused until the primary fiber path fails. This prevents unnecessary LTE data consumption and ensures the backup link is available only when needed. The other options either do not exist in Prisma SD-WAN or would allow traffic on the LTE link, violating the requirement.

Answer

Set the LTE interface to 'Passive' mode and enable 'Failover Only'.

Answer

Enable 'Load Balancing' on both interfaces and set LTE weight to 0.

Answer

Configure the LTE interface as a 'Hot Standby' with preemption disabled.

Question 9

A network engineer is preparing to deploy a new branch ION device at a site that currently has no DHCP server on the management subnet. The branch has two ISP circuits and a /29 static management subnet. The engineer wants the device to obtain its management IP automatically without manual CLI interaction during staging. Which deployment option should the engineer configure in the Prisma SD-WAN portal before shipping the device?

Accepted Answer

Configure a static management IP and default gateway directly in the device's staging template, then apply the template when the device phones home.. The scenario explicitly states there is no DHCP server on the management subnet, so the device cannot learn its management address dynamically. The only reliable option is to define the static management IP and default gateway in the device configuration template so the values are applied automatically during provisioning. This satisfies the requirement of avoiding manual CLI interaction while ensuring the device can reach the controller.

Answer

Configure the management interface as a DHCP relay and point it at the controller's IP address so the controller can assign an address.

Answer

Enable Zero-Touch Provisioning and let the device self-assign a link-local address, which the controller will discover automatically.

Answer

Rely on the ION's built-in DHCP client to obtain an address from the upstream ISP modem on the management interface.

Question 10

A network architect is designing a hub-and-spoke topology in Prisma SD-WAN where branch ION devices must reach a data center subnet behind a third-party firewall. The firewall does not participate in any dynamic routing protocol and has a static route only to the ION device's LAN address. Which configuration on the branch ION device allows it to advertise the data center subnet to the SD-WAN fabric without requiring changes on the firewall?

Accepted Answer

Configure a static route on the branch ION device pointing to the data center subnet via the hub, and enable route propagation into the overlay.. When a neighboring device cannot run dynamic routing, the ION device must originate reachability for that subnet itself. A static route toward the data center prefix, paired with overlay route propagation, injects the prefix into the SD-WAN fabric. The third-party firewall only needs its existing static route to the ION LAN address, so the design remains unchanged on the firewall side.

Answer

Enable BGP on the branch ION device and peer with the firewall using an eBGP session.

Answer

Enable NAT on the branch ION device so the data center subnet appears as a directly connected network.

Answer

Enable OSPF on the branch LAN interface and redistribute connected routes.

Question 11

A network administrator is configuring a Prisma SD-WAN policy to ensure that voice traffic from a branch site is always sent over the lowest-latency path, even if that path is not the primary WAN link. The administrator creates an application policy that matches voice traffic and sets the action to 'Low Latency'. However, after deployment, voice traffic is still using the primary link. What is the most likely cause?

Accepted Answer

The application policy is not placed in the correct policy stack order, so a higher-priority policy is overriding it.. Prisma SD-WAN evaluates policies in a top-down order, and a higher-priority policy can override a lower one. If the voice policy is not positioned correctly, another policy may match the traffic first and direct it over the primary link. Ensuring the voice policy is above conflicting policies resolves the issue.

Answer

The 'Low Latency' action requires a path quality profile to be associated with the policy.

Answer

The 'Low Latency' action only works for traffic that is already marked with DSCP EF.

Answer

The branch ION device does not have a second WAN link configured for failover.

Question 12

A network engineer is deploying a new branch ION device using Zero-Touch Provisioning (ZTP). The device has been physically installed and powered on. Which two steps are required to complete the ZTP process? (Choose two.)

Accepted Answer

Claim the device serial number in the Prisma SD-WAN portal.. The two required steps for ZTP are claiming the device serial number in the Prisma SD-WAN portal and ensuring the ION device has outbound internet connectivity to the controller. Claiming associates the device with the tenant, and connectivity allows it to download configuration. Other steps like static IP or manual image installation are not part of the standard ZTP workflow.

Answer

Manually install the SD-WAN software image on the ION device.

Answer

Create a site and assign the ION device to it in the Prisma SD-WAN portal.

Answer

Configure a static IP address on the WAN interface of the ION device.

Question 13

A network engineer is deploying a new branch office with a single ION device that has two WAN interfaces: one connected to a 500 Mbps fiber circuit and one to a 100 Mbps LTE backup. The engineer wants the LTE link to be used only when the fiber link fails. Which WAN interface configuration should the engineer apply to the LTE interface?

Accepted Answer

Set the LTE interface to 'Hot Standby' mode.. The requirement is to keep the LTE link idle until the fiber link fails. Hot Standby mode on the ION device is designed for this exact purpose: the interface remains configured and monitored but does not carry traffic unless a primary link becomes unavailable. Load balancing and FEC do not provide standby behavior, and a separate failover policy is not the interface-level setting that defines standby operation.

Answer

Assign the LTE interface to a 'Failover' policy with a lower priority than the fiber interface.

Answer

Enable 'Forward Error Correction' on the LTE interface.

Answer

Configure the LTE interface as a 'Load Balancing' member.

Question 14

An engineer is configuring a Prisma SD-WAN branch ION with two WAN interfaces: one active broadband circuit and one LTE backup. The requirement is that the LTE circuit must only carry traffic when the broadband circuit fails, and must not be used for any traffic under normal conditions. Which configuration should the engineer apply to meet this requirement?

Accepted Answer

Create a WAN interface policy that sets the LTE interface to standby mode with the broadband circuit as the primary path.. The requirement is a classic active/standby failover scenario. The LTE interface must remain idle until the primary broadband circuit fails. Configuring the LTE interface as standby with the broadband as primary ensures that the SD-WAN fabric only uses LTE when the primary path is unavailable. This is the correct way to enforce the no-traffic-under-normal-conditions rule.

Answer

Set the LTE interface's bandwidth to zero in the interface configuration so no traffic can be sent over it.

Answer

Apply a QoS policy that marks all traffic as low priority on the LTE interface, causing the SD-WAN fabric to avoid it.

Answer

Configure a load balancing policy across both WAN interfaces with a higher weight on the broadband circuit.

Question 15

A network administrator is configuring a Prisma SD-WAN policy to route all traffic from the guest VLAN directly to the internet, bypassing the corporate VPN. Which type of policy should be used to achieve this?

Accepted Answer

A traffic policy that specifies the internet as the egress path for guest VLAN.. To route guest VLAN traffic directly to the internet, a traffic policy must be configured. Traffic policies define the path selection for matching traffic, allowing the administrator to specify the internet as the egress. QoS, NAT, and service policies serve different purposes and do not control routing decisions. Thus, the traffic policy is the correct choice.

Answer

A service policy that directs guest traffic to the internet breakout.

Answer

A QoS policy with a high priority for guest traffic.

Answer

A NAT policy to translate guest traffic to a public IP.

Question 16

A network engineer is configuring a Prisma SD-WAN branch ION device to connect to a new WAN link. The engineer needs to verify that the ION device can reach the Prisma SD-WAN controller and establish a control plane connection. Which command should the engineer use on the ION device CLI to check the status of the control plane connection?

Accepted Answer

show controller status. The 'show controller status' command is used on the ION device CLI to verify the control plane connection to the Prisma SD-WAN controller. It provides details such as connection state and controller IP address, confirming that the device is properly managed.

Answer

show tunnel status

Answer

show ip route

Answer

show interface wan0

Question 17

An engineer is deploying a new data center ION device that will terminate SD-WAN tunnels from 40 branch sites. The design requires that the device remain reachable for management even if the primary WAN circuit fails, and that tunnel establishment succeed when the public address changes. Which two configuration elements are required to meet these goals? (Choose two.)

Accepted Answer

Configure a controller connection over both the primary and secondary WAN interfaces.. Management resilience and address-change tolerance both depend on how the overlay is anchored. Running the controller connection across both WAN interfaces keeps management reachable when the primary circuit fails, while controller-brokered endpoint discovery lets devices re-establish tunnels after a public address change. Together these two elements satisfy both stated goals without hardcoded peer addresses.

Answer

Configure a static route on the data center ION device for each branch subnet.

Answer

Configure the branch ION devices with the data center's static public IP address as the tunnel endpoint.

Answer

Enable dynamic DNS registration on the ION device's WAN interfaces.

Question 18

A network administrator is deploying a new Prisma SD-WAN branch ION device and needs to ensure that the device can establish connectivity to the controller for Zero-Touch Provisioning. The branch has a single ISP circuit with a dynamic public IP address. Which TWO actions are required to allow the ION to reach the controller? (Choose two.)

Accepted Answer

Allow outbound UDP 4500 and TCP 443 from the ION to the controller.. For Zero-Touch Provisioning with a dynamic ISP address, the ION must obtain a routable IP on its WAN interface, typically via DHCP, and be able to initiate outbound connections to the controller on the required ports. Outbound UDP 4500 and TCP 443 must be permitted. These two actions ensure the device can establish control plane connectivity and complete provisioning.

Answer

Install a DHCP server on the branch LAN to assign an address to the ION's management interface.

Answer

Enable inbound port forwarding on the ISP modem for the ION's management IP.

Answer

Configure a static route on the ION pointing to the controller's IP address.

Question 19

A network administrator is deploying a Prisma SD-WAN solution with a hub-and-spoke topology. The administrator wants to enable direct spoke-to-spoke communication for certain applications without routing traffic through the hub. Which feature should be configured to allow this?

Accepted Answer

Configure 'Dynamic Branch-to-Branch VPN' on the spokes.. To enable direct spoke-to-spoke communication without routing through the hub, the administrator should configure Dynamic Branch-to-Branch VPN on the spokes. This feature allows spokes to establish direct tunnels dynamically, optimizing traffic paths for specific applications. Other options like Hub Clustering or Policy-Based Routing do not create direct spoke-to-spoke tunnels.

Answer

Enable 'Hub Clustering' on the hub devices.

Answer

Set up 'Policy-Based Routing' on the hub to redirect traffic between spokes.

Answer

Enable 'Forward Error Correction' on all spoke WAN interfaces.

Question 20

A network engineer is deploying a new Prisma SD-WAN branch site. The site has two WAN circuits: a primary fiber link and a backup LTE link. The engineer wants to ensure that the LTE link is used only when the fiber link fails, and that failback to fiber occurs automatically after 30 seconds of fiber stability. Which configuration should the engineer apply to the WAN interfaces in the Prisma SD-WAN controller?

Accepted Answer

Set the fiber interface as active and the LTE interface as standby, with a failback timer of 30 seconds under the interface's link configuration.. The correct configuration uses the active/standby WAN link feature in Prisma SD-WAN, which allows one interface to be primary and the other standby. The failback timer ensures automatic return to the primary after it stabilizes for the specified duration. This is the standard method to achieve the described behavior without relying on policy-based path selection, which does not guarantee strict standby usage.

Answer

Enable 'Forward Error Correction' on the fiber link and set the LTE link to 'always on' with a 30-second failback timer.

Answer

Configure both interfaces as active and use a policy to prefer fiber for all traffic, with LTE as a lower-priority path.

Answer

Create a virtual interface pair and assign both physical interfaces to it, then set the fiber as primary and LTE as secondary with a 30-second failback.