SD-WAN-Engineer Deployment And Configuration — All Questions With Answers

Which THREE types of traffic are commonly categorized for specific QoS treatment?

Question 7mediummultiple choice

A network administrator is configuring a Prisma SD-WAN policy to ensure that all voice traffic from a branch site is marked with DSCP EF when it egresses the WAN. The administrator has already created an application definition for voice and a policy rule. Which additional configuration element must be applied to the WAN interface to enforce the DSCP marking?

Question 8easymultiple choice

You are deploying a new Prisma SD-WAN branch site. The branch has two ISP circuits: a primary fiber connection and a backup LTE connection. The customer wants the LTE link to remain idle (no traffic) unless the fiber link fails completely. Which WAN interface configuration setting should you apply to the LTE interface to achieve this?

Question 9mediummultiple choice

A network engineer is preparing to deploy a new branch ION device at a site that currently has no DHCP server on the management subnet. The branch has two ISP circuits and a /29 static management subnet. The engineer wants the device to obtain its management IP automatically without manual CLI interaction during staging. Which deployment option should the engineer configure in the Prisma SD-WAN portal before shipping the device?

Question 10hardmultiple choice

A network architect is designing a hub-and-spoke topology in Prisma SD-WAN where branch ION devices must reach a data center subnet behind a third-party firewall. The firewall does not participate in any dynamic routing protocol and has a static route only to the ION device's LAN address. Which configuration on the branch ION device allows it to advertise the data center subnet to the SD-WAN fabric without requiring changes on the firewall?

Question 11hardmultiple choice

Read the full Deployment And Configuration explanation →

A network administrator is configuring a Prisma SD-WAN policy to ensure that voice traffic from a branch site is always sent over the lowest-latency path, even if that path is not the primary WAN link. The administrator creates an application policy that matches voice traffic and sets the action to 'Low Latency'. However, after deployment, voice traffic is still using the primary link. What is the most likely cause?

Question 12hardmulti select

A network engineer is deploying a new branch ION device using Zero-Touch Provisioning (ZTP). The device has been physically installed and powered on. Which two steps are required to complete the ZTP process? (Choose two.)

Question 13mediummultiple choice

Read the full Deployment And Configuration explanation →

A network engineer is deploying a new branch office with a single ION device that has two WAN interfaces: one connected to a 500 Mbps fiber circuit and one to a 100 Mbps LTE backup. The engineer wants the LTE link to be used only when the fiber link fails. Which WAN interface configuration should the engineer apply to the LTE interface?

Question 14hardmultiple choice

An engineer is configuring a Prisma SD-WAN branch ION with two WAN interfaces: one active broadband circuit and one LTE backup. The requirement is that the LTE circuit must only carry traffic when the broadband circuit fails, and must not be used for any traffic under normal conditions. Which configuration should the engineer apply to meet this requirement?

Question 15easymultiple choice

A network administrator is configuring a Prisma SD-WAN policy to route all traffic from the guest VLAN directly to the internet, bypassing the corporate VPN. Which type of policy should be used to achieve this?

Question 16mediummultiple choice

A network engineer is configuring a Prisma SD-WAN branch ION device to connect to a new WAN link. The engineer needs to verify that the ION device can reach the Prisma SD-WAN controller and establish a control plane connection. Which command should the engineer use on the ION device CLI to check the status of the control plane connection?

Question 17mediummulti select

An engineer is deploying a new data center ION device that will terminate SD-WAN tunnels from 40 branch sites. The design requires that the device remain reachable for management even if the primary WAN circuit fails, and that tunnel establishment succeed when the public address changes. Which two configuration elements are required to meet these goals? (Choose two.)

Question 18mediummulti select

A network administrator is deploying a new Prisma SD-WAN branch ION device and needs to ensure that the device can establish connectivity to the controller for Zero-Touch Provisioning. The branch has a single ISP circuit with a dynamic public IP address. Which TWO actions are required to allow the ION to reach the controller? (Choose two.)

Question 19hardmultiple choice

A network administrator is deploying a Prisma SD-WAN solution with a hub-and-spoke topology. The administrator wants to enable direct spoke-to-spoke communication for certain applications without routing traffic through the hub. Which feature should be configured to allow this?

Question 20mediummultiple choice

A network engineer is deploying a new Prisma SD-WAN branch site. The site has two WAN circuits: a primary fiber link and a backup LTE link. The engineer wants to ensure that the LTE link is used only when the fiber link fails, and that failback to fiber occurs automatically after 30 seconds of fiber stability. Which configuration should the engineer apply to the WAN interfaces in the Prisma SD-WAN controller?

Question 21hardmulti select

A network administrator is deploying a Prisma SD-WAN solution at a branch site with two WAN links: one MPLS and one broadband internet. The administrator wants to configure a policy that ensures real-time voice traffic always uses the MPLS link and never the broadband link, even if the MPLS link experiences high latency. Which TWO actions must the administrator take to meet this requirement? (Choose two.)

Question 22hardmultiple choice

A network architect is deploying Prisma SD-WAN at a data center with two ION devices in a high-availability pair. The architect wants to ensure that if one ION fails, the other takes over all traffic seamlessly. Which configuration is required to achieve this?

Question 23hardmulti select

A network engineer is deploying a Prisma SD-WAN branch site with a single ION device that has one WAN link and one LAN link. The engineer needs to configure the LAN side to support multiple VLANs for different departments. Which TWO steps must the engineer perform to enable inter-VLAN routing on the ION? (Choose two.)

Question 24easymultiple choice

Read the full Deployment And Configuration explanation →

Which command or interface action is used to verify the current status of the SD-WAN overlay tunnels?

Question 25hardmultiple choice

A branch office requires local breakout for SaaS traffic. How do you configure the policy to ensure this traffic does not traverse the data center?

Question 26hardmultiple choice

You are implementing a QoS policy. Why would you configure a 'Shaping' rate on a WAN interface?

Question 27mediummultiple choice

Read the full Deployment And Configuration explanation →

What is the impact of assigning a site to a specific 'Site Group' in a Prisma SD-WAN policy?

Question 28mediummultiple choice

You are configuring a path policy to prioritize VoIP traffic. Which specific metric should you leverage to ensure the best call quality when multiple paths are available?

Question 29hardmultiple choice

Read the full Deployment And Configuration explanation →

When configuring an ION device as a gateway for a cloud environment, what is the primary role of a 'Service' interface?

Question 30easymultiple choice

Read the full Deployment And Configuration explanation →

When deploying a new ION device, which Prisma SD-WAN component is primarily used to initiate the zero-touch provisioning process?

Question 31easymultiple choice

When configuring a security policy, what is the purpose of an 'Application' object?

Question 32hardmultiple choice

Read the full Deployment And Configuration explanation →

In a multi-VRF deployment, what must be configured to allow traffic to move between two different VRFs?

Question 33easymultiple choice

What does the 'App-ID' feature provide in a security policy?

Question 34mediummultiple choice

Read the full Deployment And Configuration explanation →

What is the effect of changing the 'Path Selection' strategy from 'Latency' to 'Lowest Cost' in a policy?

Question 35hardmultiple choice

Read the full Deployment And Configuration explanation →

How does a 'Failover' policy differ from a 'Load Balancing' policy in Prisma SD-WAN?

Question 36mediummultiple choice

When setting up a branch site, what is the purpose of the 'Underlay' configuration?

Question 37mediummultiple choice

Read the full Deployment And Configuration explanation →

You need to restrict administrative access to the ION device. Where is this configured?

Question 38mediummultiple choice

Read the full DNS explanation →

How does Prisma SD-WAN handle DNS queries for branch users?

Question 39easymultiple choice

Where are the primary SD-WAN routing policies defined?

Question 40mediummultiple choice

Read the full Deployment And Configuration explanation →

What is the purpose of 'Bandwidth Groups' in Prisma SD-WAN?

Question 41hardmultiple choice

If a user at a branch site reports that they cannot access a specific internal server, which diagnostic tool should you use first?

Question 42mediummultiple choice

Which Prisma SD-WAN component is responsible for orchestrating the overall security policy across the entire fabric?

Question 43easymultiple choice

What is the primary function of the 'Controller' dashboard in the Prisma SD-WAN UI?

Question 44hardmultiple choice

When using Prisma SD-WAN with Prisma Access, how is the secure tunnel established?

Question 45mediummultiple choice

You need to ensure that traffic from a specific subnet is placed into a unique VRF. How is this achieved?

Question 46mediummulti select

Read the full NAT/PAT explanation →

Which TWO factors are used by Prisma SD-WAN to determine the health of a WAN path?

Question 47mediummultiple choice

When configuring 'NAT', what is the difference between 'Source NAT' and 'Destination NAT'?

Question 48hardmulti select

Which THREE components are involved in configuring Prisma SD-WAN security policies?

Question 49hardmulti select

Which THREE types of information are displayed in the Prisma SD-WAN 'Flow Monitoring' view?

Question 50mediummulti select

Which TWO items are considered 'Underlay' resources in a Prisma SD-WAN configuration?

Question 51hardmulti select

Which THREE actions can be performed by a Prisma SD-WAN 'Policy' object?

Question 52mediummulti select

Which TWO of the following are benefits of using Prisma SD-WAN?

Question 53hardmulti select

Read the full Deployment And Configuration explanation →

Which THREE items are included in a Prisma SD-WAN 'Site' configuration?

Question 54hardmulti select

Which THREE settings are typically defined during the initial ION site provisioning?

Question 55mediummulti select

Which TWO components are essential for maintaining the SD-WAN control plane?

Question 56mediummulti select

Read the full Deployment And Configuration explanation →

Which TWO features are used to monitor the performance of an application across the SD-WAN?

Question 57hardmultiple choice

A customer wants to prioritize Office 365 traffic over general web traffic. What is the most efficient way to achieve this?

Question 58mediummultiple choice

Read the full Deployment And Configuration explanation →

An engineer is deploying a new branch ION device that will connect to two different ISPs. The design requires that return traffic from the data center follows the same WAN path that the outbound session used, so that stateful inspection appliances in the data center see both directions of every flow. Which configuration on the branch ION device satisfies this requirement?

Question 59mediummultiple choice

Read the full Deployment And Configuration explanation →

A network engineer is deploying a new branch office with a single Prisma SD-WAN ION device. The branch has two WAN links: a primary fiber circuit and a backup LTE connection. The engineer wants the ION device to automatically establish secure tunnels to the Prisma SD-WAN controller and to the nearest data center without manual intervention. Which deployment method should the engineer use?

Question 60mediummultiple choice

A network engineer is deploying a new branch ION device at a site with dual WAN circuits: a primary 500 Mbps fiber link and a secondary 100 Mbps LTE link. The design requires that the LTE link only carry traffic when the fiber link fails, and that all traffic return to the fiber link automatically once it recovers. Which configuration should the engineer apply on the ION device?

Question 61easymultiple choice

A network engineer is deploying a new branch ION device at a site with two WAN links and wants to guarantee that business-critical voice traffic always uses the lowest-latency path, even when one link degrades. Which Prisma SD-WAN configuration should be applied to the branch ION device to meet this requirement?

Question 62hardmulti select

A network architect is designing a Prisma SD-WAN deployment for a retail customer with 200 small branches. Each branch has a single ION device and one broadband circuit. The customer wants centralized policy management and minimal on-site configuration. Which TWO deployment components are required to meet these goals? (Choose two.)

Question 63mediummultiple choice

Read the full wireless explanation →

A network administrator is configuring a Prisma SD-WAN branch ION device that will connect to the internet via a single ISP link. The administrator needs to ensure that the device can establish a secure control plane connection to the Prisma SD-WAN controller. Which configuration is required on the ION device?

Question 64mediummultiple choice

An engineer is configuring a Prisma SD-WAN policy to route guest Wi-Fi traffic directly out of the local branch internet circuit instead of sending it to the data center. The guest traffic must not traverse the SD-WAN overlay. Which policy type should the engineer use?

Question 65easymultiple choice

A network engineer is deploying a new branch location with a Prisma SD-WAN ION device. The branch has two WAN circuits: a primary fiber link and a backup LTE link. The engineer wants the ION device to automatically use the LTE link only when the fiber link fails. Which configuration should be applied to achieve this behavior?

Question 66hardmultiple choice

A network engineer is deploying a Prisma SD-WAN solution at a branch site with two WAN links: a primary MPLS link and a secondary broadband link. The engineer wants to ensure that if the MPLS link fails, all traffic automatically switches to the broadband link without manual intervention. Which configuration should be applied?

Question 67hardmultiple choice

A multinational company is deploying Prisma SD-WAN at a branch that has a single MPLS circuit and a broadband internet link. The security team requires that all traffic destined to the corporate data center must traverse the MPLS circuit, while internet-bound traffic should use the broadband link. However, if the MPLS circuit fails, data center traffic should fail over to the broadband link with IPsec encryption. Which configuration achieves this requirement?

Question 68hardmultiple choice

A network engineer is deploying a new ION device at a branch that uses a DSL circuit with a dynamic public IP address from the ISP. The branch must establish SD-WAN tunnels to the controller and to other sites. Which configuration must the engineer verify to ensure the tunnels come up reliably?

Question 69easymultiple choice

A branch ION device is being deployed with a single WAN circuit that is provisioned as a DHCP client. The engineer needs the device to be reachable from the corporate management system for ongoing monitoring, but the ISP does not offer a static IP. Which configuration should the engineer apply on the ION device to meet this requirement?

Question 70mediummultiple choice

A network engineer is configuring a Prisma SD-WAN ION device at a branch that has a single WAN link with a public IP address. The branch also has a local subnet of 192.168.10.0/24. The engineer wants to ensure that all traffic from the local subnet to the internet is translated to the WAN IP address. Which type of NAT should be configured?

Question 71easymultiple choice

A network administrator is configuring a new ION device at a branch. The administrator wants the device to obtain its IP address, default gateway, and DNS server automatically from the local ISP's DHCP server on the WAN interface. Which WAN interface configuration mode should be selected?

Question 72easymultiple choice

A network administrator is preparing to bring a new branch online with Prisma SD-WAN. The branch has no IT staff, and the administrator wants the ION device to receive its full configuration automatically when it is powered on and connected to the internet. Which feature should the administrator use?

Question 73mediummultiple choice

Read the full Deployment And Configuration explanation →

An engineer is configuring a Prisma SD-WAN ION device at a branch. The branch has a single WAN link with a public IP address. The internal LAN uses private IP addresses. The engineer needs to allow internal users to access the internet while hiding their private IP addresses. Which configuration is required?

Question 74hardmultiple choice

A network engineer is deploying a new branch with two ION devices for high availability. The engineer wants both devices to share a single virtual IP address on the LAN side so that hosts use a consistent default gateway even if one device fails. Which LAN-side configuration should be implemented?

Question 75hardmultiple choice

A network architect is designing a Prisma SD-WAN deployment for a company with 50 branches. Each branch has two internet links from different ISPs. The architect wants to ensure that business-critical applications always use the best-performing link based on real-time latency, jitter, and packet loss. Additionally, the architect wants to avoid using a link that is experiencing high packet loss. Which Prisma SD-WAN feature should be configured to meet these requirements?

Question 76mediummultiple choice

A network engineer is configuring a Prisma SD-WAN branch site with two WAN links: a primary MPLS link and a secondary broadband link. The engineer wants to ensure that business-critical traffic uses the MPLS link and fails over to broadband only when the MPLS link's latency exceeds 100 ms. Which configuration is required to achieve this?

Question 77hardmulti select

A network engineer is deploying a Prisma SD-WAN solution at a branch site with two WAN links. The engineer wants to ensure that the branch can automatically fail over from the primary link to the secondary link when the primary link experiences high latency or packet loss. Which TWO configuration steps are required to achieve this? (Choose two.)

Question 78hardmultiple choice

Read the full Deployment And Configuration explanation →

A network engineer is troubleshooting a branch ION device that fails to establish a control connection to the Prisma SD-WAN controller. The engineer verifies that the WAN interface has a valid IP address and can ping the default gateway. Which configuration issue is most likely preventing the control connection?

Question 79mediummultiple choice

A network engineer is preparing to deploy a new branch ION device that will use a single LTE circuit as its only WAN connection. The design requires that the device not consume the metered data plan during initial software staging, and that it validate its configuration against the controller before carrying production traffic. Which deployment approach best meets these requirements?

Question 80easymultiple choice

A network engineer is configuring a new Prisma SD-WAN branch site. The branch has two WAN circuits from different providers. The engineer wants to ensure that if one circuit degrades in performance, traffic is automatically moved to the other circuit without manual intervention. Which feature should the engineer configure to achieve this?

Question 81hardmultiple choice

An engineer is configuring a Prisma SD-WAN policy to ensure that voice traffic from a branch is always sent over the MPLS circuit, while all other traffic uses the internet circuit. The engineer creates an application policy with a match on voice applications and sets the action to use the MPLS path. However, after deployment, voice traffic is still traversing the internet circuit. Which configuration issue is the most likely cause?

Question 82mediummultiple choice

An engineer is deploying a Prisma SD-WAN branch site where the ION device will use a single LTE WAN link with a dynamic public IP address assigned by the carrier. The device must establish a control connection to the Prisma SD-WAN controller and be managed centrally. Which deployment method should the engineer use?

Question 83easymultiple choice

A network engineer is configuring a Prisma SD-WAN ION device at a branch site. The branch has a single WAN link with a static public IP address. The internal LAN uses private IP addresses. The engineer wants to allow internal users to access the internet using the public IP address. Which feature should the engineer configure on the ION device?

Question 84easymultiple choice

An engineer is configuring a Prisma SD-WAN ION device at a branch with two WAN interfaces: one for internet and one for MPLS. The engineer wants to ensure that the ION uses the MPLS link for traffic to the data center and the internet link for cloud applications. What should the engineer configure?

Question 85mediummultiple choice

Read the full Deployment And Configuration explanation →

An engineer is deploying a Prisma SD-WAN ION at a branch that will use a single MPLS circuit for connectivity to the data center and a broadband internet link for direct internet access. The engineer wants to ensure that if the MPLS circuit fails, traffic to the data center automatically fails over to the broadband link. What should the engineer configure?

Question 1mediummultiple choice

You need to ensure that specific branch traffic is encrypted over a public internet link. Which configuration step is mandatory?

Question 2mediummultiple choice

Read the full Deployment And Configuration explanation →

You are troubleshooting a performance issue where traffic is not taking the preferred path. Which tool in the Controller helps you visualize the path taken?

Question 3hardmultiple choice

Read the full Deployment And Configuration explanation →

What is the primary benefit of enabling 'Forward Error Correction' (FEC) on a high-latency WAN link?

Question 4mediummulti select

Read the full Deployment And Configuration explanation →

Which TWO steps are required to successfully deploy a new branch ION device using Zero-Touch Provisioning (ZTP)?

Question 5mediummulti select

Read the full Deployment And Configuration explanation →

Which TWO methods can be used to identify traffic for a policy?

Question 6hardmulti select

Which THREE types of traffic are commonly categorized for specific QoS treatment?

Question 7mediummultiple choice

A network administrator is configuring a Prisma SD-WAN policy to ensure that all voice traffic from a branch site is marked with DSCP EF when it egresses the WAN. The administrator has already created an application definition for voice and a policy rule. Which additional configuration element must be applied to the WAN interface to enforce the DSCP marking?

Question 8easymultiple choice

You are deploying a new Prisma SD-WAN branch site. The branch has two ISP circuits: a primary fiber connection and a backup LTE connection. The customer wants the LTE link to remain idle (no traffic) unless the fiber link fails completely. Which WAN interface configuration setting should you apply to the LTE interface to achieve this?

Question 9mediummultiple choice

A network engineer is preparing to deploy a new branch ION device at a site that currently has no DHCP server on the management subnet. The branch has two ISP circuits and a /29 static management subnet. The engineer wants the device to obtain its management IP automatically without manual CLI interaction during staging. Which deployment option should the engineer configure in the Prisma SD-WAN portal before shipping the device?

Question 10hardmultiple choice

A network architect is designing a hub-and-spoke topology in Prisma SD-WAN where branch ION devices must reach a data center subnet behind a third-party firewall. The firewall does not participate in any dynamic routing protocol and has a static route only to the ION device's LAN address. Which configuration on the branch ION device allows it to advertise the data center subnet to the SD-WAN fabric without requiring changes on the firewall?

Question 11hardmultiple choice

Read the full Deployment And Configuration explanation →

A network administrator is configuring a Prisma SD-WAN policy to ensure that voice traffic from a branch site is always sent over the lowest-latency path, even if that path is not the primary WAN link. The administrator creates an application policy that matches voice traffic and sets the action to 'Low Latency'. However, after deployment, voice traffic is still using the primary link. What is the most likely cause?

Question 12hardmulti select

A network engineer is deploying a new branch ION device using Zero-Touch Provisioning (ZTP). The device has been physically installed and powered on. Which two steps are required to complete the ZTP process? (Choose two.)

Question 13mediummultiple choice

Read the full Deployment And Configuration explanation →

A network engineer is deploying a new branch office with a single ION device that has two WAN interfaces: one connected to a 500 Mbps fiber circuit and one to a 100 Mbps LTE backup. The engineer wants the LTE link to be used only when the fiber link fails. Which WAN interface configuration should the engineer apply to the LTE interface?

Question 14hardmultiple choice

An engineer is configuring a Prisma SD-WAN branch ION with two WAN interfaces: one active broadband circuit and one LTE backup. The requirement is that the LTE circuit must only carry traffic when the broadband circuit fails, and must not be used for any traffic under normal conditions. Which configuration should the engineer apply to meet this requirement?

Question 15easymultiple choice

A network administrator is configuring a Prisma SD-WAN policy to route all traffic from the guest VLAN directly to the internet, bypassing the corporate VPN. Which type of policy should be used to achieve this?

Question 16mediummultiple choice

A network engineer is configuring a Prisma SD-WAN branch ION device to connect to a new WAN link. The engineer needs to verify that the ION device can reach the Prisma SD-WAN controller and establish a control plane connection. Which command should the engineer use on the ION device CLI to check the status of the control plane connection?

Question 17mediummulti select

An engineer is deploying a new data center ION device that will terminate SD-WAN tunnels from 40 branch sites. The design requires that the device remain reachable for management even if the primary WAN circuit fails, and that tunnel establishment succeed when the public address changes. Which two configuration elements are required to meet these goals? (Choose two.)

Question 18mediummulti select

A network administrator is deploying a new Prisma SD-WAN branch ION device and needs to ensure that the device can establish connectivity to the controller for Zero-Touch Provisioning. The branch has a single ISP circuit with a dynamic public IP address. Which TWO actions are required to allow the ION to reach the controller? (Choose two.)

Question 19hardmultiple choice

A network administrator is deploying a Prisma SD-WAN solution with a hub-and-spoke topology. The administrator wants to enable direct spoke-to-spoke communication for certain applications without routing traffic through the hub. Which feature should be configured to allow this?

Question 20mediummultiple choice

A network engineer is deploying a new Prisma SD-WAN branch site. The site has two WAN circuits: a primary fiber link and a backup LTE link. The engineer wants to ensure that the LTE link is used only when the fiber link fails, and that failback to fiber occurs automatically after 30 seconds of fiber stability. Which configuration should the engineer apply to the WAN interfaces in the Prisma SD-WAN controller?

Question 21hardmulti select

A network administrator is deploying a Prisma SD-WAN solution at a branch site with two WAN links: one MPLS and one broadband internet. The administrator wants to configure a policy that ensures real-time voice traffic always uses the MPLS link and never the broadband link, even if the MPLS link experiences high latency. Which TWO actions must the administrator take to meet this requirement? (Choose two.)

Question 22hardmultiple choice

A network architect is deploying Prisma SD-WAN at a data center with two ION devices in a high-availability pair. The architect wants to ensure that if one ION fails, the other takes over all traffic seamlessly. Which configuration is required to achieve this?

Question 23hardmulti select

A network engineer is deploying a Prisma SD-WAN branch site with a single ION device that has one WAN link and one LAN link. The engineer needs to configure the LAN side to support multiple VLANs for different departments. Which TWO steps must the engineer perform to enable inter-VLAN routing on the ION? (Choose two.)

Question 24easymultiple choice

Read the full Deployment And Configuration explanation →

Which command or interface action is used to verify the current status of the SD-WAN overlay tunnels?

Question 25hardmultiple choice

A branch office requires local breakout for SaaS traffic. How do you configure the policy to ensure this traffic does not traverse the data center?

Question 26hardmultiple choice

You are implementing a QoS policy. Why would you configure a 'Shaping' rate on a WAN interface?

Question 27mediummultiple choice

Read the full Deployment And Configuration explanation →

What is the impact of assigning a site to a specific 'Site Group' in a Prisma SD-WAN policy?

Question 28mediummultiple choice

You are configuring a path policy to prioritize VoIP traffic. Which specific metric should you leverage to ensure the best call quality when multiple paths are available?

Question 29hardmultiple choice

Read the full Deployment And Configuration explanation →

When configuring an ION device as a gateway for a cloud environment, what is the primary role of a 'Service' interface?

Question 30easymultiple choice

Read the full Deployment And Configuration explanation →

When deploying a new ION device, which Prisma SD-WAN component is primarily used to initiate the zero-touch provisioning process?

Question 31easymultiple choice

When configuring a security policy, what is the purpose of an 'Application' object?

Question 32hardmultiple choice

Read the full Deployment And Configuration explanation →

In a multi-VRF deployment, what must be configured to allow traffic to move between two different VRFs?

Question 33easymultiple choice

What does the 'App-ID' feature provide in a security policy?

Question 34mediummultiple choice

Read the full Deployment And Configuration explanation →

What is the effect of changing the 'Path Selection' strategy from 'Latency' to 'Lowest Cost' in a policy?

Question 35hardmultiple choice

Read the full Deployment And Configuration explanation →

How does a 'Failover' policy differ from a 'Load Balancing' policy in Prisma SD-WAN?

Question 36mediummultiple choice

When setting up a branch site, what is the purpose of the 'Underlay' configuration?

Question 37mediummultiple choice

Read the full Deployment And Configuration explanation →

You need to restrict administrative access to the ION device. Where is this configured?

Question 38mediummultiple choice

Read the full DNS explanation →

How does Prisma SD-WAN handle DNS queries for branch users?

Question 39easymultiple choice

Where are the primary SD-WAN routing policies defined?

Question 40mediummultiple choice

Read the full Deployment And Configuration explanation →

What is the purpose of 'Bandwidth Groups' in Prisma SD-WAN?

Question 41hardmultiple choice

If a user at a branch site reports that they cannot access a specific internal server, which diagnostic tool should you use first?

Question 42mediummultiple choice

Which Prisma SD-WAN component is responsible for orchestrating the overall security policy across the entire fabric?

Question 43easymultiple choice

What is the primary function of the 'Controller' dashboard in the Prisma SD-WAN UI?

Question 44hardmultiple choice

When using Prisma SD-WAN with Prisma Access, how is the secure tunnel established?

Question 45mediummultiple choice

You need to ensure that traffic from a specific subnet is placed into a unique VRF. How is this achieved?

Question 46mediummulti select

Read the full NAT/PAT explanation →

Which TWO factors are used by Prisma SD-WAN to determine the health of a WAN path?

Question 47mediummultiple choice

When configuring 'NAT', what is the difference between 'Source NAT' and 'Destination NAT'?

Question 48hardmulti select

Which THREE components are involved in configuring Prisma SD-WAN security policies?

Question 49hardmulti select

Which THREE types of information are displayed in the Prisma SD-WAN 'Flow Monitoring' view?

Question 50mediummulti select

Which TWO items are considered 'Underlay' resources in a Prisma SD-WAN configuration?

Question 51hardmulti select

Which THREE actions can be performed by a Prisma SD-WAN 'Policy' object?

Question 52mediummulti select

Which TWO of the following are benefits of using Prisma SD-WAN?

Question 53hardmulti select

Read the full Deployment And Configuration explanation →

Which THREE items are included in a Prisma SD-WAN 'Site' configuration?

Question 54hardmulti select

Which THREE settings are typically defined during the initial ION site provisioning?

Question 55mediummulti select

Which TWO components are essential for maintaining the SD-WAN control plane?

Question 56mediummulti select

Read the full Deployment And Configuration explanation →

Which TWO features are used to monitor the performance of an application across the SD-WAN?

Question 57hardmultiple choice

A customer wants to prioritize Office 365 traffic over general web traffic. What is the most efficient way to achieve this?

Question 58mediummultiple choice

Read the full Deployment And Configuration explanation →

An engineer is deploying a new branch ION device that will connect to two different ISPs. The design requires that return traffic from the data center follows the same WAN path that the outbound session used, so that stateful inspection appliances in the data center see both directions of every flow. Which configuration on the branch ION device satisfies this requirement?

Question 59mediummultiple choice

Read the full Deployment And Configuration explanation →

A network engineer is deploying a new branch office with a single Prisma SD-WAN ION device. The branch has two WAN links: a primary fiber circuit and a backup LTE connection. The engineer wants the ION device to automatically establish secure tunnels to the Prisma SD-WAN controller and to the nearest data center without manual intervention. Which deployment method should the engineer use?

Question 60mediummultiple choice

A network engineer is deploying a new branch ION device at a site with dual WAN circuits: a primary 500 Mbps fiber link and a secondary 100 Mbps LTE link. The design requires that the LTE link only carry traffic when the fiber link fails, and that all traffic return to the fiber link automatically once it recovers. Which configuration should the engineer apply on the ION device?

Question 61easymultiple choice

A network engineer is deploying a new branch ION device at a site with two WAN links and wants to guarantee that business-critical voice traffic always uses the lowest-latency path, even when one link degrades. Which Prisma SD-WAN configuration should be applied to the branch ION device to meet this requirement?

Question 62hardmulti select

A network architect is designing a Prisma SD-WAN deployment for a retail customer with 200 small branches. Each branch has a single ION device and one broadband circuit. The customer wants centralized policy management and minimal on-site configuration. Which TWO deployment components are required to meet these goals? (Choose two.)

Question 63mediummultiple choice

Read the full wireless explanation →

A network administrator is configuring a Prisma SD-WAN branch ION device that will connect to the internet via a single ISP link. The administrator needs to ensure that the device can establish a secure control plane connection to the Prisma SD-WAN controller. Which configuration is required on the ION device?

Question 64mediummultiple choice

An engineer is configuring a Prisma SD-WAN policy to route guest Wi-Fi traffic directly out of the local branch internet circuit instead of sending it to the data center. The guest traffic must not traverse the SD-WAN overlay. Which policy type should the engineer use?

Question 65easymultiple choice

A network engineer is deploying a new branch location with a Prisma SD-WAN ION device. The branch has two WAN circuits: a primary fiber link and a backup LTE link. The engineer wants the ION device to automatically use the LTE link only when the fiber link fails. Which configuration should be applied to achieve this behavior?

Question 66hardmultiple choice

A network engineer is deploying a Prisma SD-WAN solution at a branch site with two WAN links: a primary MPLS link and a secondary broadband link. The engineer wants to ensure that if the MPLS link fails, all traffic automatically switches to the broadband link without manual intervention. Which configuration should be applied?

Question 67hardmultiple choice

A multinational company is deploying Prisma SD-WAN at a branch that has a single MPLS circuit and a broadband internet link. The security team requires that all traffic destined to the corporate data center must traverse the MPLS circuit, while internet-bound traffic should use the broadband link. However, if the MPLS circuit fails, data center traffic should fail over to the broadband link with IPsec encryption. Which configuration achieves this requirement?

Question 68hardmultiple choice

A network engineer is deploying a new ION device at a branch that uses a DSL circuit with a dynamic public IP address from the ISP. The branch must establish SD-WAN tunnels to the controller and to other sites. Which configuration must the engineer verify to ensure the tunnels come up reliably?

Question 69easymultiple choice

A branch ION device is being deployed with a single WAN circuit that is provisioned as a DHCP client. The engineer needs the device to be reachable from the corporate management system for ongoing monitoring, but the ISP does not offer a static IP. Which configuration should the engineer apply on the ION device to meet this requirement?

Question 70mediummultiple choice

A network engineer is configuring a Prisma SD-WAN ION device at a branch that has a single WAN link with a public IP address. The branch also has a local subnet of 192.168.10.0/24. The engineer wants to ensure that all traffic from the local subnet to the internet is translated to the WAN IP address. Which type of NAT should be configured?

Question 71easymultiple choice

A network administrator is configuring a new ION device at a branch. The administrator wants the device to obtain its IP address, default gateway, and DNS server automatically from the local ISP's DHCP server on the WAN interface. Which WAN interface configuration mode should be selected?

Question 72easymultiple choice

A network administrator is preparing to bring a new branch online with Prisma SD-WAN. The branch has no IT staff, and the administrator wants the ION device to receive its full configuration automatically when it is powered on and connected to the internet. Which feature should the administrator use?

Question 73mediummultiple choice

Read the full Deployment And Configuration explanation →

An engineer is configuring a Prisma SD-WAN ION device at a branch. The branch has a single WAN link with a public IP address. The internal LAN uses private IP addresses. The engineer needs to allow internal users to access the internet while hiding their private IP addresses. Which configuration is required?

Question 74hardmultiple choice

A network engineer is deploying a new branch with two ION devices for high availability. The engineer wants both devices to share a single virtual IP address on the LAN side so that hosts use a consistent default gateway even if one device fails. Which LAN-side configuration should be implemented?

Question 75hardmultiple choice

A network architect is designing a Prisma SD-WAN deployment for a company with 50 branches. Each branch has two internet links from different ISPs. The architect wants to ensure that business-critical applications always use the best-performing link based on real-time latency, jitter, and packet loss. Additionally, the architect wants to avoid using a link that is experiencing high packet loss. Which Prisma SD-WAN feature should be configured to meet these requirements?

Question 76mediummultiple choice

A network engineer is configuring a Prisma SD-WAN branch site with two WAN links: a primary MPLS link and a secondary broadband link. The engineer wants to ensure that business-critical traffic uses the MPLS link and fails over to broadband only when the MPLS link's latency exceeds 100 ms. Which configuration is required to achieve this?

Question 77hardmulti select

A network engineer is deploying a Prisma SD-WAN solution at a branch site with two WAN links. The engineer wants to ensure that the branch can automatically fail over from the primary link to the secondary link when the primary link experiences high latency or packet loss. Which TWO configuration steps are required to achieve this? (Choose two.)

Question 78hardmultiple choice

Read the full Deployment And Configuration explanation →

A network engineer is troubleshooting a branch ION device that fails to establish a control connection to the Prisma SD-WAN controller. The engineer verifies that the WAN interface has a valid IP address and can ping the default gateway. Which configuration issue is most likely preventing the control connection?

Question 79mediummultiple choice

A network engineer is preparing to deploy a new branch ION device that will use a single LTE circuit as its only WAN connection. The design requires that the device not consume the metered data plan during initial software staging, and that it validate its configuration against the controller before carrying production traffic. Which deployment approach best meets these requirements?

Question 80easymultiple choice

A network engineer is configuring a new Prisma SD-WAN branch site. The branch has two WAN circuits from different providers. The engineer wants to ensure that if one circuit degrades in performance, traffic is automatically moved to the other circuit without manual intervention. Which feature should the engineer configure to achieve this?

Question 81hardmultiple choice

An engineer is configuring a Prisma SD-WAN policy to ensure that voice traffic from a branch is always sent over the MPLS circuit, while all other traffic uses the internet circuit. The engineer creates an application policy with a match on voice applications and sets the action to use the MPLS path. However, after deployment, voice traffic is still traversing the internet circuit. Which configuration issue is the most likely cause?

Question 82mediummultiple choice

An engineer is deploying a Prisma SD-WAN branch site where the ION device will use a single LTE WAN link with a dynamic public IP address assigned by the carrier. The device must establish a control connection to the Prisma SD-WAN controller and be managed centrally. Which deployment method should the engineer use?

Question 83easymultiple choice

A network engineer is configuring a Prisma SD-WAN ION device at a branch site. The branch has a single WAN link with a static public IP address. The internal LAN uses private IP addresses. The engineer wants to allow internal users to access the internet using the public IP address. Which feature should the engineer configure on the ION device?

Question 84easymultiple choice

An engineer is configuring a Prisma SD-WAN ION device at a branch with two WAN interfaces: one for internet and one for MPLS. The engineer wants to ensure that the ION uses the MPLS link for traffic to the data center and the internet link for cloud applications. What should the engineer configure?

Question 85mediummultiple choice