SD-WAN-Engineer Deployment And Configuration Practice Test 1 — 15 Questions

Question 1

You need to ensure that specific branch traffic is encrypted over a public internet link. Which configuration step is mandatory?

Accepted Answer

Enable Auto-VPN on the WAN interface. VPN tunnels are established automatically between ION devices when policies are defined, but the path must be categorized to allow tunnel formation.

Answer

Manually configure IPsec parameters

Answer

Disable firewall policies

Answer

Configure a static route to the peer

Question 2

You are troubleshooting a performance issue where traffic is not taking the preferred path. Which tool in the Controller helps you visualize the path taken?

Accepted Answer

Flow Monitoring. The path visualization tool displays the real-time path selected by the SD-WAN engine.

Answer

Interface counters

Answer

System Logs

Answer

Packet Capture

Question 3

What is the primary benefit of enabling 'Forward Error Correction' (FEC) on a high-latency WAN link?

Accepted Answer

It improves performance for jitter-sensitive traffic. FEC adds redundant data to packets, allowing the receiver to reconstruct lost packets without retransmission.

Answer

It bypasses the firewall

Answer

It replaces the need for QoS

Answer

It reduces total bandwidth usage

Question 4

Which TWO steps are required to successfully deploy a new branch ION device using Zero-Touch Provisioning (ZTP)?

Accepted Answer

Ensure the WAN interface has internet connectivity. ZTP requires the device to be registered and connected to the internet to reach the Controller.

Answer

Create a manual IPsec tunnel to the hub

Answer

Install a local management agent

Question 5

Which TWO methods can be used to identify traffic for a policy?

Accepted Answer

Source/Destination IP addresses. Source/Destination IP addresses (A) are correct because firewall and security policies commonly match traffic by the Layer 3 header fields, i.e., the source and destination IP addresses in the packet, which uniquely identify the endpoints of a flow. Application signatures (C) are also correct because next-generation firewalls and IPS/IDS platforms use application signatures (deep packet inspection patterns) to identify the specific application or protocol generating the traffic, allowing policy enforcement based on application identity rather than just ports. Router model (B) is not a traffic identifier—it describes hardware and cannot distinguish one flow from another. Device serial number (D) identifies a physical device, not network traffic, so it cannot be used to match packets in a policy. Physical port location (E) may be used in some switch or port-based policies, but it is not one of the two standard methods for identifying traffic for a policy in this context.

Answer

Router model

Answer

Device serial number

Answer

Physical port location

Question 6

Which THREE types of traffic are commonly categorized for specific QoS treatment?

Accepted Answer

Mission-critical database traffic. Option A (mission-critical database traffic) is correct because transactional database flows require guaranteed low latency and jitter with high reliability, so they are typically placed in a high-priority QoS class such as AF31/AF32 or a priority queue to protect them from congestion. Option C (VoIP traffic) is correct because voice uses RTP over UDP and is extremely sensitive to latency, jitter, and packet loss, so it is commonly classified into the EF (Expedited Forwarding) per-hop behavior with priority queueing and CAC. Option E (video conferencing) is correct because interactive video is real-time, delay-sensitive traffic typically classified into AF41 or a dedicated real-time class to keep latency and jitter low. Option B (public guest Wi-Fi browsing) is not a standard QoS category because guest web traffic is generally treated as best-effort or scavenger-class traffic with no special treatment. Option D (idle background system updates) is not a specific QoS category because such bulk, non-time-sensitive traffic is typically placed in a low-priority or scavenger class rather than being a defined QoS treatment category.

Answer

Public guest Wi-Fi browsing

Answer

Idle background system updates

Question 7

A network administrator is configuring a Prisma SD-WAN policy to ensure that all voice traffic from a branch site is marked with DSCP EF when it egresses the WAN. The administrator has already created an application definition for voice and a policy rule. Which additional configuration element must be applied to the WAN interface to enforce the DSCP marking?

Accepted Answer

Apply a 'Rewrite DSCP' action in the policy rule.. To enforce a specific DSCP marking on voice traffic egressing the WAN, the policy rule must include a 'Rewrite DSCP' action. This action changes the DSCP field in the IP header of matching packets, ensuring they are marked with EF. Other options like DSCP Trust or FEC do not alter the marking; they serve different purposes such as trusting existing markings or adding redundancy.

Answer

Enable 'DSCP Trust' on the WAN interface.

Answer

Enable 'Forward Error Correction' on the WAN interface.

Answer

Configure a QoS policy with a 'Mark' action for the voice application.

Question 8

You are deploying a new Prisma SD-WAN branch site. The branch has two ISP circuits: a primary fiber connection and a backup LTE connection. The customer wants the LTE link to remain idle (no traffic) unless the fiber link fails completely. Which WAN interface configuration setting should you apply to the LTE interface to achieve this?

Accepted Answer

Set the LTE interface to 'Standby' mode.. Standby mode is the correct choice because it keeps the LTE interface ready but unused until the primary fiber path fails. This prevents unnecessary LTE data consumption and ensures the backup link is available only when needed. The other options either do not exist in Prisma SD-WAN or would allow traffic on the LTE link, violating the requirement.

Answer

Set the LTE interface to 'Passive' mode and enable 'Failover Only'.

Answer

Enable 'Load Balancing' on both interfaces and set LTE weight to 0.

Answer

Configure the LTE interface as a 'Hot Standby' with preemption disabled.

Question 9

A network engineer is preparing to deploy a new branch ION device at a site that currently has no DHCP server on the management subnet. The branch has two ISP circuits and a /29 static management subnet. The engineer wants the device to obtain its management IP automatically without manual CLI interaction during staging. Which deployment option should the engineer configure in the Prisma SD-WAN portal before shipping the device?

Accepted Answer

Configure a static management IP and default gateway directly in the device's staging template, then apply the template when the device phones home.. The scenario explicitly states there is no DHCP server on the management subnet, so the device cannot learn its management address dynamically. The only reliable option is to define the static management IP and default gateway in the device configuration template so the values are applied automatically during provisioning. This satisfies the requirement of avoiding manual CLI interaction while ensuring the device can reach the controller.

Answer

Configure the management interface as a DHCP relay and point it at the controller's IP address so the controller can assign an address.

Answer

Enable Zero-Touch Provisioning and let the device self-assign a link-local address, which the controller will discover automatically.

Answer

Rely on the ION's built-in DHCP client to obtain an address from the upstream ISP modem on the management interface.

Question 10

A network architect is designing a hub-and-spoke topology in Prisma SD-WAN where branch ION devices must reach a data center subnet behind a third-party firewall. The firewall does not participate in any dynamic routing protocol and has a static route only to the ION device's LAN address. Which configuration on the branch ION device allows it to advertise the data center subnet to the SD-WAN fabric without requiring changes on the firewall?

Accepted Answer

Configure a static route on the branch ION device pointing to the data center subnet via the hub, and enable route propagation into the overlay.. When a neighboring device cannot run dynamic routing, the ION device must originate reachability for that subnet itself. A static route toward the data center prefix, paired with overlay route propagation, injects the prefix into the SD-WAN fabric. The third-party firewall only needs its existing static route to the ION LAN address, so the design remains unchanged on the firewall side.

Answer

Enable BGP on the branch ION device and peer with the firewall using an eBGP session.

Answer

Enable NAT on the branch ION device so the data center subnet appears as a directly connected network.

Answer

Enable OSPF on the branch LAN interface and redistribute connected routes.

Question 11

A network administrator is configuring a Prisma SD-WAN policy to ensure that voice traffic from a branch site is always sent over the lowest-latency path, even if that path is not the primary WAN link. The administrator creates an application policy that matches voice traffic and sets the action to 'Low Latency'. However, after deployment, voice traffic is still using the primary link. What is the most likely cause?

Accepted Answer

The application policy is not placed in the correct policy stack order, so a higher-priority policy is overriding it.. Prisma SD-WAN evaluates policies in a top-down order, and a higher-priority policy can override a lower one. If the voice policy is not positioned correctly, another policy may match the traffic first and direct it over the primary link. Ensuring the voice policy is above conflicting policies resolves the issue.

Answer

The 'Low Latency' action requires a path quality profile to be associated with the policy.

Answer

The 'Low Latency' action only works for traffic that is already marked with DSCP EF.

Answer

The branch ION device does not have a second WAN link configured for failover.

Question 12

A network engineer is deploying a new branch ION device using Zero-Touch Provisioning (ZTP). The device has been physically installed and powered on. Which two steps are required to complete the ZTP process? (Choose two.)

Accepted Answer

Claim the device serial number in the Prisma SD-WAN portal.. The two required steps for ZTP are claiming the device serial number in the Prisma SD-WAN portal and ensuring the ION device has outbound internet connectivity to the controller. Claiming associates the device with the tenant, and connectivity allows it to download configuration. Other steps like static IP or manual image installation are not part of the standard ZTP workflow.

Answer

Manually install the SD-WAN software image on the ION device.

Answer

Create a site and assign the ION device to it in the Prisma SD-WAN portal.

Answer

Configure a static IP address on the WAN interface of the ION device.

Question 13

A network engineer is deploying a new branch office with a single ION device that has two WAN interfaces: one connected to a 500 Mbps fiber circuit and one to a 100 Mbps LTE backup. The engineer wants the LTE link to be used only when the fiber link fails. Which WAN interface configuration should the engineer apply to the LTE interface?

Accepted Answer

Set the LTE interface to 'Hot Standby' mode.. The requirement is to keep the LTE link idle until the fiber link fails. Hot Standby mode on the ION device is designed for this exact purpose: the interface remains configured and monitored but does not carry traffic unless a primary link becomes unavailable. Load balancing and FEC do not provide standby behavior, and a separate failover policy is not the interface-level setting that defines standby operation.

Answer

Assign the LTE interface to a 'Failover' policy with a lower priority than the fiber interface.

Answer

Enable 'Forward Error Correction' on the LTE interface.

Answer

Configure the LTE interface as a 'Load Balancing' member.

Question 14

An engineer is configuring a Prisma SD-WAN branch ION with two WAN interfaces: one active broadband circuit and one LTE backup. The requirement is that the LTE circuit must only carry traffic when the broadband circuit fails, and must not be used for any traffic under normal conditions. Which configuration should the engineer apply to meet this requirement?

Accepted Answer

Create a WAN interface policy that sets the LTE interface to standby mode with the broadband circuit as the primary path.. The requirement is a classic active/standby failover scenario. The LTE interface must remain idle until the primary broadband circuit fails. Configuring the LTE interface as standby with the broadband as primary ensures that the SD-WAN fabric only uses LTE when the primary path is unavailable. This is the correct way to enforce the no-traffic-under-normal-conditions rule.

Answer

Set the LTE interface's bandwidth to zero in the interface configuration so no traffic can be sent over it.

Answer

Apply a QoS policy that marks all traffic as low priority on the LTE interface, causing the SD-WAN fabric to avoid it.

Answer

Configure a load balancing policy across both WAN interfaces with a higher weight on the broadband circuit.

Question 15

A network administrator is configuring a Prisma SD-WAN policy to route all traffic from the guest VLAN directly to the internet, bypassing the corporate VPN. Which type of policy should be used to achieve this?

Accepted Answer

A traffic policy that specifies the internet as the egress path for guest VLAN.. To route guest VLAN traffic directly to the internet, a traffic policy must be configured. Traffic policies define the path selection for matching traffic, allowing the administrator to specify the internet as the egress. QoS, NAT, and service policies serve different purposes and do not control routing decisions. Thus, the traffic policy is the correct choice.

Answer

A service policy that directs guest traffic to the internet breakout.

Answer

A QoS policy with a high priority for guest traffic.

Answer

A NAT policy to translate guest traffic to a public IP.