SD-WAN-Engineer Deployment And Configuration Practice Test 2 — 15 Questions

Question 1

A network engineer is configuring a Prisma SD-WAN branch ION device to connect to a new WAN link. The engineer needs to verify that the ION device can reach the Prisma SD-WAN controller and establish a control plane connection. Which command should the engineer use on the ION device CLI to check the status of the control plane connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show controller status. The 'show controller status' command is used on the ION device CLI to verify the control plane connection to the Prisma SD-WAN controller. It provides details such as connection state and controller IP address, confirming that the device is properly managed.

Answer

show tunnel status

Answer

show ip route

Answer

show interface wan0

Question 2

An engineer is deploying a new data center ION device that will terminate SD-WAN tunnels from 40 branch sites. The design requires that the device remain reachable for management even if the primary WAN circuit fails, and that tunnel establishment succeed when the public address changes. Which two configuration elements are required to meet these goals? (Choose two.)

Accepted Answer

Configure a controller connection over both the primary and secondary WAN interfaces.. Management resilience and address-change tolerance both depend on how the overlay is anchored. Running the controller connection across both WAN interfaces keeps management reachable when the primary circuit fails, while controller-brokered endpoint discovery lets devices re-establish tunnels after a public address change. Together these two elements satisfy both stated goals without hardcoded peer addresses.

Answer

Configure a static route on the data center ION device for each branch subnet.

Answer

Configure the branch ION devices with the data center's static public IP address as the tunnel endpoint.

Answer

Enable dynamic DNS registration on the ION device's WAN interfaces.

Question 3

A network administrator is deploying a new Prisma SD-WAN branch ION device and needs to ensure that the device can establish connectivity to the controller for Zero-Touch Provisioning. The branch has a single ISP circuit with a dynamic public IP address. Which TWO actions are required to allow the ION to reach the controller? (Choose two.)

Accepted Answer

Allow outbound UDP 4500 and TCP 443 from the ION to the controller.. For Zero-Touch Provisioning with a dynamic ISP address, the ION must obtain a routable IP on its WAN interface, typically via DHCP, and be able to initiate outbound connections to the controller on the required ports. Outbound UDP 4500 and TCP 443 must be permitted. These two actions ensure the device can establish control plane connectivity and complete provisioning.

Answer

Install a DHCP server on the branch LAN to assign an address to the ION's management interface.

Answer

Enable inbound port forwarding on the ISP modem for the ION's management IP.

Answer

Configure a static route on the ION pointing to the controller's IP address.

Question 4

A network administrator is deploying a Prisma SD-WAN solution with a hub-and-spoke topology. The administrator wants to enable direct spoke-to-spoke communication for certain applications without routing traffic through the hub. Which feature should be configured to allow this?

Accepted Answer

Configure 'Dynamic Branch-to-Branch VPN' on the spokes.. To enable direct spoke-to-spoke communication without routing through the hub, the administrator should configure Dynamic Branch-to-Branch VPN on the spokes. This feature allows spokes to establish direct tunnels dynamically, optimizing traffic paths for specific applications. Other options like Hub Clustering or Policy-Based Routing do not create direct spoke-to-spoke tunnels.

Answer

Enable 'Hub Clustering' on the hub devices.

Answer

Set up 'Policy-Based Routing' on the hub to redirect traffic between spokes.

Answer

Enable 'Forward Error Correction' on all spoke WAN interfaces.

Question 5

A network engineer is deploying a new Prisma SD-WAN branch site. The site has two WAN circuits: a primary fiber link and a backup LTE link. The engineer wants to ensure that the LTE link is used only when the fiber link fails, and that failback to fiber occurs automatically after 30 seconds of fiber stability. Which configuration should the engineer apply to the WAN interfaces in the Prisma SD-WAN controller?

Accepted Answer

Set the fiber interface as active and the LTE interface as standby, with a failback timer of 30 seconds under the interface's link configuration.. The correct configuration uses the active/standby WAN link feature in Prisma SD-WAN, which allows one interface to be primary and the other standby. The failback timer ensures automatic return to the primary after it stabilizes for the specified duration. This is the standard method to achieve the described behavior without relying on policy-based path selection, which does not guarantee strict standby usage.

Answer

Enable 'Forward Error Correction' on the fiber link and set the LTE link to 'always on' with a 30-second failback timer.

Answer

Configure both interfaces as active and use a policy to prefer fiber for all traffic, with LTE as a lower-priority path.

Answer

Create a virtual interface pair and assign both physical interfaces to it, then set the fiber as primary and LTE as secondary with a 30-second failback.

Question 6

A network administrator is deploying a Prisma SD-WAN solution at a branch site with two WAN links: one MPLS and one broadband internet. The administrator wants to configure a policy that ensures real-time voice traffic always uses the MPLS link and never the broadband link, even if the MPLS link experiences high latency. Which TWO actions must the administrator take to meet this requirement? (Choose two.)

Accepted Answer

Define an application signature for voice traffic and assign it to a policy rule that specifies the MPLS link as the only allowed path.. To ensure voice traffic always uses MPLS and never broadband, the administrator must first identify voice traffic using an application signature, then create a policy rule that restricts that traffic to the MPLS link only with no fallback. This combination enforces the strict requirement, even if MPLS experiences high latency. Other options either allow fallback or do not prevent broadband usage.

Answer

Set the broadband link as a backup path for voice traffic with a higher cost metric.

Answer

Configure a QoS policy that prioritizes voice traffic on the MPLS link and deprioritizes it on the broadband link.

Answer

Enable 'Forward Error Correction' on the MPLS link to improve voice quality and set the broadband link as standby.

Question 7

A network architect is deploying Prisma SD-WAN at a data center with two ION devices in a high-availability pair. The architect wants to ensure that if one ION fails, the other takes over all traffic seamlessly. Which configuration is required to achieve this?

Accepted Answer

Configure the two IONs in a cluster with a dedicated HA link and enable stateful synchronization.. Prisma SD-WAN high availability is achieved by clustering two ION devices with a dedicated HA link. This link carries heartbeat and state information, enabling the standby device to assume active role without dropping sessions. The cluster must be configured in the Prisma SD-WAN portal, and both devices must be assigned to the same site.

Answer

Configure both IONs with the same WAN IP addresses and enable BGP multihoming.

Answer

Configure the two IONs as a VRRP group on the LAN side and enable stateful failover.

Answer

Configure each ION with a separate public IP and use DNS round-robin for load balancing.

Question 8

A network engineer is deploying a Prisma SD-WAN branch site with a single ION device that has one WAN link and one LAN link. The engineer needs to configure the LAN side to support multiple VLANs for different departments. Which TWO steps must the engineer perform to enable inter-VLAN routing on the ION? (Choose two.)

Accepted Answer

Create VLAN interfaces on the ION for each department and assign IP addresses.. To enable inter-VLAN routing on a Prisma SD-WAN ION, the engineer must create VLAN interfaces with IP addresses and configure the physical LAN port as a trunk. These steps allow the ION to act as a Layer 3 gateway and route traffic between VLANs. Additional features like OSPF or policies are optional for this functionality.

Answer

Assign the ION's LAN interface to a zone and enable zone-based firewall for inter-VLAN traffic.

Answer

Enable OSPF on the ION to advertise the VLAN subnets to the WAN.

Answer

Create a policy to allow inter-VLAN traffic and set the action to allow.

Question 9

Which command or interface action is used to verify the current status of the SD-WAN overlay tunnels?

Accepted Answer

Show tunnels view in the Controller. The 'Show tunnels' view in the SD-WAN Controller (Orchestrator) provides a real-time, centralized display of all overlay tunnel status, including up/down state, latency, jitter, and packet loss for each tunnel. This is the authoritative interface for verifying overlay tunnel health because the controller maintains the tunnel state database for all edges.

Answer

show routing table

Answer

show interface status

Answer

ping gateway

Question 10

A branch office requires local breakout for SaaS traffic. How do you configure the policy to ensure this traffic does not traverse the data center?

Accepted Answer

Configure a destination-based policy with a Local Breakout action. The destination-based policy for direct internet access (DIA) ensures local traffic exits locally.

Answer

Set the VRF to global

Answer

Apply a hub-and-spoke routing policy

Answer

Enable NAT on the WAN interface

Question 11

You are implementing a QoS policy. Why would you configure a 'Shaping' rate on a WAN interface?

Accepted Answer

To manage congestion and match the provider's provisioned rate. A shaping rate on a WAN interface is configured to match the provider's provisioned (contract) rate, which is often lower than the physical interface speed. Shaping smooths traffic to that rate to avoid overwhelming the provider's policer, which would drop packets and cause TCP collapse. It manages congestion by buffering and pacing egress traffic.

Answer

To enable load balancing

Answer

To increase the circuit bandwidth

Answer

To match the physical interface speed

Question 12

What is the impact of assigning a site to a specific 'Site Group' in a Prisma SD-WAN policy?

Accepted Answer

It allows the application of policy sets to multiple sites simultaneously. Site Groups allow for scalable policy application across multiple sites with similar requirements.

Answer

It creates a new physical network

Answer

It forces all sites into the same VRF

Answer

It limits the number of peers

Question 13

You are configuring a path policy to prioritize VoIP traffic. Which specific metric should you leverage to ensure the best call quality when multiple paths are available?

Accepted Answer

Path performance metric. Jitter and latency are critical for voice; the policy uses performance metrics to steer traffic dynamically.

Answer

DSCP marking

Answer

Bandwidth consumption

Answer

Source IP address

Question 14

When configuring an ION device as a gateway for a cloud environment, what is the primary role of a 'Service' interface?

Accepted Answer

To provide connectivity to LAN-side services or segments. A 'Service' interface on an ION device configured as a cloud gateway provides connectivity to LAN-side services or segments, effectively acting as the internal-facing interface for the cloud environment. It connects the cloud workload segments to the SD-WAN fabric for policy-driven routing.

Answer

To provide management access

Answer

To update firmware

Answer

To connect to the ISP modem

Question 15

When deploying a new ION device, which Prisma SD-WAN component is primarily used to initiate the zero-touch provisioning process?

Accepted Answer

Controller. The ION device reaches out to the Controller during the initial bootstrap process to pull its configuration and firmware.

Answer

Prisma Access

Answer

CloudBlades

Answer

Prisma SD-WAN Plugin