SD-WAN-Engineer Deployment And Configuration Practice Test 3 — 15 Questions

Question 1

When configuring a security policy, what is the purpose of an 'Application' object?

Accepted Answer

To identify traffic by application signatures rather than just ports. Application objects identify traffic by signature, allowing for specific policy control.

Answer

To set the bandwidth limit

Answer

To define the physical interface

Answer

To define the user identity

Question 2

In a multi-VRF deployment, what must be configured to allow traffic to move between two different VRFs?

Accepted Answer

Configure inter-VRF routing policies. Cross-VRF communication requires explicit route leaking or inter-VRF routing policies.

Answer

Enable NAT on both interfaces

Answer

Assign both to the default VRF

Answer

Disable the firewall

Question 3

What does the 'App-ID' feature provide in a security policy?

Accepted Answer

Dynamic identification of applications. App-ID performs dynamic, context-based application identification by inspecting traffic flows (signatures, heuristics, decryption) rather than relying on static port/protocol mappings. This lets the firewall enforce security policy on the actual application (e.g., Facebook, BitTorrent) regardless of port, IP, or evasion technique. It is the foundation for application-aware policy, QoS, and Safe Search enforcement in next-gen firewalls.

Answer

A list of blocked URLs

Answer

Device inventory

Answer

A list of IP addresses

Question 4

What is the effect of changing the 'Path Selection' strategy from 'Latency' to 'Lowest Cost' in a policy?

Accepted Answer

It prioritize links based on configured cost parameters. Changing the Path Selection strategy to 'Lowest Cost' makes the SD-WAN controller choose the WAN link with the lowest configured cost metric (e.g., cost per Mbps or provider preference) rather than the lowest latency. This is a policy-level decision that affects which tunnel carries traffic, and it is useful when bandwidth economics matter more than latency. The other options describe unrelated or incorrect effects.

Answer

It disables all tunnels

Answer

It forces traffic to the internet

Answer

It improves jitter

Question 5

How does a 'Failover' policy differ from a 'Load Balancing' policy in Prisma SD-WAN?

Accepted Answer

Failover uses only one link at a time. A Failover policy in Prisma SD-WAN uses one active path at a time and switches to a backup path only when the primary fails or degrades beyond thresholds. A Load Balancing policy distributes traffic across multiple paths simultaneously. The key differentiator is that failover is active/standby, not active/active.

Answer

Load balancing only works on LAN

Answer

Load balancing is not supported

Answer

Failover requires more bandwidth

Question 6

When setting up a branch site, what is the purpose of the 'Underlay' configuration?

Accepted Answer

To configure the ISP circuit details. Underlay configuration defines the physical WAN circuit parameters (ISP, bandwidth, etc.) for the SD-WAN tunnel overlay.

Answer

To define the routing protocol

Answer

To manage internal LAN switches

Answer

To configure DHCP

Question 7

You need to restrict administrative access to the ION device. Where is this configured?

Accepted Answer

Device Configuration / Access Control. Management access policies are defined under the device configuration settings in the Controller.

Answer

In the routing table

Answer

In the CloudBlades menu

Answer

On the WAN interface

Question 8

How does Prisma SD-WAN handle DNS queries for branch users?

Accepted Answer

It can intercept and proxy DNS requests. Prisma SD-WAN can intercept and proxy DNS requests from branch users, allowing the controller to apply DNS-based policies, enforce security filtering, and direct queries to appropriate resolvers. This interception is part of its application-aware traffic handling and enables DNS-based steering and threat protection.

Answer

It ignores DNS traffic

Answer

It blocks all DNS queries

Answer

It forces all DNS to public servers

Question 9

Where are the primary SD-WAN routing policies defined?

Accepted Answer

Within the Controller policy engine. Policies are defined centrally in the Controller and pushed to the edge devices.

Answer

Locally on the ION device CLI

Answer

On the ISP router

Answer

In the local DHCP server

Question 10

What is the purpose of 'Bandwidth Groups' in Prisma SD-WAN?

Accepted Answer

To manage aggregated capacity for path policies. Bandwidth Groups in Prisma SD-WAN aggregate the total capacity of multiple WAN links (or portions of links) into a single logical pool that path policies can reference. This lets you define policies against the combined bandwidth of several circuits rather than per-link capacity, so traffic steering decisions account for the aggregate available bandwidth across all member links.

Answer

To set the time zone

Answer

To define VLANs

Answer

To limit internal file transfers

Question 11

If a user at a branch site reports that they cannot access a specific internal server, which diagnostic tool should you use first?

Accepted Answer

Review Flow Monitoring logs. Flow monitoring allows you to see if traffic is hitting the expected policy and where it is being dropped or steered.

Answer

Check the cloud status page

Answer

Check physical cables

Answer

Reboot the ION

Question 12

Which Prisma SD-WAN component is responsible for orchestrating the overall security policy across the entire fabric?

Accepted Answer

The Prisma Controller. The Prisma Controller (part of Prisma SD-WAN, formerly CloudGenix) is the centralized orchestration component that defines and distributes security policy across the fabric. It pushes policy to ION devices, which enforce it locally. The controller is the single source of truth for fabric-wide security intent.

Answer

The local firewall

Answer

The ION device itself

Answer

The DNS server

Question 13

What is the primary function of the 'Controller' dashboard in the Prisma SD-WAN UI?

Accepted Answer

To provide visibility into fabric health and status. The dashboard provides a high-level view of health, status, and traffic analytics.

Answer

To configure individual PC settings

Answer

To update user passwords

Answer

To manage ISP billing

Question 14

When using Prisma SD-WAN with Prisma Access, how is the secure tunnel established?

Accepted Answer

Automated tunnel provisioning via the Controller. The ION device automatically provisions an IPsec tunnel to the Prisma Access Cloud Service Edge (CSE).

Answer

Manual IPsec configuration

Answer

Using a BGP peer

Answer

Via a physical cable link

Question 15

You need to ensure that traffic from a specific subnet is placed into a unique VRF. How is this achieved?

Accepted Answer

By assigning the interface to the desired VRF. To place traffic from a specific subnet into a unique VRF, you assign the interface associated with that subnet to the desired VRF. In Prisma SD-WAN, VRF membership is determined by interface configuration, so the subnet's traffic inherits the VRF of the interface it enters or exits through.

Answer

By rebooting the device

Answer

By setting a firewall rule

Answer

By modifying the global routing table