SD-WAN-Engineer Deployment And Configuration Practice Test 4 — 15 Questions

Question 1

Which TWO factors are used by Prisma SD-WAN to determine the health of a WAN path?

Accepted Answer

Packet loss. Prisma SD-WAN continuously probes each WAN path and evaluates its health using measured network-quality metrics, and packet loss (option D) is one of these core metrics because dropped packets directly indicate path degradation and trigger path selection or failover decisions. Latency (option E) is the other correct factor, since round-trip delay thresholds determine whether a path meets the SLA for applications such as voice and video. Options A (physical cable color) and B (power supply status) are physical-layer or hardware attributes that have no bearing on the dynamic health scoring of a WAN path, and option C (ISP name) is merely an administrative label that does not itself measure path quality.

Answer

Physical cable color

Answer

Power supply status

Answer

ISP name

Question 2

When configuring 'NAT', what is the difference between 'Source NAT' and 'Destination NAT'?

Accepted Answer

Source NAT hides internal IPs; Destination NAT directs inbound traffic. Source NAT modifies the source IP for outbound traffic; Destination NAT modifies the destination IP for inbound traffic.

Answer

Destination NAT hides internal IPs

Answer

Only Source NAT is supported

Answer

They are the same

Question 3

Which THREE components are involved in configuring Prisma SD-WAN security policies?

Accepted Answer

Application objects. In Prisma SD-WAN, security policies are built from three core building blocks: Application objects (A) define the traffic to match by identifying applications or application groups, Policy rules (B) specify the action (allow, deny, inspect, etc.) applied to matched traffic, and Security zones (E) define the trust boundaries/interfaces between which traffic flows, which the rules reference as source and destination. These three components work together: zones establish where traffic originates and terminates, application objects identify what the traffic is, and policy rules determine how it is handled. Physical port numbering (C) is not a security policy component; ports are assigned to zones/interfaces during network configuration, not within the policy itself. Hard drive capacity (D) is irrelevant to security policy configuration, as it relates to hardware sizing rather than policy definition.

Answer

Physical port numbering

Answer

Hard drive capacity

Question 4

Which THREE types of information are displayed in the Prisma SD-WAN 'Flow Monitoring' view?

Accepted Answer

Source and destination IP. Option A is correct because the Flow Monitoring view in Prisma SD-WAN displays the source and destination IP addresses for each flow, allowing administrators to identify the endpoints of traffic traversing the fabric. Option B is correct because path metrics such as packet loss and latency are shown per flow, which is essential for understanding the quality of the selected path and for troubleshooting performance issues. Option E is correct because the Application name is displayed, since Prisma SD-WAN identifies and classifies traffic by application to support application-aware routing and policy enforcement. Option C is not correct because ISP billing records are not part of flow telemetry; they belong to billing or cost-management systems, not the Flow Monitoring view. Option D is not correct because router CPU temperature is device health telemetry, not flow-level information, and would appear in device monitoring rather than Flow Monitoring.

Answer

ISP billing records

Answer

Router CPU temperature

Question 5

Which TWO items are considered 'Underlay' resources in a Prisma SD-WAN configuration?

Accepted Answer

Public Internet broadband. In Prisma SD-WAN, the Underlay refers to the physical transport networks that carry traffic between sites before any SD-WAN overlay is built, so the two correct answers are B (Public Internet broadband) and C (MPLS circuit), since both are WAN transport links that provide the underlying connectivity for the fabric. Public Internet broadband and MPLS circuits are exactly the types of circuits/links that Prisma SD-WAN models as underlay resources and binds to interfaces on the ION devices. By contrast, A (VLAN configuration) is a Layer 2 segmentation construct used on the LAN/interface side rather than a WAN transport, D (VRF ID) is a routing/segmentation identifier used to separate virtual routing instances, and E (IPsec tunnel) is an overlay construct that Prisma SD-WAN builds on top of the underlay to create the secure fabric between sites.

Answer

VLAN configuration

Answer

VRF ID

Answer

IPsec tunnel

Question 6

Which THREE actions can be performed by a Prisma SD-WAN 'Policy' object?

Accepted Answer

Path selection. In Prisma SD-WAN, a Policy object is the mechanism that defines how traffic is handled across the fabric, and it directly performs path selection (B) by choosing which WAN path or paths (e.g., VPN, Direct Internet, or specific circuit) a flow should use based on application, source/destination, and path-quality conditions. It also performs traffic prioritization/QoS (D) by assigning traffic classes and priority levels so latency-sensitive or business-critical applications receive appropriate bandwidth and forwarding treatment. Security filtering (E) is likewise enforced through policy, since Prisma SD-WAN policies can reference security zones and service/security rule sets to permit, deny, or redirect traffic to security services. Hardware replacement (A) and firmware updates (C) are not policy actions; they are operational/lifecycle tasks handled through device management, software upgrade workflows, and the Prisma SD-WAN controller, not through the Policy object.

Answer

Hardware replacement

Answer

Firmware updates

Question 7

Which TWO of the following are benefits of using Prisma SD-WAN?

Accepted Answer

Simplified management through a centralized Controller. Option B is correct because Prisma SD-WAN uses a centralized controller (the Prisma SD-WAN Controller, hosted in the cloud) to provision, monitor, and manage all branches and data centers from a single pane of glass, replacing per-device CLI configuration with policy-driven orchestration. Option C is correct because Prisma SD-WAN continuously measures path quality (latency, jitter, packet loss) across all WAN links and automatically steers application traffic over the best-performing path using application-defined policies, which is a core SD-WAN capability. Option A is not a real benefit since no networking product can bypass the laws of physics. Option D is not a guaranteed benefit of Prisma SD-WAN, as reduced power consumption is not a marketed feature of the solution. Option E is incorrect because Prisma SD-WAN still requires physical cabling and underlay connectivity; it virtualizes and overlays the WAN rather than eliminating physical wiring.

Answer

Ability to bypass all laws of physics

Answer

Reduction of total electricity consumption

Answer

Elimination of all physical wiring

Question 8

Which THREE items are included in a Prisma SD-WAN 'Site' configuration?

Accepted Answer

Interface configuration. In Prisma SD-WAN, a Site object is the logical container that binds together the physical location and the devices deployed there, so Interface configuration (B) is correct because each site defines its WAN/LAN interfaces (e.g., IP addressing, WAN labels, and link settings) used by the SD-WAN devices at that location. Site location details (C) are also correct, since a Site stores geographic/address information (such as address, latitude/longitude, and timezone) that is used for topology mapping, policy, and path selection. Device assignment (D) is correct as well, because ION devices must be assigned to a Site so they inherit that site's interfaces, policies, and routing context. ISP contract end date (A) is a commercial/administrative detail not part of the Site configuration object, and user password history (E) is an authentication/security setting unrelated to SD-WAN site definition.

Answer

ISP contract end date

Answer

User password history

Question 9

Which THREE settings are typically defined during the initial ION site provisioning?

Accepted Answer

WAN interface settings. During initial ION site provisioning, the WAN interface settings (A) must be defined so the device can establish its uplink connectivity to the provider or internet, including IP addressing, VLAN, and link parameters. The site name (C) is also required at provisioning time because it identifies the location within the management/controller hierarchy and is used for configuration and reporting. Service interface assignments (E) are configured during provisioning to map LAN ports or VLANs to the services (e.g., internet, MPLS, VPN) that the site will use. Annual maintenance schedule (B) is an administrative/operational task handled later, not part of initial provisioning, and global DNS server settings (D) are typically inherited from a template or profile rather than defined per-site during initial provisioning.

Answer

Annual maintenance schedule

Answer

Global DNS server settings

Question 10

Which TWO components are essential for maintaining the SD-WAN control plane?

Accepted Answer

Controller. Option A (Controller) is correct because the SD-WAN control plane is logically centralized in one or more controllers that maintain the network topology, distribute routing/policy information, and manage the overlay fabric, so no control plane can function without them. Option E (Secure communication channel, e.g., TLS) is correct because control-plane elements such as controllers and edge devices must exchange sensitive routing, policy, and key material over an authenticated, encrypted channel like TLS (or DTLS) to prevent tampering and eavesdropping. Option B (Physical cable length) is incorrect because it is a Layer 1/2 physical consideration that does not participate in the SD-WAN control plane. Option C (Local switch ports) is incorrect because access switch ports are data-forwarding interfaces, not control-plane components. Option D (CloudBlades API key) is incorrect because an API key is a vendor-specific management/authentication credential, not an essential control-plane component of SD-WAN.

Answer

Physical cable length

Answer

Local switch ports

Answer

CloudBlades API key

Question 11

Which TWO features are used to monitor the performance of an application across the SD-WAN?

Accepted Answer

Path performance metrics. Path performance metrics (A) are correct because SD-WAN solutions continuously measure per-tunnel characteristics such as latency, jitter, packet loss, and bandwidth on each WAN path, which directly reflects how an application's traffic performs across the overlay. Application-level flow data (C) is also correct because SD-WAN devices perform deep packet inspection and application-aware routing, exporting flow records (e.g., via IPFIX/NetFlow) that identify which applications are traversing which paths and their quality, enabling application performance monitoring. Physical port speed (B) only describes the link's raw capacity and does not reflect end-to-end application experience. Device power consumption (D) is a hardware/environmental metric unrelated to application performance. User social media activity (E) is a user behavior/policy concern, not a performance monitoring feature of the SD-WAN fabric.

Answer

Physical port speed

Answer

Device power consumption

Answer

User social media activity

Question 12

A customer wants to prioritize Office 365 traffic over general web traffic. What is the most efficient way to achieve this?

Accepted Answer

Create an application-aware policy. Creating an application-aware policy is the most efficient way to prioritize Office 365 traffic because Prisma SD-WAN can identify Office 365 by application signature (not just port/IP) and steer it onto preferred paths with higher priority. This leverages built-in application identification and SLA-based path selection.

Answer

Manually route all traffic to a specific ISP

Answer

Set a global rate limit

Answer

Configure port-based QoS

Question 13

An engineer is deploying a new branch ION device that will connect to two different ISPs. The design requires that return traffic from the data center follows the same WAN path that the outbound session used, so that stateful inspection appliances in the data center see both directions of every flow. Which configuration on the branch ION device satisfies this requirement?

Accepted Answer

Enable path affinity so that return traffic uses the same WAN path as the originating flow.. Symmetric flow handling requires that both directions of a session traverse the same WAN path. Path affinity binds a flow to its chosen path so return traffic is not redirected to a different ISP link. This preserves stateful inspection in the data center and avoids broken sessions caused by asymmetric routing across the two ISP connections.

Answer

Configure policy-based forwarding with a unique path for each application.

Answer

Enable Forward Error Correction on both WAN interfaces.

Answer

Enable IPsec tunnel bonding across both WAN interfaces.

Question 14

A network engineer is deploying a new branch office with a single Prisma SD-WAN ION device. The branch has two WAN links: a primary fiber circuit and a backup LTE connection. The engineer wants the ION device to automatically establish secure tunnels to the Prisma SD-WAN controller and to the nearest data center without manual intervention. Which deployment method should the engineer use?

Accepted Answer

Zero-Touch Provisioning (ZTP) with a claim code. Zero-Touch Provisioning (ZTP) with a claim code enables the ION device to automatically register with the Prisma SD-WAN controller, retrieve its configuration, and establish secure tunnels to data centers and other branches. This method eliminates manual configuration and is the standard for branch deployments.

Answer

Configuring a DHCP option 43 on the branch router to point to the controller

Answer

Manual CLI configuration of IPsec tunnels and controller IP addresses

Answer

Pre-staging the device by copying a configuration file to a USB drive and booting the device

Question 15

A network engineer is deploying a new branch ION device at a site with dual WAN circuits: a primary 500 Mbps fiber link and a secondary 100 Mbps LTE link. The design requires that the LTE link only carry traffic when the fiber link fails, and that all traffic return to the fiber link automatically once it recovers. Which configuration should the engineer apply on the ION device?

Accepted Answer

Create a failover WAN bundle with the fiber interface as the primary and the LTE interface as the standby member.. The requirement describes an active/standby WAN design with automatic failback. A failover WAN bundle keeps the secondary member idle until the primary path is declared down, then shifts traffic and reverts when health returns. Load balancing, static routing with manipulated distance, or per-packet distribution all keep both links active or fail to provide monitored automatic failback.

Answer

Configure both WAN interfaces in a single load-balanced WAN bundle with per-flow hashing.

Answer

Enable per-packet load balancing on both WAN interfaces so traffic is distributed based on current utilization.

Answer

Configure a static route for 0.0.0.0/0 pointing to the LTE next-hop with a lower administrative distance than the fiber route.