SD-WAN-Engineer Deployment And Configuration Practice Test 5 — 15 Questions

Question 1

A network engineer is deploying a new branch ION device at a site with two WAN links and wants to guarantee that business-critical voice traffic always uses the lowest-latency path, even when one link degrades. Which Prisma SD-WAN configuration should be applied to the branch ION device to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a policy set with a path selection policy that uses the lowest-latency path for voice traffic and a failover action to the secondary link.. A path selection policy with lowest-latency criteria and a failover action is the correct approach because it continuously monitors WAN link performance and dynamically routes voice traffic over the best available path, with automatic failover if the primary link degrades. This ensures the required low-latency treatment without manual intervention.

Answer

Configure a static route for the voice subnet pointing to the primary WAN interface.

Answer

Enable Forward Error Correction on both WAN interfaces to reduce latency for voice traffic.

Answer

Set up a QoS policy that prioritizes voice traffic in the queue on the primary WAN link.

Question 2

A network architect is designing a Prisma SD-WAN deployment for a retail customer with 200 small branches. Each branch has a single ION device and one broadband circuit. The customer wants centralized policy management and minimal on-site configuration. Which TWO deployment components are required to meet these goals? (Choose two.)

Accepted Answer

Prisma SD-WAN ION devices at each branch for data-plane forwarding.. A Prisma SD-WAN deployment requires the cloud-hosted controller for centralized policy and configuration management, plus branch ION devices to forward and secure traffic. Together they deliver centralized orchestration with minimal on-site work. Dedicated MPLS, local management servers, and separate firewalls are not required and would raise cost and complexity.

Answer

A physical firewall appliance at each branch to enforce security policy.

Answer

A local management server installed at each branch for policy distribution.

Answer

A dedicated MPLS circuit at every branch for underlay transport.

Question 3

A network administrator is configuring a Prisma SD-WAN branch ION device that will connect to the internet via a single ISP link. The administrator needs to ensure that the device can establish a secure control plane connection to the Prisma SD-WAN controller. Which configuration is required on the ION device?

Accepted Answer

Configure the ION device with the correct controller IP address or FQDN and ensure outbound TCP port 443 is allowed.. The control plane connection between an ION device and the Prisma SD-WAN controller uses TCP port 443. This secure connection is essential for device registration, policy retrieval, and ongoing management. Therefore, outbound TCP 443 must be allowed for the device to be operational.

Answer

Configure the ION device with the correct controller IP address or FQDN and ensure outbound UDP port 500 and 4500 are allowed.

Answer

Configure the ION device with a static route to the controller and enable OSPF on the WAN interface.

Answer

Configure the ION device with the correct controller IP address or FQDN and ensure outbound UDP port 4501 is allowed.

Question 4

An engineer is configuring a Prisma SD-WAN policy to route guest Wi-Fi traffic directly out of the local branch internet circuit instead of sending it to the data center. The guest traffic must not traverse the SD-WAN overlay. Which policy type should the engineer use?

Accepted Answer

An application policy that sets the action to direct internet breakout.. To keep guest Wi-Fi traffic local and off the SD-WAN overlay, the engineer needs a policy action that performs direct internet breakout. An application policy with that action tells the ION device to forward matching flows out of the local WAN circuit. Path policies, QoS markings, and NAT do not remove traffic from the overlay, so they cannot satisfy the requirement.

Answer

A QoS policy that marks guest traffic as best effort.

Answer

A path policy that prefers the data center VPN path for guest traffic.

Answer

A NAT policy that translates guest traffic to the branch WAN IP address.

Question 5

A network engineer is deploying a new branch ION device at a site with two WAN links and wants to guarantee that business-critical voice traffic always uses the lowest-latency path, even when one link degrades. Which Prisma SD-WAN configuration should be applied to the branch ION device to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a path selection policy that sets the fiber link as primary and the LTE link as backup, with failover triggered by link health.. Prisma SD-WAN uses path selection policies to define primary and backup WAN links based on health and performance. By configuring the fiber link as primary and LTE as backup with health-based failover, the branch will use LTE only when the fiber link fails. This ensures efficient use of the primary circuit and automatic redundancy.

Answer

Configure a static route for the LTE interface with a higher administrative distance than the fiber interface.

Answer

Configure a policy that sets the LTE interface as the preferred egress for all traffic, with the fiber interface as secondary.

Answer

Enable per-packet load balancing across both WAN interfaces to distribute traffic evenly.

Question 6

A network engineer is deploying a Prisma SD-WAN solution at a branch site with two WAN links: a primary MPLS link and a secondary broadband link. The engineer wants to ensure that if the MPLS link fails, all traffic automatically switches to the broadband link without manual intervention. Which configuration should be applied?

Accepted Answer

Configure a path selection policy with a failover action to the broadband link when the MPLS link is down.. A path selection policy with a failover action is the correct solution because it continuously monitors link health and automatically redirects traffic to the secondary link when the primary link fails. This ensures seamless failover without manual intervention.

Answer

Enable Forward Error Correction on the MPLS link to prevent failures.

Answer

Configure a static route with a higher administrative distance for the broadband link.

Answer

Configure a QoS policy that prioritizes traffic on the broadband link.

Question 7

A multinational company is deploying Prisma SD-WAN at a branch that has a single MPLS circuit and a broadband internet link. The security team requires that all traffic destined to the corporate data center must traverse the MPLS circuit, while internet-bound traffic should use the broadband link. However, if the MPLS circuit fails, data center traffic should fail over to the broadband link with IPsec encryption. Which configuration achieves this requirement?

Accepted Answer

Create a path selection policy that matches data center traffic and sets MPLS as primary and broadband as backup with IPsec enabled for the backup path.. A path selection policy in Prisma SD-WAN can match traffic destined to the data center, set MPLS as the primary path, and broadband as the backup with IPsec encryption. This provides dynamic failover based on link health, ensuring data center traffic uses MPLS normally and securely switches to broadband only when MPLS fails.

Answer

Set up a QoS policy that marks data center traffic as high priority and forces it over the MPLS link, with a backup policy for broadband.

Answer

Enable per-packet load balancing across both MPLS and broadband links for data center traffic, with IPsec on the broadband link.

Answer

Configure a static route for the data center subnet pointing to the MPLS interface, and a floating static route with a higher metric pointing to the broadband interface with IPsec.

Question 8

A network engineer is deploying a new ION device at a branch that uses a DSL circuit with a dynamic public IP address from the ISP. The branch must establish SD-WAN tunnels to the controller and to other sites. Which configuration must the engineer verify to ensure the tunnels come up reliably?

Accepted Answer

The WAN interface is configured to obtain its IP address via DHCP and the correct WAN label is applied.. For a dynamic ISP circuit, the ION WAN interface must use DHCP to learn its public address and must carry the correct WAN label so the controller can map it to the right transport role. With those settings, the device registers and tunnels form reliably even when the ISP changes the address. Static addressing, loopback bundling, or disabling the overlay all prevent or break tunnel establishment.

Answer

The WAN interface is configured as a static IP with the ISP-provided address.

Answer

The WAN interface is configured with a private IP address and the SD-WAN overlay is disabled.

Answer

The WAN interface is placed in a failover bundle with a loopback interface.

Question 9

A branch ION device is being deployed with a single WAN circuit that is provisioned as a DHCP client. The engineer needs the device to be reachable from the corporate management system for ongoing monitoring, but the ISP does not offer a static IP. Which configuration should the engineer apply on the ION device to meet this requirement?

Accepted Answer

Enable the ION device to establish an outbound management tunnel to the controller.. Because ION devices originate management connectivity to the controller, a dynamically assigned WAN address is sufficient for monitoring and orchestration. The device maintains an outbound tunnel and periodically reports health, so no inbound reachability or static IP is required. This is the standard deployment model for branches on DHCP-provisioned circuits.

Answer

Configure the WAN interface with a static IP address supplied by the ISP.

Answer

Bind the WAN interface to a secondary management VLAN with a static address.

Answer

Configure a destination NAT rule on the ISP router to forward management traffic to the ION device.

Question 10

A network engineer is configuring a Prisma SD-WAN ION device at a branch that has a single WAN link with a public IP address. The branch also has a local subnet of 192.168.10.0/24. The engineer wants to ensure that all traffic from the local subnet to the internet is translated to the WAN IP address. Which type of NAT should be configured?

Accepted Answer

Source NAT (SNAT) with a translation to the WAN interface IP. Source NAT (SNAT) translates the private source IP addresses of the local subnet to the public WAN IP, enabling outbound internet access. This is the correct choice for hiding internal addresses behind a single public IP, as required in the scenario.

Answer

Static NAT with a one-to-one mapping between each local host and the WAN IP

Answer

Port Address Translation (PAT) using a pool of public IP addresses

Answer

Destination NAT (DNAT) with a translation to the WAN interface IP

Question 11

A network administrator is configuring a new ION device at a branch. The administrator wants the device to obtain its IP address, default gateway, and DNS server automatically from the local ISP's DHCP server on the WAN interface. Which WAN interface configuration mode should be selected?

Accepted Answer

DHCP Client. To automatically receive WAN addressing from the ISP, the ION device must operate as a DHCP client on that interface. DHCP Client mode requests an IP address, gateway, and DNS settings from the service provider's DHCP server, requiring no manual entry. Static IP, PPPoE, and DHCP Server modes do not provide this automatic client behavior.

Answer

DHCP Server

Answer

Static IP

Answer

PPPoE

Question 12

A network administrator is preparing to bring a new branch online with Prisma SD-WAN. The branch has no IT staff, and the administrator wants the ION device to receive its full configuration automatically when it is powered on and connected to the internet. Which feature should the administrator use?

Accepted Answer

Zero-Touch Provisioning with a pre-staged device claim in the controller.. Zero-Touch Provisioning is designed for branches without IT staff. When the ION device powers on with internet connectivity, it contacts the controller, authenticates using its pre-staged claim, and downloads its configuration and policies. Manual console work, USB imports, and LAN DHCP do not provide this automated, centralized onboarding.

Answer

Importing a full configuration file from a USB drive during boot.

Answer

Enabling a DHCP server on the branch LAN to assign the ION device a management address.

Answer

Manual console configuration of the WAN interface and controller address.

Question 13

An engineer is configuring a Prisma SD-WAN ION device at a branch. The branch has a single WAN link with a public IP address. The internal LAN uses private IP addresses. The engineer needs to allow internal users to access the internet while hiding their private IP addresses. Which configuration is required?

Accepted Answer

Configure a source NAT policy that translates the private LAN IP addresses to the public WAN IP address for internet-bound traffic.. Source NAT translates private LAN IP addresses to the public WAN IP address for outbound internet traffic. This allows internal users to access the internet while hiding their private addresses, and ensures return traffic is correctly routed back through the NAT device.

Answer

Enable dynamic routing between the LAN and WAN interfaces to allow private IP addresses to be routed to the internet.

Answer

Configure a destination NAT policy that translates the public WAN IP address to an internal server IP for inbound traffic.

Answer

Create a static route for the default gateway pointing to the WAN interface, and enable proxy ARP on the LAN interface.

Question 14

A network engineer is deploying a new branch ION device at a site with two WAN links and wants to guarantee that business-critical voice traffic always uses the lowest-latency path, even when one link degrades. Which Prisma SD-WAN configuration should be applied to the branch ION device to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure VRRP on the LAN interfaces of both ION devices.. To provide a redundant default gateway for LAN hosts, the ION devices must share a virtual IP address. VRRP is the standard protocol for this, allowing one device to act as master and another as backup. DHCP Relay, BGP, and duplicate static IPs do not achieve gateway redundancy and would either not provide a virtual IP or cause conflicts.

Answer

Create a BGP peering session between the two ION devices.

Answer

Assign both ION devices the same static IP address on their LAN interfaces.

Answer

Enable DHCP Relay on both ION devices.

Question 15

A network architect is designing a Prisma SD-WAN deployment for a company with 50 branches. Each branch has two internet links from different ISPs. The architect wants to ensure that business-critical applications always use the best-performing link based on real-time latency, jitter, and packet loss. Additionally, the architect wants to avoid using a link that is experiencing high packet loss. Which Prisma SD-WAN feature should be configured to meet these requirements?

Accepted Answer

Application-based path selection policies with health thresholds for latency, jitter, and packet loss.. Application-based path selection policies with health thresholds allow Prisma SD-WAN to monitor real-time latency, jitter, and packet loss on each WAN link. The system then steers business-critical applications to the best-performing link and avoids links that exceed the configured thresholds, ensuring optimal application performance.

Answer

Load balancing across both ISP links using per-flow distribution.

Answer

QoS policies with strict priority queues for business-critical applications.

Answer

Static routes with administrative distance to prefer one ISP over the other.