SD-WAN-Engineer Hard Questions — 25 Difficult Questions

Question 1

Which THREE actions can be performed by a Prisma SD-WAN 'Policy' object?

Accepted Answer

Path selection. In Prisma SD-WAN, a Policy object is the mechanism that defines how traffic is handled across the fabric, and it directly performs path selection (B) by choosing which WAN path or paths (e.g., VPN, Direct Internet, or specific circuit) a flow should use based on application, source/destination, and path-quality conditions. It also performs traffic prioritization/QoS (D) by assigning traffic classes and priority levels so latency-sensitive or business-critical applications receive appropriate bandwidth and forwarding treatment. Security filtering (E) is likewise enforced through policy, since Prisma SD-WAN policies can reference security zones and service/security rule sets to permit, deny, or redirect traffic to security services. Hardware replacement (A) and firmware updates (C) are not policy actions; they are operational/lifecycle tasks handled through device management, software upgrade workflows, and the Prisma SD-WAN controller, not through the Policy object.

Answer

Hardware replacement

Answer

Firmware updates

Question 2

A network engineer is troubleshooting a site where traffic from a specific VLAN is not being forwarded to the correct VPN overlay. The engineer suspects a misconfiguration in the network policy. Which tool in the Prisma SD-WAN Orchestrator should the engineer use to view the effective policy applied to that site and verify the path selection decisions?

Accepted Answer

Policy Browser. The Policy Browser is designed to show the effective policies applied to a site, including how traffic is classified and which path it should take. It allows engineers to verify if a VLAN's traffic is matching the intended rules and being forwarded correctly. Other tools like Flow Analytics, Topology View, and Event Log provide different perspectives but lack the policy evaluation detail required.

Answer

Topology View

Answer

Event Log

Answer

Flow Analytics

Question 3

An enterprise is designing Prisma SD-WAN for a data center that hosts business-critical applications. The design requires that traffic from branch sites to these applications be steered over a specific set of high-performance circuits, while all other internet-bound traffic uses a different set of circuits. The solution must be scalable and not require per-application static routes on every branch device. What should be used in the design?

Accepted Answer

Define application definitions and use a Prisma SD-WAN policy set with path selection criteria to steer the business-critical applications over the desired circuits.. Application definitions combined with policy sets are the native Prisma SD-WAN mechanism for classifying traffic and steering it over selected paths. Policies can specify preferred circuit types, performance thresholds, and priorities, and they are applied centrally to all sites. This scales without per-device static routes and provides dynamic, application-aware path selection, which is exactly what the data center steering design requires.

Answer

Configure static routes on each branch ION device that point business-critical prefixes to the high-performance circuits.

Answer

Use BGP communities to tag business-critical prefixes and rely on the data center routers to prefer the high-performance circuits for those tags.

Answer

Create separate virtual routing and forwarding instances per application on every branch device and map each VRF to a specific circuit.

Question 4

A network engineer is troubleshooting a Unified SASE deployment where branch users report that access to internal applications is slow after enabling Prisma Access inspection. The engineer confirms that internal traffic is being sent to Prisma Access instead of directly over the SD-WAN fabric. Which configuration change should the engineer make to resolve the issue?

Accepted Answer

Modify the application-based policy to send internal application prefixes over a direct SD-WAN path instead of the Service Connection.. The slowness is caused by internal traffic being backhauled to Prisma Access for inspection. The correct fix is to adjust the application-based policy so that internal application prefixes are matched and sent over a direct SD-WAN path, while internet-bound traffic continues to use the Service Connection. Bandwidth increases, disabling path selection, or static routes to Prisma Access do not correct the misrouting.

Answer

Increase the bandwidth of the ISP link used by the Service Connection to Prisma Access.

Answer

Disable Dynamic Path Selection on the Service Connection to force traffic over a single path.

Answer

Configure a static route on the ION device that points internal prefixes to the Prisma Access tunnel.

Question 5

Which THREE items are included in a Prisma SD-WAN 'Site' configuration?

Accepted Answer

Interface configuration. In Prisma SD-WAN, a Site object is the logical container that binds together the physical location and the devices deployed there, so Interface configuration (B) is correct because each site defines its WAN/LAN interfaces (e.g., IP addressing, WAN labels, and link settings) used by the SD-WAN devices at that location. Site location details (C) are also correct, since a Site stores geographic/address information (such as address, latitude/longitude, and timezone) that is used for topology mapping, policy, and path selection. Device assignment (D) is correct as well, because ION devices must be assigned to a Site so they inherit that site's interfaces, policies, and routing context. ISP contract end date (A) is a commercial/administrative detail not part of the Site configuration object, and user password history (E) is an authentication/security setting unrelated to SD-WAN site definition.

Answer

ISP contract end date

Answer

User password history

Question 6

When integrating Prisma SD-WAN with a cloud-based security service provider (CSSP) via CloudBlades, which setting must be verified to ensure proper traffic redirection?

Accepted Answer

Service-to-Tunnel Mapping. The service mapping in CloudBlades ensures that traffic classified for security inspection is steered to the correct CSSP node.

Answer

Local ISP DNS settings

Answer

DHCP Server scope

Answer

VLAN ID matching

Question 7

A network administrator is investigating why application traffic from a branch site is being routed over the less-preferred MPLS transport instead of the local broadband circuit, even though the application-aware routing policy is configured to prefer broadband for that application. The administrator has already verified that the application is correctly identified and that both TLOCs are up. Which vManage monitoring view should the administrator check first to see the per-application path selection decisions and the reason a particular path was chosen?

Accepted Answer

Monitor > Applications > App Route. Application-aware routing decisions are made per flow based on the configured SLA classes and path preferences. To understand why a specific application took a particular path, the administrator needs visibility into the policy evaluation. The App Route monitoring view provides that per-application breakdown, showing the matched policy, the chosen path, and the alternative paths with their SLA metrics, which directly answers the question.

Answer

Monitor > Devices > WAN Edge

Answer

Monitor > Network > Topology

Answer

Monitor > Network > Interfaces

Question 8

A network operations team is using vManage to monitor the health of a large SD-WAN deployment. They want to set up alerts for critical events. Which TWO alarm types can be configured in vManage to notify administrators of potential issues? (Choose two.)

Accepted Answer

OMP route threshold exceeded. vManage provides a set of predefined alarm types that can be configured for notification. Among them are 'Control connection down' and 'OMP route threshold exceeded'. These alarms help administrators proactively monitor the SD-WAN overlay for critical failures and potential misconfigurations. Other options like duplex mismatch, BGP neighbor flap, and CPU threshold are not standard vManage alarm types and would require external monitoring tools.

Answer

CPU utilization exceeding threshold

Answer

Interface duplex mismatch

Answer

BGP neighbor flap

Question 9

A network architect is reviewing the SD-WAN fabric's high availability design. The architect wants to ensure that if a vSmart controller becomes unavailable, the WAN Edge routers continue to forward traffic without interruption. Which statement accurately describes the behavior of WAN Edge routers when a vSmart controller fails in a multi-controller deployment?

Accepted Answer

WAN Edge routers continue to forward traffic using existing OMP routes and locally cached policies, and they attempt to reconnect to a surviving vSmart controller.. In a multi-controller vSmart deployment, WAN Edge routers establish control connections to multiple vSmart controllers for redundancy. If one vSmart fails, the routers retain their cached OMP routes and policies and continue forwarding traffic without interruption. They simultaneously attempt to reconnect to a surviving vSmart controller to maintain control plane updates. This design ensures high availability and uninterrupted data plane operation.

Answer

WAN Edge routers immediately drop all data plane traffic until they reconnect to a surviving vSmart controller.

Answer

WAN Edge routers stop advertising their TLOCs to other sites until a vSmart controller is reachable again.

Answer

WAN Edge routers revert to a default route and forward all traffic to the vBond orchestrator until a vSmart controller is available.

Question 10

A customer requires a granular segmentation strategy where HR, Engineering, and Guest traffic must remain isolated across the SD-WAN fabric. Which configuration construct provides this logical separation?

Accepted Answer

Virtual Networks (VNets). Virtual Networks (VNets) allow for the logical segmentation of traffic throughout the fabric.

Answer

IPsec Tunnel Groups

Answer

Subnet Masking

Answer

VLAN Tagging

Question 11

A network administrator is investigating intermittent packet loss on a Prisma SD-WAN data path between two branch sites. The administrator suspects that the issue is related to the IPsec tunnel's dead peer detection (DPD) settings. Which action should the administrator take to view the current DPD configuration and statistics on an ION device?

Accepted Answer

Navigate to the Prisma SD-WAN orchestrator, select the device, and view the 'Tunnels' tab under Monitoring.. The Prisma SD-WAN orchestrator is the central management platform that provides detailed monitoring of tunnels, including DPD settings and statistics. By selecting the device and viewing the Tunnels tab, administrators can see real-time DPD status, which helps diagnose packet loss caused by DPD timeouts or misconfigurations.

Answer

Run the CLI command 'show ipsec dpd' on the ION device.

Answer

Check the ION device's local syslog for DPD messages.

Answer

Use the 'debug ipsec' command on the ION device to enable DPD logging.

Question 12

A network administrator is troubleshooting an issue where a branch ION device is not forming an IPsec tunnel to a remote site. The administrator has verified that the underlay network is operational and that both devices have valid public IP addresses. Which of the following should be checked next to ensure the IPsec tunnel can establish?

Accepted Answer

Verify that the IKEv2 proposal and pre-shared key match on both ION devices.. IPsec tunnel formation depends on matching IKEv2 proposals and pre-shared keys. If the underlay is working and public IPs are reachable, mismatched IPsec parameters are the most likely cause. Checking BGP or firewall rules is irrelevant until the tunnel is up, and licensing does not impact tunnel establishment.

Answer

Ensure that the ION devices are licensed for SD-WAN and have valid certificates.

Answer

Review the firewall rules on the ION device to see if they are blocking IPsec traffic.

Answer

Check the BGP configuration to ensure that route advertisements are being exchanged.

Question 13

A network administrator is troubleshooting an issue where a branch site's ION device is not receiving routes from the data center ION device over the SD-WAN fabric. The control plane is up, and tunnels are established. Which CLI command on the branch ION device would best help verify whether BGP routes are being learned from the data center?

Accepted Answer

show bgp neighbor routes. The command 'show bgp neighbor routes' provides detailed information about routes received from a specific BGP neighbor. This is critical when troubleshooting route propagation issues between SD-WAN sites. It allows the administrator to see exactly which prefixes are being advertised by the data center and whether they are being accepted by the branch.

Answer

show bgp summary

Answer

show route bgp

Answer

show ip bgp neighbors <neighbor-ip> routes

Question 14

A network operations team is troubleshooting a routing loop in a Prisma SD-WAN environment. They suspect that an ION device is receiving incorrect BGP routes from a peer. Which tool should they use to view the BGP routes received by the ION device?

Accepted Answer

show bgp routes. To diagnose a routing loop involving BGP, the engineer must inspect the BGP routes received by the ION device. The 'show bgp routes' command provides the BGP table, showing all learned routes and their attributes. This allows identification of any unexpected or looping routes. Other commands either show neighbor states or the global routing table, which are less specific.

Answer

show route table

Answer

show ip bgp summary

Answer

show bgp neighbors

Question 15

A network administrator is troubleshooting an IPsec tunnel that is flapping between two ION devices. The administrator suspects that the issue is related to the Dead Peer Detection (DPD) settings. Which parameter should be adjusted to make the DPD more tolerant of temporary network delays?

Accepted Answer

DPD retry count. The DPD retry count is the correct parameter to adjust. It defines the number of consecutive missed DPD probes before the tunnel is considered down. By increasing the retry count, the tunnel can withstand temporary network delays without flapping. This is a common tuning step in unstable networks where packet loss or latency spikes occur.

Answer

DPD timeout

Answer

DPD mode

Answer

DPD interval

Question 16

An engineer is configuring a Prisma SD-WAN branch ION with two WAN interfaces: one active broadband circuit and one LTE backup. The requirement is that the LTE circuit must only carry traffic when the broadband circuit fails, and must not be used for any traffic under normal conditions. Which configuration should the engineer apply to meet this requirement?

Accepted Answer

Create a WAN interface policy that sets the LTE interface to standby mode with the broadband circuit as the primary path.. The requirement is a classic active/standby failover scenario. The LTE interface must remain idle until the primary broadband circuit fails. Configuring the LTE interface as standby with the broadband as primary ensures that the SD-WAN fabric only uses LTE when the primary path is unavailable. This is the correct way to enforce the no-traffic-under-normal-conditions rule.

Answer

Set the LTE interface's bandwidth to zero in the interface configuration so no traffic can be sent over it.

Answer

Apply a QoS policy that marks all traffic as low priority on the LTE interface, causing the SD-WAN fabric to avoid it.

Answer

Configure a load balancing policy across both WAN interfaces with a higher weight on the broadband circuit.

Question 17

Which THREE components are verified during the ION device 'check' sequence at startup?

Accepted Answer

Link status. The ION device 'check' sequence at startup validates the operational readiness of the device's own resources and its management connectivity. Option C (Link status) is correct because the device verifies that its WAN/LAN interfaces have physical link up before proceeding. Option D (Configuration integrity) is correct because the startup check confirms the stored configuration is valid and not corrupted so the device can apply it. Option E (Controller reachability) is correct because the ION device must confirm it can reach its management controller/orchestrator to register and receive policy. Options A (Cloud application popularity) and B (User browser history) are not part of the device startup check sequence; these are traffic/analytics data unrelated to local device health and management readiness.

Answer

Cloud application popularity

Answer

User browser history

Question 18

A network administrator is troubleshooting a Prisma SD-WAN environment where an ION device is experiencing intermittent packet loss on a business-critical application. The administrator suspects that the issue is related to a policy misconfiguration. Which two actions should the administrator take to verify that the correct policies are being applied to the traffic? (Choose two.)

Accepted Answer

Use the Flow Analytics dashboard to examine the path and policy applied to the specific application flow.. To verify that the correct application policies are applied, the administrator should review the policy stack order to ensure no shadowing occurs and use Flow Analytics to inspect the actual policy and path for the specific flow. These actions directly confirm whether the intended policy is enforced, which is crucial for troubleshooting intermittent packet loss caused by policy misconfiguration.

Answer

Check the ION device's system logs for policy deny messages.

Answer

Verify that the ION device has the latest software version installed.

Answer

Run a traceroute from the ION device to the application server to identify the path taken.

Question 19

A network architect is designing a hub-and-spoke topology in Prisma SD-WAN where branch ION devices must reach a data center subnet behind a third-party firewall. The firewall does not participate in any dynamic routing protocol and has a static route only to the ION device's LAN address. Which configuration on the branch ION device allows it to advertise the data center subnet to the SD-WAN fabric without requiring changes on the firewall?

Accepted Answer

Configure a static route on the branch ION device pointing to the data center subnet via the hub, and enable route propagation into the overlay.. When a neighboring device cannot run dynamic routing, the ION device must originate reachability for that subnet itself. A static route toward the data center prefix, paired with overlay route propagation, injects the prefix into the SD-WAN fabric. The third-party firewall only needs its existing static route to the ION LAN address, so the design remains unchanged on the firewall side.

Answer

Enable BGP on the branch ION device and peer with the firewall using an eBGP session.

Answer

Enable NAT on the branch ION device so the data center subnet appears as a directly connected network.

Answer

Enable OSPF on the branch LAN interface and redistribute connected routes.

Question 20

A network administrator is configuring a Prisma SD-WAN policy to ensure that voice traffic from a branch site is always sent over the lowest-latency path, even if that path is not the primary WAN link. The administrator creates an application policy that matches voice traffic and sets the action to 'Low Latency'. However, after deployment, voice traffic is still using the primary link. What is the most likely cause?

Accepted Answer

The application policy is not placed in the correct policy stack order, so a higher-priority policy is overriding it.. Prisma SD-WAN evaluates policies in a top-down order, and a higher-priority policy can override a lower one. If the voice policy is not positioned correctly, another policy may match the traffic first and direct it over the primary link. Ensuring the voice policy is above conflicting policies resolves the issue.

Answer

The 'Low Latency' action requires a path quality profile to be associated with the policy.

Answer

The 'Low Latency' action only works for traffic that is already marked with DSCP EF.

Answer

The branch ION device does not have a second WAN link configured for failover.