SD-WAN-Engineer Multiple Select — 60 Questions

Question 1

Which THREE actions can be performed by a Prisma SD-WAN 'Policy' object?

Accepted Answer

Path selection. In Prisma SD-WAN, a Policy object is the mechanism that defines how traffic is handled across the fabric, and it directly performs path selection (B) by choosing which WAN path or paths (e.g., VPN, Direct Internet, or specific circuit) a flow should use based on application, source/destination, and path-quality conditions. It also performs traffic prioritization/QoS (D) by assigning traffic classes and priority levels so latency-sensitive or business-critical applications receive appropriate bandwidth and forwarding treatment. Security filtering (E) is likewise enforced through policy, since Prisma SD-WAN policies can reference security zones and service/security rule sets to permit, deny, or redirect traffic to security services. Hardware replacement (A) and firmware updates (C) are not policy actions; they are operational/lifecycle tasks handled through device management, software upgrade workflows, and the Prisma SD-WAN controller, not through the Policy object.

Answer

Hardware replacement

Answer

Firmware updates

Question 2

A network engineer is troubleshooting an SD-WAN deployment where an ION device at a branch site is not forming a control connection to the Prisma SD-WAN Controller. The device is powered on and has a link light on its WAN port. The engineer suspects a certificate or licensing issue. Which two items should the engineer verify to confirm the device's identity and authorization with the controller? (Choose two.)

Accepted Answer

The device has a valid license assigned to its serial number in the portal.. The control connection between an ION device and the Prisma SD-WAN Controller relies on the device being properly registered and licensed in the portal. The serial number serves as the unique identity, and a valid license authorizes the device to join the network. Without these, the controller will reject the connection, preventing the device from receiving configuration or participating in the overlay.

Answer

The device's management interface is configured with a static IP address.

Answer

The device's local firewall is allowing outbound UDP port 4500.

Answer

The device's software version matches the controller's version exactly.

Question 3

Which types of traffic should ideally be prioritized via QoS policies? (Choose TWO)

Accepted Answer

Real-time video conferencing. Option A (real-time video conferencing) is correct because interactive video requires low latency, low jitter, and consistent bandwidth, so QoS should mark it with a high-priority class such as EF or AF41 to keep the call usable. Option B (Voice over IP) is correct because VoIP is highly delay-sensitive and typically uses small UDP packets with RTP; QoS should give it strict priority or a low-latency queue (often DSCP EF, 46) to prevent jitter and packet loss. Options C and D are not correct because background system backups and operating system updates are bulk, non-interactive traffic that can tolerate delay and should be placed in a lower-priority or scavenger class. Option E is not correct because social media browsing is generally non-critical, elastic traffic that does not warrant preferential QoS treatment over real-time communications.

Answer

Background system backups

Answer

Operating system updates

Answer

Social media browsing

Question 4

Which THREE items are included in a Prisma SD-WAN 'Site' configuration?

Accepted Answer

Interface configuration. In Prisma SD-WAN, a Site object is the logical container that binds together the physical location and the devices deployed there, so Interface configuration (B) is correct because each site defines its WAN/LAN interfaces (e.g., IP addressing, WAN labels, and link settings) used by the SD-WAN devices at that location. Site location details (C) are also correct, since a Site stores geographic/address information (such as address, latitude/longitude, and timezone) that is used for topology mapping, policy, and path selection. Device assignment (D) is correct as well, because ION devices must be assigned to a Site so they inherit that site's interfaces, policies, and routing context. ISP contract end date (A) is a commercial/administrative detail not part of the Site configuration object, and user password history (E) is an authentication/security setting unrelated to SD-WAN site definition.

Answer

ISP contract end date

Answer

User password history

Question 5

A healthcare organization is planning a Prisma SD-WAN design for its clinics. The design must ensure that each clinic can reach the internet directly for guest traffic while also reaching internal applications through the SD-WAN fabric. Which two design elements should be included in the site configuration? (Choose two.)

Accepted Answer

A local internet breakout on the clinic CPE for guest traffic. Meeting both requirements means giving the clinic two distinct paths: a local internet breakout for guest traffic so it exits directly to the internet, and a service link to the data center so internal applications are reached over the SD-WAN fabric. Together these elements let the design separate guest internet access from internal application access without backhauling guest traffic.

Answer

A BGP peer between the clinic CPE and the guest Wi-Fi controller

Answer

A NAT pool on the data center CPE for all clinic guest traffic

Answer

A static route on the clinic CPE pointing all traffic to the data center gateway

Question 6

Which TWO of these are valid ways to verify the status of an ION device's WAN interface?

Accepted Answer

Check the Interface dashboard in the orchestrator. Option A is correct because the orchestrator's Interface dashboard provides a centralized, real-time view of each ION device's WAN interface status, including link state, IP addressing, and operational health. Option C is correct because running 'show interface' via the CLI on the ION device directly displays the WAN interface's administrative and operational status, counters, and errors. Option B is incorrect because BIOS logs record hardware POST and boot events, not WAN interface state. Option D is incorrect because pinging the device from the internet only tests reachability and does not confirm the WAN interface's status. Option E is incorrect because DNS logs relate to name resolution queries, not WAN interface status.

Answer

Review the BIOS logs

Answer

Ping the device from the internet

Answer

Check the DNS logs

Question 7

Which TWO items are checked by the ION device to determine if a WAN path is healthy?

Accepted Answer

Packet loss. The ION device evaluates WAN path health using performance metrics that directly reflect the quality of the link, and packet loss (option A) is one of them because dropped packets indicate congestion, errors, or a degraded path that affects application delivery. Latency (option C) is also checked because round-trip delay directly impacts WAN performance and is a core metric in path health monitoring and SLA verification. Device temperature (option B) is a hardware/environmental status, not a WAN path metric, so it is not used to judge path health. User authentication status (option D) relates to access control and identity, not link quality, and local disk space (option E) is a local storage resource that has no bearing on whether a WAN path is healthy.

Answer

Device temperature

Answer

User authentication status

Answer

Local disk space

Question 8

Which THREE components are verified during the ION device 'check' sequence at startup?

Accepted Answer

Link status. The ION device 'check' sequence at startup validates the operational readiness of the device's own resources and its management connectivity. Option C (Link status) is correct because the device verifies that its WAN/LAN interfaces have physical link up before proceeding. Option D (Configuration integrity) is correct because the startup check confirms the stored configuration is valid and not corrupted so the device can apply it. Option E (Controller reachability) is correct because the ION device must confirm it can reach its management controller/orchestrator to register and receive policy. Options A (Cloud application popularity) and B (User browser history) are not part of the device startup check sequence; these are traffic/analytics data unrelated to local device health and management readiness.

Answer

Cloud application popularity

Answer

User browser history

Question 9

A network administrator is troubleshooting a Prisma SD-WAN environment where an ION device is experiencing intermittent packet loss on a business-critical application. The administrator suspects that the issue is related to a policy misconfiguration. Which two actions should the administrator take to verify that the correct policies are being applied to the traffic? (Choose two.)

Accepted Answer

Use the Flow Analytics dashboard to examine the path and policy applied to the specific application flow.. To verify that the correct application policies are applied, the administrator should review the policy stack order to ensure no shadowing occurs and use Flow Analytics to inspect the actual policy and path for the specific flow. These actions directly confirm whether the intended policy is enforced, which is crucial for troubleshooting intermittent packet loss caused by policy misconfiguration.

Answer

Check the ION device's system logs for policy deny messages.

Answer

Verify that the ION device has the latest software version installed.

Answer

Run a traceroute from the ION device to the application server to identify the path taken.

Question 10

Which TWO features are included in the vManage 'Monitor' menu?

Accepted Answer

Device health and status.. The Monitor menu is the central hub for observing the SD-WAN fabric performance.

Answer

User management.

Answer

Policy configuration.

Answer

Software image repository.

Question 11

What are the primary benefits of implementing a hub-and-spoke design with Prisma SD-WAN? (Choose THREE)

Accepted Answer

Simplified management and visibility. Option C is correct because a Prisma SD-WAN hub-and-spoke topology lets administrators manage all branch sites from a central controller (the Prisma SD-WAN portal) and gain unified visibility into WAN health, application performance, and link status across every spoke. Option D is correct because branch traffic destined for other branches or the internet is groomed through the hub, allowing the hub to aggregate, prioritize, and forward flows efficiently rather than maintaining full-mesh tunnels between every site. Option E is correct because the hub acts as a central chokepoint where security policy (e.g., zone-based firewall, IPS, URL filtering) can be consistently enforced for all spoke traffic before it reaches the data center or internet. Option A is not correct because Prisma SD-WAN still requires branch CPE (ION devices or virtual IONs), so deployments are not hardware-less. Option B is not correct because no SD-WAN architecture provides infinite bandwidth at the branch; bandwidth remains bounded by the physical links and licensed throughput.

Answer

Hardware-less branch deployments

Answer

Infinite bandwidth at the branch

Question 12

You are designing branch connectivity for a manufacturer that requires deterministic failover between a primary MPLS circuit and a secondary internet circuit, and the security team mandates that traffic to a specific PCI-scoped subnet be inspected by a next-generation firewall appliance sitting inline at the branch. Which two Prisma SD-WAN design elements must you include to meet these requirements? (Choose two.)

Accepted Answer

Define the MPLS and internet circuits as separate WAN interfaces on the ION device and place them in a single active-backup path group ordered with MPLS first. Deterministic failover comes from a preference-ordered path group containing both WAN interfaces, with MPLS ranked first so internet is used only when MPLS health probes fail. Inline inspection of the PCI subnet comes from a service link to the attached firewall plus a policy set that redirects matching traffic to that service link. Together these elements satisfy both the availability and the security design constraints.

Answer

Enable ECMP across the MPLS and internet interfaces so both circuits forward PCI traffic simultaneously for higher availability

Answer

Configure a NAT pool on the internet interface and advertise it into the MPLS routing domain so the firewall sees a single source address

Answer

Apply a QoS policy that marks PCI traffic as real-time and maps it to the MPLS interface only

Question 13

A network administrator is troubleshooting a performance issue where voice traffic is being routed over a less optimal path despite a better path being available. The administrator suspects that the Application-Aware Routing policy is not functioning as intended. Which two actions should be taken to verify that the policy is correctly applied and the SLA is being met? (Choose two.)

Accepted Answer

Check the 'App Route' statistics in vManage for the site to see the path chosen for the voice application.. To verify application-aware routing for voice, you must confirm that the policy is selecting the correct path based on SLA. The App Route statistics in vManage show the chosen path per application, and BFD/SLA status confirms that the path meets the required thresholds. Without both, the policy cannot function as intended. Packet capture, OMP routes, and syslog do not directly show policy effectiveness.

Answer

Review the OMP routes to ensure the voice prefix is advertised with the correct TLOC.

Answer

Check the syslog on the branch router for messages about policy failures.

Answer

Run a packet capture on the voice VLAN to analyze the RTP stream.

Question 14

A network engineer is validating the health of an SD-WAN fabric after a controller upgrade. The engineer needs to verify that the control plane and data plane are operating correctly across all devices. Which two vManage monitoring screens should be checked to confirm that all control connections are up and that the data plane tunnels are established? (Choose two.)

Accepted Answer

Tunnels. To verify control plane health, the Control Connections screen lists all control connections and their states. For data plane health, the Tunnels screen shows the status of data plane tunnels between devices. Together, these screens confirm that both planes are operational after the controller upgrade. Other screens like Interface Statistics, Alarms, or Application Awareness provide different metrics and do not directly show control connection or tunnel status.

Answer

Alarms

Answer

Interface Statistics

Answer

Application Awareness

Question 15

An engineer is troubleshooting why a WAN edge device shows an out-of-sync state with the vSmart controller in vManage, even though the control connection appears to be up. Which TWO conditions should the engineer verify to explain an out-of-sync policy or configuration state? (Choose two.)

Accepted Answer

The device has not yet accepted or applied the pending configuration change.. Out-of-sync status in vManage indicates that the device's applied configuration or policy differs from the intended state. The usual causes are that a template or policy update has not been delivered, or that a pending change has not been accepted and applied. Certificate expiry, version differences, and NTP drift affect connectivity or validity but do not directly produce this configuration mismatch.

Answer

The vSmart controller is running a software version older than the WAN edge device.

Answer

The device's clock is not synchronized with an NTP server.

Answer

The device's certificate has expired and it is operating in a degraded mode.

Question 16

A company is deploying Unified SASE with Prisma SD-WAN and Prisma Access. The security team wants to ensure that traffic from branch ION devices is inspected by Prisma Access and that security logs from both products are correlated for unified reporting. Which TWO actions are required to achieve this integration? (Choose two.)

Accepted Answer

Enable the same Prisma Access tenant and Prisma SD-WAN tenant in the same Unified SASE portal.. To integrate Prisma SD-WAN with Prisma Access for Unified SASE, the branch ION device must have a Service Connection to Prisma Access, and both products must be managed in the same tenant or unified portal. These two actions enable traffic inspection and log correlation. GRE tunnels, explicit proxies, or manual log import do not provide the required integrated behavior.

Answer

Configure a GRE tunnel between the ION device and the Prisma Access service infrastructure.

Answer

Manually export Prisma Access logs and import them into the Prisma SD-WAN controller.

Answer

Deploy a Cloud SWG explicit proxy at the branch and point all traffic to it.

Question 17

Which THREE components are involved in the process of applying a user-based policy in a Unified SASE architecture?

Accepted Answer

Prisma SD-WAN Controller (for policy distribution). In a Unified SASE architecture, applying a user-based policy requires three cooperating components: the Cloud Identity Engine (E) acts as the identity source, aggregating user and group information from directories such as Active Directory, Microsoft Entra ID, or Okta so that policies can be written against users/groups rather than just IP addresses. Prisma Access (C) is the security enforcement point, where the identity-aware policy is evaluated and applied to traffic in the cloud-delivered security stack (e.g., URL filtering, threat prevention, and App-ID rules). The Prisma SD-WAN Controller (A) is responsible for policy distribution, pushing the user-based policy configuration down to the SD-WAN fabric so that branch and ION devices forward traffic with the correct policy context toward Prisma Access. The local ISP's routing tables (B) are irrelevant because SASE policy enforcement is independent of ISP routing, and a custom user agent on the ION device (D) is not required since identity is sourced from the Cloud Identity Engine rather than an agent on the SD-WAN device.

Answer

The local ISP's routing tables

Answer

A custom user agent installed on the ION device

Question 18

Which TWO features are used to monitor the performance of an application across the SD-WAN?

Accepted Answer

Path performance metrics. Path performance metrics (A) are correct because SD-WAN solutions continuously measure per-tunnel characteristics such as latency, jitter, packet loss, and bandwidth on each WAN path, which directly reflects how an application's traffic performs across the overlay. Application-level flow data (C) is also correct because SD-WAN devices perform deep packet inspection and application-aware routing, exporting flow records (e.g., via IPFIX/NetFlow) that identify which applications are traversing which paths and their quality, enabling application performance monitoring. Physical port speed (B) only describes the link's raw capacity and does not reflect end-to-end application experience. Device power consumption (D) is a hardware/environmental metric unrelated to application performance. User social media activity (E) is a user behavior/policy concern, not a performance monitoring feature of the SD-WAN fabric.

Answer

Physical port speed

Answer

Device power consumption

Answer

User social media activity

Question 19

Which of the following are components of the Prisma SD-WAN Controller interface? (Choose TWO)

Accepted Answer

Dashboard. The Prisma SD-WAN Controller (formerly CloudGenix Controller) web interface is organized around a Dashboard view, which provides the top-level summary of network health, site status, link performance, and alarms, so option A is correct. It also includes a Monitoring section that offers detailed drill-down views such as topology, flows, link quality metrics, events, and device-level statistics, making option D correct. Option B is not a Controller interface component; speed testing is performed via link performance monitoring or CLI tools, not as a named interface element. Option C is documentation delivered separately, not part of the Controller UI. Option E relates to physical data center facilities and has no place in the Prisma SD-WAN Controller interface.

Answer

Internet Speed Test

Answer

Hardware installation manual

Answer

Physical server room temperature

Question 20

An engineer is designing monitoring for a dual-router branch where each router has two WAN transports. The requirement is to detect a degradation on a single transport before end users report poor application experience, and to distinguish a transport-wide problem from a single-site problem. Which two capabilities of the SD-WAN monitoring stack should be used to meet these requirements? (Choose two.)

Accepted Answer

Configure per-tunnel BFD and application-aware enhanced SLA thresholds on the tunnel interfaces so that brownout conditions are detected and acted upon before a full tunnel failure.. Per-tunnel BFD with application-aware enhanced SLA classes detects brownouts on individual transports and triggers steering before a hard failure. ADEM scoring and synthetic probes provide experience baselines that let operators compare a site against a reference, separating transport-wide problems from single-site problems. Control-plane state, log volume, and byte counters do not measure per-transport quality at the granularity required.

Answer

Enable syslog forwarding of all severity informational messages to a collector and alert on any message volume increase, since degradation increases log volume.

Answer

Schedule a daily report of interface byte counters and treat any counter deviation from the previous day as a transport degradation event.

Answer

Rely on the OMP session state between the branch routers and the controllers, since a degraded transport will always tear down the OMP session and raise an alarm.