SD-WAN-Engineer Planning And Design — 40 Questions

Question 1

You are configuring a branch site with a dual-ISP setup. What is the correct order of operations for defining transport interfaces?

Accepted Answer

Configure IP, then assign interface to a WAN transport type. Interfaces must be defined in the inventory, then assigned as transport in the site configuration.

Answer

Enable IPSec, then configure interface

Answer

Enable BGP, then configure WAN interface

Answer

Assign WAN interface to Transport group, then define IP

Question 2

A customer wants to deploy a Hub-and-Spoke model with redundant hubs. What must be configured to ensure seamless transition if the primary hub fails?

Accepted Answer

Hub Priority and Failover settings. Configuring redundant hubs in the controller allows the spokes to fail over to the secondary hub automatically.

Answer

IPsec Key Exchange

Answer

Static Route redistribution

Answer

BGP Multi-homing

Question 3

Which command or interface path is used to verify the status of the SD-WAN tunnel between two branch sites?

Accepted Answer

Controller > Monitoring > Tunnels. The Dashboard or the 'show' commands in the CLI allow for tunnel status verification.

Answer

Configuration > Sites > WAN Interfaces

Answer

Policies > Security > Rules

Answer

Network > Routing > BGP

Question 4

You are troubleshooting a performance issue where traffic is not taking the expected 'optimal' path. Which tool should you examine first to see the PFR path selection decision?

Accepted Answer

Application Performance Logs. Application Performance Logs are the primary source for PFR (Performance Routing) path selection decisions because they record the real-time metrics (latency, jitter, packet loss, MOS) that the PFR engine uses to evaluate and choose the best path for each application. These logs show the before-and-after path decisions, the reason for a switch (e.g., threshold breach), and the specific policy that triggered the action. Unlike generic system or audit logs, they are application-aware and directly tied to the PFR decision process, making them the first place to look when traffic is not taking the expected optimal path.

Answer

System Health Logs

Answer

Controller Audit Logs

Answer

Packet Capture

Question 5

You need to allow direct internet access for SaaS applications from the branch site. What is the correct term for this configuration?

Accepted Answer

Direct Internet Access (DIA). Local Internet Breakout (LIB) is the feature that allows traffic to bypass the hub and go directly to the internet.

Answer

VPN Bypass

Answer

Backhaul Traffic

Answer

Hub-Exit

Question 6

To ensure high availability, you are implementing Active-Active gateway deployment at a large branch. What is required for this to work correctly?

Accepted Answer

A dedicated Layer 2 heart-beat link between gateways. Active-Active deployment requires synchronization between the gateways, typically via a heartbeat link.

Answer

A separate management network

Answer

Separate WAN links for each gateway

Answer

Static IP addresses on all interfaces

Question 7

Which of these tasks are part of the pre-deployment planning phase for Prisma SD-WAN? (Choose TWO)

Accepted Answer

Validating WAN link connectivity. Option B (Validating WAN link connectivity) is correct because pre-deployment planning for Prisma SD-WAN requires confirming that each prospective WAN circuit actually passes traffic and meets baseline characteristics (bandwidth, latency, jitter, packet loss) before designing the overlay topology and ION device placement. Option D (Conducting a traffic audit/assessment) is correct because a traffic audit identifies application flows, bandwidth demands, and critical traffic classes, which directly drives policy design, SLA profiles, and tunnel/bandwidth sizing in the Prisma SD-WAN configuration. The remaining options do not belong: negotiating new ISP contracts (A) is a commercial/procurement activity rather than a technical planning task, updating firmware on end-user laptops (C) is endpoint management unrelated to SD-WAN deployment, and painting the office walls (E) is a facilities task with no bearing on network planning.

Answer

Negotiating new ISP contracts

Answer

Updating the firmware on end-user laptops

Answer

Painting the office walls

Question 8

You are designing a Prisma SD-WAN deployment for a retail chain with 400 branch sites, each with two broadband circuits and one LTE backup. The design must keep per-tunnel bandwidth overhead predictable and minimize encapsulation size on the LTE link, which is metered. Which WAN interface encapsulation setting should you specify in the site template?

Accepted Answer

IPSec with tunnel mode using AES-GCM, letting the Controller negotiate standard ESP overhead. Prisma SD-WAN builds its overlay with IPSec ESP tunnels between ION devices. Selecting AES-GCM as the cipher suite keeps encapsulation overhead predictable because authenticated encryption is applied in one operation rather than as separate encryption and integrity steps. On a metered LTE circuit, fewer overhead bytes per packet translate directly into lower transport cost while retaining the fabric's confidentiality and integrity guarantees.

Answer

IPSec with NULL encryption and SHA-256 authentication

Answer

IPSec with tunnel mode and UDP encapsulation on port 4501

Answer

GRE with no additional security encapsulation

Question 9

You are designing a Prisma SD-WAN deployment for a retail bank with 300 branch sites. Each site has two internet circuits from different ISPs and one MPLS circuit. The bank's security policy requires that all management traffic to the Prisma SD-WAN Controller be encrypted and that branches never communicate directly with each other. Which design element must you include to meet these requirements?

Accepted Answer

Use a hub-and-spoke topology with a secure hub site, and enable controller-managed tunnels with AES-256 encryption for management traffic.. A hub-and-spoke topology with controller-managed tunnels ensures that branch sites do not communicate directly, satisfying the isolation requirement. Prisma SD-WAN encrypts management traffic by default, meeting the encryption policy. The other options either allow direct branch communication, misplace the controller, or reference non-native technologies, so they fail to meet the design goals.

Answer

Enable dynamic multipoint VPN (DMVPN) on all branch routers to create on-demand tunnels between branches.

Answer

Deploy the Prisma SD-WAN Controller in the bank's data center and have branches connect to it over the MPLS circuit only.

Answer

Configure a full-mesh VPN topology between all branch sites using the MPLS circuit as the primary transport.

Question 10

A network engineer is planning a Prisma SD-WAN deployment for a company that requires high availability at the data center. The data center will have two ION devices connected to two separate WAN circuits and two separate LAN switches. Which design consideration ensures that the ION devices can fail over without manual intervention?

Accepted Answer

Configure the two ION devices as a high-availability pair using VRRP on the LAN side.. Prisma SD-WAN high availability at the data center typically uses two ION devices in an HA pair with VRRP on the LAN side. VRRP provides a virtual IP address that hosts use as their gateway. If the active device fails, the standby device assumes the virtual IP and continues forwarding traffic, ensuring automatic failover. This design also requires redundant LAN switches to avoid a single point of failure, but the key mechanism for automatic failover is VRRP.

Answer

Use dynamic routing protocols to advertise routes from each ION device to the LAN core.

Answer

Connect both ION devices to the same LAN switch and rely on spanning tree for redundancy.

Answer

Configure each ION device with a separate default gateway and manually change host configurations during failover.

Question 11

A retail chain is designing a Prisma SD-WAN deployment for 150 small stores. Each store has a single broadband circuit and a 4G/LTE modem for backup. The design must minimize hardware footprint and avoid any on-site configuration by non-technical staff. Which deployment model should be chosen for the branch sites?

Accepted Answer

Deploy Prisma SD-WAN as a software instance on an existing universal CPE or integrated branch device that supports the ION virtual form factor.. For many small sites with limited space and non-technical staff, the virtual ION form factor on an existing universal CPE or integrated device is the most efficient. It removes the need for a separate appliance, leverages zero-touch provisioning from the Prisma SD-WAN controller, and still supports broadband plus LTE backup. This satisfies both the footprint and no-touch deployment requirements better than dedicated hardware or hypervisor-based virtual instances.

Answer

Use a Prisma SD-WAN appliance with zero-touch provisioning, where the store manager only powers on the device and connects the ISP and LTE links.

Answer

Deploy a hardware ION device at each store with both WAN interfaces configured manually by a field technician.

Answer

Deploy a virtual ION instance on a small hypervisor host at each store and pre-stage the WAN settings in the controller.

Question 12

A financial services firm is planning a Prisma SD-WAN deployment for its headquarters and 200 branches. The firm requires that all traffic from branches to the internet be inspected by a cloud-based security service, and that branch-to-branch traffic be optimized for latency. Which Prisma SD-WAN design component should be used to redirect internet-bound traffic to the cloud security service?

Accepted Answer

Prisma SD-WAN CloudBlades. CloudBlades is the Prisma SD-WAN feature that integrates with cloud security services, enabling automatic redirection of internet-bound traffic for inspection. It provides service chaining without manual configuration. The other options are related to performance or policy management but do not provide the necessary integration with external security services, so they do not meet the requirement.

Answer

Prisma SD-WAN Policy-Based Forwarding

Answer

Prisma SD-WAN Quality of Service (QoS) policies

Answer

Prisma SD-WAN Application SLA profiles

Question 13

A network architect is designing a Prisma SD-WAN deployment for a large enterprise with multiple data centers and branches. The design must ensure that the SD-WAN fabric can scale to thousands of sites and that traffic engineering policies can be applied consistently. Which two design considerations are essential for achieving this scalability and policy consistency? (Choose two.)

Accepted Answer

Use a hierarchical topology with regional hubs to reduce the number of tunnels and simplify policy management.. For large-scale Prisma SD-WAN deployments, a hierarchical topology with regional hubs reduces tunnel count and simplifies policy application. Centralized policy management through the Prisma SD-WAN Controller ensures consistent policies across all sites. Together, these design choices enable scalability to thousands of sites while maintaining policy consistency. Full mesh, multiple controllers, and direct internet breakout are either not scalable or not directly related to the stated goals.

Answer

Deploy a separate Prisma SD-WAN Controller for each region to distribute the management load.

Answer

Enable direct internet breakout at every branch to reduce backhaul traffic to data centers.

Answer

Configure all branches in a full mesh topology to ensure direct connectivity between any two sites.

Question 14

A financial institution is designing a Prisma SD-WAN deployment for its headquarters and 40 branches. The security team requires that all traffic from branches to the data center be encrypted and that branch-to-branch traffic be inspected by a firewall in the data center. The design must also minimize bandwidth consumption on the WAN. Which Prisma SD-WAN design element should be implemented to meet these requirements?

Accepted Answer

Hub-and-spoke VPN with all traffic backhauled to the data center. A hub-and-spoke VPN with all traffic backhauled to the data center ensures that every branch-to-branch flow is inspected by the data center firewall and that all traffic is encrypted. Prisma SD-WAN's centralized policy and optimization features can help mitigate bandwidth concerns, making this the design that satisfies both security and encryption requirements.

Answer

Dynamic multipoint VPN (DMVPN) with spoke-to-spoke tunnels

Answer

Full mesh VPN with local internet breakout at each branch

Answer

Split tunneling with cloud-based security service

Question 15

A branch office uses both MPLS and Broadband. The design requires that business-critical traffic prefers MPLS, failing over to Broadband only if the MPLS path experiences packet loss exceeding 1%. Which metric should the PFR policy utilize?

Accepted Answer

Packet Loss. Performance Routing policies rely on path metrics like loss, latency, and jitter to make routing decisions.

Answer

Bandwidth Utilization

Answer

Jitter

Answer

Round Trip Time (RTT)

Question 16

A customer requires a granular segmentation strategy where HR, Engineering, and Guest traffic must remain isolated across the SD-WAN fabric. Which configuration construct provides this logical separation?

Accepted Answer

Virtual Networks (VNets). Virtual Networks (VNets) allow for the logical segmentation of traffic throughout the fabric.

Answer

IPsec Tunnel Groups

Answer

Subnet Masking

Answer

VLAN Tagging

Question 17

A network architect is designing a branch site deployment requiring sub-second failover. Which Prisma SD-WAN component must be configured to prioritize real-time traffic across multiple transport paths based on path quality metrics?

Accepted Answer

Performance Routing (PFR) Policy. Performance Routing (PFR) policies are configured to monitor path quality and dynamically steer traffic.

Answer

Traffic Policing Rule

Answer

NAT Control Policy

Answer

Access Control List (ACL)

Question 18

Which Prisma SD-WAN tool is used to monitor real-time health and performance of the SD-WAN fabric during the deployment phase?

Accepted Answer

Controller Dashboard. The Controller Dashboard in Prisma SD-WAN provides a centralized, real-time view of fabric health, including device status, link performance, and overlay tunnel states. During deployment, it is the primary tool for monitoring whether ION devices are online, tunnels are up, and policies are being enforced. It aggregates telemetry from all IONs and presents it in a single pane of glass.

Answer

SNMP Traps

Answer

CLI Debugging

Answer

Packet Capture (PCAP)

Question 19

What is the primary function of the CloudBlades platform in the Prisma SD-WAN architecture?

Accepted Answer

API-based service integration. CloudBlades is the API integration platform that allows for seamless integration with third-party cloud services.

Answer

Encryption key rotation

Answer

Hardware acceleration

Answer

Local breakout management

Question 20

During pre-deployment planning for a high-security site, you must implement an identity-aware firewall policy. Where is this configuration mapped in the Prisma SD-WAN Controller?

Accepted Answer

Identity-Based Security Policy. Identity-Based Security Policy in the Prisma SD-WAN Controller is where you configure firewall rules that use identity information (such as user, group, or device posture) as match criteria. This is the correct location for mapping an identity-aware firewall policy for a high-security site.

Answer

NAT Policy

Answer

Routing Policy

Answer

Quality of Service Policy