SD-WAN-Engineer Planning And Design Practice Test 2 — 15 Questions

Question 1

A customer requires a granular segmentation strategy where HR, Engineering, and Guest traffic must remain isolated across the SD-WAN fabric. Which configuration construct provides this logical separation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Virtual Networks (VNets). Virtual Networks (VNets) allow for the logical segmentation of traffic throughout the fabric.

Answer

IPsec Tunnel Groups

Answer

Subnet Masking

Answer

VLAN Tagging

Question 2

A network architect is designing a branch site deployment requiring sub-second failover. Which Prisma SD-WAN component must be configured to prioritize real-time traffic across multiple transport paths based on path quality metrics?

Accepted Answer

Performance Routing (PFR) Policy. Performance Routing (PFR) policies are configured to monitor path quality and dynamically steer traffic.

Answer

Traffic Policing Rule

Answer

NAT Control Policy

Answer

Access Control List (ACL)

Question 3

Which Prisma SD-WAN tool is used to monitor real-time health and performance of the SD-WAN fabric during the deployment phase?

Accepted Answer

Controller Dashboard. The Controller Dashboard in Prisma SD-WAN provides a centralized, real-time view of fabric health, including device status, link performance, and overlay tunnel states. During deployment, it is the primary tool for monitoring whether ION devices are online, tunnels are up, and policies are being enforced. It aggregates telemetry from all IONs and presents it in a single pane of glass.

Answer

SNMP Traps

Answer

CLI Debugging

Answer

Packet Capture (PCAP)

Question 4

What is the primary function of the CloudBlades platform in the Prisma SD-WAN architecture?

Accepted Answer

API-based service integration. CloudBlades is the API integration platform that allows for seamless integration with third-party cloud services.

Answer

Encryption key rotation

Answer

Hardware acceleration

Answer

Local breakout management

Question 5

During pre-deployment planning for a high-security site, you must implement an identity-aware firewall policy. Where is this configuration mapped in the Prisma SD-WAN Controller?

Accepted Answer

Identity-Based Security Policy. Identity-Based Security Policy in the Prisma SD-WAN Controller is where you configure firewall rules that use identity information (such as user, group, or device posture) as match criteria. This is the correct location for mapping an identity-aware firewall policy for a high-security site.

Answer

NAT Policy

Answer

Routing Policy

Answer

Quality of Service Policy

Question 6

You are designing a hub-and-spoke topology where spokes need to communicate directly under specific conditions. Which feature should be enabled to optimize latency and minimize load on the regional hub?

Accepted Answer

Dynamic Mesh. Dynamic Mesh in an SD-WAN hub-and-spoke design allows spoke-to-spoke traffic to be forwarded directly between branch sites when policy permits, rather than hairpinning through the regional hub. This reduces latency (no extra hop through the hub) and offloads the hub's forwarding and encryption resources. It is the standard feature for optimizing east-west branch traffic while preserving the hub for centralized policy and internet breakout.

Answer

Hub-to-Hub Transit

Answer

BGP Route Reflector

Answer

Global VPN Overlay

Question 7

When designing a multi-tenant environment, how does the Prisma SD-WAN Controller ensure that management traffic is separated for each entity?

Accepted Answer

Logical Tenant Partitioning. Prisma SD-WAN uses logical tenant partitioning to isolate management and data traffic between different entities (tenants) within a shared controller infrastructure. Each tenant gets its own logical management domain, policy namespace, and configuration scope, so one tenant's administrators and devices cannot see or affect another's. This is the mechanism that provides multi-tenant separation without requiring dedicated physical interfaces or separate controllers.

Answer

Shared Management VLANs

Answer

Client-side tunnel encryption only

Answer

Dedicated physical interfaces

Question 8

When integrating Prisma SD-WAN with a cloud-based security service provider (CSSP) via CloudBlades, which setting must be verified to ensure proper traffic redirection?

Accepted Answer

Service-to-Tunnel Mapping. The service mapping in CloudBlades ensures that traffic classified for security inspection is steered to the correct CSSP node.

Answer

Local ISP DNS settings

Answer

DHCP Server scope

Answer

VLAN ID matching

Question 9

Which protocol is utilized for the auto-discovery of Prisma SD-WAN Gateways during site provisioning?

Accepted Answer

ZTP (Zero Touch Provisioning). The Zero-Touch Provisioning (ZTP) process uses the controller to push configurations after the gateway registers via the secure cloud portal.

Answer

SNMP

Answer

RIPv2

Answer

TFTP

Question 10

Which Prisma SD-WAN feature enables the automatic configuration of security parameters for a new gateway?

Accepted Answer

Security Template. A Security Template in Prisma SD-WAN is a reusable policy object that bundles security parameters (such as IPS/IDS profiles, URL filtering, anti-malware, and decryption settings) and can be applied automatically to gateways or device stacks. When a new gateway is provisioned, the template pushes the predefined security configuration without manual per-device tuning, which is exactly what the question describes.

Answer

Firewall Rule set

Answer

Zone Configuration

Answer

Credential Vault

Question 11

During the design of a large-scale data center migration, you need to extend Layer 2 domains across the SD-WAN fabric. Which mechanism supports this requirement?

Accepted Answer

L2-Over-SD-WAN (L2VPN). L2-Over-SD-WAN (L2VPN) is the correct mechanism because it encapsulates Layer 2 frames (Ethernet) inside the SD-WAN overlay tunnels, effectively extending a single broadcast domain across geographically dispersed sites. This allows the data center migration to preserve VLANs, IP subnets, and MAC addresses without re-IPing workloads. It is a native SD-WAN feature designed specifically for Layer 2 extension use cases.

Answer

STP Bridge Group

Answer

Proxy ARP

Answer

BGP EVPN

Question 12

You need to ensure that branch office voice traffic always has the lowest latency. Which QoS classification strategy is recommended?

Accepted Answer

DSCP Marking and Queueing. DSCP marking and queueing is the recommended strategy because it classifies voice traffic into a high-priority class (typically EF, DSCP 46) at the edge, allowing every downstream SD-WAN device to place it in a low-latency priority queue. This end-to-end classification ensures voice packets are dequeued ahead of bulk data even when the WAN link is congested, which is the only way to guarantee consistently low latency.

Answer

Flow Control

Answer

Bandwidth Reservation

Answer

Rate Limiting

Question 13

A site deployment requires specific traffic to be exempted from the SD-WAN optimization process to ensure compatibility with a legacy application. Which policy should be updated?

Accepted Answer

Application Policy. Application Policy rules allow you to specify traffic types that should bypass optimization.

Answer

NAT Policy

Answer

Security Policy

Answer

Interface Policy

Question 14

What is the purpose of the 'site-id' in the Prisma SD-WAN branch configuration?

Accepted Answer

To uniquely identify the site within the fabric. The site-id is a unique identifier used to manage and reference the site within the SD-WAN fabric.

Answer

To define the management VLAN

Answer

To configure the local gateway IP

Answer

To identify the physical location on a map

Question 15

You are designing an SD-WAN path for a high-bandwidth application that is sensitive to out-of-order packets. Which configuration setting minimizes packet reordering in a multi-path environment?

Accepted Answer

Flow-based load balancing. Flow-based load balancing keeps all packets of a single flow (same 5-tuple) on one path, preserving packet order end-to-end. Packet-based load balancing distributes individual packets across multiple paths, which can cause out-of-order delivery and retransmissions for latency-sensitive, high-bandwidth applications. For an application sensitive to reordering, flow-based is the correct choice.

Answer

Jitter Buffer increase

Answer

Aggressive TCP acceleration

Answer

Packet-based load balancing