SD-WAN-Engineer Planning And Design Practice Test 4 — 15 Questions

Question 1

Which aspects of a site's network are required for configuring the SD-WAN Controller? (Choose TWO)

Accepted Answer

Management IP address. Option B (Management IP address) is correct because the SD-WAN Controller must be reachable at a known, routable address so that edge devices can establish their control-plane connections (e.g., DTLS/TLS over port 443 or 12346) to register and receive policy. Option D (LAN subnet range) is correct because the controller needs the site's local subnet information to build the network topology, define VPN/service segments, and push correct routing and policy to the edge devices at that site. Option A (the name of the branch manager) is irrelevant, as personnel names are not network parameters used in controller configuration. Option C (the office zip code) is a geographic/administrative detail that does not affect SD-WAN control-plane or data-plane configuration. Option E (the color of the Ethernet cables) is a physical attribute with no bearing on logical network configuration.

Answer

The name of the branch manager

Answer

The office zip code

Answer

The color of the Ethernet cables

Question 2

When implementing a CloudBlade for a cloud security service, what must be configured? (Choose THREE)

Accepted Answer

Automated tunnel configuration. Option C (Automated tunnel configuration) is correct because a CloudBlade must establish the secure connectivity (e.g., IPsec/GRE tunnels) between the on-premises enforcement point and the cloud security service so that traffic can be redirected to it. Option D (Service-specific parameters) is correct because each cloud security service requires its own unique settings — such as tenant IDs, API tokens, region endpoints, and licensing details — to authenticate and integrate properly. Option E (Traffic steering policy) is correct because the CloudBlade must define which traffic is redirected to the cloud service (based on source/destination, application, or user criteria) and how it is handled, otherwise the service cannot inspect or protect the intended flows. Options A (Hardware reboot schedule) and B (Local printer settings) are incorrect because they are unrelated to cloud security service integration; a CloudBlade is a software/integration construct and does not require configuring physical hardware reboot timing or printer configuration.

Answer

Hardware reboot schedule

Answer

Local printer settings

Question 3

You are designing a Prisma SD-WAN deployment for a retail chain with 300 small branch sites. Each site has a single broadband link and a 4G/LTE backup. The customer requires that the SD-WAN fabric automatically detect when the primary link degrades and switch traffic to the backup without manual intervention. Which Prisma SD-WAN feature should you include in the design to meet this requirement?

Accepted Answer

Policy-based path selection with application SLA profiles. The requirement is for automatic failover based on link degradation, not just link failure. Policy-based path selection with application SLA profiles continuously measures latency, jitter, and packet loss, and dynamically steers traffic to the best path. This ensures business continuity when the primary broadband link degrades, switching to the 4G/LTE backup without human intervention.

Answer

BGP route reflectors with graceful restart

Answer

VRRP with preemption enabled on the LAN side

Answer

Static route configuration with administrative distance

Question 4

A financial services company is designing a Prisma SD-WAN deployment for its headquarters and 50 branch offices. The security team requires that all traffic from branches to the internet be inspected by a cloud-based security service without backhauling to headquarters. Which Prisma SD-WAN design element should you use to meet this requirement?

Accepted Answer

Local internet breakout at each branch with CloudBlades integration. Local internet breakout with CloudBlades integration allows branch traffic to be sent directly to the internet and then redirected to a cloud security service for inspection. This meets the security requirement without backhauling traffic to headquarters, reducing latency and WAN usage. It is the most efficient and scalable design for cloud-based security.

Answer

Full mesh VPN between all branches and headquarters

Answer

Centralized internet breakout at headquarters with policy-based routing

Answer

Dedicated MPLS circuits from each branch to a security data center

Question 5

A retail company is deploying Prisma SD-WAN at 300 branch sites. The design team wants to minimize the number of IP addresses used on the WAN side of each branch and avoid manually configuring static IPs on every CPE. Which WAN interface addressing method should be specified in the site design to meet these requirements?

Accepted Answer

DHCP client addressing on the WAN interface of each Prisma SD-WAN CPE. Using DHCP client addressing on the WAN interface allows each Prisma SD-WAN CPE to acquire its public address automatically from the service provider, which removes the need to manually assign static addresses at every branch and reduces the number of addresses the design team must plan and track. This directly satisfies the requirement to minimize WAN IP consumption and avoid per-site static configuration.

Answer

PPPoE client addressing with per-site credentials on each WAN interface

Answer

DHCP server addressing on the WAN interface of each Prisma SD-WAN CPE

Answer

Static IP addressing with a /30 subnet per WAN interface

Question 6

A network architect is designing a Prisma SD-WAN deployment for a retail chain with 400 small branches. Each branch has a single broadband circuit and a 4G/LTE backup. The design must minimize hardware cost at the branch while still supporting the SD-WAN fabric. Which ION device deployment approach best fits this requirement?

Accepted Answer

Deploy a single ION device sized for the branch's aggregate WAN throughput at each branch.. Choosing a single ION appliance sized to the branch's combined WAN capacity keeps the fabric requirement satisfied while holding branch hardware, power, and licensing costs down, which is exactly what a 400-site retail rollout needs. Higher-capacity redundant pairs and full hypervisor stacks add expense and complexity the scenario does not justify.

Answer

Deploy a pair of ION 9000 devices at each branch for full redundancy.

Answer

Use only virtual ION instances hosted on third-party hypervisors at each branch.

Answer

Rely on the LTE circuit alone and skip any SD-WAN device at the branch.

Question 7

You are designing a Prisma SD-WAN solution for a multinational enterprise with sites in North America, Europe, and Asia. The company wants to ensure that real-time voice traffic is prioritized over bulk data transfers across the SD-WAN fabric. Which two design elements should you include to achieve this? (Choose two.)

Accepted Answer

Configure QoS policies that mark voice traffic with high priority and queue it accordingly. To prioritize voice over bulk data, you need both application SLA profiles to monitor and select paths that meet voice quality requirements, and QoS policies to mark and queue voice traffic with high priority. These elements work together to ensure low latency and jitter for real-time traffic across the SD-WAN fabric.

Answer

Enable equal-cost multipath (ECMP) routing for all traffic

Answer

Use a single WAN link per site to simplify path selection

Answer

Apply rate limiting to all traffic to prevent congestion

Question 8

A financial services firm is designing Prisma SD-WAN for a data center that must advertise its internal subnets to the SD-WAN fabric. The design requires dynamic route exchange with the SD-WAN Controller and automatic propagation of learned routes to branch sites. Which routing approach should be specified on the data center CPE?

Accepted Answer

Configure BGP on the data center CPE to peer with the Prisma SD-WAN Controller and advertise internal prefixes. Prisma SD-WAN relies on BGP for dynamic route exchange between CPEs and the Controller. Peering BGP on the data center CPE and advertising the internal subnets allows the Controller to learn those prefixes and distribute them automatically to branch sites. This provides the dynamic, scalable route propagation the design requires without manual static route maintenance on every branch.

Answer

Configure static routes on every branch CPE pointing to the data center subnets

Answer

Configure OSPF on the LAN side of the data center CPE and redistribute into the SD-WAN fabric

Answer

Configure RIP version 2 on the data center CPE to advertise internal prefixes to the fabric

Question 9

A design team is planning a Prisma SD-WAN rollout and needs to document how branch sites will learn routes to remote subnets without manually defining every prefix. They want the fabric to automatically exchange reachability information between sites. Which capability should the design rely on?

Accepted Answer

The Prisma SD-WAN fabric's built-in route learning and propagation between sites.. The Prisma SD-WAN fabric learns and propagates site prefixes automatically, so branches gain reachability to remote subnets without hand-built static routes or an added routing domain. That automatic exchange is what allows the design to scale as new sites and subnets appear.

Answer

Manually redistributing connected networks into OSPF at every branch.

Answer

Publishing all site prefixes into public DNS so devices can resolve next hops.

Answer

Static routes configured individually on each ION device through the controller.

Question 10

An engineer is designing a Prisma SD-WAN topology for a company with a primary data center, a secondary data center, and 200 branches. The requirement is that branch-to-data-center traffic must traverse the primary data center under normal conditions and only use the secondary data center if the primary becomes unreachable. Which design element should be used to express this preference?

Accepted Answer

Configure the primary data center as a preferred data center site with the secondary as backup in the branch policy set.. Expressing the primary data center as preferred with the secondary as backup within the branch policy set gives the exact ordered behavior required, including automatic use of the secondary when the primary is unreachable. Equal priority, single static routes, and tenant separation all fail to produce that deterministic preference with failover.

Answer

Place the secondary data center in a separate tenant and route branch traffic to it by default.

Answer

Assign both data centers the same site priority value and rely on equal-cost load balancing.

Answer

Create a static route on each branch pointing only to the primary data center.

Question 11

A healthcare organization is planning a Prisma SD-WAN design for its clinics. The design must ensure that each clinic can reach the internet directly for guest traffic while also reaching internal applications through the SD-WAN fabric. Which two design elements should be included in the site configuration? (Choose two.)

Accepted Answer

A local internet breakout on the clinic CPE for guest traffic. Meeting both requirements means giving the clinic two distinct paths: a local internet breakout for guest traffic so it exits directly to the internet, and a service link to the data center so internal applications are reached over the SD-WAN fabric. Together these elements let the design separate guest internet access from internal application access without backhauling guest traffic.

Answer

A BGP peer between the clinic CPE and the guest Wi-Fi controller

Answer

A NAT pool on the data center CPE for all clinic guest traffic

Answer

A static route on the clinic CPE pointing all traffic to the data center gateway

Question 12

A network architect is planning a Prisma SD-WAN deployment for a retail chain with 400 small branches. Each branch will have two broadband circuits from different providers and must be able to fail over to a cellular modem during an outage. The architect wants to minimize hardware footprint and central management overhead. Which design element should be included in the plan to meet these requirements?

Accepted Answer

Use a virtual ION instance on an existing branch compute platform, with cellular access provided by a supported external modem.. The design must balance small branch footprint with dual broadband and cellular failover. A virtual ION on existing branch compute with an external modem satisfies the hardware and management constraints while preserving Prisma SD-WAN transport flexibility. Physical appliances add cost and logistics, static-only designs lose dynamic policy, and data center backhauling defeats local failover and cloud access goals.

Answer

Deploy a dedicated physical ION device at each branch with dual power supplies.

Answer

Deploy a single ION device at the data center and backhaul all branch traffic through it.

Answer

Configure all branches as static-only sites and rely on the underlay routing for failover.

Question 13

A manufacturing company is designing its Prisma SD-WAN topology. The design team wants a simple hub-and-spoke model where all branch-to-branch traffic flows through the data center hub for inspection. Which topology design should be specified in the fabric?

Accepted Answer

A hub-and-spoke topology where branches connect through the data center hub. A hub-and-spoke topology forces branch-to-branch traffic through the central data center hub, which is exactly where the company wants inspection to occur. This design provides centralized control and predictable traffic flows, ensuring no inter-branch traffic bypasses the inspection point, which is the core requirement of the scenario.

Answer

A full mesh topology where every branch connects directly to every other branch

Answer

A point-to-point topology where each branch connects only to one other branch

Answer

A partial mesh topology where branches connect directly to each other and to the hub

Question 14

During a Prisma SD-WAN design review, a team must decide how branch users will authenticate to the corporate identity provider for policy-based access to SaaS applications, without deploying a separate identity appliance at each branch. Which design approach should be recommended?

Accepted Answer

Integrate the Prisma SD-WAN fabric with the corporate identity provider so user and group context is available for policy.. Consuming identity from the existing corporate provider lets the fabric apply user- and group-aware policy centrally, so branches need no local identity hardware. Local device databases and per-SaaS authentication cannot supply consistent enterprise identity context, and per-branch servers contradict the design constraint.

Answer

Deploy a dedicated identity server at every branch to authenticate local users.

Answer

Require users to authenticate directly against each SaaS provider's own directory.

Answer

Configure each branch ION device with a local user database for SaaS access.

Question 15

A network architect is designing a Prisma SD-WAN deployment for a retail chain with 300 small branch sites, each with two broadband circuits and no MPLS. The design must ensure that if a branch's active tunnel degrades, traffic fails over within a few seconds without requiring BGP reconvergence. Which ION device configuration element should be included in the design to meet this requirement?

Accepted Answer

Enable path quality monitoring with a low failover threshold on each WAN interface.. Prisma SD-WAN uses continuous path quality monitoring to measure latency, jitter, and loss on each WAN interface. When thresholds are breached, the ION device instantly redirects traffic to a better path without waiting for routing protocol convergence. This is the native mechanism for sub-five-second failover in a dual-broadband branch design. Configuring BGP timers, static routes, or VRRP does not provide the same quality-based, rapid failover behavior.

Answer

Create a static route with a low administrative distance for the backup broadband circuit.

Answer

Deploy a redundant ION device at each branch and configure VRRP between them.

Answer

Configure BGP with a short keepalive and hold timer on the branch ION device.