SD-WAN-Engineer Planning And Design Practice Test 5 — 15 Questions

Question 1

A financial services company is designing a Prisma SD-WAN topology for a data center that hosts a trading application. The application requires sub-10 ms latency to a specific colocation facility and must not traverse any public internet path. The design team needs to enforce this requirement across all branches. Which Prisma SD-WAN design approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom application definition and a path policy that only allows the private WAN transport for that application.. The design must guarantee that the trading application uses only the private WAN and avoids public internet. A custom application definition combined with a path policy that permits only the private transport enforces this at the SD-WAN policy layer. Adaptive path selection, QoS, and service insertion do not provide the strict transport restriction required, so they cannot satisfy the business constraint.

Answer

Configure a QoS policy that marks the trading application as high priority and trusts the underlay to route it correctly.

Answer

Enable adaptive path selection with a latency threshold and let the controller choose the best path dynamically.

Answer

Use a service insertion policy to redirect the trading application to a cloud security provider for inspection.

Question 2

A global enterprise is designing Prisma SD-WAN for regions with unreliable broadband. The design must ensure that if the primary WAN transport degrades beyond acceptable thresholds, traffic automatically moves to the secondary transport without manual intervention. Which design element should be specified?

Accepted Answer

Policy-based path selection with performance thresholds and a secondary transport defined. Policy-based path selection in Prisma SD-WAN continuously measures transport quality and compares it to configured thresholds. When the primary transport exceeds those thresholds for latency, jitter, or loss, the fabric automatically moves traffic to the secondary transport. This provides the automatic, quality-driven failover the design requires, unlike static routing which only reacts to link failure.

Answer

Static routes with administrative distance differences between the two transports

Answer

A floating static route on the secondary transport with a higher metric than the primary

Answer

Equal-cost multipath routing across both transports with per-packet load balancing

Question 3

A design team is planning the underlay for a Prisma SD-WAN branch that will use two independent internet circuits plus an LTE link. They must decide which transport configuration characteristics to document for the ION device. (Choose two.)

Accepted Answer

Each WAN transport is bound to a physical or logical interface on the ION device and identified by a unique transport label.. Each transport is bound to an interface and carries a unique label, and those labels are what policy references to steer applications across the two internet circuits and the LTE link. Shared addressing, management-only LTE, and single-active-transport assumptions all misstate how the fabric handles multiple transports.

Answer

All three transports must share a single public IP address to participate in the overlay.

Answer

The LTE transport must be configured as a management-only interface and cannot carry user traffic.

Answer

Only one transport per ION device can be active at any time, with the others held in standby.

Question 4

You are designing branch connectivity for a manufacturer that requires deterministic failover between a primary MPLS circuit and a secondary internet circuit, and the security team mandates that traffic to a specific PCI-scoped subnet be inspected by a next-generation firewall appliance sitting inline at the branch. Which two Prisma SD-WAN design elements must you include to meet these requirements? (Choose two.)

Accepted Answer

Define the MPLS and internet circuits as separate WAN interfaces on the ION device and place them in a single active-backup path group ordered with MPLS first. Deterministic failover comes from a preference-ordered path group containing both WAN interfaces, with MPLS ranked first so internet is used only when MPLS health probes fail. Inline inspection of the PCI subnet comes from a service link to the attached firewall plus a policy set that redirects matching traffic to that service link. Together these elements satisfy both the availability and the security design constraints.

Answer

Enable ECMP across the MPLS and internet interfaces so both circuits forward PCI traffic simultaneously for higher availability

Answer

Configure a NAT pool on the internet interface and advertise it into the MPLS routing domain so the firewall sees a single source address

Answer

Apply a QoS policy that marks PCI traffic as real-time and maps it to the MPLS interface only

Question 5

A multinational enterprise is designing a Prisma SD-WAN topology with hubs in North America, Europe, and Asia. The design requires that branch-to-branch traffic within the same region use direct tunnels, while inter-region traffic must traverse a regional hub for security inspection. Which Prisma SD-WAN design element should be used to enforce this traffic flow?

Accepted Answer

Define a custom topology with regional hubs and use policies to direct inter-region traffic through the hub.. Prisma SD-WAN allows administrators to define custom topologies where specific sites act as hubs and others as spokes. Policy rules can then dictate that inter-region traffic must transit a hub, while intra-region traffic can use direct tunnels. This provides the required security inspection for inter-region flows without forcing all traffic through hubs. Pure hub-and-spoke or full mesh topologies do not satisfy both conditions simultaneously.

Answer

Enable dynamic multipoint VPN (DMVPN) on the ION devices to create on-demand tunnels.

Answer

Use a full mesh topology with all branches connected directly to each other.

Answer

Configure a hub-and-spoke topology with all branches connected only to their regional hub.

Question 6

A multinational enterprise is designing a Prisma SD-WAN deployment across 50 sites in North America, Europe, and Asia. The company wants to ensure that each region uses a local Prisma SD-WAN Controller to reduce management latency, while still allowing global policy enforcement. Which design approach should you recommend?

Accepted Answer

Use Prisma SD-WAN's multi-region controller architecture, where each region has its own controller cluster and policies are synchronized globally.. Prisma SD-WAN's multi-region controller architecture allows regional controller clusters to serve local sites, reducing management latency. Global policies are synchronized across controllers, so enforcement remains consistent. The other options either introduce latency, are unsupported, or rely on third-party components, making them incorrect for this multinational design.

Answer

Deploy a standalone Prisma SD-WAN Controller at each site to eliminate management latency entirely.

Answer

Configure all sites to use a third-party SD-WAN controller that supports multi-region deployments and integrate it with Prisma SD-WAN.

Answer

Deploy a single Prisma SD-WAN Controller in North America and have all sites connect to it over the internet.

Question 7

A network engineer is planning the Prisma SD-WAN deployment for a new campus site. The site will use two ISP circuits and must support direct internet breakout for guest traffic while keeping corporate traffic on the VPN overlay. Which site configuration element is required to enable this design?

Accepted Answer

A transport interface for each ISP circuit and a policy set that directs guest traffic to the internet.. The design requires two ISP transports and selective internet breakout for guest traffic while corporate traffic uses the VPN overlay. Configuring transport interfaces for each ISP and a policy set that directs guest traffic to the internet achieves this. Service links, full VPN tunnels, and static routes do not provide the required selective breakout and overlay separation.

Answer

A VPN tunnel to the data center for all traffic, including guest.

Answer

A service link configured for the guest network.

Answer

A static route on the branch ION pointing all traffic to the primary ISP.

Question 8

A hospital network team is planning a Prisma SD-WAN rollout and needs to confirm which component is responsible for maintaining the authoritative configuration and distributing policy to all ION devices across 60 clinics. Which component performs this role?

Accepted Answer

The Prisma SD-WAN Controller (management plane). In Prisma SD-WAN the Controller is the management plane: it holds the authoritative configuration, generates policy, and distributes it to all ION devices. ION devices enforce that policy locally in the data plane. Distinguishing the management plane from the data plane is fundamental to planning a multi-site rollout, because it determines where configuration changes are made and how consistency is maintained across every clinic.

Answer

The Prisma SD-WAN CloudBlade framework

Answer

The branch next-generation firewall managed by the security team

Answer

The ION device at each clinic

Question 9

A design team is planning a Prisma SD-WAN deployment for a manufacturing company with 25 factories. Each factory has industrial control systems that must remain isolated from corporate IT traffic, and the company wants to avoid extending Layer 2 across the WAN. Which two design elements should be included in the plan? (Choose two.)

Accepted Answer

Use policy sets that permit only required industrial protocols between zones.. The design must isolate industrial control systems from corporate IT without extending Layer 2. Defining separate zones on the branch ION and using policy sets that permit only required industrial protocols between zones achieves this segmentation at Layer 3/L4. Layer 2 VPNs, flat subnets, and dedicated firewalls either violate the no-Layer-2 requirement or add unnecessary complexity.

Answer

Configure a Layer 2 VPN to stretch the industrial VLAN across all factories.

Answer

Deploy a dedicated physical firewall at each factory to segment traffic.

Answer

Enable a single flat subnet for all factory devices to simplify routing.

Question 10

A network architect is planning a Prisma SD-WAN deployment for a company with 20 branch offices. The company wants to ensure that if a branch's primary internet circuit fails, traffic automatically switches to a secondary LTE circuit. Which Prisma SD-WAN feature should be configured to meet this requirement?

Accepted Answer

Dynamic path selection with tunnel failover. Dynamic path selection with tunnel failover is the Prisma SD-WAN feature that continuously monitors tunnel health and automatically redirects traffic to a backup path when the primary fails. This directly satisfies the requirement for automatic failover to the LTE circuit. The other options either do not provide failover or are not the primary mechanism for circuit redundancy in Prisma SD-WAN.

Answer

Static routing with administrative distance

Answer

Policy-based forwarding with application SLA profiles

Answer

Quality of Service (QoS) policies with priority queuing

Question 11

A financial services firm is designing Prisma SD-WAN for a hub-and-spoke topology where 25 regional offices connect to two data centers. The design must ensure that if a regional office loses its primary path to Data Center A, traffic can reach Data Center B without requiring a full mesh of tunnels between every branch pair. Which Prisma SD-WAN capability should the design rely on?

Accepted Answer

Using the fabric's any-to-any overlay so a branch's traffic to the secondary data center is carried over tunnels negotiated with the data center ION devices when the primary path fails. Prisma SD-WAN provides an any-to-any secure overlay among fabric sites, so branch traffic can be forwarded through tunnels negotiated with the data center ION devices. When the primary path to Data Center A becomes unhealthy, path selection shifts traffic toward Data Center B using those overlay tunnels, delivering the required failover without provisioning a full mesh of branch-to-branch tunnels.

Answer

Enabling dynamic branch-to-branch tunnel establishment through the Prisma SD-WAN fabric so spokes can reach either data center over available paths

Answer

Advertising branch subnets into BGP at each data center and letting the underlay reroute traffic when the primary path fails

Answer

Configuring each branch with a full mesh of IPSec tunnels to every other branch

Question 12

A global enterprise is designing Prisma SD-WAN for regions with limited bandwidth and high latency. The design must ensure that voice traffic receives priority over bulk data transfers and that the WAN links are not oversubscribed. Which combination of design elements should be included in the plan?

Accepted Answer

QoS policies with guaranteed bandwidth for voice and a traffic shaper to limit bulk data.. The design must prioritize voice over bulk data and prevent WAN oversubscription in constrained regions. QoS policies with guaranteed bandwidth for voice and a traffic shaper for bulk data achieve both goals. Adaptive path selection, path steering alone, and FEC do not provide the required prioritization and utilization control, so they are insufficient.

Answer

Adaptive path selection with a latency threshold and no QoS configuration.

Answer

A policy set that steers all voice traffic to the MPLS transport and bulk data to broadband.

Answer

Enable forward error correction on all transports and disable QoS to reduce overhead.

Question 13

An energy company is planning a Prisma SD-WAN design for a remote drilling site that has intermittent satellite connectivity and only occasional on-site staff. The design must minimize on-site configuration effort and ensure the device can be replaced by non-technical personnel if it fails. Which design approach best meets these constraints?

Accepted Answer

Register the site and device serial in the Controller and rely on zero-touch provisioning so the replacement ION device claims its configuration automatically when it reaches the internet. Zero-touch provisioning is the Prisma SD-WAN model that matches a remote, intermittently connected site with non-technical staff. Pre-registering the site and device serial in the Controller lets a replacement ION device authenticate, claim its configuration, and build tunnels automatically once it reaches the internet, eliminating on-site CLI work and making field swaps practical.

Answer

Deploy a generic ION device image and let the device discover its role by listening for Controller broadcasts on the local subnet

Answer

Configure the site only after the device is online, using a temporary out-of-band cellular link that a technician establishes on site

Answer

Pre-stage the ION device at headquarters with a full site configuration and ship it, requiring a technician to run a CLI setup script on arrival

Question 14

A company is designing a Prisma SD-WAN deployment for a branch that has a single MPLS circuit and a single internet circuit. The design requires that voice traffic use MPLS and fail over to internet only if MPLS latency exceeds 150 ms. Which Prisma SD-WAN policy configuration should be used to meet this requirement?

Accepted Answer

Configure a path selection policy that sets MPLS as the preferred path for voice and defines a latency threshold of 150 ms to fail over to internet.. Prisma SD-WAN path selection policies allow you to define preferred and fallback paths based on path quality metrics such as latency, jitter, and loss. For voice traffic, you can set MPLS as the preferred path and configure a latency threshold of 150 ms. When MPLS latency exceeds this threshold, the ION device automatically redirects voice traffic to the internet path. This provides the required conditional failover without manual intervention.

Answer

Create a static route for voice traffic pointing to the MPLS next-hop with a backup static route to internet.

Answer

Create a priority policy that places voice traffic in a high-priority queue on the MPLS interface.

Answer

Use a QoS policy to mark voice traffic with DSCP EF and trust the MPLS provider to route it correctly.

Question 15

An enterprise is designing Prisma SD-WAN for a data center that hosts business-critical applications. The design requires that traffic from branch sites to these applications be steered over a specific set of high-performance circuits, while all other internet-bound traffic uses a different set of circuits. The solution must be scalable and not require per-application static routes on every branch device. What should be used in the design?

Accepted Answer

Define application definitions and use a Prisma SD-WAN policy set with path selection criteria to steer the business-critical applications over the desired circuits.. Application definitions combined with policy sets are the native Prisma SD-WAN mechanism for classifying traffic and steering it over selected paths. Policies can specify preferred circuit types, performance thresholds, and priorities, and they are applied centrally to all sites. This scales without per-device static routes and provides dynamic, application-aware path selection, which is exactly what the data center steering design requires.

Answer

Configure static routes on each branch ION device that point business-critical prefixes to the high-performance circuits.

Answer

Use BGP communities to tag business-critical prefixes and rely on the data center routers to prefer the high-performance circuits for those tags.

Answer

Create separate virtual routing and forwarding instances per application on every branch device and map each VRF to a specific circuit.