SD-WAN-Engineer Quick Quiz — 10 Questions

Question 1

Which THREE actions can be performed by a Prisma SD-WAN 'Policy' object?

Accepted Answer

Path selection. In Prisma SD-WAN, a Policy object is the mechanism that defines how traffic is handled across the fabric, and it directly performs path selection (B) by choosing which WAN path or paths (e.g., VPN, Direct Internet, or specific circuit) a flow should use based on application, source/destination, and path-quality conditions. It also performs traffic prioritization/QoS (D) by assigning traffic classes and priority levels so latency-sensitive or business-critical applications receive appropriate bandwidth and forwarding treatment. Security filtering (E) is likewise enforced through policy, since Prisma SD-WAN policies can reference security zones and service/security rule sets to permit, deny, or redirect traffic to security services. Hardware replacement (A) and firmware updates (C) are not policy actions; they are operational/lifecycle tasks handled through device management, software upgrade workflows, and the Prisma SD-WAN controller, not through the Policy object.

Answer

Hardware replacement

Answer

Firmware updates

Question 2

A network administrator needs to monitor real-time application performance and path quality metrics for a specific site in Cisco vManage. Which menu should the administrator navigate to?

Accepted Answer

Monitor > Applications. The Monitor > Applications section in vManage is specifically designed to display application performance and path quality metrics such as latency, jitter, and packet loss. It aggregates data from Application Aware Routing and provides per-application and per-path visibility, making it the correct choice for real-time monitoring of application experience at a site.

Answer

Monitor > Network

Answer

Monitor > Alarms

Answer

Monitor > Logs

Question 3

A network architect is planning a Prisma SD-WAN deployment for a retail chain with 400 small branches. Each branch will have two broadband circuits from different providers and must be able to fail over to a cellular modem during an outage. The architect wants to minimize hardware footprint and central management overhead. Which design element should be included in the plan to meet these requirements?

Accepted Answer

Use a virtual ION instance on an existing branch compute platform, with cellular access provided by a supported external modem.. The design must balance small branch footprint with dual broadband and cellular failover. A virtual ION on existing branch compute with an external modem satisfies the hardware and management constraints while preserving Prisma SD-WAN transport flexibility. Physical appliances add cost and logistics, static-only designs lose dynamic policy, and data center backhauling defeats local failover and cloud access goals.

Answer

Deploy a dedicated physical ION device at each branch with dual power supplies.

Answer

Deploy a single ION device at the data center and backhaul all branch traffic through it.

Answer

Configure all branches as static-only sites and rely on the underlay routing for failover.

Question 4

When performing a 'Soft Shutdown' on an HA device, what is the expected behavior?

Accepted Answer

The device gracefully transitions the active state to the standby device.. A soft shutdown allows the active unit to relinquish its role gracefully to the standby unit.

Answer

The device disables all interfaces without notifying the peer.

Answer

The device immediately reboots.

Answer

The device enters a maintenance mode that clears all routes.

Question 5

A network engineer is troubleshooting a site where traffic from a specific VLAN is not being forwarded to the correct VPN overlay. The engineer suspects a misconfiguration in the network policy. Which tool in the Prisma SD-WAN Orchestrator should the engineer use to view the effective policy applied to that site and verify the path selection decisions?

Accepted Answer

Policy Browser. The Policy Browser is designed to show the effective policies applied to a site, including how traffic is classified and which path it should take. It allows engineers to verify if a VLAN's traffic is matching the intended rules and being forwarded correctly. Other tools like Flow Analytics, Topology View, and Event Log provide different perspectives but lack the policy evaluation detail required.

Answer

Topology View

Answer

Event Log

Answer

Flow Analytics

Question 6

A network engineer is troubleshooting an SD-WAN deployment where an ION device at a branch site is not forming a control connection to the Prisma SD-WAN Controller. The device is powered on and has a link light on its WAN port. The engineer suspects a certificate or licensing issue. Which two items should the engineer verify to confirm the device's identity and authorization with the controller? (Choose two.)

Accepted Answer

The device has a valid license assigned to its serial number in the portal.. The control connection between an ION device and the Prisma SD-WAN Controller relies on the device being properly registered and licensed in the portal. The serial number serves as the unique identity, and a valid license authorizes the device to join the network. Without these, the controller will reject the connection, preventing the device from receiving configuration or participating in the overlay.

Answer

The device's management interface is configured with a static IP address.

Answer

The device's local firewall is allowing outbound UDP port 4500.

Answer

The device's software version matches the controller's version exactly.

Question 7

An enterprise is designing Prisma SD-WAN for a data center that hosts business-critical applications. The design requires that traffic from branch sites to these applications be steered over a specific set of high-performance circuits, while all other internet-bound traffic uses a different set of circuits. The solution must be scalable and not require per-application static routes on every branch device. What should be used in the design?

Accepted Answer

Define application definitions and use a Prisma SD-WAN policy set with path selection criteria to steer the business-critical applications over the desired circuits.. Application definitions combined with policy sets are the native Prisma SD-WAN mechanism for classifying traffic and steering it over selected paths. Policies can specify preferred circuit types, performance thresholds, and priorities, and they are applied centrally to all sites. This scales without per-device static routes and provides dynamic, application-aware path selection, which is exactly what the data center steering design requires.

Answer

Configure static routes on each branch ION device that point business-critical prefixes to the high-performance circuits.

Answer

Use BGP communities to tag business-critical prefixes and rely on the data center routers to prefer the high-performance circuits for those tags.

Answer

Create separate virtual routing and forwarding instances per application on every branch device and map each VRF to a specific circuit.

Question 8

A financial services company is designing a Prisma SD-WAN deployment for its headquarters and 50 branch offices. The security team requires that all traffic from branches to the internet be inspected by a cloud-based security service without backhauling to headquarters. Which Prisma SD-WAN design element should you use to meet this requirement?

Accepted Answer

Local internet breakout at each branch with CloudBlades integration. Local internet breakout with CloudBlades integration allows branch traffic to be sent directly to the internet and then redirected to a cloud security service for inspection. This meets the security requirement without backhauling traffic to headquarters, reducing latency and WAN usage. It is the most efficient and scalable design for cloud-based security.

Answer

Full mesh VPN between all branches and headquarters

Answer

Centralized internet breakout at headquarters with policy-based routing

Answer

Dedicated MPLS circuits from each branch to a security data center

Question 9

A network administrator is configuring Prisma SD-WAN to integrate with Prisma Access using the Automated Service Connection. During the onboarding process, which specific parameter must be configured in the ION device's service route to ensure traffic is correctly steered to the Prisma Access Service Infrastructure?

Accepted Answer

The specific Service Connection object representing the Prisma Access tunnel. When integrating Prisma SD-WAN with Prisma Access via Automated Service Connection, the ION device's service route must reference the specific Service Connection object that represents the Prisma Access tunnel. This object tells the ION how to steer traffic into the Prisma Access service infrastructure.

Answer

The WAN interface MTU size exclusively

Answer

The BGP AS number of the remote Prisma Access node

Answer

The local controller's IP address

Question 10

Which command or interface action is used to verify the current status of the SD-WAN overlay tunnels?

Accepted Answer

Show tunnels view in the Controller. The 'Show tunnels' view in the SD-WAN Controller (Orchestrator) provides a real-time, centralized display of all overlay tunnel status, including up/down state, latency, jitter, and packet loss for each tunnel. This is the authoritative interface for verifying overlay tunnel health because the controller maintains the tunnel state database for all edges.

Answer

show routing table

Answer

show interface status

Answer

ping gateway