SD-WAN-Engineer Troubleshooting — 20 Questions

Question 1

An ION device is unable to reach the Prisma SD-WAN Controller. Which CLI command should you use to check the status of the management tunnel?

Accepted Answer

show system state. The 'show system state' command reveals the connectivity status to the controller.

Answer

show ip route

Answer

show controller status

Answer

debug mgmt-tunnel

Question 2

A user complains that an internal application is experiencing asymmetric routing. Where in the Prisma SD-WAN orchestrator can you view the path taken by specific packets?

Accepted Answer

Packet Trace. Packet trace allows for hop-by-hop analysis of packet forwarding within the fabric.

Answer

Packet Capture

Answer

Flow Monitor

Answer

Path Selection Rules

Question 3

Which CLI command allows you to view the current WAN path performance metrics?

Accepted Answer

show path-stats. show path-stats provides the necessary performance metrics.

Answer

show interface status

Answer

show route

Answer

show perf

Question 4

Which log file on the ION device provides the most detailed information about WAN interface flapping?

Accepted Answer

system.log. The system log contains interface status change events.

Answer

flow.log

Answer

controller.log

Answer

auth.log

Question 5

You notice an ION device is showing as 'Disconnected' in the Controller UI. What is the first step you should take?

Accepted Answer

Check physical interface status and WAN connectivity. Verifying WAN connectivity and local interface status is the logical first step in troubleshooting connectivity.

Answer

Upgrade the device firmware

Answer

Reboot the ION device

Answer

Delete and recreate the site

Question 6

When analyzing a PCAP from an ION device, you see 'ICMP Destination Unreachable'. Which policy is most likely causing this?

Accepted Answer

Security Policy. Security policies or access control lists (ACLs) blocking traffic will trigger ICMP unreachable messages.

Answer

NAT Policy

Answer

QoS Policy

Answer

Path Selection Policy

Question 7

A specific branch is failing to steer traffic via the preferred ISP despite a defined Path Policy. What is the most likely cause?

Accepted Answer

Incorrect application identification. Application definitions often rely on IP ranges or DSCP tags that may not match if traffic is incorrectly identified.

Answer

License expiry

Answer

Restart the WAN interface

Answer

Controller outage

Answer

BGP cost is too high

Question 8

A branch site reports intermittent application slowness. Which tool in the Prisma SD-WAN ION dashboard is best for viewing real-time latency and jitter metrics per path?

Accepted Answer

Path Quality. The Path Quality dashboard provides real-time visibility into path performance metrics including loss, latency, and jitter.

Answer

BGP Neighbors

Answer

Flow Summary

Answer

Security Events

Question 9

A site has two ISPs. Traffic is only using one. What is the best way to verify if both paths are available?

Accepted Answer

Check Path Quality dashboard. The Path Quality dashboard displays the health status of all defined paths.

Answer

Ping from the LAN

Answer

Review firewall rules

Answer

Check the BGP summary

Question 10

What does the 'Flow Monitor' tool primarily track?

Accepted Answer

Active sessions and traffic attributes. The Flow Monitor provides granular details on active traffic sessions.

Answer

Controller connection time

Answer

ISP bandwidth limits

Answer

CPU utilization

Question 11

Where do you view the history of configuration changes pushed to an ION device?

Accepted Answer

Audit Logs. The audit log records all configuration modifications and administrative actions.

Answer

Error Reports

Answer

Event Viewer

Answer

System Logs

Question 12

An ION device has experienced a configuration drift. How can you restore the last known good configuration?

Accepted Answer

Revert Configuration in the Orchestrator. The orchestrator allows for reverting to previous configuration versions.

Answer

Copy config from another site

Answer

Factory reset

Answer

Manually re-configure everything

Question 13

Which feature should you examine if traffic is not being steered based on the application category?

Accepted Answer

Application Identification Settings. If application identification is failing, the SD-WAN policies cannot match the traffic correctly.

Answer

NAT Settings

Answer

VLAN Configuration

Answer

DHCP Settings

Question 14

When troubleshooting a site-to-site VPN issue between two ION devices, which status should you check first?

Accepted Answer

VPN Tunnel Status in the Orchestrator. The tunnel status in the orchestrator reveals if the overlay tunnel is up.

Answer

NTP synchronization

Answer

ISP routing table

Answer

BIOS settings

Question 15

A user is complaining about high latency for a SaaS app. The Path Quality dashboard shows low latency. What is the next logical step?

Accepted Answer

Check LAN-side connectivity and local congestion. If the WAN path is healthy, the latency might be internal to the LAN or at the application server level.

Answer

Enable more security policies

Answer

Change ISP provider

Answer

Restart the ION device

Question 16

A user reports that a specific SaaS application is being blocked, but no security policy matches are seen. What is the most likely cause?

Accepted Answer

Implicit Deny policy. If no policy match is found, the traffic may be hitting the default implicit deny or is being blocked by a local device policy.

Answer

Memory exhaustion

Answer

Encryption mismatch

Answer

BGP path selection error

Question 17

When troubleshooting QoS, what does a high 'drop' count in the interface statistics imply?

Accepted Answer

Interface congestion. High drop counts indicate that the interface is congested and exceeding the configured bandwidth limit.

Answer

Hardware failure

Answer

Security policy blocking

Answer

The ISP is down

Question 18

What information is provided by the 'Controller Status' widget on the dashboard?

Accepted Answer

Connectivity between ION and Controller. It confirms the connectivity status between the ION and the controller.

Answer

LAN port status

Answer

Site-to-site VPN health

Answer

ISP latency

Question 19

You are debugging a routing loop. Which tool can you use to see the BGP route advertisements received by an ION device?

Accepted Answer

Route Monitoring. The BGP neighbor status and route tables in the device monitoring show learned routes.

Answer

Path Quality

Answer

Flow Summary

Answer

Interface Stats

Question 20

Which log is used to view denied traffic attempts?

Accepted Answer

Security Logs. Security logs capture events related to security policies, including denies.

Answer

Flow Logs

Answer

Audit Logs

Answer

System Logs