SD-WAN-Engineer Troubleshooting Practice Test 1 — 15 Questions

Question 1

An ION device is unable to reach the Prisma SD-WAN Controller. Which CLI command should you use to check the status of the management tunnel?

Accepted Answer

show system state. The 'show system state' command reveals the connectivity status to the controller.

Answer

show ip route

Answer

show controller status

Answer

debug mgmt-tunnel

Question 2

A user complains that an internal application is experiencing asymmetric routing. Where in the Prisma SD-WAN orchestrator can you view the path taken by specific packets?

Accepted Answer

Packet Trace. Packet trace allows for hop-by-hop analysis of packet forwarding within the fabric.

Answer

Packet Capture

Answer

Flow Monitor

Answer

Path Selection Rules

Question 3

Which CLI command allows you to view the current WAN path performance metrics?

Accepted Answer

show path-stats. show path-stats provides the necessary performance metrics.

Answer

show interface status

Answer

show route

Answer

show perf

Question 4

A user reports that a specific SaaS application is being blocked, but no security policy matches are seen. What is the most likely cause?

Accepted Answer

Implicit Deny policy. If no policy match is found, the traffic may be hitting the default implicit deny or is being blocked by a local device policy.

Answer

Memory exhaustion

Answer

Encryption mismatch

Answer

BGP path selection error

Question 5

Which THREE factors can cause a site to go into 'Disconnected' state in the orchestrator?

Accepted Answer

Controller certificate mismatch. Option A (Controller certificate mismatch) is correct because the orchestrator validates the controller's certificate during the secure TLS handshake; if the certificate presented does not match the expected/trusted certificate, the connection is rejected and the site transitions to Disconnected. Option C (NTP time synchronization failure) is correct because certificate validity and TLS session establishment depend on accurate system time; if the controller's clock drifts beyond the certificate's validity window or skews too far from the orchestrator, the handshake fails and the site shows Disconnected. Option D (ISP outage) is correct because the orchestrator-to-controller management tunnel requires IP reachability over the WAN; if the ISP link is down, keepalives/hello messages are not received within the timeout, so the site is marked Disconnected. Option B (High CPU load) is not a defined cause of the Disconnected state, since high CPU may degrade performance but does not by itself break the control connection. Option E (Local VLAN misconfiguration) is not correct because a VLAN issue would typically affect LAN-side traffic, not the orchestrator's management reachability to the controller, and is not one of the recognized triggers for the Disconnected state.

Answer

High CPU load

Answer

Local VLAN misconfiguration

Question 6

Which TWO actions can resolve persistent high latency on a path?

Accepted Answer

Adjust QoS bandwidth limits. Option C is correct because adjusting QoS bandwidth limits lets you allocate or guarantee more bandwidth to the affected traffic class, reducing queuing delay and thus lowering persistent latency on that path. Option E is correct because modifying the Path Selection policy (for example, changing from Fixed to Round Robin or Most Recently Used in a multipathing environment like VMware NMP or iSCSI/FC SANs) redirects traffic onto a less congested or faster path, directly addressing persistent path latency. Deleting all VLANs (A) would disrupt network segmentation and does not reduce latency. Changing the device hostname (B) has no effect on traffic forwarding or path performance. Increasing the MTU size (D) can reduce per-packet overhead and fragmentation but does not by itself resolve persistent latency and can even cause issues if the path does not support the larger MTU end-to-end.

Answer

Delete all VLANs

Answer

Change the device hostname

Answer

Increase the MTU size

Question 7

An engineer at a branch site notices that the ION device's control plane is up and the site shows as Connected in the Prisma SD-WAN orchestrator, but no application traffic is passing. The engineer suspects a problem with the data plane tunnel. Which CLI command on the ION device should be used to verify the status of the data plane tunnels?

Accepted Answer

show tunnel interface. The correct command to verify data plane tunnel status on an ION device is 'show tunnel interface'. This command provides detailed information about each tunnel's state and statistics, which is critical when the control plane is operational but application traffic is not flowing. Other commands either check control plane status or are invalid.

Answer

show control-plane status

Answer

show data-plane tunnels

Answer

show tunnel status

Question 8

A network administrator is troubleshooting an issue where a branch ION device is not forming an IPsec tunnel to a remote site. The administrator has verified that the underlay network is operational and that both devices have valid public IP addresses. Which of the following should be checked next to ensure the IPsec tunnel can establish?

Accepted Answer

Verify that the IKEv2 proposal and pre-shared key match on both ION devices.. IPsec tunnel formation depends on matching IKEv2 proposals and pre-shared keys. If the underlay is working and public IPs are reachable, mismatched IPsec parameters are the most likely cause. Checking BGP or firewall rules is irrelevant until the tunnel is up, and licensing does not impact tunnel establishment.

Answer

Ensure that the ION devices are licensed for SD-WAN and have valid certificates.

Answer

Review the firewall rules on the ION device to see if they are blocking IPsec traffic.

Answer

Check the BGP configuration to ensure that route advertisements are being exchanged.

Question 9

A network engineer is troubleshooting a Prisma SD-WAN site where the ION device shows the WAN interface as up, but the site status in the orchestrator is 'Disconnected'. The management tunnel appears to be down. Which command should the engineer run first on the ION device to verify the status of the management tunnel?

Accepted Answer

show tunnel status. When a site is disconnected in the orchestrator, the first step is to verify the management tunnel status on the ION device. The 'show tunnel status' command provides a clear view of all tunnels, including the management tunnel. If it is down, the engineer can then investigate underlying issues such as underlay connectivity or firewall rules blocking tunnel establishment.

Answer

show controller status

Answer

show system status

Answer

show interface brief

Question 10

A network administrator is troubleshooting an ION device that is not establishing a control connection to the Prisma SD-WAN Controller. The administrator has verified basic IP connectivity to the controller's public IP address. Which CLI command should be used to display the status of the control plane tunnel and verify the local device's authentication state?

Accepted Answer

show controller status. The control plane tunnel carries critical signaling and authentication between the ION device and the Prisma SD-WAN Controller. To verify its status and any authentication issues, the appropriate CLI command is 'show controller status'. This command displays the tunnel state, controller IP, and authentication details, directly addressing the problem of a failed control connection.

Answer

show interface brief

Answer

show system status

Answer

show tunnel status

Question 11

A network administrator is troubleshooting an issue where a branch site's ION device is not receiving routes from the data center ION device over the SD-WAN fabric. The control plane is up, and tunnels are established. Which CLI command on the branch ION device would best help verify whether BGP routes are being learned from the data center?

Accepted Answer

show bgp neighbor routes. The command 'show bgp neighbor routes' provides detailed information about routes received from a specific BGP neighbor. This is critical when troubleshooting route propagation issues between SD-WAN sites. It allows the administrator to see exactly which prefixes are being advertised by the data center and whether they are being accepted by the branch.

Answer

show bgp summary

Answer

show route bgp

Answer

show ip bgp neighbors <neighbor-ip> routes

Question 12

A network administrator is investigating intermittent packet loss on a Prisma SD-WAN data path between two branch sites. The administrator suspects that the issue is related to the IPsec tunnel's dead peer detection (DPD) settings. Which action should the administrator take to view the current DPD configuration and statistics on an ION device?

Accepted Answer

Navigate to the Prisma SD-WAN orchestrator, select the device, and view the 'Tunnels' tab under Monitoring.. The Prisma SD-WAN orchestrator is the central management platform that provides detailed monitoring of tunnels, including DPD settings and statistics. By selecting the device and viewing the Tunnels tab, administrators can see real-time DPD status, which helps diagnose packet loss caused by DPD timeouts or misconfigurations.

Answer

Run the CLI command 'show ipsec dpd' on the ION device.

Answer

Check the ION device's local syslog for DPD messages.

Answer

Use the 'debug ipsec' command on the ION device to enable DPD logging.

Question 13

A network engineer notices that an ION device at a branch site is not forming a secure fabric tunnel with any other ION devices, even though the device shows as connected to the Prisma SD-WAN Controller. The engineer suspects a certificate issue. Which CLI command on the ION device should be used to verify the status of the device certificate?

Accepted Answer

show device certificate. The correct command is 'show device certificate'. This command provides detailed information about the device certificate's validity, expiration, and trust state. In this scenario, the ION device is connected to the controller but cannot form fabric tunnels, which often indicates a certificate problem. Verifying the device certificate status helps determine if the certificate is expired or not trusted, which would prevent tunnel establishment.

Answer

show security certificate

Answer

show system certificate

Answer

show controller certificate

Question 14

A network engineer is troubleshooting a routing issue in a Prisma SD-WAN deployment. The engineer needs to verify the BGP peering status and the routes learned from a specific branch ION device. Which CLI command should the engineer use on the ION device to display BGP neighbor information and advertised/received routes?

Accepted Answer

show bgp summary. The 'show bgp summary' command is the standard way to check BGP neighbor status and route counts on ION devices. It provides a quick overview of which peers are up and how many routes have been received, which is essential for troubleshooting BGP peering and route propagation. Other commands either lack neighbor status or are not valid on the platform.

Answer

show ip route

Answer

show routing protocol bgp

Answer

show bgp neighbors

Question 15

A network engineer is troubleshooting a site that is unable to reach the Prisma SD-WAN controller. The engineer suspects a DNS resolution issue. Which command should be used on the ION device to verify DNS resolution of the controller's hostname?

Accepted Answer

nslookup <controller-hostname>. nslookup actively queries DNS servers to resolve a hostname and displays the result, making it the best tool to verify DNS resolution of the controller's hostname. Other commands like ping or traceroute may indirectly test DNS but do not provide detailed query information. 'show dns cache' only shows cached entries and does not perform a live lookup.

Answer

ping <controller-hostname>

Answer

show dns cache

Answer

traceroute <controller-hostname>