SD-WAN-Engineer Troubleshooting Practice Test 2 — 15 Questions

Question 1

A network operations team is troubleshooting a routing loop in a Prisma SD-WAN environment. They suspect that an ION device is receiving incorrect BGP routes from a peer. Which tool should they use to view the BGP routes received by the ION device?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show bgp routes. To diagnose a routing loop involving BGP, the engineer must inspect the BGP routes received by the ION device. The 'show bgp routes' command provides the BGP table, showing all learned routes and their attributes. This allows identification of any unexpected or looping routes. Other commands either show neighbor states or the global routing table, which are less specific.

Answer

show route table

Answer

show ip bgp summary

Answer

show bgp neighbors

Question 2

A network engineer notices that an ION device at a branch site is not forming a BGP peering with the local router. The engineer runs 'show bgp neighbors' on the ION device and sees the peer in 'Active' state. Which of the following is the most likely reason for the peering failure?

Accepted Answer

The BGP peer is configured with the wrong autonomous system number on the ION device.. A BGP peer stuck in Active state indicates a failure to establish the TCP session. The most common reasons include an AS number mismatch, incorrect neighbor IP address, or a reachability issue. Among the options, an AS number mismatch is a frequent misconfiguration that directly prevents the session from forming. The engineer should verify the AS number on both the ION device and the remote peer.

Answer

The ION device's WAN interface is administratively down.

Answer

The BGP keepalive timer is set too high on the ION device.

Answer

The ION device is configured with an incorrect BGP router ID.

Question 3

A network administrator is troubleshooting an IPsec tunnel that is flapping between two ION devices. The administrator suspects that the issue is related to the Dead Peer Detection (DPD) settings. Which parameter should be adjusted to make the DPD more tolerant of temporary network delays?

Accepted Answer

DPD retry count. The DPD retry count is the correct parameter to adjust. It defines the number of consecutive missed DPD probes before the tunnel is considered down. By increasing the retry count, the tunnel can withstand temporary network delays without flapping. This is a common tuning step in unstable networks where packet loss or latency spikes occur.

Answer

DPD timeout

Answer

DPD mode

Answer

DPD interval

Question 4

A network engineer is troubleshooting a Prisma SD-WAN environment where an ION device at a branch site is not forming a secure Fabric connection with another ION device at a data center. The engineer has verified that both devices are online and have valid licenses. Which TWO steps should the engineer take to troubleshoot this issue? (Choose two.)

Accepted Answer

Verify that both devices are assigned to the same Fabric in the Prisma SD-WAN portal.. The correct steps are to verify that both devices are assigned to the same Fabric and that the Fabric configuration includes the correct subnets. Fabric membership is required for devices to participate in the same overlay network, and subnet inclusion ensures that traffic for those subnets is allowed over the Fabric. Without these, the Fabric connection will not form or will not carry the intended traffic.

Answer

Check that the WAN interfaces on both devices have public IP addresses and can reach each other on UDP port 4500.

Answer

Confirm that both devices are using the same IKEv2 pre-shared key for the Fabric tunnel.

Answer

Verify that the branch ION device has a static route pointing to the data center ION device's public IP address.

Question 5

A network engineer is troubleshooting a Prisma SD-WAN environment where a branch ION device is not receiving an IP address from the DHCP server on the LAN side. The engineer has verified that the DHCP server is operational and other devices on the same LAN are getting addresses. Which of the following should the engineer check on the ION device?

Accepted Answer

The ION device's LAN interface is configured to use DHCP, but the DHCP server is not reachable due to a missing route or firewall rule.. The correct answer is that the ION device's LAN interface is configured to use DHCP, but the DHCP server is not reachable due to a missing route or firewall rule. In Prisma SD-WAN, the ION device can act as a DHCP client on its LAN interface to obtain an IP from an external DHCP server. If routing or security policies block DHCP traffic, the device will fail to obtain an address. The engineer should verify that the ION device can reach the DHCP server and that no policies are blocking UDP ports 67 and 68.

Answer

The LAN interface is configured as a DHCP client instead of a DHCP server.

Answer

The LAN interface is configured with a static IP address that conflicts with the DHCP server's scope.

Answer

The ION device's WAN interface is down, preventing it from reaching the DHCP server on the LAN.

Question 6

Which log file on the ION device provides the most detailed information about WAN interface flapping?

Accepted Answer

system.log. The system.log on the ION device is the general-purpose system log that records interface state changes, including WAN link up/down (flapping) events, along with daemon and kernel messages. Because interface state transitions are logged by the system/interface management subsystem, system.log provides the most detailed and chronologically complete record of WAN flapping.

Answer

flow.log

Answer

controller.log

Answer

auth.log

Question 7

You notice an ION device is showing as 'Disconnected' in the Controller UI. What is the first step you should take?

Accepted Answer

Check physical interface status and WAN connectivity. Verifying WAN connectivity and local interface status is the logical first step in troubleshooting connectivity.

Answer

Upgrade the device firmware

Answer

Reboot the ION device

Answer

Delete and recreate the site

Question 8

When analyzing a PCAP from an ION device, you see 'ICMP Destination Unreachable'. Which policy is most likely causing this?

Accepted Answer

Security Policy. Security policies or access control lists (ACLs) blocking traffic will trigger ICMP unreachable messages.

Answer

NAT Policy

Answer

QoS Policy

Answer

Path Selection Policy

Question 9

A specific branch is failing to steer traffic via the preferred ISP despite a defined Path Policy. What is the most likely cause?

Accepted Answer

Incorrect application identification. The most likely cause is incorrect application identification, because SD-WAN Path Policies typically match on applications or application groups; if the application is misidentified (e.g., due to outdated App-ID signatures, custom port usage, or encryption), the policy will not match and traffic will not be steered to the preferred ISP. License expiry, controller outage, or BGP cost would cause broader failures, not selective path steering for a specific branch.

Answer

License expiry

Answer

Restart the WAN interface

Answer

Controller outage

Answer

BGP cost is too high

Question 10

A branch site reports intermittent application slowness. Which tool in the Prisma SD-WAN ION dashboard is best for viewing real-time latency and jitter metrics per path?

Accepted Answer

Path Quality. The Path Quality tool in the Prisma SD-WAN ION dashboard provides real-time and historical metrics for each WAN path, including latency, jitter, packet loss, and MOS scores. It is specifically designed to monitor the performance of individual paths and is the best choice for diagnosing intermittent application slowness caused by path degradation.

Answer

BGP Neighbors

Answer

Flow Summary

Answer

Security Events

Question 11

A site has two ISPs. Traffic is only using one. What is the best way to verify if both paths are available?

Accepted Answer

Check Path Quality dashboard. The Path Quality dashboard displays the health status of all defined paths.

Answer

Ping from the LAN

Answer

Review firewall rules

Answer

Check the BGP summary

Question 12

What does the 'Flow Monitor' tool primarily track?

Accepted Answer

Active sessions and traffic attributes. The Flow Monitor provides granular details on active traffic sessions.

Answer

Controller connection time

Answer

ISP bandwidth limits

Answer

CPU utilization

Question 13

Where do you view the history of configuration changes pushed to an ION device?

Accepted Answer

Audit Logs. The audit log records all configuration modifications and administrative actions.

Answer

Error Reports

Answer

Event Viewer

Answer

System Logs

Question 14

An ION device has experienced a configuration drift. How can you restore the last known good configuration?

Accepted Answer

Revert Configuration in the Orchestrator. The Orchestrator in Prisma SD-WAN maintains a version history of configurations for each ION device. The 'Revert Configuration' function allows you to roll back to a previous known-good configuration, restoring the device to a stable state without manual intervention. This is the designed method for recovering from configuration drift.

Answer

Copy config from another site

Answer

Factory reset

Answer

Manually re-configure everything

Question 15

Which feature should you examine if traffic is not being steered based on the application category?

Accepted Answer

Application Identification Settings. Application identification in SD-WAN is driven by the Application Identification Settings, which define how the system recognizes applications (signatures, heuristics, IP/port mappings) and how they map to application categories. If traffic is not being steered by category, the first place to inspect is these settings — the signature database may be outdated, the category mapping may be misconfigured, or the application may be unrecognized and falling into a default bucket.

Answer

NAT Settings

Answer

VLAN Configuration

Answer

DHCP Settings