SD-WAN-Engineer Troubleshooting Practice Test 4 — 15 Questions

Question 1

Which TWO of these are valid ways to verify the status of an ION device's WAN interface?

Accepted Answer

Check the Interface dashboard in the orchestrator. Option A is correct because the orchestrator's Interface dashboard provides a centralized, real-time view of each ION device's WAN interface status, including link state, IP addressing, and operational health. Option C is correct because running 'show interface' via the CLI on the ION device directly displays the WAN interface's administrative and operational status, counters, and errors. Option B is incorrect because BIOS logs record hardware POST and boot events, not WAN interface state. Option D is incorrect because pinging the device from the internet only tests reachability and does not confirm the WAN interface's status. Option E is incorrect because DNS logs relate to name resolution queries, not WAN interface status.

Answer

Review the BIOS logs

Answer

Ping the device from the internet

Answer

Check the DNS logs

Question 2

Which TWO metrics are displayed in the Path Quality dashboard?

Accepted Answer

Latency. The Path Quality dashboard in SD-WAN/network monitoring tools focuses on link and path performance characteristics, and Latency (C) is a core metric it displays because it measures the round-trip time for packets traversing a path, directly reflecting path health. Jitter (E) is also displayed because it quantifies the variation in packet delay between consecutive packets, which is critical for real-time traffic quality such as VoIP and video. These two metrics, along with packet loss, form the standard trio used to evaluate path quality and drive dynamic path selection. Options A (Total number of users), B (Fan speed), and D (Power supply voltage) are not path-performance metrics: user count is an adoption/usage statistic, while fan speed and power supply voltage are hardware telemetry values reported by device sensors, not by the Path Quality dashboard.

Answer

Total number of users

Answer

Fan speed

Answer

Power supply voltage

Question 3

Which THREE methods can be used to troubleshoot application identification issues?

Accepted Answer

Perform a Packet Capture. Option A (Perform a Packet Capture) is correct because capturing traffic lets you inspect the actual packets on the wire, including ports, payload patterns, and TLS SNI or HTTP Host headers, which is essential for determining why an application is not being identified correctly by the engine. Option B (Review application signatures in the orchestrator) is correct because application identification relies on signature definitions; if the signature is missing, outdated, or misconfigured in the orchestrator, the app will not be recognized, so verifying the signature set is a valid troubleshooting step. Option E (Check the Flow Monitor) is correct because flow monitoring shows how traffic is being classified per flow, including the application ID assigned, bytes, and session details, which directly reveals whether identification succeeded or failed. Option C (Check the BGP table) is not relevant because BGP is a routing protocol and does not affect application identification logic. Option D (Reboot the router) is not a targeted troubleshooting method and does not address the root cause of application identification issues.

Answer

Check the BGP table

Answer

Reboot the router

Question 4

Which THREE pieces of information are critical when opening a support ticket for a suspected SD-WAN bug?

Accepted Answer

Support bundle/logs. Option A (Support bundle/logs) is correct because a support bundle collects the SD-WAN device's configuration, control-plane state, and system logs, giving TAC the diagnostic evidence needed to reproduce and root-cause a suspected software bug. Option D (Packet capture of the issue) is correct because a pcap on the relevant overlay/underlay interfaces shows the actual data-plane and control-plane traffic (e.g., IPsec, BFD, OMP, DTLS), which is essential for proving whether packets are dropped, malformed, or mishandled by the code. Option E (Device serial number) is correct because the serial number uniquely identifies the hardware/software asset, allowing support to pull the exact model, firmware version, and entitlement records tied to that device. Option B (Internal employee names) is not needed and raises privacy concerns, since the ticket should reference the device and symptoms rather than personnel. Option C (User passwords) must never be included, as credentials are sensitive and irrelevant to diagnosing an SD-WAN bug.

Answer

Internal employee names

Answer

User passwords

Question 5

Which TWO tools are available in the ION CLI for network connectivity testing?

Accepted Answer

traceroute. The ION CLI provides traceroute (option C) as a built-in diagnostic tool to trace the hop-by-hop path packets take to a destination, using incrementing TTL values to reveal each router along the route. It also provides ping (option D), which sends ICMP Echo Request packets to verify basic IP reachability and measure round-trip latency to a target host. Both are standard, lightweight connectivity-testing utilities integrated into the ION command set. The other options are not part of the ION CLI: wireshark (A) is a graphical packet-capture and protocol-analysis application, nmap (E) is an external network scanning/port-discovery tool, and telnet (B) is a remote terminal protocol rather than a connectivity-testing utility bundled in the ION CLI.

Answer

wireshark

Answer

telnet

Answer

nmap

Question 6

Which TWO factors contribute to the 'Path Health' score?

Accepted Answer

Packet loss. Path Health is a composite metric that reflects the real-time quality of a network path, and it is driven primarily by transport-level performance measurements such as packet loss (option B) and latency (option C). Packet loss is correct because dropped packets directly degrade path quality and are a core input into the health calculation, typically expressed as a percentage of lost traffic. Latency is correct because round-trip or one-way delay is another fundamental indicator of path performance, and higher latency lowers the Path Health score. Device firmware version (option A) is a configuration/software attribute, not a dynamic path-quality measurement, so it does not contribute to the score. The number of connected users (option D) is a load or capacity metric rather than a direct measure of path integrity, and the site name (option E) is merely a label used for identification, so neither affects Path Health.

Answer

Device firmware version

Answer

Number of connected users

Answer

Site name

Question 7

Which THREE logs or reports should be reviewed to troubleshoot a security policy drop?

Accepted Answer

Security Logs. Security Logs (A) are correct because they record the policy rule that matched and the action taken (allow/deny/drop), including the rule name, source/destination, and application, which directly identifies why traffic was dropped. Session Monitor (B) is correct because it shows the session details and the security policy evaluation for a specific flow, letting you trace the exact rule and drop reason for that session. Flow Reports (C) is correct because it provides aggregated flow data (source, destination, application, bytes, and action) that reveals whether traffic is being dropped and by which policy. Hardware Inventory (D) is not relevant because it lists device components and serial numbers, not policy enforcement events. BGP Neighbors (E) is not relevant because it shows routing peer status and routes, not security policy drop decisions.

Answer

Hardware Inventory

Answer

BGP Neighbors

Question 8

Which THREE components are verified during the ION device 'check' sequence at startup?

Accepted Answer

Link status. The ION device 'check' sequence at startup validates the operational readiness of the device's own resources and its management connectivity. Option C (Link status) is correct because the device verifies that its WAN/LAN interfaces have physical link up before proceeding. Option D (Configuration integrity) is correct because the startup check confirms the stored configuration is valid and not corrupted so the device can apply it. Option E (Controller reachability) is correct because the ION device must confirm it can reach its management controller/orchestrator to register and receive policy. Options A (Cloud application popularity) and B (User browser history) are not part of the device startup check sequence; these are traffic/analytics data unrelated to local device health and management readiness.

Answer

Cloud application popularity

Answer

User browser history

Question 9

Which THREE areas of configuration should you verify if a site cannot reach the local LAN gateway?

Accepted Answer

Interface IP/Mask. To reach the local LAN gateway, the host's interface must have a valid IP address and subnet mask that places the gateway in the same subnet, so B (Interface IP/Mask) is a primary check. If the interface is on a trunk or tagged port, incorrect VLAN tagging will place the host in the wrong broadcast domain and prevent gateway reachability, making C (VLAN tagging configuration) essential. Even with correct L2/L3 settings, a missing or stale ARP entry for the gateway means the host cannot resolve the gateway's MAC address, so E (ARP table status) must be verified. A (Application security policy) and D (Controller tunnel status) are not required for basic local gateway reachability, since application-layer policy and controller tunnel state do not determine whether a host can ARP and route to its local gateway.

Answer

Application security policy

Answer

Controller tunnel status

Question 10

An engineer notices that an ION device at a branch site shows a WAN interface status of 'up' in the Prisma SD-WAN orchestrator, but no traffic is being forwarded over that interface. The interface is configured for DHCP. Which troubleshooting step should be performed first to determine why the interface is not passing traffic?

Accepted Answer

Verify that the DHCP server is reachable and has provided a valid IP address, default gateway, and DNS servers.. When a WAN interface is up but not passing traffic, the most common cause is a failure to obtain a valid IP configuration via DHCP. Verifying the DHCP lease ensures the interface has an IP address, default gateway, and DNS servers, which are prerequisites for any traffic forwarding. Other options, like checking BGP or restarting, are either premature or irrelevant.

Answer

Review the application performance dashboard to see if any applications are experiencing latency.

Answer

Check the BGP neighbor state to ensure the peering session with the service provider is established.

Answer

Restart the ION device to force a renegotiation of the interface and DHCP lease.

Question 11

A network administrator is troubleshooting an ION device at a branch site that intermittently loses connectivity to the Prisma SD-WAN Controller. The administrator suspects a problem with the underlying WAN link. Which CLI command provides the most direct real-time view of the interface status, IP address, and packet counters for the WAN interfaces?

Accepted Answer

show interfaces. The 'show interfaces' command is the correct choice because it provides real-time operational status, IP configuration, and packet counters for WAN interfaces, which are essential for diagnosing intermittent connectivity issues. Other commands focus on different aspects such as controller tunnel status, routing, or system resources, and do not offer the same interface-level detail needed here.

Answer

show controller status

Answer

show routing table

Answer

show system resources

Question 12

A network engineer is troubleshooting a site where traffic from a specific VLAN is not being forwarded to the correct VPN overlay. The engineer suspects a misconfiguration in the network policy. Which tool in the Prisma SD-WAN Orchestrator should the engineer use to view the effective policy applied to that site and verify the path selection decisions?

Accepted Answer

Policy Browser. The Policy Browser is designed to show the effective policies applied to a site, including how traffic is classified and which path it should take. It allows engineers to verify if a VLAN's traffic is matching the intended rules and being forwarded correctly. Other tools like Flow Analytics, Topology View, and Event Log provide different perspectives but lack the policy evaluation detail required.

Answer

Topology View

Answer

Event Log

Answer

Flow Analytics

Question 13

A network engineer is troubleshooting an SD-WAN deployment where an ION device at a branch site is not forming a control connection to the Prisma SD-WAN Controller. The device is powered on and has a link light on its WAN port. The engineer suspects a certificate or licensing issue. Which two items should the engineer verify to confirm the device's identity and authorization with the controller? (Choose two.)

Accepted Answer

The device has a valid license assigned to its serial number in the portal.. The control connection between an ION device and the Prisma SD-WAN Controller relies on the device being properly registered and licensed in the portal. The serial number serves as the unique identity, and a valid license authorizes the device to join the network. Without these, the controller will reject the connection, preventing the device from receiving configuration or participating in the overlay.

Answer

The device's management interface is configured with a static IP address.

Answer

The device's local firewall is allowing outbound UDP port 4500.

Answer

The device's software version matches the controller's version exactly.

Question 14

A network administrator is troubleshooting a branch site that is experiencing poor voice quality. The administrator suspects that the SD-WAN fabric is not prioritizing voice traffic correctly. Which dashboard in the Prisma SD-WAN Orchestrator provides a real-time view of application performance, including latency, jitter, and packet loss per application?

Accepted Answer

Application Dashboard. The Application Dashboard is the correct tool because it provides detailed performance metrics per application, which are essential for diagnosing voice quality issues. It shows latency, jitter, and packet loss, allowing administrators to verify if voice traffic is being prioritized correctly. The other dashboards focus on different aspects and do not offer the required application-level detail.

Answer

Security Dashboard

Answer

System Dashboard

Answer

Network Dashboard

Question 15

A network operations team is troubleshooting an intermittent connectivity issue between two branch sites. The ION devices at both sites are managed by Prisma SD-WAN. The team suspects that the issue is related to the underlay network. Which two actions should the team perform to gather relevant troubleshooting data? (Choose two.)

Accepted Answer

Review the WAN interface statistics for errors, drops, and utilization on both ION devices.. To troubleshoot underlay issues, the team should run traceroute to trace the path and identify drop points, and review WAN interface statistics for errors and utilization. These actions directly assess the underlay network's health. Other options focus on overlay or higher-layer protocols, which may be affected but do not provide direct underlay diagnostics.

Answer

Check the ION device's IPsec tunnel status to see if the tunnel is flapping.

Answer

Examine the BGP routing table to see if routes are being withdrawn and re-advertised.

Answer

Verify the application SLA policies to ensure they are not incorrectly steering traffic.