SD-WAN-Engineer Troubleshooting — Timed 25 Questions

Question 1

An ION device is unable to reach the Prisma SD-WAN Controller. Which CLI command should you use to check the status of the management tunnel?

Accepted Answer

show system state. The 'show system state' command reveals the connectivity status to the controller.

Answer

show ip route

Answer

show controller status

Answer

debug mgmt-tunnel

Question 2

A user complains that an internal application is experiencing asymmetric routing. Where in the Prisma SD-WAN orchestrator can you view the path taken by specific packets?

Accepted Answer

Packet Trace. Packet trace allows for hop-by-hop analysis of packet forwarding within the fabric.

Answer

Packet Capture

Answer

Flow Monitor

Answer

Path Selection Rules

Question 3

Which CLI command allows you to view the current WAN path performance metrics?

Accepted Answer

show path-stats. show path-stats provides the necessary performance metrics.

Answer

show interface status

Answer

show route

Answer

show perf

Question 4

A user reports that a specific SaaS application is being blocked, but no security policy matches are seen. What is the most likely cause?

Accepted Answer

Implicit Deny policy. If no policy match is found, the traffic may be hitting the default implicit deny or is being blocked by a local device policy.

Answer

Memory exhaustion

Answer

Encryption mismatch

Answer

BGP path selection error

Question 5

Which THREE factors can cause a site to go into 'Disconnected' state in the orchestrator?

Accepted Answer

Controller certificate mismatch. Option A (Controller certificate mismatch) is correct because the orchestrator validates the controller's certificate during the secure TLS handshake; if the certificate presented does not match the expected/trusted certificate, the connection is rejected and the site transitions to Disconnected. Option C (NTP time synchronization failure) is correct because certificate validity and TLS session establishment depend on accurate system time; if the controller's clock drifts beyond the certificate's validity window or skews too far from the orchestrator, the handshake fails and the site shows Disconnected. Option D (ISP outage) is correct because the orchestrator-to-controller management tunnel requires IP reachability over the WAN; if the ISP link is down, keepalives/hello messages are not received within the timeout, so the site is marked Disconnected. Option B (High CPU load) is not a defined cause of the Disconnected state, since high CPU may degrade performance but does not by itself break the control connection. Option E (Local VLAN misconfiguration) is not correct because a VLAN issue would typically affect LAN-side traffic, not the orchestrator's management reachability to the controller, and is not one of the recognized triggers for the Disconnected state.

Answer

High CPU load

Answer

Local VLAN misconfiguration

Question 6

Which TWO actions can resolve persistent high latency on a path?

Accepted Answer

Adjust QoS bandwidth limits. Option C is correct because adjusting QoS bandwidth limits lets you allocate or guarantee more bandwidth to the affected traffic class, reducing queuing delay and thus lowering persistent latency on that path. Option E is correct because modifying the Path Selection policy (for example, changing from Fixed to Round Robin or Most Recently Used in a multipathing environment like VMware NMP or iSCSI/FC SANs) redirects traffic onto a less congested or faster path, directly addressing persistent path latency. Deleting all VLANs (A) would disrupt network segmentation and does not reduce latency. Changing the device hostname (B) has no effect on traffic forwarding or path performance. Increasing the MTU size (D) can reduce per-packet overhead and fragmentation but does not by itself resolve persistent latency and can even cause issues if the path does not support the larger MTU end-to-end.

Answer

Delete all VLANs

Answer

Change the device hostname

Answer

Increase the MTU size

Question 7

An engineer at a branch site notices that the ION device's control plane is up and the site shows as Connected in the Prisma SD-WAN orchestrator, but no application traffic is passing. The engineer suspects a problem with the data plane tunnel. Which CLI command on the ION device should be used to verify the status of the data plane tunnels?

Accepted Answer

show tunnel interface. The correct command to verify data plane tunnel status on an ION device is 'show tunnel interface'. This command provides detailed information about each tunnel's state and statistics, which is critical when the control plane is operational but application traffic is not flowing. Other commands either check control plane status or are invalid.

Answer

show control-plane status

Answer

show data-plane tunnels

Answer

show tunnel status

Question 8

A network administrator is troubleshooting an issue where a branch ION device is not forming an IPsec tunnel to a remote site. The administrator has verified that the underlay network is operational and that both devices have valid public IP addresses. Which of the following should be checked next to ensure the IPsec tunnel can establish?

Accepted Answer

Verify that the IKEv2 proposal and pre-shared key match on both ION devices.. IPsec tunnel formation depends on matching IKEv2 proposals and pre-shared keys. If the underlay is working and public IPs are reachable, mismatched IPsec parameters are the most likely cause. Checking BGP or firewall rules is irrelevant until the tunnel is up, and licensing does not impact tunnel establishment.

Answer

Ensure that the ION devices are licensed for SD-WAN and have valid certificates.

Answer

Review the firewall rules on the ION device to see if they are blocking IPsec traffic.

Answer

Check the BGP configuration to ensure that route advertisements are being exchanged.

Question 9

A network engineer is troubleshooting a Prisma SD-WAN site where the ION device shows the WAN interface as up, but the site status in the orchestrator is 'Disconnected'. The management tunnel appears to be down. Which command should the engineer run first on the ION device to verify the status of the management tunnel?

Accepted Answer

show tunnel status. When a site is disconnected in the orchestrator, the first step is to verify the management tunnel status on the ION device. The 'show tunnel status' command provides a clear view of all tunnels, including the management tunnel. If it is down, the engineer can then investigate underlying issues such as underlay connectivity or firewall rules blocking tunnel establishment.

Answer

show controller status

Answer

show system status

Answer

show interface brief

Question 10

A network administrator is troubleshooting an ION device that is not establishing a control connection to the Prisma SD-WAN Controller. The administrator has verified basic IP connectivity to the controller's public IP address. Which CLI command should be used to display the status of the control plane tunnel and verify the local device's authentication state?

Accepted Answer

show controller status. The control plane tunnel carries critical signaling and authentication between the ION device and the Prisma SD-WAN Controller. To verify its status and any authentication issues, the appropriate CLI command is 'show controller status'. This command displays the tunnel state, controller IP, and authentication details, directly addressing the problem of a failed control connection.

Answer

show interface brief

Answer

show system status

Answer

show tunnel status

Question 11

A network administrator is troubleshooting an issue where a branch site's ION device is not receiving routes from the data center ION device over the SD-WAN fabric. The control plane is up, and tunnels are established. Which CLI command on the branch ION device would best help verify whether BGP routes are being learned from the data center?

Accepted Answer

show bgp neighbor routes. The command 'show bgp neighbor routes' provides detailed information about routes received from a specific BGP neighbor. This is critical when troubleshooting route propagation issues between SD-WAN sites. It allows the administrator to see exactly which prefixes are being advertised by the data center and whether they are being accepted by the branch.

Answer

show bgp summary

Answer

show route bgp

Answer

show ip bgp neighbors <neighbor-ip> routes

Question 12

A network administrator is investigating intermittent packet loss on a Prisma SD-WAN data path between two branch sites. The administrator suspects that the issue is related to the IPsec tunnel's dead peer detection (DPD) settings. Which action should the administrator take to view the current DPD configuration and statistics on an ION device?

Accepted Answer

Navigate to the Prisma SD-WAN orchestrator, select the device, and view the 'Tunnels' tab under Monitoring.. The Prisma SD-WAN orchestrator is the central management platform that provides detailed monitoring of tunnels, including DPD settings and statistics. By selecting the device and viewing the Tunnels tab, administrators can see real-time DPD status, which helps diagnose packet loss caused by DPD timeouts or misconfigurations.

Answer

Run the CLI command 'show ipsec dpd' on the ION device.

Answer

Check the ION device's local syslog for DPD messages.

Answer

Use the 'debug ipsec' command on the ION device to enable DPD logging.

Question 13

A network engineer notices that an ION device at a branch site is not forming a secure fabric tunnel with any other ION devices, even though the device shows as connected to the Prisma SD-WAN Controller. The engineer suspects a certificate issue. Which CLI command on the ION device should be used to verify the status of the device certificate?

Accepted Answer

show device certificate. The correct command is 'show device certificate'. This command provides detailed information about the device certificate's validity, expiration, and trust state. In this scenario, the ION device is connected to the controller but cannot form fabric tunnels, which often indicates a certificate problem. Verifying the device certificate status helps determine if the certificate is expired or not trusted, which would prevent tunnel establishment.

Answer

show security certificate

Answer

show system certificate

Answer

show controller certificate

Question 14

A network engineer is troubleshooting a routing issue in a Prisma SD-WAN deployment. The engineer needs to verify the BGP peering status and the routes learned from a specific branch ION device. Which CLI command should the engineer use on the ION device to display BGP neighbor information and advertised/received routes?

Accepted Answer

show bgp summary. The 'show bgp summary' command is the standard way to check BGP neighbor status and route counts on ION devices. It provides a quick overview of which peers are up and how many routes have been received, which is essential for troubleshooting BGP peering and route propagation. Other commands either lack neighbor status or are not valid on the platform.

Answer

show ip route

Answer

show routing protocol bgp

Answer

show bgp neighbors

Question 15

A network engineer is troubleshooting a site that is unable to reach the Prisma SD-WAN controller. The engineer suspects a DNS resolution issue. Which command should be used on the ION device to verify DNS resolution of the controller's hostname?

Accepted Answer

nslookup <controller-hostname>. nslookup actively queries DNS servers to resolve a hostname and displays the result, making it the best tool to verify DNS resolution of the controller's hostname. Other commands like ping or traceroute may indirectly test DNS but do not provide detailed query information. 'show dns cache' only shows cached entries and does not perform a live lookup.

Answer

ping <controller-hostname>

Answer

show dns cache

Answer

traceroute <controller-hostname>

Question 16

A network operations team is troubleshooting a routing loop in a Prisma SD-WAN environment. They suspect that an ION device is receiving incorrect BGP routes from a peer. Which tool should they use to view the BGP routes received by the ION device?

Accepted Answer

show bgp routes. To diagnose a routing loop involving BGP, the engineer must inspect the BGP routes received by the ION device. The 'show bgp routes' command provides the BGP table, showing all learned routes and their attributes. This allows identification of any unexpected or looping routes. Other commands either show neighbor states or the global routing table, which are less specific.

Answer

show route table

Answer

show ip bgp summary

Answer

show bgp neighbors

Question 17

A network engineer notices that an ION device at a branch site is not forming a BGP peering with the local router. The engineer runs 'show bgp neighbors' on the ION device and sees the peer in 'Active' state. Which of the following is the most likely reason for the peering failure?

Accepted Answer

The BGP peer is configured with the wrong autonomous system number on the ION device.. A BGP peer stuck in Active state indicates a failure to establish the TCP session. The most common reasons include an AS number mismatch, incorrect neighbor IP address, or a reachability issue. Among the options, an AS number mismatch is a frequent misconfiguration that directly prevents the session from forming. The engineer should verify the AS number on both the ION device and the remote peer.

Answer

The ION device's WAN interface is administratively down.

Answer

The BGP keepalive timer is set too high on the ION device.

Answer

The ION device is configured with an incorrect BGP router ID.

Question 18

A network administrator is troubleshooting an IPsec tunnel that is flapping between two ION devices. The administrator suspects that the issue is related to the Dead Peer Detection (DPD) settings. Which parameter should be adjusted to make the DPD more tolerant of temporary network delays?

Accepted Answer

DPD retry count. The DPD retry count is the correct parameter to adjust. It defines the number of consecutive missed DPD probes before the tunnel is considered down. By increasing the retry count, the tunnel can withstand temporary network delays without flapping. This is a common tuning step in unstable networks where packet loss or latency spikes occur.

Answer

DPD timeout

Answer

DPD mode

Answer

DPD interval

Question 19

A network engineer is troubleshooting a Prisma SD-WAN environment where an ION device at a branch site is not forming a secure Fabric connection with another ION device at a data center. The engineer has verified that both devices are online and have valid licenses. Which TWO steps should the engineer take to troubleshoot this issue? (Choose two.)

Accepted Answer

Verify that both devices are assigned to the same Fabric in the Prisma SD-WAN portal.. The correct steps are to verify that both devices are assigned to the same Fabric and that the Fabric configuration includes the correct subnets. Fabric membership is required for devices to participate in the same overlay network, and subnet inclusion ensures that traffic for those subnets is allowed over the Fabric. Without these, the Fabric connection will not form or will not carry the intended traffic.

Answer

Check that the WAN interfaces on both devices have public IP addresses and can reach each other on UDP port 4500.

Answer

Confirm that both devices are using the same IKEv2 pre-shared key for the Fabric tunnel.

Answer

Verify that the branch ION device has a static route pointing to the data center ION device's public IP address.

Question 20

A network engineer is troubleshooting a Prisma SD-WAN environment where a branch ION device is not receiving an IP address from the DHCP server on the LAN side. The engineer has verified that the DHCP server is operational and other devices on the same LAN are getting addresses. Which of the following should the engineer check on the ION device?

Accepted Answer

The ION device's LAN interface is configured to use DHCP, but the DHCP server is not reachable due to a missing route or firewall rule.. The correct answer is that the ION device's LAN interface is configured to use DHCP, but the DHCP server is not reachable due to a missing route or firewall rule. In Prisma SD-WAN, the ION device can act as a DHCP client on its LAN interface to obtain an IP from an external DHCP server. If routing or security policies block DHCP traffic, the device will fail to obtain an address. The engineer should verify that the ION device can reach the DHCP server and that no policies are blocking UDP ports 67 and 68.

Answer

The LAN interface is configured as a DHCP client instead of a DHCP server.

Answer

The LAN interface is configured with a static IP address that conflicts with the DHCP server's scope.

Answer

The ION device's WAN interface is down, preventing it from reaching the DHCP server on the LAN.