SD-WAN-Engineer Unified SASE — 10 Questions

Question 1

When onboarding a new branch site into a Unified SASE environment, what is the prerequisite for the branch ION device to establish a tunnel to Prisma Access?

Accepted Answer

An active Service Connection configuration. For a branch ION to build a tunnel to Prisma Access, a Service Connection must exist so the Prisma Access infrastructure has a reachable termination point and the branch has a target to peer with. The Service Connection is what stitches the branch fabric into the Prisma Access security processing nodes. Without it, the ION has no defined remote endpoint to establish the IPSec/SSL tunnel toward.

Answer

A pre-installed certificate on the endpoint host

Answer

An on-premise Active Directory server

Answer

A physical MPLS line at the branch

Question 2

An administrator wants to ensure that all traffic from a specific branch is routed to Prisma Access, but bypasses the Cloud SWG for specific trusted SaaS applications. How is this achieved?

Accepted Answer

Create an App steering policy with a path selection for the specific apps. To route all branch traffic to Prisma Access but bypass the Cloud SWG for specific trusted SaaS applications, you create an App steering policy with a path selection for those apps. This policy can direct the specified applications to go directly to the internet (bypassing SWG) while all other traffic goes through the Service Connection to Prisma Access. This is achieved by defining the applications and setting the action to 'Direct to Internet' or a specific path.

Answer

Use a custom NAT rule on the ION

Answer

Disable the Service Connection at the branch

Answer

Configure an exclusion list in the Cloud Identity Engine

Question 3

When integrating Prisma SD-WAN with Prisma Access, how does the system ensure that the security policy is applied to the traffic correctly based on the user's identity?

Accepted Answer

User identity is mapped via CIE and passed as metadata. The ION device retrieves user identity context, which is passed through the tunnel to Prisma Access, where the security policy is applied.

Answer

The ION device performs DPI and injects user info

Answer

Prisma Access performs IP-based reverse lookups

Answer

The SD-WAN controller acts as the identity proxy

Question 4

What is the role of the 'Service Connection' in the Prisma SD-WAN interface?

Accepted Answer

To define the tunnel parameters for Prisma Access integration. A Service Connection is a logical construct that maps traffic from the SD-WAN fabric to external services like Prisma Access.

Answer

To monitor bandwidth usage

Answer

To configure a firewall rule

Answer

To manage branch-to-branch routing

Question 5

When using a Service Connection, what happens if the Prisma Access node is unreachable?

Accepted Answer

The system falls back to the configured backup path. The SD-WAN policy will trigger a failover action based on the configured policy, such as direct internet breakout or alternate tunnel.

Answer

The user is forced to re-authenticate

Answer

The ION device restarts

Answer

The traffic is dropped

Question 6

An administrator needs to exclude specific traffic from being inspected by Prisma Access in a Unified SASE environment. Where is this defined?

Accepted Answer

In the Prisma SD-WAN Application Policy. This is defined in the Application Steering Policy by selecting a different path (e.g., direct internet) for the specific app.

Answer

In the ION device firmware settings

Answer

In the Cloud Identity Engine

Answer

Inside the Prisma Access Security Policy

Question 7

A branch office uses an ION device with a single WAN link. The security team requires that all internet-bound traffic from the branch be inspected by Prisma Access, but only for users in the 'Finance' VLAN. Traffic from the 'Guest' VLAN should go directly to the internet. Which configuration on the ION device achieves this requirement?

Accepted Answer

Create a policy-based routing rule that matches the Finance VLAN source and sets the next hop to the Prisma Access Service Connection.. Policy-based routing on the ION device allows granular control, matching source VLAN and directing traffic to the Prisma Access Service Connection. This ensures only Finance VLAN traffic is inspected, while Guest traffic uses the default path. Static routes and interface bindings lack the necessary source-based criteria, and 'Secure Internet Gateway' is not an ION feature.

Answer

Create a service connection on the ION device and bind it to the Finance VLAN interface.

Answer

Enable the 'Secure Internet Gateway' feature on the ION device and apply it to the Finance VLAN.

Answer

Configure a static route for the Finance VLAN subnet pointing to the Prisma Access Service Connection.

Question 8

A Prisma SD-WAN administrator needs to apply a consistent security policy to all traffic from a branch, including traffic that is destined for the internet and traffic that must be inspected by Prisma Access. The branch uses an ION device that is already connected to a Prisma SD-WAN Controller. The administrator wants to avoid configuring separate policies on the ION and in Prisma Access. Which Unified SASE feature should be used to meet this requirement?

Accepted Answer

Prisma SD-WAN CloudBlade for Prisma Access. The Prisma SD-WAN CloudBlade for Prisma Access is the integration point that lets a single security policy be applied to branch traffic, whether it is inspected locally or sent to Prisma Access. It automates service connection setup and policy synchronization, so the administrator does not have to maintain separate rules on the ION and in Prisma Access. Other options either provide only connectivity or require manual, separate policy configuration.

Answer

Prisma Access Explicit Proxy

Answer

Prisma Access Service Connection

Answer

Prisma SD-WAN Policy Construct

Question 9

An engineer is deploying a new branch with a Prisma SD-WAN ION device that must forward all internet-bound traffic to Prisma Access for security inspection. The branch has two ISP links, and the design requires that if one link fails, inspection continues without manual intervention. Which configuration on the ION device ensures this behavior?

Accepted Answer

Configure a Service Connection to Prisma Access and enable Dynamic Path Selection on the service connection.. A Service Connection to Prisma Access is the supported mechanism for sending branch traffic to the security inspection infrastructure. Combining it with Dynamic Path Selection ensures that traffic is continuously steered over the best available ISP link, providing automatic failover. Static routing, explicit proxy, or a manually configured GRE tunnel lack the integrated resiliency needed to keep inspection active when a link fails.

Answer

Configure a GRE tunnel to the nearest Prisma Access location and enable OSPF over the tunnel.

Answer

Configure a static route to Prisma Access using the primary ISP and enable BGP graceful restart.

Answer

Configure a Cloud SWG explicit proxy and set the ION device to forward all HTTP and HTTPS traffic to it.

Question 10

A branch office uses a Prisma SD-WAN ION device connected to Prisma Access via an Automated Service Connection. The security team wants to ensure that traffic destined for a specific SaaS application is inspected by Prisma Access while all other internet-bound traffic goes directly out the local internet link. What should the administrator configure to achieve this?

Accepted Answer

Create a policy rule that matches the SaaS application's IP addresses and set the action to 'Service Connection'.. The correct approach is to use a policy rule with the Service Connection action for the specific SaaS application. This ensures that only the desired traffic is sent to Prisma Access for inspection, while all other internet-bound traffic uses the local internet link. Policy rules in Prisma SD-WAN provide application-aware steering, which static routes or default gateway changes cannot achieve.

Answer

Configure a static route on the ION device pointing the SaaS application's subnet to the Prisma Access tunnel interface.

Answer

Set the ION device's default gateway to the Prisma Access tunnel endpoint so all traffic is inspected.

Answer

Enable 'Local Breakout' for all internet-bound traffic and rely on Prisma Access to inspect traffic via a separate tunnel.