SD-WAN-Engineer Unified SASE — 25 Questions

Question 1

A network administrator is configuring Prisma SD-WAN to integrate with Prisma Access using the Automated Service Connection. During the onboarding process, which specific parameter must be configured in the ION device's service route to ensure traffic is correctly steered to the Prisma Access Service Infrastructure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The specific Service Connection object representing the Prisma Access tunnel. The Service Connection requires defined IP prefixes and the assignment of the Prisma Access gateway as the next hop to establish the tunnel.

Answer

The WAN interface MTU size exclusively

Answer

The BGP AS number of the remote Prisma Access node

Answer

The local controller's IP address

Question 2

You are deploying Cloud Identity Engine (CIE) to enable identity-based security policies across your SD-WAN and SASE environment. Which configuration step is required to ensure that user identity information is successfully propagated from the enterprise directory to the Prisma Access security nodes?

Accepted Answer

Link the Prisma Access instance to the CIE instance using the API Key and Tenant ID. CIE acts as a central identity provider that synchronizes with the directory and pushes identity context to the SASE components.

Answer

Configure a local user database on every ION device

Answer

Manually map IP addresses to usernames in the Cloud SWG UI

Answer

Enable the Identity Service on the Prisma SD-WAN Controller

Question 3

When onboarding a new branch site into a Unified SASE environment, what is the prerequisite for the branch ION device to establish a tunnel to Prisma Access?

Accepted Answer

An active Service Connection configuration. The device must have internet connectivity and reachability to the Prisma Access public endpoints to establish the IPSec tunnel.

Answer

A pre-installed certificate on the endpoint host

Answer

An on-premise Active Directory server

Answer

A physical MPLS line at the branch

Question 4

In a Unified SASE architecture, an administrator needs to ensure that branch offices prioritize voice traffic while using Prisma Access. Where should the Quality of Service (QoS) policy be defined to ensure consistent application performance?

Accepted Answer

On the Prisma SD-WAN Controller under Application QoS Policy. QoS policies must be defined on the Prisma SD-WAN side to ensure traffic is queued correctly before being encapsulated into the Service Connection tunnel.

Answer

On the local ION device CLI only

Answer

Inside the Prisma Access Security Policy

Answer

Within the Cloud Identity Engine

Question 5

A customer is experiencing intermittent connectivity to internal applications after enabling Unified SASE. Traffic is being routed through Prisma Access. What is the most likely cause?

Accepted Answer

MTU size mismatch leading to packet fragmentation. MTU/MSS mismatches are a common issue when encapsulating traffic through tunnels, especially in SASE environments.

Answer

The ION device is overheating

Answer

Incorrect DNS server configuration

Answer

Identity cache expiration in CIE

Question 6

An engineer is troubleshooting a scenario where users at a branch office cannot access SaaS applications via Prisma Access. The SD-WAN path is active, but the traffic is not reaching the Cloud SWG. What is the most likely cause related to the Unified SASE policy?

Accepted Answer

The Security Policy rule for the branch traffic is set to 'Direct to Internet' instead of 'Service Connection'. In Unified SASE, the Security Policy set on the Prisma SD-WAN controller must explicitly permit the traffic to the Cloud SWG via the Service Connection policy.

Answer

The ION device is missing the latest firmware

Answer

The Cloud Identity Engine is not reachable

Answer

The WAN port is set to DHCP

Question 7

You are verifying the status of a Service Connection between a branch ION and Prisma Access. Which command or dashboard view provides the most accurate status of the tunnel reachability?

Accepted Answer

The Controller Service Connection Status Dashboard. The Prisma SD-WAN Controller dashboard provides a clear Service Connection status widget that shows tunnel up/down state.

Answer

The ION device hardware health tab

Answer

The local device ARP table

Answer

The cloud provider logs

Question 8

An organization is migrating to Unified SASE. When configuring the 'Direct to App' policy for branch offices, what is the primary benefit of leveraging the Prisma SD-WAN integration with Prisma Access?

Accepted Answer

It provides unified visibility and automated steering based on security requirements. The integration allows for dynamic path selection and security enforcement, ensuring that traffic is sent directly to the app when possible, or via Prisma Access when security inspection is required.

Answer

It allows the ION device to run full security stack analysis locally

Answer

It eliminates the need for DNS

Answer

It bypasses the need for WAN optimization

Question 9

What is the primary function of the 'Cloud Identity Engine' in the Unified SASE architecture?

Accepted Answer

To act as a central identity source for security policies. CIE centralizes identity across all SASE components, enabling consistent user-based policies.

Answer

To accelerate SaaS application traffic

Answer

To manage SD-WAN tunnel keys

Answer

To store traffic logs

Question 10

Which component in the Unified SASE stack is responsible for enforcing URL filtering and threat prevention policies for remote users?

Accepted Answer

Prisma Access. Prisma Access is the SASE component that provides full security stack capabilities, including URL filtering and threat prevention.

Answer

Prisma SD-WAN ION device

Answer

Cloud Identity Engine

Answer

SD-WAN Controller

Question 11

An administrator wants to ensure that all traffic from a specific branch is routed to Prisma Access, but bypasses the Cloud SWG for specific trusted SaaS applications. How is this achieved?

Accepted Answer

Create an App steering policy with a path selection for the specific apps. You can define an Application Steering Policy that specifies a different action (e.g., direct internet) for specific applications, overriding the general Service Connection path.

Answer

Use a custom NAT rule on the ION

Answer

Disable the Service Connection at the branch

Answer

Configure an exclusion list in the Cloud Identity Engine

Question 12

When defining an Application Steering Policy in a Unified SASE environment, what is the advantage of using 'Application Groups'?

Accepted Answer

They enable consistent policy application across multiple applications. Application groups allow for policy abstraction, so multiple apps can be steered using a single policy definition.

Answer

They are required for local internet breakout

Answer

They reduce the amount of bandwidth consumed

Answer

They bypass the security inspection

Question 13

In a scenario where a branch office loses its internet connection, what happens to the Unified SASE connection?

Accepted Answer

The SD-WAN system automatically fails over to an available secondary path. The Service Connection is lost, and if configured, the SD-WAN will failover to a backup WAN path or enter a local-only state depending on the policy.

Answer

The SD-WAN controller disables the branch

Answer

The traffic is automatically dropped

Answer

Traffic is sent to the default gateway without security

Question 14

When integrating Prisma SD-WAN with Prisma Access, how does the system ensure that the security policy is applied to the traffic correctly based on the user's identity?

Accepted Answer

User identity is mapped via CIE and passed as metadata. The ION device retrieves user identity context, which is passed through the tunnel to Prisma Access, where the security policy is applied.

Answer

The ION device performs DPI and injects user info

Answer

Prisma Access performs IP-based reverse lookups

Answer

The SD-WAN controller acts as the identity proxy

Question 15

You are monitoring traffic in a Unified SASE environment. You notice that traffic from a branch is taking a non-optimal path to Prisma Access. Which tool would you use to verify the path selection logic?

Accepted Answer

The flow diagnostic tool on the SD-WAN controller. The flow diagnostic tool on the SD-WAN controller provides visibility into the path selection decisions.

Answer

The WAN interface stats

Answer

The ION device ping tool

Answer

The Prisma Access logs

Question 16

What is the role of the 'Service Connection' in the Prisma SD-WAN interface?

Accepted Answer

To define the tunnel parameters for Prisma Access integration. A Service Connection is a logical construct that maps traffic from the SD-WAN fabric to external services like Prisma Access.

Answer

To monitor bandwidth usage

Answer

To configure a firewall rule

Answer

To manage branch-to-branch routing

Question 17

Which protocol is primarily used for the tunnel between the ION device and the Prisma Access Service Infrastructure?

Accepted Answer

IPSec. IPSec is the standard protocol for creating secure tunnels between SD-WAN devices and cloud service infrastructure.

Answer

SSL

Answer

GRE

Answer

MPLS

Question 18

Which of the following is a benefit of a Unified SASE architecture?

Accepted Answer

Unified management and consistent policy enforcement. Unified SASE combines networking (SD-WAN) and security (SASE) into a single management plane, simplifying operations.

Answer

Total replacement of physical branch routers

Answer

Removal of the need for internet connectivity

Answer

Increased hardware complexity at the branch

Question 19

In a Unified SASE deployment, what is the significance of the ION device serial number?

Accepted Answer

It is used for device onboarding and policy assignment. The serial number is the unique identifier used to register the device to the controller and associate it with the SASE tenant.

Answer

It is required for user authentication

Answer

It determines the tunnel MTU

Answer

It is needed for local WAN port configuration

Question 20

When troubleshooting a persistent 'Service Connection Down' status, which log type is most relevant?

Accepted Answer

Service Connection event logs. The event logs on the SD-WAN controller provide detailed status changes and errors related to Service Connection tunnels.

Answer

System health logs

Answer

User activity logs

Answer

Application performance logs