SD-WAN-Engineer Unified SASE — 40 Questions

Question 1

When onboarding a new branch site into a Unified SASE environment, what is the prerequisite for the branch ION device to establish a tunnel to Prisma Access?

Accepted Answer

An active Service Connection configuration. For a branch ION to build a tunnel to Prisma Access, a Service Connection must exist so the Prisma Access infrastructure has a reachable termination point and the branch has a target to peer with. The Service Connection is what stitches the branch fabric into the Prisma Access security processing nodes. Without it, the ION has no defined remote endpoint to establish the IPSec/SSL tunnel toward.

Answer

A pre-installed certificate on the endpoint host

Answer

An on-premise Active Directory server

Answer

A physical MPLS line at the branch

Question 2

An administrator wants to ensure that all traffic from a specific branch is routed to Prisma Access, but bypasses the Cloud SWG for specific trusted SaaS applications. How is this achieved?

Accepted Answer

Create an App steering policy with a path selection for the specific apps. To route all branch traffic to Prisma Access but bypass the Cloud SWG for specific trusted SaaS applications, you create an App steering policy with a path selection for those apps. This policy can direct the specified applications to go directly to the internet (bypassing SWG) while all other traffic goes through the Service Connection to Prisma Access. This is achieved by defining the applications and setting the action to 'Direct to Internet' or a specific path.

Answer

Use a custom NAT rule on the ION

Answer

Disable the Service Connection at the branch

Answer

Configure an exclusion list in the Cloud Identity Engine

Question 3

When integrating Prisma SD-WAN with Prisma Access, how does the system ensure that the security policy is applied to the traffic correctly based on the user's identity?

Accepted Answer

User identity is mapped via CIE and passed as metadata. The ION device retrieves user identity context, which is passed through the tunnel to Prisma Access, where the security policy is applied.

Answer

The ION device performs DPI and injects user info

Answer

Prisma Access performs IP-based reverse lookups

Answer

The SD-WAN controller acts as the identity proxy

Question 4

What is the role of the 'Service Connection' in the Prisma SD-WAN interface?

Accepted Answer

To define the tunnel parameters for Prisma Access integration. A Service Connection is a logical construct that maps traffic from the SD-WAN fabric to external services like Prisma Access.

Answer

To monitor bandwidth usage

Answer

To configure a firewall rule

Answer

To manage branch-to-branch routing

Question 5

When using a Service Connection, what happens if the Prisma Access node is unreachable?

Accepted Answer

The system falls back to the configured backup path. The SD-WAN policy will trigger a failover action based on the configured policy, such as direct internet breakout or alternate tunnel.

Answer

The user is forced to re-authenticate

Answer

The ION device restarts

Answer

The traffic is dropped

Question 6

An administrator needs to exclude specific traffic from being inspected by Prisma Access in a Unified SASE environment. Where is this defined?

Accepted Answer

In the Prisma SD-WAN Application Policy. This is defined in the Application Steering Policy by selecting a different path (e.g., direct internet) for the specific app.

Answer

In the ION device firmware settings

Answer

In the Cloud Identity Engine

Answer

Inside the Prisma Access Security Policy

Question 7

A branch office uses an ION device with a single WAN link. The security team requires that all internet-bound traffic from the branch be inspected by Prisma Access, but only for users in the 'Finance' VLAN. Traffic from the 'Guest' VLAN should go directly to the internet. Which configuration on the ION device achieves this requirement?

Accepted Answer

Create a policy-based routing rule that matches the Finance VLAN source and sets the next hop to the Prisma Access Service Connection.. Policy-based routing on the ION device allows granular control, matching source VLAN and directing traffic to the Prisma Access Service Connection. This ensures only Finance VLAN traffic is inspected, while Guest traffic uses the default path. Static routes and interface bindings lack the necessary source-based criteria, and 'Secure Internet Gateway' is not an ION feature.

Answer

Create a service connection on the ION device and bind it to the Finance VLAN interface.

Answer

Enable the 'Secure Internet Gateway' feature on the ION device and apply it to the Finance VLAN.

Answer

Configure a static route for the Finance VLAN subnet pointing to the Prisma Access Service Connection.

Question 8

A Prisma SD-WAN administrator needs to apply a consistent security policy to all traffic from a branch, including traffic that is destined for the internet and traffic that must be inspected by Prisma Access. The branch uses an ION device that is already connected to a Prisma SD-WAN Controller. The administrator wants to avoid configuring separate policies on the ION and in Prisma Access. Which Unified SASE feature should be used to meet this requirement?

Accepted Answer

Prisma SD-WAN CloudBlade for Prisma Access. The Prisma SD-WAN CloudBlade for Prisma Access is the integration point that lets a single security policy be applied to branch traffic, whether it is inspected locally or sent to Prisma Access. It automates service connection setup and policy synchronization, so the administrator does not have to maintain separate rules on the ION and in Prisma Access. Other options either provide only connectivity or require manual, separate policy configuration.

Answer

Prisma Access Explicit Proxy

Answer

Prisma Access Service Connection

Answer

Prisma SD-WAN Policy Construct

Question 9

An engineer is deploying a new branch with a Prisma SD-WAN ION device that must forward all internet-bound traffic to Prisma Access for security inspection. The branch has two ISP links, and the design requires that if one link fails, inspection continues without manual intervention. Which configuration on the ION device ensures this behavior?

Accepted Answer

Configure a Service Connection to Prisma Access and enable Dynamic Path Selection on the service connection.. A Service Connection to Prisma Access is the supported mechanism for sending branch traffic to the security inspection infrastructure. Combining it with Dynamic Path Selection ensures that traffic is continuously steered over the best available ISP link, providing automatic failover. Static routing, explicit proxy, or a manually configured GRE tunnel lack the integrated resiliency needed to keep inspection active when a link fails.

Answer

Configure a GRE tunnel to the nearest Prisma Access location and enable OSPF over the tunnel.

Answer

Configure a static route to Prisma Access using the primary ISP and enable BGP graceful restart.

Answer

Configure a Cloud SWG explicit proxy and set the ION device to forward all HTTP and HTTPS traffic to it.

Question 10

A branch office uses a Prisma SD-WAN ION device connected to Prisma Access via an Automated Service Connection. The security team wants to ensure that traffic destined for a specific SaaS application is inspected by Prisma Access while all other internet-bound traffic goes directly out the local internet link. What should the administrator configure to achieve this?

Accepted Answer

Create a policy rule that matches the SaaS application's IP addresses and set the action to 'Service Connection'.. The correct approach is to use a policy rule with the Service Connection action for the specific SaaS application. This ensures that only the desired traffic is sent to Prisma Access for inspection, while all other internet-bound traffic uses the local internet link. Policy rules in Prisma SD-WAN provide application-aware steering, which static routes or default gateway changes cannot achieve.

Answer

Configure a static route on the ION device pointing the SaaS application's subnet to the Prisma Access tunnel interface.

Answer

Set the ION device's default gateway to the Prisma Access tunnel endpoint so all traffic is inspected.

Answer

Enable 'Local Breakout' for all internet-bound traffic and rely on Prisma Access to inspect traffic via a separate tunnel.

Question 11

A company is deploying Prisma SD-WAN with Unified SASE. The security team wants to ensure that traffic from branch ION devices to Prisma Access is encrypted and that Prisma Access can apply security policies based on the original source IP address of the branch devices. Which two configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Configure a Service Connection between the ION devices and Prisma Access.. To encrypt traffic to Prisma Access and allow policy based on original source IP, a Service Connection must be configured, and source NAT must be disabled on that connection. The Service Connection provides the encrypted tunnel, and disabling source NAT preserves the original source IP so Prisma Access can use it in policy decisions. Other options either break source IP preservation or are not required.

Answer

Enable IPsec on the ION devices for all traffic.

Answer

Configure a static route on the ION devices pointing all traffic to the Prisma Access tunnel.

Answer

Enable source NAT on the ION devices for traffic destined to Prisma Access.

Question 12

A network architect is designing a Unified SASE solution for a retail company with 200 stores. Each store has a Prisma SD-WAN ION device and requires secure internet access with URL filtering and threat prevention. The company wants to minimize hardware footprint and management overhead. Which Prisma SASE component should the architect recommend for providing these security services?

Accepted Answer

Prisma Access Cloud SWG with Service Connections from each store.. Prisma Access Cloud SWG delivers cloud-based URL filtering and threat prevention, which can be applied to traffic from branch ION devices via Service Connections. This eliminates the need for dedicated security appliances at each store, reducing hardware footprint and centralizing policy management. The other options either require on-premises hardware, are designed for different use cases, or do not provide the required security services.

Answer

Prisma Cloud Compute for container security at each store.

Answer

Prisma Access Mobile Users with GlobalProtect on store endpoints.

Answer

Prisma SD-WAN Advanced Security license on each ION device.

Question 13

An administrator has deployed Prisma SD-WAN with Unified SASE and configured an Automated Service Connection to Prisma Access. Users at a branch report that they cannot access internal applications hosted in the data center, but internet access works fine. The administrator verifies that the Service Connection is up and that the ION device has a route to the data center via the VPN. What is the most likely cause?

Accepted Answer

The Service Connection is configured with a 'Default' route, causing all traffic, including data center traffic, to be sent to Prisma Access, but Prisma Access lacks a route back to the data center.. The most likely cause is that the Service Connection is sending all traffic, including data center-bound traffic, to Prisma Access, but Prisma Access does not have a route back to the data center. This results in dropped packets for internal applications while internet access continues to work. The administrator should verify Prisma Access routing tables and add a route for the data center subnet.

Answer

The data center subnet is not included in the Prisma Access 'Remote Networks' configuration, so Prisma Access does not know to route traffic to the data center via the Service Connection.

Answer

The data center subnet is not included in the Service Connection's 'Local Networks' configuration.

Answer

The ION device is not configured to route data center traffic through the Service Connection; it is sending it directly over the VPN, bypassing Prisma Access.

Question 14

An administrator is enabling Unified SASE for a branch and wants to verify that the ION device has successfully established a Service Connection to Prisma Access. Which status indicator should the administrator check on the ION device?

Accepted Answer

The Service Connection status showing as up in the Prisma SD-WAN controller dashboard.. The Prisma SD-WAN controller dashboard is the central management plane and shows the real-time status of Service Connections. When the tunnel to Prisma Access is up, the dashboard reflects that state. Other indicators such as BGP state, WAN link status, or device resource usage do not directly confirm that the Service Connection is established and operational.

Answer

The ION device's CPU and memory utilization remaining below 80 percent.

Answer

The ION device's WAN interface link status showing green for both ISP links.

Answer

The BGP neighbor state on the ION device showing Established with the Prisma Access peer.

Question 15

A network operations team is monitoring a Unified SASE deployment with Prisma SD-WAN and Prisma Access. They notice that security logs from Prisma Access show allowed traffic for a specific user, but Prisma SD-WAN logs show the same session as denied by a policy. What is the most likely explanation for this discrepancy?

Accepted Answer

The session was allowed by Prisma Access but then denied by a Prisma SD-WAN policy on a subsequent packet due to a policy change.. The discrepancy can occur if a policy change on the Prisma SD-WAN takes effect during an active session. Prisma Access may have already allowed the initial packets and logged them, while the ION device begins denying subsequent packets based on the new policy. This leads to conflicting logs. Administrators should check policy change history and session timestamps to confirm.

Answer

Prisma Access and Prisma SD-WAN are correlating logs incorrectly due to mismatched session identifiers.

Answer

The traffic matched a deny rule in Prisma SD-WAN for outbound but was allowed by Prisma Access on the return path.

Answer

The ION device is applying a security policy that denies the traffic before it reaches Prisma Access.

Question 16

A network engineer is deploying Prisma SD-WAN with Unified SASE. They need to ensure that traffic from a branch to a critical business application is always inspected by Prisma Access, even if the primary Service Connection fails. What should they configure?

Accepted Answer

Enable 'Service Connection Backup' and configure a secondary Service Connection to a different Prisma Access location.. Service Connection Backup is the correct feature to ensure continuous inspection. It allows the ION device to automatically fail over to a secondary Service Connection if the primary fails, ensuring that traffic is still inspected by Prisma Access. This provides both redundancy and security compliance.

Answer

Configure a policy rule that sends traffic directly to the internet if the Service Connection is down, to maintain availability.

Answer

Set up a GRE tunnel directly to Prisma Access as a backup, bypassing the Service Connection.

Answer

Use 'Local Breakout' with a security policy applied to the ION device to inspect traffic locally.

Question 17

A company has deployed Unified SASE with Prisma SD-WAN and Prisma Access. They want to ensure that security logs from Prisma Access and network logs from Prisma SD-WAN are correlated to provide a single view of user activity. Which component of the Unified SASE architecture is responsible for this correlation?

Accepted Answer

The Prisma Access Insights and Prisma SD-WAN Analytics integration, which uses shared context such as user, device, and application to correlate events.. Correlation of security and network logs in Unified SASE is achieved through the integration of Prisma Access Insights and Prisma SD-WAN Analytics, which share contextual data such as user, device, and application. This provides a unified view of activity. The other options describe components that either manage only one domain or do not have the capability to correlate logs from both security and network sources.

Answer

The Prisma Access Cloud Management console, which aggregates logs from all Prisma Access tenants.

Answer

The ION device's local logging feature, which stores both network and security logs and forwards them to a central syslog server.

Answer

The Prisma SD-WAN Controller, which collects flow data from ION devices and correlates it with security events from Prisma Access.

Question 18

An administrator is troubleshooting a Unified SASE deployment where traffic from a branch to the internet is being inspected by Prisma Access, but traffic to a specific SaaS application is not being inspected. The administrator has verified that the Service Connection is up and that a policy rule exists to send that SaaS application's traffic to the Service Connection. What should the administrator check next?

Accepted Answer

The order of policy rules to ensure the SaaS application rule is not overridden by a higher-priority rule.. The most likely cause is that a higher-priority policy rule is matching the SaaS application traffic and overriding the intended Service Connection rule. Policy rules are evaluated top-down, so the administrator must verify the rule order and adjust it so that the specific SaaS application rule is evaluated before any broader rules that might match.

Answer

The ION device's routing table to confirm that the SaaS application's IP addresses are not routed directly to the internet.

Answer

The Prisma Access security policy to ensure that the SaaS application is not blocked.

Answer

The Service Connection's encryption settings to verify that the SaaS application's traffic is not being decrypted before inspection.

Question 19

An administrator is configuring a Service Connection between a Prisma SD-WAN ION device and Prisma Access. The administrator wants to ensure that the connection uses the most efficient path and that failover occurs automatically if the primary tunnel goes down. Which configuration should the administrator apply on the ION device?

Accepted Answer

Configure a single Service Connection with BGP and enable tunnel monitoring with failover to a secondary tunnel.. To achieve efficient path selection and automatic failover, the administrator should configure BGP for dynamic routing and set up tunnel monitoring with a secondary tunnel. BGP allows the ION device to select the best path based on network conditions, while tunnel monitoring detects failures and triggers failover. This combination ensures both optimal performance and high availability for the Service Connection.

Answer

Configure a single Service Connection with OSPF and enable graceful restart to handle failover.

Answer

Configure a single Service Connection with BGP and rely on the ION device's built-in redundancy to switch to a backup WAN link if the tunnel fails.

Answer

Configure two Service Connections with static routes and equal cost, relying on ECMP for load balancing and failover.

Question 20

A network engineer is designing a Unified SASE deployment with Prisma SD-WAN and Prisma Access. They need to ensure that traffic from a branch to the internet is inspected by Prisma Access, while traffic to internal data center applications is routed directly over the VPN without inspection. Which two actions should they take? (Choose two.)

Accepted Answer

Configure a policy rule to send data center traffic directly over the VPN, bypassing the Service Connection.. The correct actions are to create a policy rule that sends internet-bound traffic to the Service Connection for inspection, and a higher-priority rule that sends data center traffic directly over the VPN, bypassing the Service Connection. This ensures that only internet traffic is inspected, while internal traffic remains uninspected and efficient.

Answer

Set the default route on the ION device to point to the Service Connection.

Answer

Enable 'Local Breakout' for all traffic to reduce latency.

Answer

Configure the Service Connection to advertise a default route to Prisma Access.