SD-WAN-Engineer Unified SASE Practice Test 2 — 15 Questions

Question 1

What is the role of the 'Service Connection' in the Prisma SD-WAN interface?

Accepted Answer

To define the tunnel parameters for Prisma Access integration. A Service Connection is a logical construct that maps traffic from the SD-WAN fabric to external services like Prisma Access.

Answer

To monitor bandwidth usage

Answer

To configure a firewall rule

Answer

To manage branch-to-branch routing

Question 2

Which protocol is primarily used for the tunnel between the ION device and the Prisma Access Service Infrastructure?

Accepted Answer

IPSec. IPSec is the standard protocol for creating secure tunnels between SD-WAN devices and cloud service infrastructure.

Answer

SSL

Answer

GRE

Answer

MPLS

Question 3

Which of the following is a benefit of a Unified SASE architecture?

Accepted Answer

Unified management and consistent policy enforcement. Unified SASE combines networking (SD-WAN) and security (SASE) into a single management plane, simplifying operations.

Answer

Total replacement of physical branch routers

Answer

Removal of the need for internet connectivity

Answer

Increased hardware complexity at the branch

Question 4

In a Unified SASE deployment, what is the significance of the ION device serial number?

Accepted Answer

It is used for device onboarding and policy assignment. The serial number is the unique identifier used to register the device to the controller and associate it with the SASE tenant.

Answer

It is required for user authentication

Answer

It determines the tunnel MTU

Answer

It is needed for local WAN port configuration

Question 5

When troubleshooting a persistent 'Service Connection Down' status, which log type is most relevant?

Accepted Answer

Service Connection event logs. The event logs on the SD-WAN controller provide detailed status changes and errors related to Service Connection tunnels.

Answer

System health logs

Answer

User activity logs

Answer

Application performance logs

Question 6

An administrator wants to limit the bandwidth used by a specific application when routed to Prisma Access. Where is this configured?

Accepted Answer

In the SD-WAN Application Policy. Traffic shaping policies on the ION device allow for bandwidth limits on specific applications.

Answer

In the Cloud Identity Engine

Answer

In the Prisma Access cloud settings

Answer

On the ION device physical port setting

Question 7

If a user is incorrectly identified in a SASE security log, which part of the Unified SASE architecture should be investigated first?

Accepted Answer

The Cloud Identity Engine. CIE is responsible for mapping IP addresses to users; an incorrect mapping suggests an issue with the CIE-to-SASE synchronization.

Answer

The ION device WAN interface

Answer

The DNS settings

Answer

The Prisma SD-WAN Controller

Question 8

When using a Service Connection, what happens if the Prisma Access node is unreachable?

Accepted Answer

The system falls back to the configured backup path. The SD-WAN policy will trigger a failover action based on the configured policy, such as direct internet breakout or alternate tunnel.

Answer

The user is forced to re-authenticate

Answer

The ION device restarts

Answer

The traffic is dropped

Question 9

What is the purpose of the 'Zone' configuration on an ION device in a Unified SASE context?

Accepted Answer

To apply different security and routing policies based on traffic origin. Zones are used to segment traffic logically, allowing for different policies to be applied to different traffic types or users.

Answer

To define the physical location of the device

Answer

To increase the encryption level of the tunnel

Answer

To bypass the SD-WAN controller

Question 10

Which THREE factors influence the 'Path Selection' decision for traffic in a Unified SASE architecture?

Accepted Answer

User department or group. Path selection is dynamic and based on performance, policy, and availability.

Answer

The physical color of the WAN cable

Answer

The number of users logged into the local ION device

Question 11

An engineer notices that some traffic is not being optimized by the Prisma SD-WAN fabric. Upon inspection, the traffic is bypassing the SD-WAN tunnels. What is the most likely cause?

Accepted Answer

The traffic is matching a local breakout rule that takes precedence. If traffic is not hitting the SD-WAN policy, it might be bypassing it due to local breakout settings or incorrect zone mapping.

Answer

The controller is down

Answer

The license has expired

Answer

The ION device is in bypass mode

Question 12

How are security logs from Prisma Access and Prisma SD-WAN correlated in a Unified SASE environment?

Accepted Answer

Through the unified logging service. The logging service acts as a single repository, and correlation is achieved via common identifiers like timestamp, username, and IP.

Answer

By manually exporting logs to a CSV

Answer

Via the Cloud Identity Engine

Answer

They cannot be correlated

Question 13

Which component manages the configuration and policy definition for a fleet of Prisma SD-WAN ION devices?

Accepted Answer

The Prisma SD-WAN Controller. The Prisma SD-WAN Controller is the single pane of glass for managing all ION devices and policies.

Answer

Prisma Access

Answer

The Cloud Identity Engine

Answer

The ION device web UI

Question 14

Which TWO of the following are required to successfully establish a Service Connection to Prisma Access?

Accepted Answer

Prisma Access gateway IP addresses or FQDNs. Establishing a Service Connection requires defining the destination in the SD-WAN controller and ensuring the ION device has connectivity to the Prisma Access endpoint.

Answer

An on-premise BGP router

Answer

A local root CA certificate for the SD-WAN controller

Answer

A valid physical cross-connect to the cloud provider

Question 15

Which TWO functions are performed by the Cloud Identity Engine (CIE) within a Unified SASE environment?

Accepted Answer

Mapping IP addresses to user identities for policy enforcement. CIE synchronizes directory data and provides identity context to the security components.

Answer

Enforcing URL filtering policies

Answer

Directing traffic to the nearest SASE POP

Answer

Managing physical interface speed settings