SD-WAN-Engineer Unified SASE Practice Test 2 — 15 Questions

Question 1

A network engineer is deploying Prisma SD-WAN with Unified SASE. They need to ensure that traffic from a branch to a critical business application is always inspected by Prisma Access, even if the primary Service Connection fails. What should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'Service Connection Backup' and configure a secondary Service Connection to a different Prisma Access location.. Service Connection Backup is the correct feature to ensure continuous inspection. It allows the ION device to automatically fail over to a secondary Service Connection if the primary fails, ensuring that traffic is still inspected by Prisma Access. This provides both redundancy and security compliance.

Answer

Configure a policy rule that sends traffic directly to the internet if the Service Connection is down, to maintain availability.

Answer

Set up a GRE tunnel directly to Prisma Access as a backup, bypassing the Service Connection.

Answer

Use 'Local Breakout' with a security policy applied to the ION device to inspect traffic locally.

Question 2

A company has deployed Unified SASE with Prisma SD-WAN and Prisma Access. They want to ensure that security logs from Prisma Access and network logs from Prisma SD-WAN are correlated to provide a single view of user activity. Which component of the Unified SASE architecture is responsible for this correlation?

Accepted Answer

The Prisma Access Insights and Prisma SD-WAN Analytics integration, which uses shared context such as user, device, and application to correlate events.. Correlation of security and network logs in Unified SASE is achieved through the integration of Prisma Access Insights and Prisma SD-WAN Analytics, which share contextual data such as user, device, and application. This provides a unified view of activity. The other options describe components that either manage only one domain or do not have the capability to correlate logs from both security and network sources.

Answer

The Prisma Access Cloud Management console, which aggregates logs from all Prisma Access tenants.

Answer

The ION device's local logging feature, which stores both network and security logs and forwards them to a central syslog server.

Answer

The Prisma SD-WAN Controller, which collects flow data from ION devices and correlates it with security events from Prisma Access.

Question 3

An administrator is troubleshooting a Unified SASE deployment where traffic from a branch to the internet is being inspected by Prisma Access, but traffic to a specific SaaS application is not being inspected. The administrator has verified that the Service Connection is up and that a policy rule exists to send that SaaS application's traffic to the Service Connection. What should the administrator check next?

Accepted Answer

The order of policy rules to ensure the SaaS application rule is not overridden by a higher-priority rule.. The most likely cause is that a higher-priority policy rule is matching the SaaS application traffic and overriding the intended Service Connection rule. Policy rules are evaluated top-down, so the administrator must verify the rule order and adjust it so that the specific SaaS application rule is evaluated before any broader rules that might match.

Answer

The ION device's routing table to confirm that the SaaS application's IP addresses are not routed directly to the internet.

Answer

The Prisma Access security policy to ensure that the SaaS application is not blocked.

Answer

The Service Connection's encryption settings to verify that the SaaS application's traffic is not being decrypted before inspection.

Question 4

An administrator is configuring a Service Connection between a Prisma SD-WAN ION device and Prisma Access. The administrator wants to ensure that the connection uses the most efficient path and that failover occurs automatically if the primary tunnel goes down. Which configuration should the administrator apply on the ION device?

Accepted Answer

Configure a single Service Connection with BGP and enable tunnel monitoring with failover to a secondary tunnel.. To achieve efficient path selection and automatic failover, the administrator should configure BGP for dynamic routing and set up tunnel monitoring with a secondary tunnel. BGP allows the ION device to select the best path based on network conditions, while tunnel monitoring detects failures and triggers failover. This combination ensures both optimal performance and high availability for the Service Connection.

Answer

Configure a single Service Connection with OSPF and enable graceful restart to handle failover.

Answer

Configure a single Service Connection with BGP and rely on the ION device's built-in redundancy to switch to a backup WAN link if the tunnel fails.

Answer

Configure two Service Connections with static routes and equal cost, relying on ECMP for load balancing and failover.

Question 5

A network engineer is designing a Unified SASE deployment with Prisma SD-WAN and Prisma Access. They need to ensure that traffic from a branch to the internet is inspected by Prisma Access, while traffic to internal data center applications is routed directly over the VPN without inspection. Which two actions should they take? (Choose two.)

Accepted Answer

Configure a policy rule to send data center traffic directly over the VPN, bypassing the Service Connection.. The correct actions are to create a policy rule that sends internet-bound traffic to the Service Connection for inspection, and a higher-priority rule that sends data center traffic directly over the VPN, bypassing the Service Connection. This ensures that only internet traffic is inspected, while internal traffic remains uninspected and efficient.

Answer

Set the default route on the ION device to point to the Service Connection.

Answer

Enable 'Local Breakout' for all traffic to reduce latency.

Answer

Configure the Service Connection to advertise a default route to Prisma Access.

Question 6

A security administrator is integrating Prisma SD-WAN with Prisma Access to enforce security policies based on user identity. The administrator wants to ensure that user identity information is available for policy enforcement. Which TWO actions are required to enable user-based policies in this Unified SASE deployment? (Choose two.)

Accepted Answer

Configure the Cloud Identity Engine (CIE) to synchronize user and group information from the identity provider.. To enforce user-based policies in a Unified SASE deployment with Prisma SD-WAN and Prisma Access, two key actions are required: integrating the Cloud Identity Engine (CIE) to provide user and group information, and configuring a service connection on the ION device to steer traffic to Prisma Access. CIE synchronizes identity data, while the service connection ensures that traffic is inspected by Prisma Access, where the identity information is used to apply policies.

Answer

Configure a security policy rule in Prisma Access that references user groups.

Answer

Install a forwarding proxy on the ION device to intercept user traffic.

Answer

Enable User-ID on the ION device to map IP addresses to usernames.

Question 7

A network engineer is integrating Prisma SD-WAN with Prisma Access for Unified SASE. The engineer wants to ensure that user-based policies are enforced for branch traffic. Which Prisma SD-WAN component is responsible for mapping user identities to IP addresses to enable user-based policies?

Accepted Answer

Cloud Identity Engine. Cloud Identity Engine is the component that aggregates user identity information from various sources and maps it to IP addresses, enabling Prisma SD-WAN to enforce user-based policies. Other options either do not perform this mapping or are not integrated directly with Prisma SD-WAN.

Answer

ION device local user database

Answer

Prisma Access User-ID Agent

Answer

Active Directory Domain Controller

Question 8

A network administrator is configuring Prisma SD-WAN to integrate with Prisma Access using the Automated Service Connection. During the onboarding process, which specific parameter must be configured in the ION device's service route to ensure traffic is correctly steered to the Prisma Access Service Infrastructure?

Accepted Answer

The specific Service Connection object representing the Prisma Access tunnel. When integrating Prisma SD-WAN with Prisma Access via Automated Service Connection, the ION device's service route must reference the specific Service Connection object that represents the Prisma Access tunnel. This object tells the ION how to steer traffic into the Prisma Access service infrastructure.

Answer

The WAN interface MTU size exclusively

Answer

The BGP AS number of the remote Prisma Access node

Answer

The local controller's IP address

Question 9

You are deploying Cloud Identity Engine (CIE) to enable identity-based security policies across your SD-WAN and SASE environment. Which configuration step is required to ensure that user identity information is successfully propagated from the enterprise directory to the Prisma Access security nodes?

Accepted Answer

Link the Prisma Access instance to the CIE instance using the API Key and Tenant ID. To propagate identity from the enterprise directory to Prisma Access security nodes, the Prisma Access tenant must be linked to the Cloud Identity Engine instance using the API Key and Tenant ID. This linkage authorizes CIE to push user-to-IP mappings and group information into Prisma Access so identity-based security policies can be enforced at the enforcement nodes.

Answer

Configure a local user database on every ION device

Answer

Manually map IP addresses to usernames in the Cloud SWG UI

Answer

Enable the Identity Service on the Prisma SD-WAN Controller

Question 10

In a Unified SASE architecture, an administrator needs to ensure that branch offices prioritize voice traffic while using Prisma Access. Where should the Quality of Service (QoS) policy be defined to ensure consistent application performance?

Accepted Answer

On the Prisma SD-WAN Controller under Application QoS Policy. In a Prisma SD-WAN + Prisma Access Unified SASE deployment, application-level QoS is defined centrally on the Prisma SD-WAN Controller as an Application QoS Policy. This policy is then pushed to the ION devices at the branch, where it enforces prioritization (e.g., real-time voice in a high-priority queue) before traffic is steered to Prisma Access. Centralizing QoS at the Controller ensures consistent policy across all branches rather than per-device configuration drift.

Answer

On the local ION device CLI only

Answer

Inside the Prisma Access Security Policy

Answer

Within the Cloud Identity Engine

Question 11

A customer is experiencing intermittent connectivity to internal applications after enabling Unified SASE. Traffic is being routed through Prisma Access. What is the most likely cause?

Accepted Answer

MTU size mismatch leading to packet fragmentation. MTU size mismatch is a common cause of intermittent connectivity when traffic is routed through Prisma Access. If the MTU on the ION device or the tunnel is larger than the path MTU, packets may be fragmented or dropped, leading to intermittent failures, especially for applications that do not handle fragmentation well. This is a typical issue after enabling Unified SASE because the additional encapsulation (e.g., IPsec) reduces the effective MTU.

Answer

The ION device is overheating

Answer

Incorrect DNS server configuration

Answer

Identity cache expiration in CIE

Question 12

An engineer is troubleshooting a scenario where users at a branch office cannot access SaaS applications via Prisma Access. The SD-WAN path is active, but the traffic is not reaching the Cloud SWG. What is the most likely cause related to the Unified SASE policy?

Accepted Answer

The Security Policy rule for the branch traffic is set to 'Direct to Internet' instead of 'Service Connection'. In Prisma Access Unified SASE, the Security Policy rule determines whether branch traffic is sent to the Cloud SWG (Service Connection) or sent directly to the internet. If the rule is set to 'Direct to Internet', traffic bypasses the Cloud SWG entirely, so users cannot reach SaaS applications through the security service. The SD-WAN path being active only means the underlay is up; the policy action controls the security inspection path.

Answer

The ION device is missing the latest firmware

Answer

The Cloud Identity Engine is not reachable

Answer

The WAN port is set to DHCP

Question 13

You are verifying the status of a Service Connection between a branch ION and Prisma Access. Which command or dashboard view provides the most accurate status of the tunnel reachability?

Accepted Answer

The Controller Service Connection Status Dashboard. The Prisma SD-WAN Controller dashboard provides a clear Service Connection status widget that shows tunnel up/down state.

Answer

The ION device hardware health tab

Answer

The local device ARP table

Answer

The cloud provider logs

Question 14

An organization is migrating to Unified SASE. When configuring the 'Direct to App' policy for branch offices, what is the primary benefit of leveraging the Prisma SD-WAN integration with Prisma Access?

Accepted Answer

It provides unified visibility and automated steering based on security requirements. The integration allows for dynamic path selection and security enforcement, ensuring that traffic is sent directly to the app when possible, or via Prisma Access when security inspection is required.

Answer

It allows the ION device to run full security stack analysis locally

Answer

It eliminates the need for DNS

Answer

It bypasses the need for WAN optimization

Question 15

What is the primary function of the 'Cloud Identity Engine' in the Unified SASE architecture?

Accepted Answer

To act as a central identity source for security policies. CIE centralizes identity across all SASE components, enabling consistent user-based policies.

Answer

To accelerate SaaS application traffic

Answer

To manage SD-WAN tunnel keys

Answer

To store traffic logs