SD-WAN-Engineer Unified SASE Practice Test 3 — 15 Questions

Question 1

Which component in the Unified SASE stack is responsible for enforcing URL filtering and threat prevention policies for remote users?

Accepted Answer

Prisma Access. Prisma Access is the SASE component that provides full security stack capabilities, including URL filtering and threat prevention.

Answer

Prisma SD-WAN ION device

Answer

Cloud Identity Engine

Answer

SD-WAN Controller

Question 2

When defining an Application Steering Policy in a Unified SASE environment, what is the advantage of using 'Application Groups'?

Accepted Answer

They enable consistent policy application across multiple applications. Application groups allow for policy abstraction, so multiple apps can be steered using a single policy definition.

Answer

They are required for local internet breakout

Answer

They reduce the amount of bandwidth consumed

Answer

They bypass the security inspection

Question 3

In a scenario where a branch office loses its internet connection, what happens to the Unified SASE connection?

Accepted Answer

The SD-WAN system automatically fails over to an available secondary path. Prisma SD-WAN is built around multiple transport links and continuous path monitoring, so when the primary internet circuit fails, the fabric automatically steers traffic onto a secondary path (LTE, secondary broadband, or MPLS) without operator intervention. The Unified SASE tunnel is re-established or maintained over the surviving path, preserving security inspection. This is the core resilience promise of the SD-WAN overlay.

Answer

The SD-WAN controller disables the branch

Answer

The traffic is automatically dropped

Answer

Traffic is sent to the default gateway without security

Question 4

You are monitoring traffic in a Unified SASE environment. You notice that traffic from a branch is taking a non-optimal path to Prisma Access. Which tool would you use to verify the path selection logic?

Accepted Answer

The flow diagnostic tool on the SD-WAN controller. The flow diagnostic tool on the SD-WAN controller provides visibility into the path selection decisions.

Answer

The WAN interface stats

Answer

The ION device ping tool

Answer

The Prisma Access logs

Question 5

Which protocol is primarily used for the tunnel between the ION device and the Prisma Access Service Infrastructure?

Accepted Answer

IPSec. IPSec is the standard protocol for creating secure tunnels between SD-WAN devices and cloud service infrastructure.

Answer

SSL

Answer

GRE

Answer

MPLS

Question 6

Which of the following is a benefit of a Unified SASE architecture?

Accepted Answer

Unified management and consistent policy enforcement. Unified SASE combines networking (SD-WAN) and security (SASE) into a single management plane, simplifying operations.

Answer

Total replacement of physical branch routers

Answer

Removal of the need for internet connectivity

Answer

Increased hardware complexity at the branch

Question 7

In a Unified SASE deployment, what is the significance of the ION device serial number?

Accepted Answer

It is used for device onboarding and policy assignment. The serial number is the unique identifier used to register the device to the controller and associate it with the SASE tenant.

Answer

It is required for user authentication

Answer

It determines the tunnel MTU

Answer

It is needed for local WAN port configuration

Question 8

When troubleshooting a persistent 'Service Connection Down' status, which log type is most relevant?

Accepted Answer

Service Connection event logs. The event logs on the SD-WAN controller provide detailed status changes and errors related to Service Connection tunnels.

Answer

System health logs

Answer

User activity logs

Answer

Application performance logs

Question 9

An administrator wants to limit the bandwidth used by a specific application when routed to Prisma Access. Where is this configured?

Accepted Answer

In the SD-WAN Application Policy. Bandwidth limits for specific applications routed to Prisma Access are configured within the SD-WAN Application Policy on the Prisma SD-WAN Controller. This policy defines application-based rules including path selection, QoS, and bandwidth allocation that apply when traffic is steered to Prisma Access. The Application Policy is the centralized mechanism for controlling how applications are treated across the SD-WAN fabric.

Answer

In the Cloud Identity Engine

Answer

In the Prisma Access cloud settings

Answer

On the ION device physical port setting

Question 10

If a user is incorrectly identified in a SASE security log, which part of the Unified SASE architecture should be investigated first?

Accepted Answer

The Cloud Identity Engine. The Cloud Identity Engine is the component in Palo Alto's Unified SASE architecture that resolves user identity by integrating with identity providers (Entra ID, Okta, LDAP, etc.) and mapping users to IP addresses and groups. If a user is misidentified in a security log, the identity mapping is the first thing to verify, making the Cloud Identity Engine the correct starting point.

Answer

The ION device WAN interface

Answer

The DNS settings

Answer

The Prisma SD-WAN Controller

Question 11

What is the purpose of the 'Zone' configuration on an ION device in a Unified SASE context?

Accepted Answer

To apply different security and routing policies based on traffic origin. The Zone configuration on an ION device defines logical groupings of interfaces so that security and routing policies can be applied based on the origin of traffic. Zones enable policy differentiation, such as treating traffic from a guest network differently from corporate traffic. This is fundamental to how Unified SASE enforces context-aware policies.

Answer

To define the physical location of the device

Answer

To increase the encryption level of the tunnel

Answer

To bypass the SD-WAN controller

Question 12

Which THREE factors influence the 'Path Selection' decision for traffic in a Unified SASE architecture?

Accepted Answer

User department or group. Option A is correct because Unified SASE path selection can be policy-driven by identity attributes such as user department or group, so traffic from different groups can be steered over different paths (for example, guest traffic to a direct internet breakout while finance traffic goes through a secure web gateway). Option B is correct because path selection continuously monitors application latency and jitter (often via probes such as HTTP ping or synthetic transactions) and chooses the WAN link or overlay path that best meets the application's SLA. Option E is correct because the required security inspection determines the path: traffic needing full inspection must be routed through the security service chain (SWG, CASB, FWaaS, ZTNA), while traffic that can bypass inspection may take a more direct path. Option C is not a factor because cable color is purely cosmetic and has no bearing on routing or path selection. Option D is not a factor because the count of users logged into a local ION device is not a path-selection criterion; decisions are based on policy, application performance, and security requirements rather than local session counts.

Answer

The physical color of the WAN cable

Answer

The number of users logged into the local ION device

Question 13

An engineer notices that some traffic is not being optimized by the Prisma SD-WAN fabric. Upon inspection, the traffic is bypassing the SD-WAN tunnels. What is the most likely cause?

Accepted Answer

The traffic is matching a local breakout rule that takes precedence. Local breakout rules are policy constructs that intentionally send specific traffic directly out a local internet path rather than through the SD-WAN overlay, so traffic matching such a rule will bypass the tunnels by design. This is the most likely cause when only some traffic is unoptimized while the fabric itself is healthy. The behavior is expected, not a fault, once you identify the matching rule.

Answer

The controller is down

Answer

The license has expired

Answer

The ION device is in bypass mode

Question 14

How are security logs from Prisma Access and Prisma SD-WAN correlated in a Unified SASE environment?

Accepted Answer

Through the unified logging service. In a Unified SASE environment, Prisma Access and Prisma SD-WAN logs are correlated through the unified logging service, which normalizes and joins events from both products using common context such as user, device, and session identifiers. This allows a single pane of glass for security and network events.

Answer

By manually exporting logs to a CSV

Answer

Via the Cloud Identity Engine

Answer

They cannot be correlated

Question 15

Which component manages the configuration and policy definition for a fleet of Prisma SD-WAN ION devices?

Accepted Answer

The Prisma SD-WAN Controller. The Prisma SD-WAN Controller is the single pane of glass for managing all ION devices and policies.

Answer

Prisma Access

Answer

The Cloud Identity Engine

Answer

The ION device web UI