SD-WAN-Engineer Unified SASE Practice Test 4 — 15 Questions

Question 1

Which TWO of the following are required to successfully establish a Service Connection to Prisma Access?

Accepted Answer

Prisma Access gateway IP addresses or FQDNs. Option B is correct because a Service Connection requires the remote peer to know the Prisma Access gateway IP addresses or FQDNs to establish the IPSec tunnel to the correct Prisma Access location. Option E is correct because the Service Connection must be configured and active on the SD-WAN controller (e.g., Prisma SD-WAN ION device or Panorama-managed firewall) so the tunnel parameters, routing, and termination are properly defined. Option A is not required because BGP is optional; static routing can be used for the Service Connection. Option C is not required because a local root CA for the SD-WAN controller is not a prerequisite for the Service Connection itself. Option D is not required because a physical cross-connect is not needed; the Service Connection runs over the existing internet or private WAN transport.

Answer

An on-premise BGP router

Answer

A local root CA certificate for the SD-WAN controller

Answer

A valid physical cross-connect to the cloud provider

Question 2

Which TWO functions are performed by the Cloud Identity Engine (CIE) within a Unified SASE environment?

Accepted Answer

Mapping IP addresses to user identities for policy enforcement. Option B is correct because the Cloud Identity Engine's core purpose is to aggregate identity data and provide user-to-IP mapping (via sources such as GlobalProtect, Prisma Access, and directory logs) so that security policy can be enforced against users rather than just IP addresses. Option E is correct because CIE synchronizes users and groups from directory services such as Active Directory, Microsoft Entra ID, and Okta, then distributes that identity information to enforcement points in the Unified SASE environment. Option A is incorrect because URL filtering is enforced by the SASE security service (e.g., Prisma Access/Cloud SWG), not by CIE itself, which supplies identity context. Option C is incorrect because POP selection and traffic steering are handled by the SASE infrastructure's routing and GlobalProtect/App Connector mechanisms, not by CIE. Option D is incorrect because physical interface speed settings are a networking/device configuration concern unrelated to CIE's identity functions.

Answer

Enforcing URL filtering policies

Answer

Directing traffic to the nearest SASE POP

Answer

Managing physical interface speed settings

Question 3

Which TWO types of traffic are typically steered to Prisma Access in a Unified SASE architecture?

Accepted Answer

SaaS application traffic. Option C (SaaS application traffic) is correct because in a Unified SASE architecture, Prisma Access provides secure web gateway (SWG) and CASB capabilities that inspect and secure traffic to cloud-delivered SaaS applications such as Microsoft 365, Salesforce, and Google Workspace. Option D (Public internet-bound traffic) is correct because Prisma Access acts as the internet security enforcement point, steering all web and internet-bound traffic through its security processing nodes for threat prevention, URL filtering, and DNS security. Options A and B are incorrect because traffic to a local server rack or a local printer on the same subnet stays on the local LAN and is handled by the on-premises network, not steered to Prisma Access. Option E is incorrect because branch-to-branch traffic is typically handled by the SD-WAN fabric or Prisma SD-WAN, not by Prisma Access, which focuses on securing user and branch traffic to SaaS, internet, and private applications.

Answer

Traffic destined to a local server rack

Answer

Local printer traffic on the same subnet

Answer

Traffic between two branch offices

Question 4

Which TWO benefits does an automated Service Connection provide over a manual tunnel configuration?

Accepted Answer

Reduced manual configuration steps and lower risk of error. Option D is correct because an automated Service Connection provisions the tunnel end-to-end through orchestration, eliminating the repetitive CLI/GUI entry of peer IPs, pre-shared keys, and encryption domains that manual tunnel configuration requires, which directly lowers the chance of typos and misconfigured parameters. Option E is correct because automation handles the dynamic exchange of tunnel parameters (such as IKE/IPsec proposals, keys, and endpoint addresses) and continuously runs health monitoring (for example DPD or BFD-style liveness checks) so the tunnel can be re-established without operator intervention. Options A, B, and C are not benefits of an automated Service Connection: firewall policies are still required to permit the underlying traffic, the connection remains a logical overlay tunnel rather than a physical link to the datacenter, and an SD-WAN controller is typically the component that enables this automation rather than being made unnecessary by it.

Answer

It replaces the need for firewall policies

Answer

It provides a physical connection to the datacenter

Answer

It removes the need for an SD-WAN controller

Question 5

Which TWO visibility tools help monitor the Unified SASE traffic flow?

Accepted Answer

Unified Logging Service (Cloud logging). Option D, Unified Logging Service (Cloud logging), is correct because it aggregates logs from Prisma SASE components in the cloud, giving centralized visibility into traffic flow, security events, and policy decisions across the SASE fabric. Option E, Prisma SD-WAN Flow Diagnostic tool, is correct because it provides hop-by-hop path and flow-level analysis of SD-WAN traffic, letting administrators trace how application flows traverse the SASE infrastructure and identify where issues occur. The other options do not belong: a physical cable tester (A) only verifies Layer 1 cabling continuity and cannot inspect SASE traffic flows; local ION device power supply status (B) is a hardware health indicator unrelated to traffic visibility; and local printer logs (C) are irrelevant to network or SASE traffic monitoring.

Answer

Physical cable tester

Answer

Local ION device power supply status

Answer

Local printer logs

Question 6

Which THREE components are involved in the process of applying a user-based policy in a Unified SASE architecture?

Accepted Answer

Prisma SD-WAN Controller (for policy distribution). In a Unified SASE architecture, applying a user-based policy requires three cooperating components: the Cloud Identity Engine (E) acts as the identity source, aggregating user and group information from directories such as Active Directory, Microsoft Entra ID, or Okta so that policies can be written against users/groups rather than just IP addresses. Prisma Access (C) is the security enforcement point, where the identity-aware policy is evaluated and applied to traffic in the cloud-delivered security stack (e.g., URL filtering, threat prevention, and App-ID rules). The Prisma SD-WAN Controller (A) is responsible for policy distribution, pushing the user-based policy configuration down to the SD-WAN fabric so that branch and ION devices forward traffic with the correct policy context toward Prisma Access. The local ISP's routing tables (B) are irrelevant because SASE policy enforcement is independent of ISP routing, and a custom user agent on the ION device (D) is not required since identity is sourced from the Cloud Identity Engine rather than an agent on the SD-WAN device.

Answer

The local ISP's routing tables

Answer

A custom user agent installed on the ION device

Question 7

Which THREE parameters are essential when troubleshooting a Service Connection tunnel status?

Accepted Answer

Tunnel interface MTU settings. Option A is correct because the tunnel interface MTU directly affects whether encapsulated packets can traverse the Service Connection without fragmentation or drops, so mismatched or too-low MTU values are a common cause of a tunnel that shows up but passes no traffic. Option C is correct because the ION WAN port must have working public IP connectivity (reachable gateway, correct IP, and UDP 500/4500 or TCP 443 reachability to the peer) for the tunnel to establish at all. Option D is correct because IKE phase 1 and phase 2 policy settings (encryption, hashing, DH group, lifetime, and matching proposals/selectors) must align on both peers; any mismatch prevents the IPsec SA from coming up. Option B is not essential because the count of active users is a capacity/load metric and does not determine whether the tunnel itself establishes. Option E is not essential because the ION serial number is an inventory/identity detail, not a parameter that governs tunnel negotiation or data flow.

Answer

The number of users currently active

Answer

The serial number of the ION device

Question 8

Which THREE items must be configured to ensure that traffic is correctly routed through a Service Connection for security inspection?

Accepted Answer

An Application Steering policy that selects the Service Connection path. Option A is correct because an Application Steering policy is what actually directs the matching traffic into the Service Connection path so it can be inspected, rather than being sent directly to the internet. Option B is correct because Prisma Access enforces security policy on the traffic traversing the Service Connection, so a firewall rule permitting that traffic must exist or the flow will be dropped. Option C is correct because the Service Connection itself depends on a valid tunnel configuration (the IPSec tunnel between the remote network and Prisma Access) to carry the traffic to the inspection point. Option D is not needed because routing is handled by the Service Connection and steering policy, not by manual route entries on each workstation. Option E is not required because the WAN port does not need a static IP address for Service Connection traffic to be routed and inspected.

Answer

A manual route entry on every workstation

Answer

A static IP address for the WAN port

Question 9

Which THREE factors must be considered when designing a high-availability (HA) Service Connection to Prisma Access?

Accepted Answer

Properly configured path steering policies for automatic failover. Option A is correct because path steering policies (such as those based on probe-based monitoring with failover thresholds) are required for the Service Connection to automatically detect a degraded or failed path and redirect traffic to a healthy tunnel without manual intervention. Option C is correct because defining multiple Service Connection definitions that terminate at different Prisma Access POPs provides redundancy at the Prisma Access side, so if one POP or its associated infrastructure becomes unavailable, traffic can be re-routed to an alternate POP. Option E is correct because using multiple WAN transports (for example, Broadband plus LTE) ensures physical and link-layer diversity, so a failure of one ISP or transport medium does not take down the entire Service Connection. Option B is incorrect because HA design aims for automatic failover, not manual tunnel switching, which would introduce downtime and human error. Option D is incorrect because an on-premise secondary firewall is not a required factor for a Prisma Access Service Connection HA design; redundancy is achieved through multiple tunnels, POPs, and WAN transports rather than a second physical firewall.

Answer

Manual switching of tunnels in the event of failure

Answer

An on-premise secondary firewall

Question 10

Which THREE items are required to successfully deploy a new branch ION device with zero-touch provisioning for a Unified SASE environment?

Accepted Answer

The device serial number registered in the controller. Option A is correct because zero-touch provisioning requires the ION device's serial number to be pre-registered in the controller (e.g., Prisma SASE / Prisma SD-WAN controller) so the device can be authenticated and claimed automatically when it first comes online. Option B is correct because the branch device must reach the controller over the internet to receive its configuration; without WAN/internet connectivity, the zero-touch bootstrap process cannot occur. Option C is correct because a predefined policy template (or device/stack template) must be assigned to the device in the controller so that, once it authenticates, it automatically receives its intended configuration and policies. Option D is not required because zero-touch provisioning relies on DHCP or controller-delivered configuration rather than a manually pre-configured static WAN IP address. Option E is not required because the device communicates with the cloud controller over the internet, not via a physical connection to the company datacenter.

Answer

A pre-configured local IP address on the WAN port

Answer

A physical connection to the company datacenter

Question 11

Which TWO actions can be performed by the SD-WAN controller to manage SASE security policy?

Accepted Answer

Associate specific applications with security policies. Option D is correct because the SD-WAN controller can associate specific applications with security policies, allowing application-aware traffic steering and enforcement so that identified applications are matched to the appropriate security rules. Option E is correct because the controller defines security policies that are pushed to the Prisma Access nodes, enabling centralized policy management and consistent enforcement across the SASE fabric. Options A, B, and C are not SD-WAN controller SASE policy actions: resetting Active Directory passwords is a directory/identity administration task, configuring physical internal switch ports on an ION device is a local device/interface configuration, and performing firmware upgrades on the Cloud Identity Engine is a lifecycle/update operation rather than security policy management.

Answer

Manually reset user passwords in the Active Directory

Answer

Configure the physical internal switch ports of the ION device

Answer

Perform firmware upgrades on the Cloud Identity Engine

Question 12

A network engineer is deploying a new branch office with a Prisma SD-WAN ION device. The security team requires that all internet-bound traffic from the branch be inspected by Prisma Access Cloud SWG, while traffic to internal SaaS applications should use direct internet breakouts. The engineer must configure the ION to steer traffic appropriately. Which action should the engineer take to meet these requirements?

Accepted Answer

Configure application-based policy rules to direct SaaS traffic to a local breakout and all other internet traffic to the Service Connection.. The requirement is to inspect general internet traffic with Cloud SWG while allowing direct SaaS breakouts. Application-based policy rules on the ION device can identify SaaS applications and steer them to a local breakout, while all other internet traffic is sent to the Service Connection for inspection. This provides the necessary granularity and meets both security and performance goals.

Answer

Enable 'Cloud Security' on the ION device and set the default route to the Service Connection.

Answer

Set up a static route for each SaaS application's IP range pointing to the local internet circuit and a default route to the Service Connection.

Answer

Create a policy rule that matches all traffic and set the action to 'Service Connection' for the Cloud SWG.

Question 13

A network administrator is deploying a new branch with a Prisma SD-WAN ION device and wants to leverage Unified SASE for security inspection. The administrator has already configured the Service Connection to Prisma Access. Which additional step is required to ensure that traffic from the branch is inspected by Prisma Access?

Accepted Answer

Create a policy on the ION device that directs traffic to the Service Connection.. After establishing the Service Connection, the ION device must have a policy that directs specific traffic to that connection. This policy ensures that traffic is encapsulated and sent to Prisma Access for inspection. Without it, traffic will use the default internet path and bypass security inspection.

Answer

Assign a security zone to the branch ION device in Prisma Access.

Answer

Configure a security policy in Prisma Access that allows traffic from the branch.

Answer

Enable 'Unified SASE' in the Prisma SD-WAN portal for the branch site.

Question 14

A network engineer is deploying a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer wants to ensure that traffic from a specific branch is inspected by Prisma Access, but traffic to a critical internal application must bypass Prisma Access and go directly over the Prisma SD-WAN fabric. The branch has two ION devices for redundancy. Which configuration should the engineer use to achieve this?

Accepted Answer

Configure a Prisma SD-WAN policy with a destination-based rule that steers traffic for the internal application directly over the SD-WAN fabric and sends all other traffic to Prisma Access.. A Prisma SD-WAN policy with destination-based rules allows precise control over which traffic is sent to Prisma Access and which bypasses it. By matching the internal application's destination and setting the action to direct, and setting a default action to send other traffic to Prisma Access, the engineer achieves the desired split. This is more granular and maintainable than subnet-based split tunneling.

Answer

Create a Prisma Access service connection and configure a static route on the ION devices to send all traffic to Prisma Access.

Answer

Use Prisma Access Service Connection with a split-tunnel configuration on the ION devices, where the internal application subnet is excluded from the tunnel.

Answer

Enable Prisma Access Explicit Proxy on the ION devices and configure the internal application as a bypass in the proxy settings.

Question 15

A security administrator is troubleshooting a Unified SASE deployment where branch users cannot access a critical internal application hosted in an on-premises data center. The application is reachable from other sites, but branch traffic destined to the application's IP is being routed to Prisma Access instead of the data center. The ION device has a Service Connection configured to Prisma Access and a VPN connection to the data center. What is the most likely cause of this issue?

Accepted Answer

The ION device's routing table has a more specific route to the application via the Service Connection than via the VPN connection.. The ION device selects routes based on longest prefix match. If the Service Connection advertises a more specific route to the application's IP than the VPN connection, the ION will forward that traffic to Prisma Access. This misrouting prevents branch users from reaching the internal application. The administrator should verify the advertised routes from both connections and adjust route preferences or filters to ensure internal traffic uses the VPN.

Answer

The VPN connection to the data center is using a different encryption domain than the branch.

Answer

The Service Connection is down, causing all traffic to be dropped.

Answer

The application's IP is included in the local breakout policy, sending it directly to the internet.