SD-WAN-Engineer Unified SASE Practice Test 5 — 15 Questions

Question 1

A security architect is designing a Unified SASE deployment where branch users must access both SaaS applications and internal data center resources. The requirement is that SaaS traffic be inspected by Prisma Access while internal traffic goes directly over the SD-WAN fabric without backhauling to the cloud. Which Prisma SD-WAN feature should be used to enforce this traffic separation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application-based policy with a service connection for internet-bound traffic and a direct path for internal prefixes.. Application-based policy in Prisma SD-WAN lets the administrator define which traffic goes to Prisma Access for inspection and which stays on the SD-WAN fabric. By steering internet-bound SaaS flows through the Service Connection and sending internal prefixes directly, the design satisfies both security inspection and no-backhaul goals. A default route or reversed policy would either backhaul internal traffic or leave SaaS uninspected.

Answer

A Cloud SWG explicit proxy configuration for SaaS traffic and a direct internet breakout for internal applications.

Answer

A single default route from the branch to Prisma Access for all traffic, including internal applications.

Answer

Policy-based forwarding that sends all RFC 1918 traffic to Prisma Access and all public traffic directly to the internet.

Question 2

A network engineer has just deployed a new ION device at a branch office. The device has successfully established its control plane connection to the Prisma SD-WAN controller. The engineer now wants to enable secure web gateway (SWG) inspection for all internet-bound traffic from this branch without manually creating tunnels. Which Prisma SD-WAN feature should the engineer configure?

Accepted Answer

Service Connection. A Service Connection is a Prisma SD-WAN construct that automates the creation of secure tunnels from an ION device to Prisma Access. When configured, it enables the branch to forward internet-bound traffic to Prisma Access for SWG inspection without manual tunnel setup. This matches the engineer's goal of enabling SWG inspection without manual intervention.

Answer

Data Center Group

Answer

Virtual Interface

Answer

Network Policy Rule

Question 3

A network engineer is deploying a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer needs to ensure that branch traffic destined for the internet is inspected by Prisma Access cloud security services, while traffic to internal data center applications goes directly over the SD-WAN fabric without inspection. Which configuration on the ION device accomplishes this?

Accepted Answer

Use a service connection with a policy that matches traffic based on application or destination and steers internet-bound traffic to the Prisma Access service connection, while internal traffic uses the direct SD-WAN path.. The ION device uses policy-based routing to direct traffic to a service connection. By defining a policy that matches internet-bound traffic and steering it to Prisma Access, while allowing internal traffic to use the direct SD-WAN path, the engineer achieves selective security inspection. This is a core capability of Unified SASE with Prisma SD-WAN, ensuring that only traffic requiring inspection is sent to the cloud security service, optimizing performance and security.

Answer

Create a policy rule that directs all traffic to the Prisma Access service connection and relies on Prisma Access to send internal traffic back over the SD-WAN.

Answer

Configure a static route on the ION device that points all traffic to the Prisma Access service connection and rely on Prisma Access to enforce security policies.

Answer

Enable the 'Secure Internet Gateway' feature on the ION device, which automatically inspects all traffic and forwards it to Prisma Access.

Question 4

An administrator is configuring a Unified SASE deployment with Prisma SD-WAN and Prisma Access. The administrator wants to verify that the service connection between the branch ION device and Prisma Access is operational and that traffic is being inspected. Which Prisma SD-WAN dashboard view should the administrator use to see the status of the service connection and the amount of traffic being sent to Prisma Access?

Accepted Answer

Monitor > Service Connections. The Monitor > Service Connections view is specifically designed to show the status and traffic statistics of service connections between ION devices and Prisma Access. It provides the necessary information to verify that the connection is operational and that traffic is being sent for inspection. Other views either focus on device health or individual flows, not the aggregated service connection status.

Answer

Monitor > Flows

Answer

Monitor > Prisma Access

Answer

Monitor > ION Health

Question 5

A network engineer is troubleshooting a Unified SASE deployment where branch users report slow access to Microsoft 365. The engineer suspects that traffic is being backhauled to a data center for security inspection instead of being sent directly to Prisma Access. The ION device has a Service Connection configured and active. Which action should the engineer take to ensure that Microsoft 365 traffic is inspected by Prisma Access while other traffic follows the default route?

Accepted Answer

Create a Network Policy Rule that matches Microsoft 365 and sets the action to 'Service Connection' with a higher priority than the default rule.. To ensure Microsoft 365 traffic is inspected by Prisma Access while other traffic follows the default route, the engineer must create a specific Network Policy Rule that matches Microsoft 365 and directs it to the Service Connection. This rule must have a higher priority than the default rule so it is evaluated first and takes precedence.

Answer

Modify the default Network Policy Rule to use the Service Connection as the primary path for all traffic.

Answer

Enable 'Direct Internet Breakout' on the ION device for Microsoft 365 traffic.

Answer

Configure a static route on the ION device for Microsoft 365 IP ranges pointing to the Service Connection.

Question 6

A network security administrator is configuring Prisma Access to integrate with Prisma SD-WAN for Unified SASE. The administrator needs to ensure that security logs from Prisma Access can be correlated with traffic logs from Prisma SD-WAN to troubleshoot an incident. Which configuration is required to enable this correlation?

Accepted Answer

Enable the Prisma SD-WAN CloudBlade for Prisma Access and ensure that the same tenant and correlation ID are used.. Log correlation between Prisma Access and Prisma SD-WAN is achieved through the CloudBlade integration, which shares a tenant and uses a correlation ID. This identifier is included in logs from both systems, enabling a unified view for troubleshooting. Simply forwarding logs to the same destination or enabling user identification does not provide the necessary linkage.

Answer

Enable User-ID and IP-tagging in Prisma Access and Prisma SD-WAN.

Answer

Configure the same log forwarding destination for both Prisma Access and Prisma SD-WAN.

Answer

Configure a shared service connection and enable logging on the ION devices.

Question 7

A security administrator is troubleshooting a Unified SASE deployment where branch users cannot access a cloud-based CRM application. The traffic is being steered to Prisma Access for inspection, but users report timeouts. The administrator checks the ION device and sees that the service connection to Prisma Access is up, and the CRM application is allowed in the security policy. What is the most likely cause of the issue?

Accepted Answer

The return traffic from the CRM application is not being routed back through the same Prisma Access location, causing asymmetric routing.. The most likely cause is asymmetric routing of return traffic. In a Unified SASE architecture, traffic steered to Prisma Access must have its return traffic follow the same path to ensure stateful inspection. If the CRM application's return traffic takes a different route, the session may be dropped. This is a common pitfall when integrating cloud security services with SD-WAN. The administrator should verify that return traffic is also directed through Prisma Access, possibly by ensuring that the CRM's IP addresses are advertised or routed appropriately.

Answer

The ION device's service connection is using an outdated encryption algorithm that Prisma Access no longer supports.

Answer

The ION device's policy for the CRM application is incorrectly matching and sending traffic to the direct internet path instead of the service connection.

Answer

The Prisma Access security policy is blocking the CRM application due to a misconfigured rule or application signature.

Question 8

A network architect is designing a Unified SASE solution for a company with multiple branches. The company wants to ensure that all internet-bound traffic from branches is inspected by Cloud SWG, while traffic to internal applications is routed through a data center. The architect plans to use Prisma SD-WAN with Service Connections to Prisma Access. Which configuration approach should the architect recommend to meet these requirements?

Accepted Answer

Configure a Service Connection on each ION device and create Network Policy Rules that direct internet-bound traffic to the Service Connection, while internal traffic follows a default route to the data center.. The recommended approach is to configure Service Connections on each ION device and create Network Policy Rules that match internet-bound traffic and direct it to the Service Connection. Internal traffic can follow the default route to the data center. This provides Cloud SWG inspection for internet traffic while maintaining efficient routing for internal applications, leveraging the distributed security of Prisma Access.

Answer

Configure Service Connections on each ION device and set the default route to use the Service Connection for all traffic.

Answer

Configure Service Connections on each ION device and use BGP to advertise routes to Prisma Access, ensuring all traffic is inspected.

Answer

Configure a single Service Connection at the data center and backhaul all branch internet traffic to the data center for inspection.

Question 9

A company is deploying Unified SASE with Prisma SD-WAN and Prisma Access. The security team wants to ensure that traffic from branch ION devices is inspected by Prisma Access and that security logs from both products are correlated for unified reporting. Which TWO actions are required to achieve this integration? (Choose two.)

Accepted Answer

Enable the same Prisma Access tenant and Prisma SD-WAN tenant in the same Unified SASE portal.. To integrate Prisma SD-WAN with Prisma Access for Unified SASE, the branch ION device must have a Service Connection to Prisma Access, and both products must be managed in the same tenant or unified portal. These two actions enable traffic inspection and log correlation. GRE tunnels, explicit proxies, or manual log import do not provide the required integrated behavior.

Answer

Configure a GRE tunnel between the ION device and the Prisma Access service infrastructure.

Answer

Manually export Prisma Access logs and import them into the Prisma SD-WAN controller.

Answer

Deploy a Cloud SWG explicit proxy at the branch and point all traffic to it.

Question 10

A security architect is designing a Unified SASE deployment where branch users must access both SaaS applications and internal data center resources. The requirement is that SaaS traffic be inspected by Prisma Access while internal traffic goes directly over the SD-WAN fabric without backhauling to the cloud. Which Prisma SD-WAN feature should be used to enforce this traffic separation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A single-pass parallel processing engine that combines networking and security functions in one cloud-delivered platform.. Unified SASE merges SD-WAN with cloud-delivered security services into a single platform, using a shared policy engine and single-pass processing. This architecture eliminates separate management consoles and ensures consistent enforcement for internet-bound and private application traffic. The other options describe point solutions or traditional models that do not achieve the required consolidation of networking and security.

Answer

A centralized logging server that aggregates syslog messages from all branch devices for compliance reporting.

Answer

An overlay routing protocol that automatically selects the best path based on real-time link quality metrics.

Answer

A dedicated physical firewall appliance deployed at each branch that forwards traffic to a central data center for inspection.

Question 11

A network engineer is configuring a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer wants to ensure that traffic from a specific branch is inspected by Prisma Access, but also wants to avoid sending traffic to Prisma Access for destinations that are reachable via a direct SD-WAN path to the data center. Which Prisma SD-WAN feature allows the engineer to define which traffic should be sent to Prisma Access?

Accepted Answer

Policy Sets. Policy Sets are the correct feature. In Prisma SD-WAN, policy sets are applied to ION devices and contain rules that match traffic and define actions, including steering to a service connection. By creating a policy set with a rule that matches internet-bound traffic and steers it to the Prisma Access service connection, and another rule that allows data center traffic to use the direct path, the engineer achieves the desired behavior. This is the standard method for traffic engineering in Unified SASE.

Answer

Application Definition

Answer

Service Connection Groups

Answer

WAN Interface Profiles

Question 12

A network engineer is troubleshooting a Unified SASE deployment where branch users report that access to internal applications is slow after enabling Prisma Access inspection. The engineer confirms that internal traffic is being sent to Prisma Access instead of directly over the SD-WAN fabric. Which configuration change should the engineer make to resolve the issue?

Accepted Answer

Modify the application-based policy to send internal application prefixes over a direct SD-WAN path instead of the Service Connection.. The slowness is caused by internal traffic being backhauled to Prisma Access for inspection. The correct fix is to adjust the application-based policy so that internal application prefixes are matched and sent over a direct SD-WAN path, while internet-bound traffic continues to use the Service Connection. Bandwidth increases, disabling path selection, or static routes to Prisma Access do not correct the misrouting.

Answer

Increase the bandwidth of the ISP link used by the Service Connection to Prisma Access.

Answer

Disable Dynamic Path Selection on the Service Connection to force traffic over a single path.

Answer

Configure a static route on the ION device that points internal prefixes to the Prisma Access tunnel.

Question 13

A network administrator is configuring a Service Connection between a branch ION device and Prisma Access. The administrator wants to ensure that all traffic from the branch to the internet is inspected by the cloud SWG, while traffic to private applications goes directly over the VPN. Which configuration element on the ION device is used to define which traffic is sent to the Service Connection?

Accepted Answer

Policy rules that match traffic based on application, domain, or IP address and specify the Service Connection as the path.. Policy rules on the ION device are used to classify traffic and direct it to the appropriate path, such as the Service Connection for internet-bound traffic or the VPN for private applications. This allows granular control based on application, domain, or IP. Static routes, QoS, and NAT do not provide the selective steering needed to meet the requirement.

Answer

Static routes configured on the ION device that point all default traffic to the Service Connection tunnel interface.

Answer

NAT rules that translate branch IP addresses to a public IP before sending traffic to the Service Connection.

Answer

QoS profiles that prioritize traffic based on application type and assign it to the Service Connection.

Question 14

An administrator is deploying Prisma SD-WAN with Unified SASE. The administrator needs to ensure that the ION device can establish a service connection to Prisma Access. Which of the following must be configured on the ION device to allow the service connection to be established?

Accepted Answer

A service connection with the Prisma Access tenant information and a public IP address or NAT traversal.. The essential configuration on the ION device for a service connection is the Prisma Access tenant information and ensuring the device can reach Prisma Access, which requires a public IP or NAT traversal. These elements enable the IPsec tunnel to be established. Other items like static routes or firewall rules are either not required or are configured on other devices. Therefore, the correct answer is the one that includes tenant information and reachability.

Answer

A static route to the Prisma Access service IP and a DNS server for name resolution.

Answer

A firewall rule allowing IPsec traffic and a NAT policy for outbound traffic.

Answer

An IKEv2 pre-shared key and a certificate for authentication.

Question 15

A network engineer is deploying a new branch office with a Prisma SD-WAN ION device. The branch requires direct internet access for guest users, but corporate traffic must be inspected by Prisma Access. The engineer wants to minimize configuration overhead and ensure that only corporate traffic is redirected to Prisma Access while guest traffic goes directly to the internet. Which feature should the engineer configure on the ION device to achieve this?

Accepted Answer

Policy-Based Forwarding (PBF) with a traffic policy that matches corporate subnets and directs them to the Prisma Access tunnel.. The requirement is to selectively redirect only corporate traffic to Prisma Access while allowing guest traffic direct internet access. Policy-Based Forwarding (PBF) on the ION device enables matching traffic by subnet or other criteria and steering it into the Prisma Access tunnel. This provides granular control without affecting guest traffic, and it is the standard method in Prisma SD-WAN for traffic engineering to Prisma Access.

Answer

Enable split tunneling on the ION device and configure the Prisma Access tunnel as the default route.

Answer

Create a virtual interface for guest traffic and bind it to a separate WAN interface, then route corporate traffic through the Prisma Access tunnel using OSPF.

Answer

Configure a static route on the ION device that points all traffic to the Prisma Access tunnel, and use NAT to exempt guest traffic.