Certified SD-WAN Engineer (SD-WAN-Engineer) (SD-WAN-Engineer) — Questions 1–75

Monitor > Network > [Device] > Control Connections is the exact vManage path showing live control connection state per device, including system IP, local colour, remote colour, and state. It satisfies the stem's requirement to check active control connections directly, unlike tunnel, interface, or alarm views that omit per-connection control-plane status.

Data center groups or service endpoints represent the destinations that branches need to reach. Defining both primary and secondary data centers in the controller allows policies to reference them and enables the fabric to steer traffic to the appropriate site. Without these definitions, the SD-WAN fabric would not know how to route branch traffic to either data center, making this a required design element.

The WAN interface configuration holds the DHCP client settings that request addresses from the upstream provider. If DHCP is disabled or the interface is set to static, the ION device never sends a request, so checking WAN interface settings first confirms whether the device is even asking for a lease.

Prisma SD-WAN uses policies to control path selection. A policy could be configured to direct specific traffic or all traffic over the secondary WAN interface, regardless of path quality. This is the most likely cause because policies take precedence over default path selection based on quality and cost.

VRF membership is bound at the interface level: assigning the subnet's interface to the target VRF places its traffic into that routing table. The stem's requirement for a unique VRF per subnet is met because interface-to-VRF mapping, not policy or prefix lists, determines forwarding separation.

Zones segment traffic by origin, letting the ION apply distinct security and routing policies per segment. This satisfies the scenario's need to differentiate handling based on where traffic enters, rather than treating all ingress identically.

Bandwidth Groups define aggregated capacity thresholds that path policies reference when selecting WAN links, satisfying the requirement to manage total available bandwidth across circuits. Rather than per-link limits, they let policies enforce admission control against combined capacity, ensuring traffic steering respects the aggregate ceiling configured for a site's paths.

Unified Logging Service aggregates traffic, threat and tunnel logs from Prisma Access and Prisma SD-WAN into one cloud repository, giving correlated visibility across the Unified SASE fabric. This satisfies the stem's need to monitor traffic flow end to end rather than per-component.

A single appropriately sized ION device at each branch terminates both the broadband and LTE transports, runs the SD-WAN overlay, and applies policy, which satisfies the fabric requirement while keeping hardware count and cost at the branch minimal. Sizing to the branch's aggregate WAN throughput avoids over-provisioning, directly meeting the stated cost constraint.

Associating applications with security policies lets the controller enforce application-aware rules centrally, satisfying the requirement to manage SASE policy by application identity rather than by IP or port. The controller distributes these mappings to edge devices, so traffic matching a defined application receives the correct inspection and forwarding treatment.

ION devices initiate outbound connections to the management plane, so a DHCP-assigned address is sufficient for ongoing reachability and monitoring. No inbound static address is required because the device maintains the tunnel from behind the dynamic WAN address. This satisfies the requirement without ISP changes.

The Top Applications dashboard displays applications sorted by bandwidth usage, allowing the engineer to quickly identify the top consumers. It provides a clear ranking of applications based on traffic volume, which directly answers the question of which application is using the most bandwidth. This is the most efficient way to pinpoint the culprit.

The ION device establishes a secure control plane connection to the Prisma SD-WAN controller over TCP port 443. This port is used for the initial registration and ongoing control communication. Ensuring outbound TCP 443 is allowed is mandatory for the device to be managed and to receive policies.

Prisma SD-WAN supports zero-touch provisioning: the site and device serial number are pre-registered in the Controller, and when the ION device powers on and reaches the internet it authenticates, claims its assigned configuration, and builds its tunnels without local intervention. This suits a remote, lightly staffed site and makes field replacement practical for non-technical personnel.

The Monitor > Network > [Device] > Tunnel path opens the tunnel dashboard for the selected vEdge, showing real-time state, uptime, latency, loss and jitter per tunnel. Other Monitor submenus cover interfaces or control connections, not tunnel statistics.

A destination-based policy matches traffic by its target address, so SaaS prefixes can be steered to a Local Breakout action that sends them directly out the branch WAN interface. This satisfies the requirement that SaaS traffic must not traverse the data centre.

The Cloud Identity Engine aggregates and maps identity sources, resolving users to the correct directory entries for policy and logging. Incorrect user attribution in security logs therefore points to a misconfigured or stale identity mapping there, rather than to the dataplane or policy layers.

Dynamic path selection continuously monitors the health of all available tunnels and automatically reroutes traffic to a backup tunnel if the primary fails. In Prisma SD-WAN, this is a core capability that ensures seamless failover between circuits. Configuring dynamic path selection with tunnel failover directly meets the requirement of switching to the LTE circuit when the primary internet circuit fails.

The device-level Control Connections view shows every controller relationship for that router, including whether the DTLS or TLS session is up and which local TLOC and color carry it. This directly answers whether all control connections are established and encrypted for that single device, which is exactly what the engineer must verify.

Access Control under Device Configuration governs administrative access to the ION device, letting you restrict which users or roles may log in and manage it. This directly satisfies the requirement to limit admin access at the device level rather than through a broader template or orchestration layer.

The ION device must be claimed in the Prisma SD-WAN portal using its serial number and assigned to a site for the controller to push configuration. If the serial number is incorrect or the device is unassigned, the controller will not send any configuration even though the control connection is up.

Hub-and-spoke concentrates branch connectivity through regional hubs, so Prisma SD-WAN delivers a single management plane and unified telemetry across all sites. It satisfies the stem by reducing operational complexity compared with managing full-mesh policy per branch.

The ION device must have a policy that matches the desired traffic and sets the action to forward it to the Prisma Access Service Connection. This is typically done via a policy-based routing rule or an application policy. Without this, traffic will follow the default route and bypass inspection.

In vManage, historical bandwidth utilisation for a site is produced under Monitor > Reports, which offers prebuilt report types including bandwidth and application usage. This satisfies the stem's requirement to generate a historical bandwidth report.

Identity-Based Security Policy in the Prisma SD-WAN Controller maps user and group identity to firewall rules, enabling identity-aware enforcement at the site. This is the correct configuration location for policies that must act on who the traffic belongs to, not just IP addresses.

The Application Dashboard in Prisma SD-WAN Orchestrator displays real-time and historical performance metrics for applications, including latency, jitter, and packet loss. It allows administrators to quickly identify if voice traffic is experiencing degradation and whether the SD-WAN fabric is applying the correct QoS policies. This dashboard is specifically designed for application-level monitoring and troubleshooting.

Flow Monitor tracks active sessions traversing the ION, showing source, destination, application, path and byte counts per flow. It does not measure path latency or jitter, which belong to Path Quality, nor device health, so its focus is live session and traffic attribute visibility.

Prisma SD-WAN can intercept branch DNS queries and proxy them to configured resolvers, letting the branch forward name resolution through the overlay rather than relying solely on local ISP DNS. This centralises resolution and enforces policy on outbound queries.

This is correct because a path selection policy with lowest-latency criteria continuously evaluates both WAN links and directs voice traffic over the best-performing path, while the failover action ensures traffic moves to the secondary link if the primary degrades. This directly satisfies the requirement for guaranteed low-latency voice routing without manual intervention.

This command displays the BFD sessions on a Cisco IOS XE SD-WAN device, including the remote system IP, color, state, and the measured latency, loss, and jitter for each tunnel. It directly provides the per-tunnel BFD detail needed to diagnose why traffic is dropping on the specific tunnel.

The Network Health Dashboard aggregates fabric-wide telemetry into a single composite score covering control, data, and transport planes, giving the at-a-glance status the stem requests. It is the vManage component purpose-built for whole-fabric health rather than per-device or per-tunnel views.

The Prisma Controller is the centralised management plane that defines and distributes security policy across all Prisma SD-WAN branches and data centres. It orchestrates fabric-wide policy, unlike the forwarding elements that merely enforce it locally.

A Service interface on an ION device connects to LAN-side services or segments, allowing local traffic to reach internal resources. It is distinct from WAN or tunnel interfaces, which handle overlay connectivity toward remote sites or cloud environments.

Prisma SD-WAN supports a multi-region controller architecture where controller clusters are deployed in different geographic regions. Each region's sites connect to their local controller cluster, reducing management latency. Policies are defined centrally and synchronized across all controllers, ensuring consistent global enforcement. This design meets both the latency and global policy requirements.

Flow Analytics in vManage provides detailed visibility into individual flows, including the path taken, the application, and the reason for path selection. It shows the actual egress interface and the policy decision, enabling the administrator to see why the less desirable link was chosen. This directly answers the need to examine per-flow path selection.

Traffic policies in Prisma SD-WAN allow you to specify a preferred path and define failover conditions based on performance metrics like latency. By setting the preferred path to MPLS and configuring a failover condition when latency exceeds 100 ms, the policy will automatically switch to broadband when the threshold is breached. This meets the requirement precisely.

A path selection policy can monitor the MPLS link and automatically redirect traffic to the broadband link if the MPLS link fails. This provides the required automatic failover without manual intervention, ensuring continuous connectivity for all traffic.

The 'Top Sites' widget on the orchestrator dashboard ranks sites by bandwidth consumption, allowing the administrator to quickly identify which sites are using the most bandwidth. This is the most direct way to see site-level bandwidth usage and address potential issues.

Policy-Based Forwarding allows the ION device to make forwarding decisions based on traffic characteristics such as source/destination IP, application, or user group. By creating a traffic policy that matches corporate subnets and steers them into the Prisma Access tunnel, while allowing guest traffic to use the local internet breakout, the engineer achieves the required segmentation without additional tunnels or complex routing. This is the intended method in Prisma SD-WAN for selective traffic redirection.

Application-defined policies allow the identification of SaaS applications like Microsoft 365. By combining these policies with local internet breakout, traffic to SaaS apps can be sent directly to the nearest PoP, improving performance. Internal data center traffic can be backhauled via separate policies. This feature directly enables the required traffic steering.

The Controller Dashboard provides live telemetry on fabric health, including tunnel status, path quality and device reachability, directly satisfying the real-time monitoring requirement during deployment. Unlike configuration or policy tools, it aggregates current operational state across all sites, letting engineers verify connectivity and performance as branches are brought online.

Checking physical interface status and WAN connectivity directly addresses the most likely cause of an ION device losing its management tunnel to the Controller: a down WAN link or failed physical port. Since the device cannot reach the Controller without underlay connectivity, verifying layer 1 and WAN reachability first isolates the fault before deeper troubleshooting.

In Prisma SD-WAN, policy rules determine how traffic is handled. To steer internet-bound traffic to Prisma Access, you must create a policy rule that matches that traffic and specifies the action to use the service connection. Without this rule, the service connection remains unused for that traffic, and it will follow the default path, bypassing Prisma Access. This step is essential for directing traffic to the security service.

Prisma SD-WAN's centralized Controller delivers a single management plane for all branches, eliminating per-device CLI configuration. This directly satisfies the stem's simplified-management benefit, since policy is defined once and pushed automatically to every site, reducing operational overhead and configuration drift across the fabric.

ZTP allows the ION to automatically discover the controller using its serial number and the LTE interface's dynamic IP. The ION initiates an outbound connection, so no inbound reachability is needed. This is the intended deployment method for dynamic WAN links and is fully supported for LTE.

Prisma SD-WAN's autonomous mesh enables dynamic, on-demand tunnels between branches for direct communication, optimizing path efficiency without a full mesh. It automatically establishes tunnels when needed, reducing overhead and improving performance for branch-to-branch traffic, which meets the requirement for efficient paths.

The Tools > Reports section in vManage allows you to create custom reports based on historical data, including application bandwidth consumption. You can specify the time range (e.g., past week), the site, and the metric (e.g., top ten applications by bandwidth). This is the correct feature to generate the required report.

The 'show interfaces' command displays detailed status for all interfaces, including WAN interfaces, showing operational state (up/down), assigned IP addresses, and packet/error counters. This directly addresses the need to check WAN link health, as counters can reveal drops or errors causing intermittent controller connectivity. It is the most direct real-time view for interface-level troubleshooting on the ION device.

Lowest Cost replaces the latency-based metric with administrator-defined cost values, so the policy selects the link with the lowest configured cost rather than the lowest measured latency. This satisfies scenarios where link expense, not performance, drives path preference.

Total bandwidth per link is required during initial site information gathering because it determines circuit sizing, overlay capacity and QoS planning. Without it, the SD-WAN design cannot allocate traffic correctly, satisfying the deployment-planning requirement for accurate link capacity data.

Flow Monitoring logs record per-flow forwarding decisions, including which policy and tunnel a flow matched, so they reveal why traffic to that internal server was dropped or misrouted. Reviewing them first pinpoints the branch-level cause before deeper troubleshooting.

Flow Analytics in Prisma SD-WAN provides detailed visibility into flows, including the policy that was applied and the path taken. By examining the specific application flow, the administrator can confirm whether the intended policy is being enforced. If the flow shows a different policy or path, it indicates a misconfiguration or shadowing, allowing the administrator to correct the policy stack or rule criteria.

A Service Connection is a logical link between a Prisma SD-WAN ION device and a Prisma Access service infrastructure that automatically creates secure tunnels for traffic steering to security services like SWG. Configuring a Service Connection allows the branch to send internet-bound traffic to Prisma Access for inspection without manual tunnel setup, exactly as required.

Defining QoS on the Prisma SD-WAN Controller's Application QoS Policy lets the controller classify and prioritise voice across all branches centrally, satisfying the consistent-performance constraint. Edge-only policies would vary per site and could not enforce uniform priority.

Support bundles and logs capture device configuration, system state and event history at the time of the fault. Engineers need this evidence to reproduce and diagnose the suspected SD-WAN bug, making it critical when opening the ticket.

The site-id is a unique numeric identifier assigned to each branch site, allowing the Prisma SD-WAN controller to distinguish sites within the fabric, map them to elements and policies, and prevent overlapping addressing across the overlay.

BFD on each tunnel combined with enhanced application-aware SLA classes continuously measures loss, latency, and jitter per transport. When a threshold is crossed, the tunnel is marked out of SLA and traffic is steered to a compliant path. This detects brownouts, not just hard failures, which is exactly what the requirement asks for on a per-transport basis.

Path policies match traffic by application signature; if the application is misidentified, the flow never matches the policy and falls through to default routing, so it exits via the wrong ISP despite the policy existing.

The Prisma SD-WAN Controller is the centralised management plane that stores and pushes configuration and policy to every ION device in the fleet. This satisfies the requirement for a single component managing policy definition across the devices.

The Controller Service Connection Status Dashboard reports tunnel state as seen by the controller, showing whether the branch ION's Service Connection to Prisma Access is up or down, which is more authoritative than local interface or routing output.

A path selection policy with latency and packet loss thresholds is essential because it defines the acceptable performance criteria for the primary link. When these thresholds are exceeded, the policy triggers failover to the secondary link, ensuring that traffic is moved based on real-time link quality.

The Event Log records significant events such as path selection changes, link up/down transitions, and policy violations. Reviewing it can reveal if the SD-WAN fabric is frequently switching paths due to link quality thresholds being crossed. This helps correlate intermittent connectivity with underlying link instability, providing valuable diagnostic context.

A path group defines a set of WAN links that can be used for traffic steering. By including both MPLS and broadband in a path group and assigning it to the data center policy, the ION will use MPLS when available and fail over to broadband if MPLS fails. This provides automatic failover based on link health.

Unified SASE converges networking and security into a single cloud-delivered platform, so one console governs both traffic forwarding and security policy. This eliminates the policy drift and duplicated administration inherent in stitching separate SD-WAN and security stacks together, delivering the consistent enforcement the architecture promises.

This command displays the OMP route table on the vSmart controller, showing all routes received from vEdges and their attributes such as originator, VPN, and path. It directly confirms whether the branch's routes were received and propagated, making it the correct tool for verifying OMP route exchange in this scenario.

The ION device uses an application signature database to identify SaaS applications. If the database is outdated, the device may fail to recognize the application, causing it to be treated as unknown and potentially blocked by a default rule. Verifying and updating the signature database is essential for accurate application-based policies.

SD-WAN continuously monitors path health and, on primary link failure, reroutes traffic over a secondary WAN link, preserving the tunnel to Prisma Access. This satisfies the resilience constraint by maintaining the Unified SASE connection without manual intervention.

The Path Trace tool in vManage Real-Time Monitoring initiates a live, hop-by-hop probe from a selected WAN Edge router to a destination, displaying each device and interface along the path with latency and loss. This directly answers the team's need to identify where latency is introduced. It uses the SD-WAN fabric's native tracing capability and works across the overlay without requiring CLI access to each hop.

When a path fails its health thresholds, the device withdraws it from forwarding and traffic falls back to the next eligible link, even if policy prefers the failed one. This explains the sub-optimal path the stem describes without any policy misconfiguration.

Packet loss is a primary factor in the Path Health score, since dropped packets directly degrade path reliability. Alongside latency and jitter, it is measured continuously per path and weighted into the composite health calculation.

A Network Policy Rule with a higher priority than the default rule will match Microsoft 365 traffic and steer it to the Service Connection, ensuring it is inspected by Prisma Access. This prevents backhauling to the data center. The default rule can then handle other traffic, allowing direct internet access or other paths as configured.

Latency is displayed in the Path Quality dashboard as a core per-path metric, measured continuously across each WAN link. It satisfies the stem's requirement, sitting alongside jitter and packet loss as the values used to judge path health.

The Tunnel view under Monitor > Network > WAN Edge displays the status of all tunnels, including BFD session state, latency, jitter, and loss. This is exactly where the administrator can verify if BFD sessions are up and if performance metrics are within acceptable thresholds for voice. It provides per-tunnel granularity, allowing correlation of BFD health with voice quality issues. Other views do not offer this combined BFD and performance detail.

ZTP allows for the automated registration and configuration of new gateways.

A custom application definition identifies the trading application traffic, and a path policy restricting it to the private WAN transport ensures it never uses public internet paths. Prisma SD-WAN path policies can specify allowed transports per application, so this design directly enforces the latency and path constraints. This is the correct way to guarantee that the application stays on the private network.