Certified SD-WAN Engineer (SD-WAN-Engineer) (SD-WAN-Engineer) — Questions 151–225

The Tunnels screen displays the status of data plane tunnels (such as IPsec) between vEdges, including whether they are up and the source/destination. Checking this screen confirms that the data plane is operational and that tunnels have been established after the upgrade.

Application-based policy allows the engineer to classify traffic by application or destination and steer it accordingly. Internet-bound SaaS flows can be sent through the Service Connection to Prisma Access for inspection, while internal data center prefixes use a direct SD-WAN path. This meets both inspection and no-backhaul requirements.

Audit Logs record every configuration change pushed to an ION device, including who made it and when. This directly satisfies the requirement to view configuration change history, unlike operational or security logs which capture traffic and threat events rather than orchestration actions.

For automatic failover, WAN Edge devices must know the IP addresses of all vSmart controllers in the domain. They are typically configured with the vBond address, which provides the list of vSmart controllers. The WAN Edge then establishes control connections to multiple vSmarts. If one fails, the WAN Edge can use the remaining connection, ensuring continuous control plane operation without manual intervention.

The App Route view displays the application-aware routing decisions for each flow, including the chosen path, the available paths, and the policy criteria that matched. It shows which SLA class or preference was applied and why a particular TLOC was selected. This is exactly the view needed to diagnose why broadband was not chosen despite the policy intent.

Peak-hour packet loss signals that demand exceeds the transport's committed capacity, forcing buffers to overflow and drop traffic. Because the loss correlates with the busiest period rather than occurring randomly, it directly evidences oversubscription of the WAN circuit.

With LAN traffic unaffected, the fault lies at the WAN edge, so verify the ISP handoff, physical WAN interface state and IP addressing first. This isolates the boundary the stem describes: local switching works, but the uplink to the provider does not.

Automation replaces repetitive CLI entry with templated provisioning, eliminating transcription mistakes across sites. This directly satisfies the stem's demand for reduced manual configuration steps and lower error risk, since each hand-typed tunnel parameter is a potential misconfiguration. Manual configuration cannot match this consistency at scale.

This is a common issue in Unified SASE deployments. When traffic is steered to Prisma Access, the return traffic must also traverse the same Prisma Access location to maintain stateful inspection. If the CRM application's servers are reachable via multiple paths, return traffic might take a different route, leading to asymmetric routing and dropped sessions. This would cause timeouts even though the service connection is up and the policy allows the application.

QoS policies with guaranteed bandwidth ensure voice traffic receives priority, while a traffic shaper limits bulk data to prevent oversubscription. Prisma SD-WAN supports QoS classes and shaping on transport interfaces. This combination directly addresses the requirements for priority and link utilization, making it the correct design choice for constrained regions.

Prisma SD-WAN's Controller automates IPSec tunnel provisioning to Prisma Access, removing manual configuration of peer addresses and keys. This satisfies the stem's requirement for how the secure tunnel is established between the branch and Prisma Access, using the Controller's orchestration rather than static, hand-built tunnels.

Prisma SD-WAN policy allows a branch to prefer one data center site over another for a given traffic class, with automatic use of the backup when the preferred site is unreachable. This directly encodes the stated primary-then-secondary behavior and lets the fabric react to loss of the primary without manual intervention.

Prisma Access gateways terminate the IPsec tunnels that carry the Service Connection, so the on-premises device must know their public IP addresses or FQDNs to initiate IKE. Without these endpoints, tunnel establishment cannot begin, satisfying the stem's requirement for a successful Service Connection.

Policy Sets in Prisma SD-WAN contain ordered rules that match traffic based on criteria such as application, source, destination, and then apply actions like steering to a service connection. By configuring a policy set, the engineer can specify that certain traffic (e.g., internet-bound) is sent to Prisma Access, while other traffic (e.g., to data center subnets) uses the direct SD-WAN path. This is the correct feature for controlling traffic flow.

WAN Edge routers maintain a local copy of OMP routes and policies received from vSmart. If the vSmart connection fails, they continue forwarding based on this cached information while attempting to establish a control connection to another vSmart controller. This ensures data plane continuity and is the correct description of the failover behavior.

Enabling SNMP traps for specific OIDs and configuring the trap receiver allows the WAN Edge device to send asynchronous notifications for events like BFD session state changes and control connection status. This complements syslog and provides another channel for proactive monitoring. The trap receiver must be configured with the correct community string and destination to receive these alerts. Without this, SNMP-based monitoring would miss critical events.

Alarm Notifications under Administration allows the engineer to configure alarm rules, including conditions such as control connection loss, and set thresholds and notification methods (email, SNMP trap, syslog). This directly meets the requirement to receive alerts when a WAN Edge device loses its vSmart connection for more than five minutes. It is the correct place to define and manage proactive alerts for fabric health.

Policy sets that permit only required industrial protocols between zones enforce least-privilege segmentation and prevent unauthorized corporate access to industrial systems. This aligns with the isolation goal and avoids Layer 2 extension by operating at Layer 3/L4. Combined with zones, this design element provides the necessary security and segmentation for the factories.

QoS policies classify and mark voice traffic with high priority (e.g., EF) and place it in a low-latency queue. This ensures that voice packets are transmitted before bulk data, reducing delay and jitter. It is a fundamental design element for prioritizing real-time traffic.

This command displays the routes known to the SD-WAN fabric, including those advertised by the local device and those learned from other sites. It provides a clear view of the fabric's routing table, allowing the engineer to verify whether the branch's subnet is being advertised correctly and whether data center routes are being received.

The ION serial number uniquely identifies each device during onboarding to Prisma Access, binding it to the correct tenant and enabling policy assignment. Without this unique identifier, the controller cannot authenticate the specific device or push the appropriate configuration, satisfying the deployment's requirement for secure, per-device provisioning.

The Tunnel monitoring view provides real-time and historical statistics for each tunnel, including latency, jitter, packet loss, and bandwidth utilization. This directly addresses the engineer's need to determine whether the slow SaaS access is caused by transport latency or packet loss. It is the correct view for per-tunnel performance verification.

Prisma SD-WAN policy-based path selection monitors transport quality against configured thresholds for latency, jitter, and loss, and automatically shifts traffic to the secondary transport when the primary degrades. This directly delivers the automatic, quality-driven failover the design requires without manual intervention.

A Template is a reusable configuration baseline that stores standard settings applied across many sites, ensuring consistent policy and reducing per-site manual effort. This matches the scenario's need to define shared configuration centrally within the SD-WAN Controller.

Path Quality displays real-time per-path latency, jitter and loss for each WAN circuit, directly matching the intermittent slowness investigation. Flow Monitor and event logs show sessions or alarms rather than live path performance metrics, so Path Quality isolates which link degrades.

The Cloud Identity Engine maps IP addresses to user identities, enabling user-based policy enforcement where traffic lacks native identity. This satisfies the requirement to apply identity-aware rules to traffic originating from unmanaged or shared endpoints.

ZTP allows the ION device to automatically connect to the Prisma SD-WAN controller using a pre-shared claim code, download its configuration, and establish tunnels without manual CLI input. This is the standard deployment method for branch devices and satisfies the requirement for automatic secure tunnel establishment.

ICMP Destination Unreachable is generated when a packet is administratively blocked, which is the action a Security Policy takes on the ION device; routing or QoS policies would drop or reclassify traffic without returning that ICMP error.

This policy directly addresses the requirement: it identifies data center traffic, prioritizes MPLS as the primary path, and designates broadband as the backup with IPsec encryption. This ensures that data center traffic uses MPLS normally and securely fails over to broadband when MPLS fails, meeting both routing and security needs.

Administrative roles are partitionable because Prisma SD-WAN's multi-tenant model scopes role-based access control assignments to a specific tenant, so an administrator granted privileges in one tenant cannot view or manage another tenant's sites, policies or devices. This satisfies the stem's isolation constraint, keeping each tenant's administrative authority separate.

Path performance continuously measures latency, jitter and packet loss across available WAN paths, letting the policy steer VoIP flows onto the healthiest link. Voice quality depends on these real-time characteristics rather than static attributes, so this metric directly satisfies the prioritisation requirement.

SaaS application traffic is steered to Prisma Access because inline security inspection requires the cloud service to broker sessions to sanctioned SaaS providers. This satisfies the stem's Unified SASE constraint, where Prisma Access enforces tenant-aware policy and data-loss prevention on SaaS flows that direct internet breakout cannot inspect.

BFD and data-plane tunnel state reflect the actual forwarding path between TLOCs. If OMP peerings are up but tunnels are down, the problem lives in the data plane, such as keys, ports, or reachability. This cleanly separates a tunnel failure from an OMP or policy issue, which is the isolation the engineer needs.

The Prisma SD-WAN Controller continuously monitors path quality, including latency, jitter, and packet loss, for each WAN link. By examining these metrics, the engineer can determine if the high latency is observed across the entire path or only on the ION device. If the controller also reports high latency, it indicates an ISP or path issue; if the controller reports normal latency, the problem may be local to the device or its measurement.

QoS Policy governs bandwidth allocation and prioritisation between traffic classes, letting POS traffic receive guaranteed treatment over guest WiFi. It operates on queues and scheduling, directly satisfying the retail requirement to prioritise POS above guest traffic.

The flow diagnostic tool traces the actual forwarding decision hop by hop, exposing which path-selection rule matched and why the branch traffic diverted from the optimal Prisma Access path. It reads the live policy evaluation rather than inferring it from configuration, directly satisfying the need to verify path selection logic.

WAN interface settings define the physical and logical uplink configuration — IP addressing, VLAN tagging and bandwidth — that the ION appliance needs before it can establish overlay tunnels to the SD-WAN controller. Without these, the device cannot reach the orchestrator, so they are provisioned at initial site setup.

Service-to-Tunnel Mapping defines which tunnel carries traffic for each CSSP service, so incorrect mapping sends traffic down the wrong path or bypasses inspection. Verifying it ensures proper redirection of traffic to the cloud security service provider.

Path quality monitoring continuously measures latency, jitter, and packet loss on each WAN interface. When the configured threshold is exceeded, the ION device immediately redirects traffic to the alternate path without waiting for BGP or other routing protocol convergence. This provides sub-five-second failover, which is exactly what the retail branch design requires. The threshold must be tuned low enough to detect degradation quickly, but not so low that transient spikes cause unnecessary flapping.

The controller maintains the SD-WAN control plane, distributing fabric topology, policy and tunnel information to branches. It satisfies the stem's control-plane requirement because elements and sites rely on the controller for orchestration and reachability signalling, rather than forwarding user traffic themselves.

In Prisma SD-WAN, routing decisions are based on longest prefix match. If the Service Connection advertises a more specific route to the application's IP than the VPN connection, the ION will prefer that path. This would cause internal traffic to be sent to Prisma Access instead of the data center VPN, explaining why users cannot reach the application despite it being reachable from other sites.

Using the 4G/LTE modem as a secondary WAN interface with path quality monitoring allows the ION device to detect broadband failure and automatically fail over to the cellular link. Failover rules based on path quality ensure that cloud application traffic continues without manual intervention, meeting the requirement for continuous connectivity.

A packet capture exposes the actual traffic on the wire, letting you confirm whether the flow's payload matches a known application signature or is being misclassified. This directly satisfies the need to troubleshoot why the engine fails to identify an application correctly.

Dynamic ISP circuits require the WAN interface to use DHCP so it can receive the current public address. Applying the correct WAN label allows the controller to recognize the interface role and build tunnels properly. Together, DHCP addressing and the correct label ensure the ION device can register and establish SD-WAN tunnels even when the public IP changes.

Source NAT translates the private source IP addresses of the local subnet to the public WAN IP, allowing outbound internet access. This is the standard configuration for hiding internal addresses behind a single public IP, and it matches the requirement to translate all traffic from the local subnet.

Public Internet broadband is an underlay transport: it provides the physical IP reachability that Prisma SD-WAN overlays tunnels across. The stem asks which resources form the underlay, and broadband circuits supply the raw connectivity beneath the fabric, independent of any overlay policy.

Defining a transport interface for each ISP circuit provides the underlay paths, and a policy set that sends guest traffic directly to the internet enables local breakout. Corporate traffic can be steered over the VPN overlay by a separate policy. This combination is the standard Prisma SD-WAN approach for supporting guest breakout while keeping corporate traffic on the overlay.

The Device Health Dashboard surfaces per-device reachability, control-plane status and resource utilisation, so failed or degraded edges are spotted immediately. This satisfies the daily operational health check by confirming every node in the SD-WAN fabric is up and functioning.

Application objects are reusable definitions identifying traffic by signature, port or IP, and security policies reference them as match criteria. They satisfy the stem's configuration requirement because rules cannot target specific applications without these objects, which feed directly into policy construction.

The SD-WAN Controller requires the site's management IP address to establish the control-plane tunnel used for orchestrating policy and forwarding decisions. This satisfies the stem's requirement for controller configuration, since reachability to the device's management interface is mandatory before the controller can push configuration or manage the site.

Application Policy defines how the SD-WAN edge classifies and handles traffic, including bypass actions that exclude flows from optimisation. Updating it lets you exempt the legacy application's traffic from the optimisation process, satisfying the compatibility constraint in the stem.

The command 'show control connections' on a vEdge displays the status of control plane connections to vSmart controllers, including whether they are up or down, the remote system IP, and the local/remote IP addresses. It directly helps diagnose why vManage might see the device as unreachable, as vManage relies on control plane connectivity.

The Tunnel Health dashboard in vManage displays BFD session status, latency, jitter, and packet loss for each tunnel. This directly indicates whether packet loss is occurring within the overlay tunnel. By comparing tunnel health across different tunnels, you can determine if the issue is specific to one tunnel or the underlay.

The Controller orchestrates zero-touch provisioning: on first boot the ION device authenticates to the Controller, which pushes the assigned configuration and software, bringing the device online without manual intervention. This satisfies the requirement to initiate provisioning automatically during deployment.

The system.log records detailed interface state transitions, including link up/down events and the underlying causes of WAN interface flapping, such as physical layer errors or keepalive timeouts. It satisfies the stem's requirement for the most detailed diagnostic information, offering greater granularity than event or alarm logs.

Verifying the interface IP address and subnet mask confirms the host's Layer 3 addressing matches the gateway's subnet. This satisfies the stem by ruling out misaddressing or an incorrect mask that would prevent the site reaching its local LAN gateway.

The Path Selection Policy defines the algorithm—such as weighted, percentage-based, or best-path—used to distribute traffic across active WAN links. With both ISPs up, this policy governs how flows are balanced, so it is the setting to inspect when load-balancing fails.

Application Steering policies define which traffic classes are redirected into the Service Connection rather than sent direct to the internet. Without a steering policy matching the target applications, traffic bypasses the tunnel entirely, so no security inspection occurs.

The Control Plane Health widget displays the status of control connections between vSmart controllers and WAN Edge devices. It is critical for daily health checks because it quickly identifies if any control plane disruptions could affect routing and policy enforcement. A healthy control plane ensures that OMP routes and policies are propagated correctly, which is foundational for SD-WAN operations.

VRFs are isolated routing tables, so routes and traffic never leak between them by default. Inter-VRF routing policies explicitly permit and direct traffic from one VRF into another, which is the required configuration for cross-VRF communication.

Integrating with the existing corporate identity provider lets the fabric consume user and group information and apply policy based on identity without placing an identity appliance at every branch. This satisfies the requirement for centralized authentication context while keeping branch hardware and management footprint small, which is the stated design constraint.

When vManage pushes a configuration or policy change, the device must receive and apply it to reach the intended state. If the change is pending, rejected, or failed to apply, the device reports out of sync. Verifying whether a pending change has been applied is therefore a correct troubleshooting condition.

Performance Routing (PFR) Policy continuously measures path quality metrics such as latency, jitter and packet loss across multiple transports, then steers real-time traffic onto the best-performing path. This satisfies the sub-second failover requirement by reacting to degradation before sessions break.

Prisma SD-WAN ION devices establish secure tunnels to Prisma Access using IPsec. This protocol provides encryption and authentication for the traffic traversing the public internet between the branch and the Prisma Access service infrastructure. IPsec is the standard for site-to-cloud tunnels in Unified SASE deployments, ensuring confidentiality and integrity of data in transit.

Unified SASE integrates SD-WAN and security services (such as SWG, CASB, ZTNA, and FWaaS) into a single cloud platform. This consolidation allows administrators to define and enforce consistent policies across all locations and users from a central console, reducing the need to manage separate networking and security appliances. For a retail company with many branches, this greatly simplifies operations and ensures uniform security posture.

Prisma SD-WAN path selection policies allow you to specify a preferred path and a fallback path based on path quality metrics. By setting MPLS as preferred for voice traffic and configuring a latency threshold of 150 ms, the ION device will monitor MPLS latency and automatically switch voice traffic to the internet path when the threshold is exceeded. This exactly meets the requirement of using MPLS normally and failing over to internet only on high latency.

Application objects match traffic using deep packet inspection against application signatures, so policies can allow or block specific applications regardless of the port they use. This satisfies the requirement to identify traffic beyond port-based rules, which port-only policies cannot achieve.

QoS configuration on the ION device determines how traffic is classified and prioritized. If VoIP traffic is not being marked or mapped to the appropriate queue, it may not receive the necessary priority, leading to jitter even if the WAN link is good. Checking the QoS configuration ensures that the traffic is correctly identified and placed in a low-latency queue, which is crucial for real-time applications like VoIP.

Prisma SD-WAN supports custom topologies where you can define which sites are hubs and which are spokes, and then use policy rules to control path selection. By defining regional hubs and creating policies that force inter-region traffic through the hub while allowing intra-region direct tunnels, you meet both the direct tunnel and security inspection requirements. This is the most flexible and accurate way to achieve the desired traffic flow.

Application/Flow Monitoring aggregates per-application and per-flow byte counters, exposing which hosts or applications consume the most bandwidth. This directly satisfies the stem's need to rank top consumers, unlike interface-level or device-health dashboards that show only aggregate link utilisation.

Reachability actively probes the WAN interface and its upstream next-hop to confirm the ISP link is up and forwarding traffic, not merely cabled. This satisfies the stem's requirement to validate the underlying transport before overlay tunnels or policy decisions are trusted.

Automated tunnel configuration satisfies the requirement for secure connectivity between the SD-WAN edge and the cloud security service. CloudBlade provisioning dynamically establishes the overlay tunnels to the provider's points of presence, removing manual IPsec setup. This mechanism is mandatory because traffic must be steered through the security service before reaching the internet.

If the ION device lacks a DNS server or has an incorrect DNS configuration, it cannot resolve the controller's FQDN. Without resolution, the device cannot initiate the control connection, even if basic IP connectivity exists. This is a common oversight during deployment.

This approach uses Service Connections to steer internet-bound traffic to Prisma Access for Cloud SWG inspection, while internal traffic is routed to the data center via the default route. It meets the requirements by selectively directing traffic based on destination, ensuring security inspection for internet traffic and efficient routing for internal applications.

Path selection is a policy action: Prisma SD-WAN policies evaluate traffic against match criteria and steer it across the best available WAN path. It satisfies the stem's action requirement because the policy object actively chooses the egress path rather than merely classifying or logging traffic.