175 questions total · 3pages · All types, answers revealed
Page 3 of 3
When troubleshooting QoS, what does a high 'drop' count in the interface statistics imply?
Drops occur when traffic exceeds the shaping rate.
Why this answer
High drop counts indicate that the interface is congested and exceeding the configured bandwidth limit.
Which THREE components are verified during the ION device 'check' sequence at startup?
Verifies physical connectivity.
Why this answer
The startup sequence checks physical links, controller reachability, and basic configuration integrity.
You want to audit who changed a policy on the Controller. Where is this information logged?
Audit logs track administrative actions.
Why this answer
The Audit logs record all administrative actions, including policy changes.
Which THREE types of traffic are commonly categorized for specific QoS treatment?
Business-priority traffic.
Why this answer
QoS focuses on real-time and business-critical traffic.
What is the primary benefit of enabling 'Forward Error Correction' (FEC) on a high-latency WAN link?
FEC helps recover lost packets, crucial for voice/video.
Why this answer
FEC adds redundant data to packets, allowing the receiver to reconstruct lost packets without retransmission.
You are designing an SD-WAN path for a high-bandwidth application that is sensitive to out-of-order packets. Which configuration setting minimizes packet reordering in a multi-path environment?
Flow-based balancing keeps all packets of a session on one path, preventing reordering.
Why this answer
Enabling session affinity or path steering policies that restrict traffic to a single path avoids reordering issues common in multi-path load balancing.
During the design of a large-scale data center migration, you need to extend Layer 2 domains across the SD-WAN fabric. Which mechanism supports this requirement?
L2VPN functionality allows bridging segments across the fabric.
Why this answer
Prisma SD-WAN supports L2 extension through encapsulation over the SD-WAN overlay.
You are deploying Cloud Identity Engine (CIE) to enable identity-based security policies across your SD-WAN and SASE environment. Which configuration step is required to ensure that user identity information is successfully propagated from the enterprise directory to the Prisma Access security nodes?
The connection between Prisma Access and CIE is established via API credentials for identity mapping.
Why this answer
CIE acts as a central identity provider that synchronizes with the directory and pushes identity context to the SASE components.
Which THREE actions occur when a device transitions to 'Active' status in an HA pair?
BFD must re-establish to verify path health.
Why this answer
The transition triggers BFD, OMP advertisement, and interface reactivation.
A user is complaining about high latency for a SaaS app. The Path Quality dashboard shows low latency. What is the next logical step?
Internal network issues are the most likely culprit if WAN paths are healthy.
Why this answer
If the WAN path is healthy, the latency might be internal to the LAN or at the application server level.
You have configured two different DCI paths. You want to load balance traffic across both paths. What OMP configuration must be set?
To achieve load balancing, the routing attributes must be identical.
Why this answer
Equal cost multi-path (ECMP) requires identical OMP attributes.
Which TWO methods can be used to identify traffic for a policy?
Standard L3/L4 classification.
Why this answer
Traffic can be identified by application or by IP/port-based rules.
When troubleshooting a site-to-site VPN issue between two ION devices, which status should you check first?
The orchestrator provides the status of the overlay tunnels between nodes.
Why this answer
The tunnel status in the orchestrator reveals if the overlay tunnel is up.
Which THREE components are involved in the process of applying a user-based policy in a Unified SASE architecture?
The controller pushes policies to the edge.
Why this answer
Identity synchronization, local enforcement, and cloud policy enforcement work together.
When configuring 'NAT', what is the difference between 'Source NAT' and 'Destination NAT'?
Correct definitions of NAT types.
Why this answer
Source NAT modifies the source IP for outbound traffic; Destination NAT modifies the destination IP for inbound traffic.
Which TWO features are used to monitor the performance of an application across the SD-WAN?
Tracks latency/loss of the tunnel.
Why this answer
Performance monitoring uses traffic flow data and path statistics.
Which of the following are components of the Prisma SD-WAN Controller interface? (Choose TWO)
Main landing page.
Why this answer
The dashboard and the monitoring sections are standard components of the Controller GUI.
You are configuring a branch site with a dual-ISP setup. What is the correct order of operations for defining transport interfaces?
Transport types must be mapped to specific interfaces for the SD-WAN overlay to function.
Why this answer
Interfaces must be defined in the inventory, then assigned as transport in the site configuration.
When performing a 'Soft Shutdown' on an HA device, what is the expected behavior?
Soft shutdown is designed to prevent traffic loss by shifting the active role.
Why this answer
A soft shutdown allows the active unit to relinquish its role gracefully to the standby unit.
Which THREE items are required to successfully deploy a new branch ION device with zero-touch provisioning for a Unified SASE environment?
The controller must know to expect the device.
Why this answer
ZTP requires internet, registration, and initial policy pull.
An administrator wants to limit the bandwidth used by a specific application when routed to Prisma Access. Where is this configured?
Application policy allows defining bandwidth limits on specific paths.
Why this answer
Traffic shaping policies on the ION device allow for bandwidth limits on specific applications.
You are troubleshooting a performance issue where traffic is not taking the preferred path. Which tool in the Controller helps you visualize the path taken?
Flow monitoring provides deep visibility into the path and policy enforcement.
Why this answer
The path visualization tool displays the real-time path selected by the SD-WAN engine.
A company is migrating to a cloud-native architecture. How does Prisma SD-WAN support multi-cloud connectivity?
vGateways extend the SD-WAN fabric into cloud environments.
Why this answer
Through CloudBlades and virtual gateways (vGateways) deployed in public cloud VPCs/VNets.
An administrator needs to exclude specific traffic from being inspected by Prisma Access in a Unified SASE environment. Where is this defined?
The steering policy dictates the path, which determines whether traffic is sent to the cloud.
Why this answer
This is defined in the Application Steering Policy by selecting a different path (e.g., direct internet) for the specific app.
Where are the primary SD-WAN routing policies defined?
The Controller is the central location for policy management.
Why this answer
Policies are defined centrally in the Controller and pushed to the edge devices.
Page 3 of 3
Practice SD-WAN-Engineer by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →