Certified SD-WAN Engineer (SD-WAN-Engineer) (SD-WAN-Engineer) — Questions 226–300

The Monitor > Applications section in vManage provides detailed application performance and path quality metrics, including latency, jitter, packet loss, and application-specific data. This is the correct location to monitor real-time application experience and path health for a site, as it aggregates data from the Application Aware Routing engine.

A virtual ION instance on existing branch compute minimizes hardware footprint and central management overhead while still supporting dual broadband and cellular failover through a supported external modem. Prisma SD-WAN allows virtual ION deployment on compatible hypervisors, and the cellular link can be integrated as a transport, meeting the design goals without adding a full physical appliance at each site.

The Policy Browser in Prisma SD-WAN Orchestrator allows engineers to view the effective network, security, and path policies applied to a specific site or device. It shows how policies are evaluated and which rules match, including path selection based on VPN overlays. This directly helps verify if the VLAN traffic is being correctly matched and forwarded, making it the right tool for this scenario.

Licensing is required for the device to be authorized and to establish a control connection. Without a valid license, the controller will not permit the device to join the overlay network. Checking the license status ensures the device is entitled to connect and receive configuration.

Traceroute is a native ION CLI diagnostic that maps each hop along the path to a destination, exposing where packets are dropped or delayed. This directly satisfies the connectivity-testing requirement, since it verifies reachability hop by hop rather than merely confirming a single end-to-end response.

In Prisma SD-WAN, policy rules are the mechanism that determines how traffic is routed. By creating rules that match internet-bound traffic and set the Service Connection as the destination, the administrator can ensure that only that traffic is inspected by the cloud SWG. Private application traffic can be matched by separate rules to use the VPN, achieving the desired split.

Local internet breakout allows branch traffic to go directly to the internet, and CloudBlades integration enables automatic redirection of that traffic to a cloud security service for inspection. This avoids backhauling to headquarters while meeting the security requirement, making it the correct design choice.

Deploying dual Prisma SD-WAN devices at the data center in a high-availability pair ensures that if one device fails, the other takes over, providing uninterrupted connectivity and services. This is a standard design for data center high availability in Prisma SD-WAN, meeting the requirement for redundancy and failover.

ISP-side congestion throttles traffic beyond your edge, so the interface never approaches its configured throughput limit despite the device itself performing normally. Because the bottleneck sits upstream in the provider's network, local interface counters show low utilisation, matching the stem's constraint that the configured limit is not being reached.

The Service Connection object binds the ION device's service route to the specific Prisma Access tunnel, steering matching traffic into the service infrastructure. Without this binding, the ION cannot identify which tunnel carries the Automated Service Connection.

The underlay comprises the physical or logical ISP circuits—MPLS, broadband, LTE—that carry packets between sites. SD-WAN overlays then build encrypted tunnels across these transports. This option directly satisfies the stem's requirement to define the underlay transport at the branch, distinguishing it from the logical overlay.

Security Logs capture traffic denied by firewall or security policy enforcement, including the matching rule and source. This directly satisfies the requirement to view denied traffic attempts, whereas audit logs record configuration changes and system logs record device events.

Unified SASE converges networking (SD-WAN) and security (SWG, FWaaS, ZTNA, CASB) into a single cloud-delivered service with a shared policy engine. This single-pass architecture eliminates the need for separate consoles and ensures consistent enforcement for all traffic types, directly meeting the requirement to reduce management overhead while applying uniform policies.

A failover WAN bundle designates one member as active and keeps the other in standby. The ION device monitors the primary path and only shifts traffic to the standby LTE member when the primary fails, then automatically reverts when the fiber path recovers. This matches the active/standby requirement with automatic failback exactly.

The problem is that internal traffic is being backhauled to Prisma Access, causing latency. Adjusting the application-based policy to match internal prefixes and steer them over a direct SD-WAN path restores optimal routing while keeping internet-bound traffic inspected. This directly addresses the root cause.

A WAN interface can show 'up' at layer 2 even if DHCP failed to provide a usable IP configuration. Without a valid IP, gateway, and DNS, the interface cannot route traffic. Checking DHCP lease details is the first logical step to confirm the interface has the necessary layer 3 parameters before investigating higher-level issues.

The Unified SASE policy action determines whether branch traffic traverses the Prisma Access service infrastructure or exits locally. 'Direct to Internet' bypasses Cloud SWG entirely, so SaaS traffic never reaches it despite the active SD-WAN path.

Video conferencing is delay- and jitter-sensitive, so QoS must place it in a low-latency, high-priority class to prevent degraded interactivity. Prioritising this real-time traffic satisfies the stem's requirement to protect latency-critical flows ahead of elastic data.

A service connection is the secure tunnel that carries traffic from the ION device to Prisma Access. Without it, traffic cannot be forwarded to Prisma Access for inspection. It is a fundamental component for integrating Prisma SD-WAN with Prisma Access in a Unified SASE architecture.

Route monitoring shows the learned BGP and OSPF routes.

Prisma Access is the cloud-delivered security platform that inspects remote-user traffic, enforcing URL filtering and threat prevention through its security processing nodes. It satisfies the requirement because enforcement occurs in the SASE security layer, not on the SD-WAN fabric.

A service link to a CloudBlade directs internet-bound traffic to a cloud security service for inspection, while path quality monitoring continuously measures latency, jitter, and packet loss. Forwarding rules can then automatically steer traffic to the secondary circuit when thresholds are exceeded, satisfying both security and resiliency requirements without additional hardware.

Reverting the configuration in the Orchestrator restores the last known good configuration by pushing the previously committed template back to the ION device, directly resolving the drift. This satisfies the scenario because the Orchestrator holds the authoritative configuration baseline.

QoS policies define how traffic is classified, marked, and queued on the WAN interfaces. They ensure that voice packets receive priority treatment, such as low latency queuing and appropriate DSCP markings. Verifying the QoS policy is essential to confirm that voice traffic is prioritized correctly and to troubleshoot why it might not be.

Interface configuration is a core component of a Prisma SD-WAN Site, defining the WAN and LAN interfaces, their IP addressing, and the circuits bound to each. This satisfies the stem's requirement for included Site items, since interfaces determine how the site connects to underlay transports and the local network.

The Firewall log records all traffic that matches firewall rules, including allow and deny actions. It provides details such as source, destination, port, and rule ID. This is the correct log to check to determine if traffic is being dropped by a firewall rule on the ION device.

Correlating BFD session state changes with tunnel statistics timestamps identifies which tunnel and which path (e.g., a specific TLOC) is flapping. This narrows the issue to a particular transport or remote TLOC without changing configuration, which is the correct first step in an isolation workflow before applying any remediation.

A local internet breakout lets the clinic CPE send guest traffic directly to the internet from the branch, avoiding backhauling that traffic through the data center. This matches the requirement that clinics reach the internet directly for guest use and is a standard Prisma SD-WAN design element for separating guest internet access from internal application traffic.

Tunnel interface MTU settings directly govern whether encapsulated SD-WAN packets survive transit without fragmentation or silent drops, making MTU a primary diagnostic axis for tunnel status. Mismatched MTU between overlay endpoints causes handshake failures and flapping, so verifying this parameter is essential when troubleshooting a Service Connection tunnel.

The Interface dashboard in the orchestrator reports live operational state for each WAN interface, including link up/down, IP addressing and overlay tunnel health, without requiring CLI access to the device. This satisfies the stem's requirement for a valid verification method by surfacing the same telemetry the edge collects.

Local breakout rules are evaluated before tunnel forwarding, so matching traffic egresses the local internet path instead of entering the SD-WAN overlay. This precedence explains why those flows bypass the tunnels and receive no fabric optimisation.

The most likely cause is that the SLA class referenced in the application-aware routing policy does not match the intended criteria. For example, if the SLA class is configured with a higher latency threshold, the policy may select a path that meets that threshold but is not the lowest-latency path. The engineer should verify the SLA class configuration and ensure it aligns with the desired path selection criteria.

Packet loss directly measures dropped traffic across a WAN path, so the ION device uses it as a health metric when evaluating link quality. Alongside latency and jitter, it satisfies the stem's requirement for path-health checks, since sustained loss indicates degradation warranting failover to an alternate path.

DHCP Client mode makes the ION device act as a DHCP client on the WAN interface, automatically requesting an IP address, default gateway, and DNS servers from the ISP's DHCP server. This matches the administrator's goal of zero-touch WAN addressing without manual configuration.

Prisma SD-WAN uses application definitions and policy sets to classify traffic and select paths based on criteria such as circuit type, performance thresholds, and priority. This centralizes control, scales across all branches, and avoids per-device static routes. It directly meets the requirement to steer business-critical applications over high-performance circuits while sending other traffic elsewhere.

The Cloud Identity Engine aggregates identity from multiple directories and IdPs into one normalised source that security policies reference. Rather than each policy querying separate identity stores, CIE supplies the authoritative user and group context, satisfying the requirement for a central identity source in Unified SASE.

Dynamic Mesh establishes direct spoke-to-spoke tunnels on demand, so traffic between branches bypasses the regional hub entirely. This cuts transit hops, lowering latency and relieving hub forwarding load, which is precisely the optimisation the design requires.

Underlay configuration defines the physical transport circuits beneath the overlay, capturing each ISP link's WAN interface, IP addressing, bandwidth and next-hop details. Prisma SD-WAN needs these ISP circuit parameters before it can build tunnels and apply overlay policies across the branch.

To establish a service connection, the ION device must be configured with the Prisma Access tenant details (such as the tenant name or ID) and must have a way to reach Prisma Access, either via a public IP address or through NAT traversal if behind a NAT device. This allows the IPsec tunnel to be initiated and established. Without these, the service connection cannot come up.

Prisma Access and Prisma SD-WAN forward their security events into a shared unified logging service, which normalises and correlates records from both products. This common logging layer links activity across the SASE fabric, giving one consolidated view rather than separate per-product log stores.

Data plane tunnels use IPsec and can be blocked by NAT devices that do not support IPsec passthrough or by incorrect WAN IP configuration. Since the control connection (which uses TCP) is up, the issue is likely specific to IPsec. Verifying WAN IPs and NAT compatibility is the logical next step to diagnose tunnel establishment failures.

IPSec provides the encrypted tunnel between the ION device and Prisma Access service infrastructure, authenticating both peers and protecting traffic in transit. It is the standard encapsulation for this site-to-cloud connection, satisfying the requirement for the primary tunnel protocol.

Flow Monitor in Prisma SD-WAN provides detailed visibility into individual flows, including the source, destination, application, and the WAN path being used. It also displays performance metrics such as latency and packet loss for that flow. This allows the engineer to quickly identify which path the business-critical application is using and its current performance, making it the ideal tool for this troubleshooting task.

Monitor > Network > App Route in vManage shows real-time application-aware routing statistics, including per-application and per-path latency, loss, and jitter, as well as the selected path. This is the correct location to verify AAR behavior for a site.

Virtual Networks create separate logical routing and forwarding domains on the same SD-WAN fabric, so HR, Engineering and Guest traffic never share a topology segment. This delivers the granular isolation the segmentation strategy requires, unlike simple VLAN or policy-based segmentation.

A high drop count in interface statistics indicates the egress queue is overflowing because offered traffic exceeds the interface's configured bandwidth, which is the definition of congestion. QoS then discards excess packets rather than buffering them.

Application-based path selection policies allow you to define which applications use which WAN links based on real-time performance metrics. By setting health thresholds for latency, jitter, and packet loss, the system can dynamically steer traffic to the best-performing link and avoid links that exceed the thresholds. This directly meets the requirements.

The startup check sequence verifies physical and logical link status, confirming interfaces are up and passing traffic. This satisfies the stem's requirement by ensuring the device's WAN and LAN ports are operational before the appliance proceeds to establish overlay connectivity.

Prisma SD-WAN path selection policies allow you to designate a primary WAN link and a backup link. When the primary link fails health checks, traffic automatically fails over to the backup. This matches the requirement to use LTE only when fiber fails, providing dynamic, health-based failover without manual intervention.

Configuring the WAN interface as a DHCP client lets the branch CPE obtain its address automatically from the ISP or upstream device, eliminating per-site static configuration and reducing the address footprint the design team must manage. This aligns with the stated goal of minimal WAN IP usage and no manual static addressing across 300 branches.

Controller Audit Logs record administrative actions, including policy modifications, capturing the identity and timestamp of each change. This satisfies the stem's requirement to audit who altered a policy on the Controller, providing the necessary accountability trail.

The App Route statistics in vManage show the path selected for specific applications based on the application-aware routing policy. This directly verifies whether the voice traffic is taking the expected path and whether the SLA criteria are being met. It provides per-application path visibility, which is essential for troubleshooting policy effectiveness.

Flow-based load balancing pins each flow to a single path, so packets belonging to one application session traverse the same link and arrive in order. This directly satisfies the stem's constraint by preventing multi-path reordering for the sensitive high-bandwidth application.

L2VPN encapsulates Ethernet frames and tunnels them across the SD-WAN fabric, extending Layer 2 broadcast domains between sites. This directly satisfies the migration requirement to stretch VLANs across data centres without re-addressing workloads, unlike Layer 3 overlays such as IPsec route-based tunnels, which terminate broadcast domains at each edge.

This command provides detailed per-interface statistics, including input/output errors, drops, CRC errors, and queue overruns. These metrics are essential for distinguishing between physical layer issues (e.g., CRC errors) and congestion (e.g., output drops). It offers the granular data required to diagnose intermittent packet loss effectively.

OMP session down is a control-plane alarm indicating that the Overlay Management Protocol session between a WAN Edge router and a controller (vSmart or vBond) has gone down. This directly affects control-plane connectivity and route exchange, making it a correct choice.

Linking Prisma Access to the Cloud Identity Engine via API Key and Tenant ID authorises the security nodes to query CIE for user-to-IP mappings. Without this binding, directory identity data cannot be retrieved, so identity-based policies fail to resolve users.

The Path Quality dashboard measures WAN-side performance only, so low latency there rules out the overlay. High user-perceived latency must therefore originate LAN-side, from local congestion, faulty switching or endpoint issues, making LAN-side connectivity the next logical check.

Unified SASE log correlation and unified policy require that Prisma Access and Prisma SD-WAN are managed under the same tenant or integrated portal. This allows the system to correlate events and apply consistent security policies across both products.

Equal TLOC preference and OMP cost make both DCI paths equally preferred, so the vEdge forwards flows across them rather than selecting one. Any difference in either metric causes deterministic path selection instead of load balancing.

VPN Tunnel Status in the Orchestrator shows whether the IPsec tunnel between the two ION devices is up or down, immediately confirming or eliminating the overlay as the fault domain before deeper packet-level troubleshooting. This satisfies the requirement to check status first.

The fabric automatically learns local subnets at each site and advertises them across the overlay so remote ION devices can reach them without per-prefix manual entry. This matches the design goal of automatic reachability exchange, scales cleanly as sites are added, and removes the operational burden of maintaining static route tables on every appliance.

The Prisma SD-WAN Controller distributes user-based policy to branch devices, translating identity-aware rules into enforceable forwarding decisions at the SD-WAN edge. This satisfies the stem's requirement for the policy distribution component within the Unified SASE user-policy workflow.

Source NAT rewrites the source address of outbound packets, masking internal IPs behind a public address; destination NAT rewrites the destination address of inbound packets, steering external traffic to internal hosts. This axis of difference satisfies the question's request to distinguish the two translation directions.

Path performance metrics measure latency, jitter, packet loss and bandwidth on each WAN link, allowing the SD-WAN to compare paths and steer application traffic accordingly. This satisfies the requirement to monitor application performance across the SD-WAN by exposing the underlay conditions affecting each application's delivery.

The Dashboard is a core component of the Prisma SD-WAN Controller interface, providing the central monitoring view for the scenario. It aggregates real-time telemetry across all branches and data centres, letting engineers verify tunnel health, application performance and policy compliance from one pane, satisfying the requirement to identify Controller interface components.

A Soft Shutdown drains traffic and hands over the active role cleanly, so sessions and tunnels fail over without dropping. This satisfies the graceful-transition constraint in the stem, unlike a hard shutdown, which forces an abrupt failover.

Registering the device serial number in the controller is mandatory for zero-touch provisioning: it binds the physical ION appliance to its tenant and configuration profile before shipment. Without this pre-registration, the controller cannot authenticate or push the bootstrap configuration to the branch device, so the deployment fails.

The application-aware flow test records the full forwarding decision for the synthetic flow, including the local egress interface and the WAN transport chosen in each direction. Reading the flow details lets the team confirm the exact path the test took, which is essential before drawing conclusions about a production voice path that may use a different tunnel.

This is the correct approach. In Prisma SD-WAN, you define policy rules that classify traffic by application, destination, or other criteria. Internet-bound traffic can be steered to a service connection that points to Prisma Access for inspection, while internal traffic follows the direct SD-WAN path. This ensures security for internet traffic without adding latency to internal applications.

The SD-WAN Application Policy defines per-application handling, including bandwidth limits, for traffic steered to Prisma Access. Configuring the limit there ties the restriction to the specific application and its SD-WAN path, satisfying the requirement to cap that application's bandwidth.

WAN interface statistics can reveal physical layer issues, such as CRC errors, drops, or high utilization, which can cause intermittent connectivity. Checking these statistics on both devices helps identify if one side has a faulty link or is experiencing congestion, pointing to an underlay problem.

Prisma SD-WAN policies allow traffic steering based on destination prefixes. By creating a policy that matches data center prefixes and sets the action to use the MPLS link, the engineer ensures that traffic to the data center takes the desired path. This is the standard method for path selection.

Prisma SD-WAN builds secure tunnels between sites, and application policies can log path selection and performance events. Forwarding these logs to a central system provides audit evidence of which path carried cardholder data. This combination delivers end-to-end encryption for branch-to-branch traffic and the path-level auditing required by the compliance design.

Prisma SD-WAN builds an any-to-any secure overlay among fabric sites, so a branch ION device can forward traffic toward Data Center B over tunnels to that data center's ION devices when the path to Data Center A is unhealthy. This meets the failover requirement without provisioning a full mesh of branch-to-branch tunnels.