CCNA Planning And Design Questions

Data center groups or service endpoints represent the destinations that branches need to reach. Defining both primary and secondary data centers in the controller allows policies to reference them and enables the fabric to steer traffic to the appropriate site. Without these definitions, the SD-WAN fabric would not know how to route branch traffic to either data center, making this a required design element.

A single appropriately sized ION device at each branch terminates both the broadband and LTE transports, runs the SD-WAN overlay, and applies policy, which satisfies the fabric requirement while keeping hardware count and cost at the branch minimal. Sizing to the branch's aggregate WAN throughput avoids over-provisioning, directly meeting the stated cost constraint.

Prisma SD-WAN supports zero-touch provisioning: the site and device serial number are pre-registered in the Controller, and when the ION device powers on and reaches the internet it authenticates, claims its assigned configuration, and builds its tunnels without local intervention. This suits a remote, lightly staffed site and makes field replacement practical for non-technical personnel.

Dynamic path selection continuously monitors the health of all available tunnels and automatically reroutes traffic to a backup tunnel if the primary fails. In Prisma SD-WAN, this is a core capability that ensures seamless failover between circuits. Configuring dynamic path selection with tunnel failover directly meets the requirement of switching to the LTE circuit when the primary internet circuit fails.

Hub-and-spoke concentrates branch connectivity through regional hubs, so Prisma SD-WAN delivers a single management plane and unified telemetry across all sites. It satisfies the stem by reducing operational complexity compared with managing full-mesh policy per branch.

Identity-Based Security Policy in the Prisma SD-WAN Controller maps user and group identity to firewall rules, enabling identity-aware enforcement at the site. This is the correct configuration location for policies that must act on who the traffic belongs to, not just IP addresses.

Prisma SD-WAN supports a multi-region controller architecture where controller clusters are deployed in different geographic regions. Each region's sites connect to their local controller cluster, reducing management latency. Policies are defined centrally and synchronized across all controllers, ensuring consistent global enforcement. This design meets both the latency and global policy requirements.

Application-defined policies allow the identification of SaaS applications like Microsoft 365. By combining these policies with local internet breakout, traffic to SaaS apps can be sent directly to the nearest PoP, improving performance. Internal data center traffic can be backhauled via separate policies. This feature directly enables the required traffic steering.

The Controller Dashboard provides live telemetry on fabric health, including tunnel status, path quality and device reachability, directly satisfying the real-time monitoring requirement during deployment. Unlike configuration or policy tools, it aggregates current operational state across all sites, letting engineers verify connectivity and performance as branches are brought online.

Prisma SD-WAN's autonomous mesh enables dynamic, on-demand tunnels between branches for direct communication, optimizing path efficiency without a full mesh. It automatically establishes tunnels when needed, reducing overhead and improving performance for branch-to-branch traffic, which meets the requirement for efficient paths.

Total bandwidth per link is required during initial site information gathering because it determines circuit sizing, overlay capacity and QoS planning. Without it, the SD-WAN design cannot allocate traffic correctly, satisfying the deployment-planning requirement for accurate link capacity data.

The site-id is a unique numeric identifier assigned to each branch site, allowing the Prisma SD-WAN controller to distinguish sites within the fabric, map them to elements and policies, and prevent overlapping addressing across the overlay.

ZTP allows for the automated registration and configuration of new gateways.

A custom application definition identifies the trading application traffic, and a path policy restricting it to the private WAN transport ensures it never uses public internet paths. Prisma SD-WAN path policies can specify allowed transports per application, so this design directly enforces the latency and path constraints. This is the correct way to guarantee that the application stays on the private network.

The Site ID is a unique identifier assigned to each site in Prisma SD-WAN. It is used to associate the site with its WAN interfaces, policies, and other configuration elements. This allows the controller to apply site-specific policies and manage the site's connectivity, making it the correct choice for uniquely identifying each site in a large deployment.

Logical tenant partitioning isolates each entity's management plane within the Prisma SD-WAN Controller, giving every tenant its own separate administrative domain, policies and visibility. This directly satisfies the multi-tenant separation requirement, preventing one entity's management traffic or configuration from being visible to, or affecting, another tenant.

The LAN interface connects the Prisma SD-WAN device to the local network, carrying traffic to and from internal hosts. WAN interfaces face the transport underlay, so the LAN interface is the correct attachment point for local LAN connectivity.

Security Templates in Prisma SD-WAN define reusable security parameters that are applied automatically when a new gateway is onboarded, removing manual per-device configuration. This satisfies the stem's requirement for automatic configuration of security settings on new gateways.

This is the specific metric to trigger the failover based on the 1% threshold.

DSCP marking tags voice packets with high-priority values, and queueing schedules them ahead of bulk traffic, guaranteeing lowest latency and jitter. This satisfies the stem's requirement that branch voice traffic always receives preferential forwarding treatment across the SD-WAN fabric.

MPLS is a valid private transport type in a Prisma SD-WAN site configuration, representing a dedicated carrier circuit with committed bandwidth. It can be assigned to a site's WAN interface alongside other transports, satisfying the question's requirement for valid transport types.

A hub-and-spoke topology directs branch-to-branch traffic through the central hub, which in this design is the data center where inspection occurs. This matches the company's requirement that all branch-to-branch traffic be inspected and provides predictable, centralized control over inter-branch flows.

Packet loss is a measured performance metric that Performance Routing policies continuously monitor on each path, triggering traffic steering when a threshold is breached. This satisfies the stem's requirement for criteria usable to steer traffic in a Performance Routing policy.

Transports in Prisma SD-WAN are defined by binding them to interfaces and giving each a distinct label so policy and path selection can reference them individually. Documenting this ensures the design can distinguish the two internet circuits from the LTE link, which is essential for expressing per-transport preferences and failover rules correctly.

Policy-based path selection uses application SLA profiles to continuously monitor link quality (latency, jitter, packet loss) and automatically steer traffic to the best available path. When the primary broadband link degrades below the SLA threshold, the system fails over to the 4G/LTE backup without manual intervention, exactly as required for the retail branches.

CloudBlades provides an API-based framework that integrates Palo Alto Networks Prisma SD-WAN with third-party and cloud services, enabling automated service insertion without appliance changes. This satisfies the architecture's requirement for extensible, API-driven service integration across branches.

Prisma SD-WAN uses BGP as the control-plane protocol between CPEs and the Controller for dynamic route exchange. Peering BGP on the data center CPE and advertising internal subnets lets the Controller learn and distribute those prefixes to branch sites automatically, exactly matching the design requirement for dynamic route exchange and propagation.

Path quality monitoring continuously measures latency, jitter, and packet loss on each WAN circuit. When a circuit fails or degrades beyond thresholds, Prisma SD-WAN automatically reroutes traffic to the remaining healthy circuit without manual intervention. This directly satisfies the requirement for continuous monitoring and automatic failover across dual broadband links.

The Prisma SD-WAN Controller is the centralized management plane that stores the authoritative configuration, computes policy, and pushes it to ION devices. It also collects telemetry and provides the single pane of glass for the 60-clinic rollout, so it is the component responsible for maintaining configuration consistency and distributing policy fabric-wide.

Prisma SD-WAN path groups let you bind multiple WAN interfaces into a preference-ordered set, and an active-backup group sends traffic over the highest-priority healthy path, failing to the next when probes fail. Ordering MPLS ahead of internet delivers the deterministic failover the manufacturer requires without relying on per-flow load balancing or application-specific policy alone.

Latency to branch locations governs hub placement because traffic backhauls through the hub; excessive round-trip delay degrades real-time applications. It satisfies the stem's design factor by minimising overlay path delay between spokes and the regional aggregation point.

A Virtual Gateway (vGateway) is a software instance deployed in public cloud or virtualised environments, peering with Prisma SD-WAN branches over IPSec tunnels. It satisfies the stem by providing a valid fabric attachment method where no hardware CPE is present.

QoS policies with guaranteed bandwidth ensure voice traffic receives priority, while a traffic shaper limits bulk data to prevent oversubscription. Prisma SD-WAN supports QoS classes and shaping on transport interfaces. This combination directly addresses the requirements for priority and link utilization, making it the correct design choice for constrained regions.

Prisma SD-WAN policy allows a branch to prefer one data center site over another for a given traffic class, with automatic use of the backup when the preferred site is unreachable. This directly encodes the stated primary-then-secondary behavior and lets the fabric react to loss of the primary without manual intervention.

Policy sets that permit only required industrial protocols between zones enforce least-privilege segmentation and prevent unauthorized corporate access to industrial systems. This aligns with the isolation goal and avoids Layer 2 extension by operating at Layer 3/L4. Combined with zones, this design element provides the necessary security and segmentation for the factories.

QoS policies classify and mark voice traffic with high priority (e.g., EF) and place it in a low-latency queue. This ensures that voice packets are transmitted before bulk data, reducing delay and jitter. It is a fundamental design element for prioritizing real-time traffic.

Prisma SD-WAN policy-based path selection monitors transport quality against configured thresholds for latency, jitter, and loss, and automatically shifts traffic to the secondary transport when the primary degrades. This directly delivers the automatic, quality-driven failover the design requires without manual intervention.

A Template is a reusable configuration baseline that stores standard settings applied across many sites, ensuring consistent policy and reducing per-site manual effort. This matches the scenario's need to define shared configuration centrally within the SD-WAN Controller.

Administrative roles are partitionable because Prisma SD-WAN's multi-tenant model scopes role-based access control assignments to a specific tenant, so an administrator granted privileges in one tenant cannot view or manage another tenant's sites, policies or devices. This satisfies the stem's isolation constraint, keeping each tenant's administrative authority separate.

QoS Policy governs bandwidth allocation and prioritisation between traffic classes, letting POS traffic receive guaranteed treatment over guest WiFi. It operates on queues and scheduling, directly satisfying the retail requirement to prioritise POS above guest traffic.

Service-to-Tunnel Mapping defines which tunnel carries traffic for each CSSP service, so incorrect mapping sends traffic down the wrong path or bypasses inspection. Verifying it ensures proper redirection of traffic to the cloud security service provider.

Path quality monitoring continuously measures latency, jitter, and packet loss on each WAN interface. When the configured threshold is exceeded, the ION device immediately redirects traffic to the alternate path without waiting for BGP or other routing protocol convergence. This provides sub-five-second failover, which is exactly what the retail branch design requires. The threshold must be tuned low enough to detect degradation quickly, but not so low that transient spikes cause unnecessary flapping.

Using the 4G/LTE modem as a secondary WAN interface with path quality monitoring allows the ION device to detect broadband failure and automatically fail over to the cellular link. Failover rules based on path quality ensure that cloud application traffic continues without manual intervention, meeting the requirement for continuous connectivity.

Defining a transport interface for each ISP circuit provides the underlay paths, and a policy set that sends guest traffic directly to the internet enables local breakout. Corporate traffic can be steered over the VPN overlay by a separate policy. This combination is the standard Prisma SD-WAN approach for supporting guest breakout while keeping corporate traffic on the overlay.

The SD-WAN Controller requires the site's management IP address to establish the control-plane tunnel used for orchestrating policy and forwarding decisions. This satisfies the stem's requirement for controller configuration, since reachability to the device's management interface is mandatory before the controller can push configuration or manage the site.

Application Policy defines how the SD-WAN edge classifies and handles traffic, including bypass actions that exclude flows from optimisation. Updating it lets you exempt the legacy application's traffic from the optimisation process, satisfying the compatibility constraint in the stem.

Integrating with the existing corporate identity provider lets the fabric consume user and group information and apply policy based on identity without placing an identity appliance at every branch. This satisfies the requirement for centralized authentication context while keeping branch hardware and management footprint small, which is the stated design constraint.

Performance Routing (PFR) Policy continuously measures path quality metrics such as latency, jitter and packet loss across multiple transports, then steers real-time traffic onto the best-performing path. This satisfies the sub-second failover requirement by reacting to degradation before sessions break.

Prisma SD-WAN path selection policies allow you to specify a preferred path and a fallback path based on path quality metrics. By setting MPLS as preferred for voice traffic and configuring a latency threshold of 150 ms, the ION device will monitor MPLS latency and automatically switch voice traffic to the internet path when the threshold is exceeded. This exactly meets the requirement of using MPLS normally and failing over to internet only on high latency.

Prisma SD-WAN supports custom topologies where you can define which sites are hubs and which are spokes, and then use policy rules to control path selection. By defining regional hubs and creating policies that force inter-region traffic through the hub while allowing intra-region direct tunnels, you meet both the direct tunnel and security inspection requirements. This is the most flexible and accurate way to achieve the desired traffic flow.

Automated tunnel configuration satisfies the requirement for secure connectivity between the SD-WAN edge and the cloud security service. CloudBlade provisioning dynamically establishes the overlay tunnels to the provider's points of presence, removing manual IPsec setup. This mechanism is mandatory because traffic must be steered through the security service before reaching the internet.

A virtual ION instance on existing branch compute minimizes hardware footprint and central management overhead while still supporting dual broadband and cellular failover through a supported external modem. Prisma SD-WAN allows virtual ION deployment on compatible hypervisors, and the cellular link can be integrated as a transport, meeting the design goals without adding a full physical appliance at each site.

Local internet breakout allows branch traffic to go directly to the internet, and CloudBlades integration enables automatic redirection of that traffic to a cloud security service for inspection. This avoids backhauling to headquarters while meeting the security requirement, making it the correct design choice.

Deploying dual Prisma SD-WAN devices at the data center in a high-availability pair ensures that if one device fails, the other takes over, providing uninterrupted connectivity and services. This is a standard design for data center high availability in Prisma SD-WAN, meeting the requirement for redundancy and failover.

The underlay comprises the physical or logical ISP circuits—MPLS, broadband, LTE—that carry packets between sites. SD-WAN overlays then build encrypted tunnels across these transports. This option directly satisfies the stem's requirement to define the underlay transport at the branch, distinguishing it from the logical overlay.

Video conferencing is delay- and jitter-sensitive, so QoS must place it in a low-latency, high-priority class to prevent degraded interactivity. Prioritising this real-time traffic satisfies the stem's requirement to protect latency-critical flows ahead of elastic data.

A service link to a CloudBlade directs internet-bound traffic to a cloud security service for inspection, while path quality monitoring continuously measures latency, jitter, and packet loss. Forwarding rules can then automatically steer traffic to the secondary circuit when thresholds are exceeded, satisfying both security and resiliency requirements without additional hardware.

A local internet breakout lets the clinic CPE send guest traffic directly to the internet from the branch, avoiding backhauling that traffic through the data center. This matches the requirement that clinics reach the internet directly for guest use and is a standard Prisma SD-WAN design element for separating guest internet access from internal application traffic.

Prisma SD-WAN uses application definitions and policy sets to classify traffic and select paths based on criteria such as circuit type, performance thresholds, and priority. This centralizes control, scales across all branches, and avoids per-device static routes. It directly meets the requirement to steer business-critical applications over high-performance circuits while sending other traffic elsewhere.

Dynamic Mesh establishes direct spoke-to-spoke tunnels on demand, so traffic between branches bypasses the regional hub entirely. This cuts transit hops, lowering latency and relieving hub forwarding load, which is precisely the optimisation the design requires.

Virtual Networks create separate logical routing and forwarding domains on the same SD-WAN fabric, so HR, Engineering and Guest traffic never share a topology segment. This delivers the granular isolation the segmentation strategy requires, unlike simple VLAN or policy-based segmentation.

Configuring the WAN interface as a DHCP client lets the branch CPE obtain its address automatically from the ISP or upstream device, eliminating per-site static configuration and reducing the address footprint the design team must manage. This aligns with the stated goal of minimal WAN IP usage and no manual static addressing across 300 branches.

Controller Audit Logs record administrative actions, including policy modifications, capturing the identity and timestamp of each change. This satisfies the stem's requirement to audit who altered a policy on the Controller, providing the necessary accountability trail.

Flow-based load balancing pins each flow to a single path, so packets belonging to one application session traverse the same link and arrive in order. This directly satisfies the stem's constraint by preventing multi-path reordering for the sensitive high-bandwidth application.

L2VPN encapsulates Ethernet frames and tunnels them across the SD-WAN fabric, extending Layer 2 broadcast domains between sites. This directly satisfies the migration requirement to stretch VLANs across data centres without re-addressing workloads, unlike Layer 3 overlays such as IPsec route-based tunnels, which terminate broadcast domains at each edge.

The fabric automatically learns local subnets at each site and advertises them across the overlay so remote ION devices can reach them without per-prefix manual entry. This matches the design goal of automatic reachability exchange, scales cleanly as sites are added, and removes the operational burden of maintaining static route tables on every appliance.

The Dashboard is a core component of the Prisma SD-WAN Controller interface, providing the central monitoring view for the scenario. It aggregates real-time telemetry across all branches and data centres, letting engineers verify tunnel health, application performance and policy compliance from one pane, satisfying the requirement to identify Controller interface components.

Prisma SD-WAN builds secure tunnels between sites, and application policies can log path selection and performance events. Forwarding these logs to a central system provides audit evidence of which path carried cardholder data. This combination delivers end-to-end encryption for branch-to-branch traffic and the path-level auditing required by the compliance design.

Prisma SD-WAN builds an any-to-any secure overlay among fabric sites, so a branch ION device can forward traffic toward Data Center B over tunnels to that data center's ION devices when the path to Data Center A is unhealthy. This meets the failover requirement without provisioning a full mesh of branch-to-branch tunnels.

Prisma SD-WAN policies can classify telehealth traffic and select paths based on real-time performance metrics such as latency and jitter. If thresholds are breached, the policy automatically steers traffic to a better circuit. This directly satisfies the requirement for automatic best-path selection and failover for telehealth video across 80 clinics with dual broadband.

Virtual Gateways terminate IPsec tunnels from branch devices directly into public cloud providers, bypassing physical data centres. This satisfies the cloud-native constraint by providing native connectivity to AWS, Azure and Google Cloud, with Prisma SD-WAN managing policy and routing across all clouds from a single fabric.