scenario questions

Where do you check the status of active control connections in vManage?

A logistics company is designing Prisma SD-WAN for a hub-and-spoke topology with a primary data center and a secondary data center for disaster recovery. The design must ensure that branch traffic reaches the primary data center under normal conditions and automatically uses the secondary data center if the primary becomes unreachable. Which two design elements are required to meet these requirements? (Choose two.)

If an ION device is not receiving DHCP addresses from an upstream provider, where should you look first?

A network administrator is troubleshooting a Prisma SD-WAN environment where a branch ION device is configured with two WAN interfaces: one primary and one secondary. The administrator notices that all traffic is being sent over the secondary WAN interface even though the primary interface is up and has better path quality. Which of the following is the most likely cause?

You need to ensure that traffic from a specific subnet is placed into a unique VRF. How is this achieved?

What is the purpose of the 'Zone' configuration on an ION device in a Unified SASE context?

What is the purpose of 'Bandwidth Groups' in Prisma SD-WAN?

Which TWO visibility tools help monitor the Unified SASE traffic flow?

A network architect is designing a Prisma SD-WAN deployment for a retail chain with 400 small branches. Each branch has a single broadband circuit and a 4G/LTE backup. The design must minimize hardware cost at the branch while still supporting the SD-WAN fabric. Which ION device deployment approach best fits this requirement?

Which TWO actions can be performed by the SD-WAN controller to manage SASE security policy?

A branch ION device is being deployed with a single WAN circuit that is provisioned as a DHCP client. The engineer needs the device to be reachable from the corporate management system for ongoing monitoring, but the ISP does not offer a static IP. Which configuration should the engineer apply on the ION device to meet this requirement?

A network operations center (NOC) engineer is investigating a performance issue at a branch site. The engineer needs to identify which application is consuming the most bandwidth on the WAN link. Which dashboard in the Prisma SD-WAN orchestrator should the engineer use?

A network administrator is configuring a Prisma SD-WAN branch ION device that will connect to the internet via a single ISP link. The administrator needs to ensure that the device can establish a secure control plane connection to the Prisma SD-WAN controller. Which configuration is required on the ION device?

An energy company is planning a Prisma SD-WAN design for a remote drilling site that has intermittent satellite connectivity and only occasional on-site staff. The design must minimize on-site configuration effort and ensure the device can be replaced by non-technical personnel if it fails. Which design approach best meets these constraints?

Which menu path is used to view the real-time tunnel statistics for a specific vEdge router?

A branch office requires local breakout for SaaS traffic. How do you configure the policy to ensure this traffic does not traverse the data center?

If a user is incorrectly identified in a SASE security log, which part of the Unified SASE architecture should be investigated first?

A network architect is planning a Prisma SD-WAN deployment for a company with 20 branch offices. The company wants to ensure that if a branch's primary internet circuit fails, traffic automatically switches to a secondary LTE circuit. Which Prisma SD-WAN feature should be configured to meet this requirement?

A junior engineer needs to confirm that a specific branch router's control connections to all controllers are currently established and encrypted. Which vManage view should the engineer open for that single device to see the state of each control connection and the TLOC it uses?

You need to restrict administrative access to the ION device. Where is this configured?

A network engineer is troubleshooting a Prisma SD-WAN deployment where an ION device has established a control connection to the controller but is not receiving any configuration. The engineer verifies that the device is licensed and the controller is reachable. Which of the following should the engineer check next to resolve the missing configuration?

What are the primary benefits of implementing a hub-and-spoke design with Prisma SD-WAN? (Choose THREE)

A network administrator is deploying a new branch with a Prisma SD-WAN ION device and wants to leverage Unified SASE for security inspection. The administrator has already configured the Service Connection to Prisma Access. Which additional step is required to ensure that traffic from the branch is inspected by Prisma Access?

Where do you go in vManage to generate a report on historical bandwidth utilization for a specific site?

During pre-deployment planning for a high-security site, you must implement an identity-aware firewall policy. Where is this configuration mapped in the Prisma SD-WAN Controller?

A network administrator is troubleshooting a branch site that is experiencing poor voice quality. The administrator suspects that the SD-WAN fabric is not prioritizing voice traffic correctly. Which dashboard in the Prisma SD-WAN Orchestrator provides a real-time view of application performance, including latency, jitter, and packet loss per application?

What does the 'Flow Monitor' tool primarily track?

How does Prisma SD-WAN handle DNS queries for branch users?

A network engineer is deploying a new branch ION device at a site with two WAN links and wants to guarantee that business-critical voice traffic always uses the lowest-latency path, even when one link degrades. Which Prisma SD-WAN configuration should be applied to the branch ION device to meet this requirement?

During an incident, an engineer observes that a WAN edge device is dropping traffic on a specific tunnel, and wants to verify the BFD session state and the measured loss and latency for that tunnel. Which operational command on a Cisco IOS XE SD-WAN device provides this per-tunnel BFD detail?

Which dashboard component in vManage provides an 'at-a-glance' health score for the entire SD-WAN fabric?

Which Prisma SD-WAN component is responsible for orchestrating the overall security policy across the entire fabric?

When configuring an ION device as a gateway for a cloud environment, what is the primary role of a 'Service' interface?

A multinational enterprise is designing a Prisma SD-WAN deployment across 50 sites in North America, Europe, and Asia. The company wants to ensure that each region uses a local Prisma SD-WAN Controller to reduce management latency, while still allowing global policy enforcement. Which design approach should you recommend?

A network administrator is troubleshooting why a specific application flow is being routed over a less desirable WAN link despite the configured application-aware routing policy preferring a different link. The administrator has verified that the application is recognized correctly. Which vManage monitoring tool should be used to examine the per-flow path selection and the reason for the chosen path?

A network engineer is configuring a Prisma SD-WAN branch site with two WAN links: a primary MPLS link and a secondary broadband link. The engineer wants to ensure that business-critical traffic uses the MPLS link and fails over to broadband only when the MPLS link's latency exceeds 100 ms. Which configuration is required to achieve this?

A network engineer is deploying a Prisma SD-WAN solution at a branch site with two WAN links: a primary MPLS link and a secondary broadband link. The engineer wants to ensure that if the MPLS link fails, all traffic automatically switches to the broadband link without manual intervention. Which configuration should be applied?

A network administrator is examining the Prisma SD-WAN orchestrator dashboard to identify which sites are consuming the most bandwidth. Which dashboard widget should the administrator use to quickly see the top bandwidth consumers?

A network engineer is deploying a new branch office with a Prisma SD-WAN ION device. The branch requires direct internet access for guest users, but corporate traffic must be inspected by Prisma Access. The engineer wants to minimize configuration overhead and ensure that only corporate traffic is redirected to Prisma Access while guest traffic goes directly to the internet. Which feature should the engineer configure on the ION device to achieve this?

A multinational corporation is planning a Prisma SD-WAN deployment across 500 sites in multiple regions. The design must ensure that traffic from branch users to SaaS applications like Microsoft 365 is directed to the nearest Point of Presence (PoP) for optimal performance, while traffic to internal data centers is backhauled. Which Prisma SD-WAN feature should be leveraged to achieve this?

Which Prisma SD-WAN tool is used to monitor real-time health and performance of the SD-WAN fabric during the deployment phase?

You notice an ION device is showing as 'Disconnected' in the Controller UI. What is the first step you should take?

A network engineer is deploying Prisma SD-WAN with Unified SASE and wants to ensure that branch traffic destined for the internet is inspected by Prisma Access. The engineer has already configured the service connection on the ION device. Which additional configuration is required on the ION device to direct internet-bound traffic to Prisma Access?

Which TWO of the following are benefits of using Prisma SD-WAN?

An engineer is deploying a Prisma SD-WAN branch site where the ION device will use a single LTE WAN link with a dynamic public IP address assigned by the carrier. The device must establish a control connection to the Prisma SD-WAN controller and be managed centrally. Which deployment method should the engineer use?

A financial institution is designing a Prisma SD-WAN deployment across 40 branches and two data centers. The design must ensure that branch-to-branch traffic takes the most efficient path and that the network can automatically recover from a data center failure. Which two design elements should be included? (Choose two.)

A network administrator needs to generate a report that shows the top ten applications by bandwidth consumption over the past week for a specific site. Which vManage feature should be used?

A network administrator is troubleshooting an ION device at a branch site that intermittently loses connectivity to the Prisma SD-WAN Controller. The administrator suspects a problem with the underlying WAN link. Which CLI command provides the most direct real-time view of the interface status, IP address, and packet counters for the WAN interfaces?

What is the effect of changing the 'Path Selection' strategy from 'Latency' to 'Lowest Cost' in a policy?

When planning for a large-scale deployment, which items are required for the initial site information gather? (Choose THREE)

If a user at a branch site reports that they cannot access a specific internal server, which diagnostic tool should you use first?

A network administrator is troubleshooting a Prisma SD-WAN environment where an ION device is experiencing intermittent packet loss on a business-critical application. The administrator suspects that the issue is related to a policy misconfiguration. Which two actions should the administrator take to verify that the correct policies are being applied to the traffic? (Choose two.)

A network engineer has just deployed a new ION device at a branch office. The device has successfully established its control plane connection to the Prisma SD-WAN controller. The engineer now wants to enable secure web gateway (SWG) inspection for all internet-bound traffic from this branch without manually creating tunnels. Which Prisma SD-WAN feature should the engineer configure?

In a Unified SASE architecture, an administrator needs to ensure that branch offices prioritize voice traffic while using Prisma Access. Where should the Quality of Service (QoS) policy be defined to ensure consistent application performance?

Which THREE pieces of information are critical when opening a support ticket for a suspected SD-WAN bug?

What is the purpose of the 'site-id' in the Prisma SD-WAN branch configuration?

An engineer is designing monitoring for a dual-router branch where each router has two WAN transports. The requirement is to detect a degradation on a single transport before end users report poor application experience, and to distinguish a transport-wide problem from a single-site problem. Which two capabilities of the SD-WAN monitoring stack should be used to meet these requirements? (Choose two.)

A specific branch is failing to steer traffic via the preferred ISP despite a defined Path Policy. What is the most likely cause?

Which component manages the configuration and policy definition for a fleet of Prisma SD-WAN ION devices?

You are verifying the status of a Service Connection between a branch ION and Prisma Access. Which command or dashboard view provides the most accurate status of the tunnel reachability?

A network engineer is deploying a Prisma SD-WAN solution at a branch site with two WAN links. The engineer wants to ensure that the branch can automatically fail over from the primary link to the secondary link when the primary link experiences high latency or packet loss. Which TWO configuration steps are required to achieve this? (Choose two.)

A network operations team is troubleshooting a Prisma SD-WAN environment where multiple sites are reporting intermittent connectivity to critical cloud applications. The team suspects an issue with the SD-WAN fabric's path selection or link quality. Which two actions should the team perform to gather the most relevant data for diagnosis? (Choose two.)

An engineer is deploying a Prisma SD-WAN ION at a branch that will use a single MPLS circuit for connectivity to the data center and a broadband internet link for direct internet access. The engineer wants to ensure that if the MPLS circuit fails, traffic to the data center automatically fails over to the broadband link. What should the engineer configure?

Which of the following is a benefit of a Unified SASE architecture?

A network operations engineer needs to confirm whether the OMP routes advertised by a specific branch vEdge have been received by the vSmart controller and propagated to other sites. The engineer is already logged into the CLI of the vSmart controller. Which command should be used to display the OMP routes received from that branch?

A network administrator is investigating why a specific SaaS application is being blocked for users at a branch site. The security policy in the orchestrator does not show any hits for that application. The administrator suspects that the ION device is not correctly identifying the application. Which feature should be verified to ensure the application is recognized and allowed?

In a scenario where a branch office loses its internet connection, what happens to the Unified SASE connection?

A network operations team is using Cisco vManage to manage a large SD-WAN fabric. They need to view a real-time, hop-by-hop path trace between a branch router and a data center application server to pinpoint where latency is being introduced. Which vManage feature should they use to capture this information?

Which mechanism would explain why traffic is taking a sub-optimal path despite a policy favoring a different link?

Which TWO factors contribute to the 'Path Health' score?

A network engineer is troubleshooting a Unified SASE deployment where branch users report slow access to Microsoft 365. The engineer suspects that traffic is being backhauled to a data center for security inspection instead of being sent directly to Prisma Access. The ION device has a Service Connection configured and active. Which action should the engineer take to ensure that Microsoft 365 traffic is inspected by Prisma Access while other traffic follows the default route?

Which TWO metrics are displayed in the Path Quality dashboard?

A network administrator is troubleshooting an SD-WAN issue where a branch site's voice traffic is experiencing poor quality. The administrator suspects that the issue is related to the Bidirectional Forwarding Detection (BFD) sessions used for Application-Aware Routing. Which vManage monitoring view should the administrator check to see the BFD session status and performance metrics for the tunnels from that branch?

Which protocol is utilized for the auto-discovery of Prisma SD-WAN Gateways during site provisioning?

A financial services company is designing a Prisma SD-WAN topology for a data center that hosts a trading application. The application requires sub-10 ms latency to a specific colocation facility and must not traverse any public internet path. The design team needs to enforce this requirement across all branches. Which Prisma SD-WAN design approach should be used?

An engineer is configuring a Prisma SD-WAN ION device at a branch. The branch has a single WAN link with a public IP address. The internal LAN uses private IP addresses. The engineer needs to allow internal users to access the internet while hiding their private IP addresses. Which configuration is required?

A security architect is designing a Unified SASE solution with Prisma SD-WAN and Prisma Access. The company requires that all traffic from branch ION devices to the internet be inspected by Prisma Access, but they also want to optimize performance for Microsoft 365 traffic by using local internet breakout. Which Prisma SD-WAN feature should the architect use to achieve this?

An administrator is troubleshooting a routing loop that occurs intermittently between two branch sites. The administrator suspects that the BGP route advertisements received by one of the ION devices are causing the loop. Which tool in the Prisma SD-WAN orchestrator can be used to view the BGP routes received by an ION device?

A network engineer is analyzing a Prisma SD-WAN network where a critical SaaS application is experiencing intermittent performance degradation. The engineer suspects that the SD-WAN policy is not correctly steering traffic to the optimal path. Which feature in the Prisma SD-WAN orchestrator should the engineer use to verify the path selection decisions made for the application's traffic flows?

A network architect is planning a Prisma SD-WAN deployment for a company with 200 sites. The company wants to ensure that each site's WAN interfaces are correctly identified and that policies can be applied based on site-specific attributes. Which Prisma SD-WAN configuration element should be used to uniquely identify each site and associate it with its WAN interfaces?

When designing a multi-tenant environment, how does the Prisma SD-WAN Controller ensure that management traffic is separated for each entity?

Which Prisma SD-WAN interface is used to connect to the local LAN?

A network engineer is troubleshooting a Prisma SD-WAN environment where a branch ION device is not forming a control-plane connection to the controller. The engineer has verified that the underlay WAN interface is up and can ping the internet. Which step should the engineer take next to diagnose the control-plane issue?

Which Prisma SD-WAN feature enables the automatic configuration of security parameters for a new gateway?

When defining an Application Steering Policy in a Unified SASE environment, what is the advantage of using 'Application Groups'?

You have a DCI configuration where two data centers are connected via a dedicated link. You want to ensure the DCI link is only used if the primary WAN transport fails. How do you achieve this?

A branch office uses both MPLS and Broadband. The design requires that business-critical traffic prefers MPLS, failing over to Broadband only if the MPLS path experiences packet loss exceeding 1%. Which metric should the PFR policy utilize?

An operator must prove to an auditor that traffic from a branch to a business-critical SaaS application used the preferred low-latency transport over the last 24 hours, and that failover to the backup transport occurred only during a documented outage window. Which vManage monitoring capability provides the per-application, time-correlated evidence needed?

Which TWO features are included in the vManage 'Monitor' menu?

A network engineer is deploying a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer wants to ensure that traffic from a specific branch is inspected by Prisma Access, but traffic to a critical internal application must bypass Prisma Access and go directly over the Prisma SD-WAN fabric. The branch has two ION devices for redundancy. Which configuration should the engineer use to achieve this?

A network security administrator is configuring Prisma Access to integrate with Prisma SD-WAN for Unified SASE. The administrator needs to ensure that security logs from Prisma Access can be correlated with traffic logs from Prisma SD-WAN to troubleshoot an incident. Which configuration is required to enable this correlation?

You need to ensure that branch office voice traffic always has the lowest latency. Which QoS classification strategy is recommended?

A customer is experiencing intermittent connectivity to internal applications after enabling Unified SASE. Traffic is being routed through Prisma Access. What is the most likely cause?

Which TWO factors are used by Prisma SD-WAN to determine the health of a WAN path?

Which of the following are valid transport types that can be defined in a Prisma SD-WAN site configuration? (Choose TWO)

What is the primary function of the 'Controller' dashboard in the Prisma SD-WAN UI?

A network operations engineer is troubleshooting a Cisco SD-WAN overlay where a branch site's WAN Edge router has lost its control plane connectivity to the vSmart controllers. The engineer runs the command `show control connections` on the WAN Edge and sees that all control connections are in a 'connect' state rather than 'up'. Which action should the engineer take first to diagnose the issue?

A manufacturing company is designing its Prisma SD-WAN topology. The design team wants a simple hub-and-spoke model where all branch-to-branch traffic flows through the data center hub for inspection. Which topology design should be specified in the fabric?

A junior engineer wants to quickly confirm whether a specific WAN edge device has established control connections to all three controller roles (vBond, vSmart, and vManage) after onboarding. Which vManage location provides this per-device control connection status view?

A network administrator is troubleshooting a performance issue where voice traffic is being routed over a less optimal path despite a better path being available. The administrator has verified that the application-aware routing policy is correctly configured to prefer the lower-latency path for voice traffic. Which action should the administrator take next to identify the cause?

An engineer is configuring a Prisma SD-WAN policy to ensure that voice traffic from a branch is always sent over the MPLS circuit, while all other traffic uses the internet circuit. The engineer creates an application policy with a match on voice applications and sets the action to use the MPLS path. However, after deployment, voice traffic is still traversing the internet circuit. Which configuration issue is the most likely cause?

Which criteria can be used to steer traffic in a Performance Routing policy? (Choose TWO)

An administrator is configuring a Unified SASE deployment with Prisma SD-WAN and Prisma Access. The administrator wants to verify that the service connection between the branch ION device and Prisma Access is operational and that traffic is being inspected. Which Prisma SD-WAN dashboard view should the administrator use to see the status of the service connection and the amount of traffic being sent to Prisma Access?

A network architect is designing a Prisma SD-WAN deployment for a retail customer with 200 small branches. Each branch has a single ION device and one broadband circuit. The customer wants centralized policy management and minimal on-site configuration. Which TWO deployment components are required to meet these goals? (Choose two.)

A network engineer is troubleshooting a Prisma SD-WAN environment where a branch site is experiencing intermittent connectivity to a critical cloud application. The engineer suspects that the issue is related to the SD-WAN fabric's handling of the application's traffic. Which of the following tools should the engineer use to capture and analyze the actual packets traversing the ION device to determine if packets are being dropped or modified?

Which command or interface action is used to verify the current status of the SD-WAN overlay tunnels?

What is the impact of assigning a site to a specific 'Site Group' in a Prisma SD-WAN policy?

A design team is planning the underlay for a Prisma SD-WAN branch that will use two independent internet circuits plus an LTE link. They must decide which transport configuration characteristics to document for the ION device. (Choose two.)

You need to see the exact DSCP markings on packets exiting the ION. Which tool should you use?

Which THREE types of information are displayed in the Prisma SD-WAN 'Flow Monitoring' view?

A network operations team is troubleshooting a Prisma SD-WAN network where a specific branch site is experiencing poor voice quality. The team suspects that the issue is due to the branch's WAN link not meeting the required SLA for jitter. Which tool in the Prisma SD-WAN orchestrator should the team use to verify the real-time jitter measurements for the branch's WAN link?

When configuring Data Center Interconnect (DCI) between two sites, you notice that routing loops are occurring. What is the most effective way to prevent this in a dual-homed DCI scenario?

A site has two ISPs. Traffic is only using one. What is the best way to verify if both paths are available?

You are designing a Prisma SD-WAN deployment for a retail chain with 300 small branch sites. Each site has a single broadband link and a 4G/LTE backup. The customer requires that the SD-WAN fabric automatically detect when the primary link degrades and switch traffic to the backup without manual intervention. Which Prisma SD-WAN feature should you include in the design to meet this requirement?

A network engineer is deploying a new branch with two ION devices for high availability. The engineer wants both devices to share a single virtual IP address on the LAN side so that hosts use a consistent default gateway even if one device fails. Which LAN-side configuration should be implemented?

Which dashboard provides the most detailed information regarding the health of individual tunnels within an SD-WAN fabric?

An operations team is investigating why a specific application flow between two branches is taking a suboptimal path through a hub site. They suspect the application-aware routing policy is not steering the flow as intended. Which vManage operational view should the engineer use to examine the per-flow path chosen by the SD-WAN fabric for this traffic?

An organization is migrating to Unified SASE. When configuring the 'Direct to App' policy for branch offices, what is the primary benefit of leveraging the Prisma SD-WAN integration with Prisma Access?

If a device is stuck in 'In-Progress' during a template push, what is the first troubleshooting step?

A network administrator is troubleshooting a Prisma SD-WAN environment and needs to view the current status of all WAN interfaces on a specific ION device. Which section of the Prisma SD-WAN portal should the administrator navigate to?

A network engineer is configuring a new Prisma SD-WAN branch site. The branch has two WAN circuits from different providers. The engineer wants to ensure that if one circuit degrades in performance, traffic is automatically moved to the other circuit without manual intervention. Which feature should the engineer configure to achieve this?

What information is provided by the 'Controller Status' widget on the dashboard?

Which THREE factors must be considered when designing a high-availability (HA) Service Connection to Prisma Access?

You are implementing a QoS policy. Why would you configure a 'Shaping' rate on a WAN interface?

A network engineer is troubleshooting a Unified SASE deployment where a branch ION device has established a control connection to Prisma Access, but application traffic from the branch is not being inspected by Prisma Access security services. The engineer confirms that the ION device is online and the service connection is active. Which configuration element should the engineer verify to ensure that traffic is steered to Prisma Access for inspection?

How does a 'Failover' policy differ from a 'Load Balancing' policy in Prisma SD-WAN?

A customer wants to prioritize Office 365 traffic over general web traffic. What is the most efficient way to achieve this?

A network engineer is troubleshooting a site that is experiencing intermittent connectivity issues. The ION device shows the WAN interface flapping. Which two CLI commands should the engineer use to gather information about the interface flapping? (Choose two.)

A network administrator is preparing to bring a new branch online with Prisma SD-WAN. The branch has no IT staff, and the administrator wants the ION device to receive its full configuration automatically when it is powered on and connected to the internet. Which feature should the administrator use?

An engineer is deploying a new branch ION device that will connect to two different ISPs. The design requires that return traffic from the data center follows the same WAN path that the outbound session used, so that stateful inspection appliances in the data center see both directions of every flow. Which configuration on the branch ION device satisfies this requirement?

Which feature should you examine if traffic is not being steered based on the application category?

A network engineer is troubleshooting an ION device that frequently reboots and loses its configuration. The engineer suspects a hardware or software issue. Which two commands should be used to gather relevant diagnostic information from the ION device? (Choose two.)

What does the 'App-ID' feature provide in a security policy?

A network engineer is configuring a Prisma SD-WAN ION device at a branch site. The branch has a single WAN link with a static public IP address. The internal LAN uses private IP addresses. The engineer wants to allow internal users to access the internet using the public IP address. Which feature should the engineer configure on the ION device?

What is the primary function of the CloudBlades platform in the Prisma SD-WAN architecture?

Which THREE factors influence the 'Path Selection' decision for traffic in a Unified SASE architecture?

Which THREE logs or reports should be reviewed to troubleshoot a security policy drop?

A network engineer is troubleshooting a Unified SASE deployment. Branch users report that HTTPS traffic to a business-critical SaaS application is intermittently failing. The engineer suspects that the traffic is not being steered to Prisma Access for security inspection. Which action should the engineer take first to verify the traffic steering policy?

A financial services firm is designing Prisma SD-WAN for a data center that must advertise its internal subnets to the SD-WAN fabric. The design requires dynamic route exchange with the SD-WAN Controller and automatic propagation of learned routes to branch sites. Which routing approach should be specified on the data center CPE?

A healthcare organization is designing a Prisma SD-WAN deployment for 80 clinics. Each clinic has two broadband circuits from different ISPs. The design must ensure that if one circuit fails, all traffic automatically reroutes to the other circuit without manual intervention, and that the SD-WAN fabric continuously monitors both paths. Which Prisma SD-WAN feature should be included in the design to meet these requirements?

An engineer is configuring a Prisma SD-WAN policy to route guest Wi-Fi traffic directly out of the local branch internet circuit instead of sending it to the data center. The guest traffic must not traverse the SD-WAN overlay. Which policy type should the engineer use?

When troubleshooting a persistent 'Service Connection Down' status, which log type is most relevant?

A hospital network team is planning a Prisma SD-WAN rollout and needs to confirm which component is responsible for maintaining the authoritative configuration and distributing policy to all ION devices across 60 clinics. Which component performs this role?

You are designing branch connectivity for a manufacturer that requires deterministic failover between a primary MPLS circuit and a secondary internet circuit, and the security team mandates that traffic to a specific PCI-scoped subnet be inspected by a next-generation firewall appliance sitting inline at the branch. Which two Prisma SD-WAN design elements must you include to meet these requirements? (Choose two.)

A network engineer is troubleshooting an SD-WAN overlay where a branch router's BFD sessions to two WAN transports keep flapping every few minutes. The engineer suspects the issue is related to the BFD hello interval and multiplier settings configured in the vManage feature template. Which CLI command on the branch router displays the current BFD session state and the negotiated transmit/receive intervals for each WAN transport?

Which THREE OMP attributes can be used to influence path selection for DCI?

A network engineer is preparing to deploy a new branch ION device that will use a single LTE circuit as its only WAN connection. The design requires that the device not consume the metered data plan during initial software staging, and that it validate its configuration against the controller before carrying production traffic. Which deployment approach best meets these requirements?

A network engineer is deploying a new branch office with a Prisma SD-WAN ION device. The security team requires that all internet-bound traffic from the branch be inspected by Prisma Access Cloud SWG, while traffic to internal SaaS applications should use direct internet breakouts. The engineer must configure the ION to steer traffic appropriately. Which action should the engineer take to meet these requirements?

Which factors should be considered when designing the placement of a regional hub in a Prisma SD-WAN architecture? (Choose TWO)

Which are valid methods to connect a branch to the SD-WAN fabric? (Choose TWO)

A network engineer is validating the health of an SD-WAN fabric after a controller upgrade. The engineer needs to verify that the control plane and data plane are operating correctly across all devices. Which two vManage monitoring screens should be checked to confirm that all control connections are up and that the data plane tunnels are established? (Choose two.)

A security architect is designing a Unified SASE deployment where branch users must access both SaaS applications and internal data center resources. The requirement is that SaaS traffic be inspected by Prisma Access while internal traffic goes directly over the SD-WAN fabric without backhauling to the cloud. Which Prisma SD-WAN feature should be used to enforce this traffic separation?

Where do you view the history of configuration changes pushed to an ION device?

A network engineer is configuring a Cisco SD-WAN solution with two vSmart controllers in a high-availability pair. The engineer wants to ensure that if one vSmart controller fails, the WAN Edge devices automatically switch to the other controller without manual intervention. Which mechanism should the engineer verify is properly configured?

A network administrator is investigating why application traffic from a branch site is being routed over the less-preferred MPLS transport instead of the local broadband circuit, even though the application-aware routing policy is configured to prefer broadband for that application. The administrator has already verified that the application is correctly identified and that both TLOCs are up. Which vManage monitoring view should the administrator check first to see the per-application path selection decisions and the reason a particular path was chosen?

Which TWO indicators would lead you to believe that a site's WAN transport is oversubscribed?

A branch loses connectivity to the internet, but local LAN traffic is fine. What should you troubleshoot first?

Which TWO benefits does an automated Service Connection provide over a manual tunnel configuration?

A security administrator is troubleshooting a Unified SASE deployment where branch users cannot access a cloud-based CRM application. The traffic is being steered to Prisma Access for inspection, but users report timeouts. The administrator checks the ION device and sees that the service connection to Prisma Access is up, and the CRM application is allowed in the security policy. What is the most likely cause of the issue?

A global enterprise is designing Prisma SD-WAN for regions with limited bandwidth and high latency. The design must ensure that voice traffic receives priority over bulk data transfers and that the WAN links are not oversubscribed. Which combination of design elements should be included in the plan?

When using Prisma SD-WAN with Prisma Access, how is the secure tunnel established?

An engineer is designing a Prisma SD-WAN topology for a company with a primary data center, a secondary data center, and 200 branches. The requirement is that branch-to-data-center traffic must traverse the primary data center under normal conditions and only use the secondary data center if the primary becomes unreachable. Which design element should be used to express this preference?

Which TWO of the following are required to successfully establish a Service Connection to Prisma Access?

A network engineer is configuring a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer wants to ensure that traffic from a specific branch is inspected by Prisma Access, but also wants to avoid sending traffic to Prisma Access for destinations that are reachable via a direct SD-WAN path to the data center. Which Prisma SD-WAN feature allows the engineer to define which traffic should be sent to Prisma Access?

A network architect is reviewing the SD-WAN fabric's high availability design. The architect wants to ensure that if a vSmart controller becomes unavailable, the WAN Edge routers continue to forward traffic without interruption. Which statement accurately describes the behavior of WAN Edge routers when a vSmart controller fails in a multi-controller deployment?

An SD-WAN engineer is configuring syslog and SNMP traps for proactive monitoring of WAN Edge devices. The engineer wants to ensure that critical events such as control connection failures and BFD session flaps are reported to the central monitoring server. Which two actions must be performed on the WAN Edge devices to achieve this? (Choose two.)

A network engineer needs to monitor the health of an SD-WAN fabric and wants to receive alerts when any WAN Edge device loses its connection to the vSmart controller for more than five minutes. Which vManage feature should the engineer use to configure this alert?

A design team is planning a Prisma SD-WAN deployment for a manufacturing company with 25 factories. Each factory has industrial control systems that must remain isolated from corporate IT traffic, and the company wants to avoid extending Layer 2 across the WAN. Which two design elements should be included in the plan? (Choose two.)

You are designing a Prisma SD-WAN solution for a multinational enterprise with sites in North America, Europe, and Asia. The company wants to ensure that real-time voice traffic is prioritized over bulk data transfers across the SD-WAN fabric. Which two design elements should you include to achieve this? (Choose two.)

A network engineer is investigating why a branch site is not receiving any traffic from the data center after a recent change. The engineer suspects that the SD-WAN fabric is not advertising the branch's subnet correctly. Which CLI command on the ION device can be used to verify the routes being advertised to and received from the SD-WAN fabric?

In a Unified SASE deployment, what is the significance of the ION device serial number?

A help desk technician reports that users at a remote site are experiencing slow access to a SaaS application. The SD-WAN engineer wants to quickly verify whether the issue is due to high latency on the WAN transport or due to packet loss. Which vManage monitoring dashboard provides a real-time view of latency, jitter, and packet loss per tunnel and per application?

A global enterprise is designing Prisma SD-WAN for regions with unreliable broadband. The design must ensure that if the primary WAN transport degrades beyond acceptable thresholds, traffic automatically moves to the secondary transport without manual intervention. Which design element should be specified?

In the context of the SD-WAN Controller, what does the 'Template' object represent?

A branch site reports intermittent application slowness. Which tool in the Prisma SD-WAN ION dashboard is best for viewing real-time latency and jitter metrics per path?

Which TWO functions are performed by the Cloud Identity Engine (CIE) within a Unified SASE environment?

A network engineer is deploying a new branch office with a single Prisma SD-WAN ION device. The branch has two WAN links: a primary fiber circuit and a backup LTE connection. The engineer wants the ION device to automatically establish secure tunnels to the Prisma SD-WAN controller and to the nearest data center without manual intervention. Which deployment method should the engineer use?

When analyzing a PCAP from an ION device, you see 'ICMP Destination Unreachable'. Which policy is most likely causing this?

A multinational company is deploying Prisma SD-WAN at a branch that has a single MPLS circuit and a broadband internet link. The security team requires that all traffic destined to the corporate data center must traverse the MPLS circuit, while internet-bound traffic should use the broadband link. However, if the MPLS circuit fails, data center traffic should fail over to the broadband link with IPsec encryption. Which configuration achieves this requirement?

In a multi-tenant Prisma SD-WAN design, what can be partitioned per tenant? (Choose THREE)

You are configuring a path policy to prioritize VoIP traffic. Which specific metric should you leverage to ensure the best call quality when multiple paths are available?

Which TWO types of traffic are typically steered to Prisma Access in a Unified SASE architecture?

A branch router shows its OMP peerings to the vSmart controllers as up, but routes learned from other sites are not appearing in its routing table, and the overlay has stopped forwarding between sites. The engineer suspects the data plane rather than the control plane. Which check best isolates whether the issue is a data-plane tunnel problem rather than an OMP or routing-policy problem?

A network operations center (NOC) engineer is monitoring a Prisma SD-WAN deployment and notices that one ION device at a remote site is consistently showing high latency on its broadband link, while the LTE link is performing well. The engineer wants to quickly identify whether the high latency is due to an ISP issue or a device problem. Which of the following should the engineer check first?

A retail customer needs to prioritize POS (Point of Sale) traffic over guest WiFi. Which policy type governs this bandwidth allocation?

You are monitoring traffic in a Unified SASE environment. You notice that traffic from a branch is taking a non-optimal path to Prisma Access. Which tool would you use to verify the path selection logic?

Which THREE settings are typically defined during the initial ION site provisioning?

When integrating Prisma SD-WAN with a cloud-based security service provider (CSSP) via CloudBlades, which setting must be verified to ensure proper traffic redirection?

A network architect is designing a Prisma SD-WAN deployment for a retail chain with 300 small branch sites, each with two broadband circuits and no MPLS. The design must ensure that if a branch's active tunnel degrades, traffic fails over within a few seconds without requiring BGP reconvergence. Which ION device configuration element should be included in the design to meet this requirement?

Which TWO components are essential for maintaining the SD-WAN control plane?

A security administrator is troubleshooting a Unified SASE deployment where branch users cannot access a critical internal application hosted in an on-premises data center. The application is reachable from other sites, but branch traffic destined to the application's IP is being routed to Prisma Access instead of the data center. The ION device has a Service Connection configured to Prisma Access and a VPN connection to the data center. What is the most likely cause of this issue?

A network engineer is planning a Prisma SD-WAN deployment for a small office with a single broadband circuit and a 4G/LTE modem for backup. The office needs to maintain connectivity to cloud applications even when the broadband circuit fails. Which design approach should the engineer use?

Which THREE methods can be used to troubleshoot application identification issues?

A network engineer is deploying a new ION device at a branch that uses a DSL circuit with a dynamic public IP address from the ISP. The branch must establish SD-WAN tunnels to the controller and to other sites. Which configuration must the engineer verify to ensure the tunnels come up reliably?

A network engineer is configuring a Prisma SD-WAN ION device at a branch that has a single WAN link with a public IP address. The branch also has a local subnet of 192.168.10.0/24. The engineer wants to ensure that all traffic from the local subnet to the internet is translated to the WAN IP address. Which type of NAT should be configured?

Which TWO items are considered 'Underlay' resources in a Prisma SD-WAN configuration?

A network engineer is planning the Prisma SD-WAN deployment for a new campus site. The site will use two ISP circuits and must support direct internet breakout for guest traffic while keeping corporate traffic on the VPN overlay. Which site configuration element is required to enable this design?

Which TWO dashboards are most useful for a daily operational health check?

Which THREE components are involved in configuring Prisma SD-WAN security policies?

Which aspects of a site's network are required for configuring the SD-WAN Controller? (Choose TWO)

A site deployment requires specific traffic to be exempted from the SD-WAN optimization process to ensure compatibility with a legacy application. Which policy should be updated?

A network engineer is troubleshooting an issue where a vEdge device shows as unreachable in vManage, but the device is still forwarding traffic. The engineer suspects a problem with the control plane. Which CLI command on the vEdge should be used to check the status of its control connections to the vSmart controllers?

A network engineer is analyzing a recurring issue where a specific site experiences intermittent packet loss on its WAN circuit. The engineer wants to determine whether the packet loss is occurring on the underlay or within the overlay tunnel. Which vManage monitoring feature provides the most direct insight into this?

When deploying a new ION device, which Prisma SD-WAN component is primarily used to initiate the zero-touch provisioning process?

Which log file on the ION device provides the most detailed information about WAN interface flapping?

Which THREE areas of configuration should you verify if a site cannot reach the local LAN gateway?

A branch is failing to load-balance traffic across two ISPs. Both are active. Which setting controls the load-balancing algorithm?

Which THREE items must be configured to ensure that traffic is correctly routed through a Service Connection for security inspection?

A network operations team is using Cisco vManage to monitor the health of their SD-WAN fabric. They want to create a custom dashboard that provides a quick overview of the most critical operational metrics for daily health checks. Which three widgets should they include to effectively monitor the overall health and performance of the SD-WAN fabric? (Choose three.)

In a multi-VRF deployment, what must be configured to allow traffic to move between two different VRFs?

During a Prisma SD-WAN design review, a team must decide how branch users will authenticate to the corporate identity provider for policy-based access to SaaS applications, without deploying a separate identity appliance at each branch. Which design approach should be recommended?

An engineer is troubleshooting why a WAN edge device shows an out-of-sync state with the vSmart controller in vManage, even though the control connection appears to be up. Which TWO conditions should the engineer verify to explain an out-of-sync policy or configuration state? (Choose two.)

A network architect is designing a branch site deployment requiring sub-second failover. Which Prisma SD-WAN component must be configured to prioritize real-time traffic across multiple transport paths based on path quality metrics?

A network engineer is deploying a new branch office with a Prisma SD-WAN ION device that will connect to Prisma Access for Unified SASE. The engineer needs to configure the ION device to establish a secure tunnel to the Prisma Access service infrastructure. Which protocol is used for this tunnel?

A network administrator is designing a Unified SASE solution for a retail company with many small branches. The company wants to reduce the complexity of managing separate security and networking policies. Which primary benefit of Unified SASE should the administrator highlight to the management team?

A company is designing a Prisma SD-WAN deployment for a branch that has a single MPLS circuit and a single internet circuit. The design requires that voice traffic use MPLS and fail over to internet only if MPLS latency exceeds 150 ms. Which Prisma SD-WAN policy configuration should be used to meet this requirement?

When configuring a security policy, what is the purpose of an 'Application' object?

A network engineer is investigating a performance issue in a Prisma SD-WAN environment where an ION device is showing high jitter on a business-critical VoIP call. The engineer has verified that the WAN link quality is good and that no policies are misconfigured. The engineer suspects that the issue might be due to the ION device's handling of the traffic. Which of the following should the engineer check next to determine if the ION device is correctly marking and prioritizing the VoIP traffic?

A multinational enterprise is designing a Prisma SD-WAN topology with hubs in North America, Europe, and Asia. The design requires that branch-to-branch traffic within the same region use direct tunnels, while inter-region traffic must traverse a regional hub for security inspection. Which Prisma SD-WAN design element should be used to enforce this traffic flow?

Which dashboard is most useful for identifying top bandwidth consumers in the network?

What is the function of the 'Reachability' check in the ION device configuration?

When implementing a CloudBlade for a cloud security service, what must be configured? (Choose THREE)

A network engineer is troubleshooting a branch ION device that fails to establish a control connection to the Prisma SD-WAN controller. The engineer verifies that the WAN interface has a valid IP address and can ping the default gateway. Which configuration issue is most likely preventing the control connection?

A network architect is designing a Unified SASE solution for a company with multiple branches. The company wants to ensure that all internet-bound traffic from branches is inspected by Cloud SWG, while traffic to internal applications is routed through a data center. The architect plans to use Prisma SD-WAN with Service Connections to Prisma Access. Which configuration approach should the architect recommend to meet these requirements?

Which THREE actions can be performed by a Prisma SD-WAN 'Policy' object?

A network administrator needs to monitor real-time application performance and path quality metrics for a specific site in Cisco vManage. Which menu should the administrator navigate to?

A network architect is planning a Prisma SD-WAN deployment for a retail chain with 400 small branches. Each branch will have two broadband circuits from different providers and must be able to fail over to a cellular modem during an outage. The architect wants to minimize hardware footprint and central management overhead. Which design element should be included in the plan to meet these requirements?

A network engineer is troubleshooting a site where traffic from a specific VLAN is not being forwarded to the correct VPN overlay. The engineer suspects a misconfiguration in the network policy. Which tool in the Prisma SD-WAN Orchestrator should the engineer use to view the effective policy applied to that site and verify the path selection decisions?

A network engineer is troubleshooting an SD-WAN deployment where an ION device at a branch site is not forming a control connection to the Prisma SD-WAN Controller. The device is powered on and has a link light on its WAN port. The engineer suspects a certificate or licensing issue. Which two items should the engineer verify to confirm the device's identity and authorization with the controller? (Choose two.)

Which TWO tools are available in the ION CLI for network connectivity testing?

A network administrator is configuring a Service Connection between a branch ION device and Prisma Access. The administrator wants to ensure that all traffic from the branch to the internet is inspected by the cloud SWG, while traffic to private applications goes directly over the VPN. Which configuration element on the ION device is used to define which traffic is sent to the Service Connection?

A financial services company is designing a Prisma SD-WAN deployment for its headquarters and 50 branch offices. The security team requires that all traffic from branches to the internet be inspected by a cloud-based security service without backhauling to headquarters. Which Prisma SD-WAN design element should you use to meet this requirement?

A company is designing a Prisma SD-WAN deployment for its data center and 100 branches. The design team needs to ensure that the data center can provide high availability and that branch traffic is securely encrypted. Which two design elements should be included to meet these requirements? (Choose two.)

A user reports slow speeds. You see that the interface is not hitting the configured throughput limit. What could be the issue?

A network administrator is configuring Prisma SD-WAN to integrate with Prisma Access using the Automated Service Connection. During the onboarding process, which specific parameter must be configured in the ION device's service route to ensure traffic is correctly steered to the Prisma Access Service Infrastructure?

When setting up a branch, you need to define the 'Underlay' transport. What does this refer to?

Which log is used to view denied traffic attempts?

A security architect is designing a Unified SASE deployment for a retail chain with 200 branch sites. The company wants to enforce consistent security policies for both internet-bound and private application traffic, while minimizing the number of separate management consoles. Which architectural component of Unified SASE directly provides this consolidation?

A network engineer is deploying a new branch ION device at a site with dual WAN circuits: a primary 500 Mbps fiber link and a secondary 100 Mbps LTE link. The design requires that the LTE link only carry traffic when the fiber link fails, and that all traffic return to the fiber link automatically once it recovers. Which configuration should the engineer apply on the ION device?

A network engineer is troubleshooting a Unified SASE deployment where branch users report that access to internal applications is slow after enabling Prisma Access inspection. The engineer confirms that internal traffic is being sent to Prisma Access instead of directly over the SD-WAN fabric. Which configuration change should the engineer make to resolve the issue?

An engineer notices that an ION device at a branch site shows a WAN interface status of 'up' in the Prisma SD-WAN orchestrator, but no traffic is being forwarded over that interface. The interface is configured for DHCP. Which troubleshooting step should be performed first to determine why the interface is not passing traffic?

An engineer is troubleshooting a scenario where users at a branch office cannot access SaaS applications via Prisma Access. The SD-WAN path is active, but the traffic is not reaching the Cloud SWG. What is the most likely cause related to the Unified SASE policy?

Which types of traffic should ideally be prioritized via QoS policies? (Choose TWO)

A network engineer is configuring a Unified SASE deployment with Prisma SD-WAN and Prisma Access. The engineer needs to ensure that user traffic from branch offices is securely forwarded to Prisma Access for inspection. Which TWO components are required to establish this secure forwarding? (Choose two.)

You are debugging a routing loop. Which tool can you use to see the BGP route advertisements received by an ION device?

Which component in the Unified SASE stack is responsible for enforcing URL filtering and threat prevention policies for remote users?

A healthcare organization is designing a Prisma SD-WAN deployment for 25 clinics. Each clinic will have two broadband circuits and a single ION device. The security team requires that all internet-bound traffic from the clinics be inspected by a cloud-delivered security service, and that traffic be automatically rerouted if the primary circuit degrades. Which design element should the engineer include to meet these requirements?

An ION device has experienced a configuration drift. How can you restore the last known good configuration?

A network administrator is troubleshooting a site that is experiencing poor voice quality over the SD-WAN. The administrator suspects that the voice traffic is not being prioritized correctly. Which SD-WAN feature should be verified to ensure that voice packets are marked and queued appropriately across the WAN?

Which THREE items are included in a Prisma SD-WAN 'Site' configuration?

A network engineer is troubleshooting why a branch ION device is not receiving any traffic from the data center. The engineer suspects that a firewall rule on the ION device is blocking traffic. Which log should the engineer check to see if traffic is being dropped by the firewall?

You are troubleshooting an SD-WAN environment where a branch site's vEdge reports that the BFD sessions to the remote data center are flapping every few minutes. The underlay transport is stable, and the WAN interface counters show no errors. You run 'show tunnel statistics' and observe periodic drops in the tunnel. Which action should you take FIRST to isolate the cause?

A healthcare organization is planning a Prisma SD-WAN design for its clinics. The design must ensure that each clinic can reach the internet directly for guest traffic while also reaching internal applications through the SD-WAN fabric. Which two design elements should be included in the site configuration? (Choose two.)

Which THREE parameters are essential when troubleshooting a Service Connection tunnel status?

Which TWO of these are valid ways to verify the status of an ION device's WAN interface?

An engineer notices that some traffic is not being optimized by the Prisma SD-WAN fabric. Upon inspection, the traffic is bypassing the SD-WAN tunnels. What is the most likely cause?

An engineer is analyzing an application-aware routing policy on a Cisco SD-WAN fabric. The policy is configured to steer business-critical traffic based on the best path according to BFD probes. After a recent change, the engineer notices that traffic is being forwarded over a path that has a higher latency than an alternative path, even though the BFD probes indicate the alternative path is better. The engineer verifies that the BFD sessions are up and the policy is applied to the correct VPN. What is the most likely cause of this behavior?

Which TWO items are checked by the ION device to determine if a WAN path is healthy?

A network administrator is configuring a new ION device at a branch. The administrator wants the device to obtain its IP address, default gateway, and DNS server automatically from the local ISP's DHCP server on the WAN interface. Which WAN interface configuration mode should be selected?

An enterprise is designing Prisma SD-WAN for a data center that hosts business-critical applications. The design requires that traffic from branch sites to these applications be steered over a specific set of high-performance circuits, while all other internet-bound traffic uses a different set of circuits. The solution must be scalable and not require per-application static routes on every branch device. What should be used in the design?

What is the primary function of the 'Cloud Identity Engine' in the Unified SASE architecture?

You are designing a hub-and-spoke topology where spokes need to communicate directly under specific conditions. Which feature should be enabled to optimize latency and minimize load on the regional hub?

When setting up a branch site, what is the purpose of the 'Underlay' configuration?

An administrator is deploying Prisma SD-WAN with Unified SASE. The administrator needs to ensure that the ION device can establish a service connection to Prisma Access. Which of the following must be configured on the ION device to allow the service connection to be established?

How are security logs from Prisma Access and Prisma SD-WAN correlated in a Unified SASE environment?

A network engineer is troubleshooting a Prisma SD-WAN deployment where a new ION device at a remote site fails to establish any data plane tunnels to other sites. The engineer has verified that the control connection to the controller is up and the device is showing as 'Connected' in the orchestrator. Which step should the engineer take next to diagnose the data plane tunnel issue?

Which protocol is primarily used for the tunnel between the ION device and the Prisma Access Service Infrastructure?

A network engineer is troubleshooting a Prisma SD-WAN site where a specific business-critical application is experiencing high latency. The engineer wants to quickly identify which WAN path the application traffic is currently using and its performance metrics. Which tool in the Prisma SD-WAN orchestrator should the engineer use?

An engineer needs to view real-time application-aware routing statistics for a specific site in vManage. Which menu path should the engineer use?

A customer requires a granular segmentation strategy where HR, Engineering, and Guest traffic must remain isolated across the SD-WAN fabric. Which configuration construct provides this logical separation?

When troubleshooting QoS, what does a high 'drop' count in the interface statistics imply?

A network architect is designing a Prisma SD-WAN deployment for a company with 50 branches. Each branch has two internet links from different ISPs. The architect wants to ensure that business-critical applications always use the best-performing link based on real-time latency, jitter, and packet loss. Additionally, the architect wants to avoid using a link that is experiencing high packet loss. Which Prisma SD-WAN feature should be configured to meet these requirements?

Which THREE components are verified during the ION device 'check' sequence at startup?

A network engineer is deploying a new branch location with a Prisma SD-WAN ION device. The branch has two WAN circuits: a primary fiber link and a backup LTE link. The engineer wants the ION device to automatically use the LTE link only when the fiber link fails. Which configuration should be applied to achieve this behavior?

A retail company is deploying Prisma SD-WAN at 300 branch sites. The design team wants to minimize the number of IP addresses used on the WAN side of each branch and avoid manually configuring static IPs on every CPE. Which WAN interface addressing method should be specified in the site design to meet these requirements?

You want to audit who changed a policy on the Controller. Where is this information logged?

A network administrator is troubleshooting a performance issue where voice traffic is being routed over a less optimal path despite a better path being available. The administrator suspects that the Application-Aware Routing policy is not functioning as intended. Which two actions should be taken to verify that the policy is correctly applied and the SLA is being met? (Choose two.)

You are designing an SD-WAN path for a high-bandwidth application that is sensitive to out-of-order packets. Which configuration setting minimizes packet reordering in a multi-path environment?

During the design of a large-scale data center migration, you need to extend Layer 2 domains across the SD-WAN fabric. Which mechanism supports this requirement?

A network administrator is troubleshooting an ION device that is experiencing intermittent packet loss on its WAN interface. The administrator wants to determine whether the issue is due to physical layer errors or congestion. Which CLI command provides the most detailed statistics for identifying such problems?

A network operations team wants to proactively detect and alert on control-plane issues in their Cisco SD-WAN fabric. They plan to use vManage alarms. Which TWO alarm types are directly related to control-plane connectivity? (Choose two.)

You are deploying Cloud Identity Engine (CIE) to enable identity-based security policies across your SD-WAN and SASE environment. Which configuration step is required to ensure that user identity information is successfully propagated from the enterprise directory to the Prisma Access security nodes?

A user is complaining about high latency for a SaaS app. The Path Quality dashboard shows low latency. What is the next logical step?

A company is deploying Unified SASE with Prisma SD-WAN and Prisma Access. The security team wants to ensure that traffic from branch ION devices is inspected by Prisma Access and that security logs from both products are correlated for unified reporting. Which TWO actions are required to achieve this integration? (Choose two.)

You have configured two different DCI paths. You want to load balance traffic across both paths. What OMP configuration must be set?

When troubleshooting a site-to-site VPN issue between two ION devices, which status should you check first?

A design team is planning a Prisma SD-WAN rollout and needs to document how branch sites will learn routes to remote subnets without manually defining every prefix. They want the fabric to automatically exchange reachability information between sites. Which capability should the design rely on?

Which THREE components are involved in the process of applying a user-based policy in a Unified SASE architecture?

When configuring 'NAT', what is the difference between 'Source NAT' and 'Destination NAT'?

Which TWO features are used to monitor the performance of an application across the SD-WAN?

Which of the following are components of the Prisma SD-WAN Controller interface? (Choose TWO)

When performing a 'Soft Shutdown' on an HA device, what is the expected behavior?

Which THREE items are required to successfully deploy a new branch ION device with zero-touch provisioning for a Unified SASE environment?

A network operations team is troubleshooting an intermittent voice-quality complaint at a branch. In vManage they open the Troubleshooting pane for the affected device and run a bidirectional application-aware traffic flow test between the branch and the voice gateway. The test completes successfully, but the team wants to confirm which physical WAN transport and which local interface the simulated flow actually traversed. Where should they look in the test results?

A network engineer is deploying a Unified SASE solution with Prisma SD-WAN and Prisma Access. The engineer needs to ensure that branch traffic destined for the internet is inspected by Prisma Access cloud security services, while traffic to internal data center applications goes directly over the SD-WAN fabric without inspection. Which configuration on the ION device accomplishes this?

An administrator wants to limit the bandwidth used by a specific application when routed to Prisma Access. Where is this configured?

A network operations team is troubleshooting an intermittent connectivity issue between two branch sites. The ION devices at both sites are managed by Prisma SD-WAN. The team suspects that the issue is related to the underlay network. Which two actions should the team perform to gather relevant troubleshooting data? (Choose two.)

An engineer is configuring a Prisma SD-WAN ION device at a branch with two WAN interfaces: one for internet and one for MPLS. The engineer wants to ensure that the ION uses the MPLS link for traffic to the data center and the internet link for cloud applications. What should the engineer configure?

A financial services company is designing a Prisma SD-WAN deployment with strict compliance requirements. The design must ensure that branch-to-branch traffic carrying cardholder data is encrypted end-to-end and that the SD-WAN fabric can prove which path was used for auditing. Which combination of Prisma SD-WAN features should be included in the design?

A financial services firm is designing Prisma SD-WAN for a hub-and-spoke topology where 25 regional offices connect to two data centers. The design must ensure that if a regional office loses its primary path to Data Center A, traffic can reach Data Center B without requiring a full mesh of tunnels between every branch pair. Which Prisma SD-WAN capability should the design rely on?

A healthcare provider is planning a Prisma SD-WAN rollout across 80 clinics. Each clinic has two broadband circuits from different ISPs and a requirement that telehealth video traffic maintain latency below 100 ms and jitter below 30 ms. The design must automatically steer telehealth traffic to the best-performing circuit and fail over if thresholds are breached. Which Prisma SD-WAN design element is required?

A company is migrating to a cloud-native architecture. How does Prisma SD-WAN support multi-cloud connectivity?

Where are the primary SD-WAN routing policies defined?