CCNA Unified SASE Questions

Zones segment traffic by origin, letting the ION apply distinct security and routing policies per segment. This satisfies the scenario's need to differentiate handling based on where traffic enters, rather than treating all ingress identically.

Unified Logging Service aggregates traffic, threat and tunnel logs from Prisma Access and Prisma SD-WAN into one cloud repository, giving correlated visibility across the Unified SASE fabric. This satisfies the stem's need to monitor traffic flow end to end rather than per-component.

Associating applications with security policies lets the controller enforce application-aware rules centrally, satisfying the requirement to manage SASE policy by application identity rather than by IP or port. The controller distributes these mappings to edge devices, so traffic matching a defined application receives the correct inspection and forwarding treatment.

The Cloud Identity Engine aggregates and maps identity sources, resolving users to the correct directory entries for policy and logging. Incorrect user attribution in security logs therefore points to a misconfigured or stale identity mapping there, rather than to the dataplane or policy layers.

The ION device must have a policy that matches the desired traffic and sets the action to forward it to the Prisma Access Service Connection. This is typically done via a policy-based routing rule or an application policy. Without this, traffic will follow the default route and bypass inspection.

Policy-Based Forwarding allows the ION device to make forwarding decisions based on traffic characteristics such as source/destination IP, application, or user group. By creating a traffic policy that matches corporate subnets and steers them into the Prisma Access tunnel, while allowing guest traffic to use the local internet breakout, the engineer achieves the required segmentation without additional tunnels or complex routing. This is the intended method in Prisma SD-WAN for selective traffic redirection.

In Prisma SD-WAN, policy rules determine how traffic is handled. To steer internet-bound traffic to Prisma Access, you must create a policy rule that matches that traffic and specifies the action to use the service connection. Without this rule, the service connection remains unused for that traffic, and it will follow the default path, bypassing Prisma Access. This step is essential for directing traffic to the security service.

A Service Connection is a logical link between a Prisma SD-WAN ION device and a Prisma Access service infrastructure that automatically creates secure tunnels for traffic steering to security services like SWG. Configuring a Service Connection allows the branch to send internet-bound traffic to Prisma Access for inspection without manual tunnel setup, exactly as required.

Defining QoS on the Prisma SD-WAN Controller's Application QoS Policy lets the controller classify and prioritise voice across all branches centrally, satisfying the consistent-performance constraint. Edge-only policies would vary per site and could not enforce uniform priority.

The Prisma SD-WAN Controller is the centralised management plane that stores and pushes configuration and policy to every ION device in the fleet. This satisfies the requirement for a single component managing policy definition across the devices.

The Controller Service Connection Status Dashboard reports tunnel state as seen by the controller, showing whether the branch ION's Service Connection to Prisma Access is up or down, which is more authoritative than local interface or routing output.

Unified SASE converges networking and security into a single cloud-delivered platform, so one console governs both traffic forwarding and security policy. This eliminates the policy drift and duplicated administration inherent in stitching separate SD-WAN and security stacks together, delivering the consistent enforcement the architecture promises.

SD-WAN continuously monitors path health and, on primary link failure, reroutes traffic over a secondary WAN link, preserving the tunnel to Prisma Access. This satisfies the resilience constraint by maintaining the Unified SASE connection without manual intervention.

A Network Policy Rule with a higher priority than the default rule will match Microsoft 365 traffic and steer it to the Service Connection, ensuring it is inspected by Prisma Access. This prevents backhauling to the data center. The default rule can then handle other traffic, allowing direct internet access or other paths as configured.

Policy-based forwarding allows the architect to create rules that match specific applications, such as Microsoft 365, and direct them to a local internet breakout while sending all other traffic to Prisma Access. This provides both security inspection and performance optimization for the specified application.

Application Groups bundle multiple applications under one logical object, so a single steering policy covers them all. This removes per-application rule duplication and guarantees identical path selection across the group, satisfying the requirement for consistent policy application across many applications.

A Prisma SD-WAN policy can match traffic by destination and apply different actions. By creating a rule that sends internal application traffic directly over the SD-WAN fabric and a default rule that sends other traffic to Prisma Access, the engineer meets both requirements. This provides the necessary granularity and ensures inspection only where needed.

The CloudBlade integration between Prisma SD-WAN and Prisma Access uses a shared tenant and a correlation ID to link traffic logs. When enabled, logs from both systems include this identifier, allowing administrators to correlate events. This is the required configuration to achieve the desired log correlation.

Prisma Access adds encapsulation overhead, reducing the effective MTU on the tunnel. If the ION's interface MTU is not lowered accordingly, larger packets are dropped rather than fragmented, producing intermittent failures on internal applications that exchange bulk data.

The Monitor > Service Connections view in Prisma SD-WAN provides real-time status of service connections, including whether they are up or down, and statistics on traffic sent and received. It is the primary dashboard for verifying connectivity and traffic flow to Prisma Access, making it the correct choice.

The integration lets Prisma SD-WAN steer traffic per application while sharing telemetry with Prisma Access, delivering unified visibility and automated steering driven by security requirements. This satisfies the Direct to App policy's need to bypass backhaul without losing enforcement.

Path steering policies detect link degradation and reroute traffic across the active tunnels, satisfying the HA requirement for automatic failover without manual intervention. Without them, a failed or degraded WAN path leaves the Service Connection black-holed, so steering logic is essential to maintain continuous Prisma Access connectivity.

In Unified SASE, the ION device uses service connections to direct specific traffic to Prisma Access for security inspection. If the service connection is active but the traffic steering rules are not correctly configured, application traffic will bypass Prisma Access. The engineer must verify that the service connection includes the correct traffic selectors and that the ION device is configured to use it for the relevant applications.

Unified SASE path selection can steer traffic according to identity-based policy, so the user's department or group influences which path and security service chain the session takes. This satisfies the identity-driven factor the question requires.

Unified SASE steers traffic based on application definitions and policies. Verifying that the SaaS application is correctly defined and that the steering policy matches it ensures the traffic is directed to Prisma Access. This is the first logical step to confirm whether the policy is correctly configured.

Service Connection event logs record the tunnel negotiation, IKE/IPsec state changes and heartbeat failures between the ION device and Prisma Access nodes. This is the only log source that captures the specific reason the connection cannot establish or stay up, directly addressing the persistent 'Service Connection Down' symptom.

This solution uses application identification to distinguish SaaS traffic from general internet traffic. By directing known SaaS applications to a local breakout and all remaining internet traffic through the Service Connection, it ensures Cloud SWG inspection for general web traffic while optimizing SaaS performance through direct paths, exactly matching the security team's requirements.

Application-based policy allows the engineer to classify traffic by application or destination and steer it accordingly. Internet-bound SaaS flows can be sent through the Service Connection to Prisma Access for inspection, while internal data center prefixes use a direct SD-WAN path. This meets both inspection and no-backhaul requirements.

Automation replaces repetitive CLI entry with templated provisioning, eliminating transcription mistakes across sites. This directly satisfies the stem's demand for reduced manual configuration steps and lower error risk, since each hand-typed tunnel parameter is a potential misconfiguration. Manual configuration cannot match this consistency at scale.

This is a common issue in Unified SASE deployments. When traffic is steered to Prisma Access, the return traffic must also traverse the same Prisma Access location to maintain stateful inspection. If the CRM application's servers are reachable via multiple paths, return traffic might take a different route, leading to asymmetric routing and dropped sessions. This would cause timeouts even though the service connection is up and the policy allows the application.

Prisma Access gateways terminate the IPsec tunnels that carry the Service Connection, so the on-premises device must know their public IP addresses or FQDNs to initiate IKE. Without these endpoints, tunnel establishment cannot begin, satisfying the stem's requirement for a successful Service Connection.

Policy Sets in Prisma SD-WAN contain ordered rules that match traffic based on criteria such as application, source, destination, and then apply actions like steering to a service connection. By configuring a policy set, the engineer can specify that certain traffic (e.g., internet-bound) is sent to Prisma Access, while other traffic (e.g., to data center subnets) uses the direct SD-WAN path. This is the correct feature for controlling traffic flow.

The ION serial number uniquely identifies each device during onboarding to Prisma Access, binding it to the correct tenant and enabling policy assignment. Without this unique identifier, the controller cannot authenticate the specific device or push the appropriate configuration, satisfying the deployment's requirement for secure, per-device provisioning.

The Cloud Identity Engine maps IP addresses to user identities, enabling user-based policy enforcement where traffic lacks native identity. This satisfies the requirement to apply identity-aware rules to traffic originating from unmanaged or shared endpoints.

SaaS application traffic is steered to Prisma Access because inline security inspection requires the cloud service to broker sessions to sanctioned SaaS providers. This satisfies the stem's Unified SASE constraint, where Prisma Access enforces tenant-aware policy and data-loss prevention on SaaS flows that direct internet breakout cannot inspect.

The flow diagnostic tool traces the actual forwarding decision hop by hop, exposing which path-selection rule matched and why the branch traffic diverted from the optimal Prisma Access path. It reads the live policy evaluation rather than inferring it from configuration, directly satisfying the need to verify path selection logic.

In Prisma SD-WAN, routing decisions are based on longest prefix match. If the Service Connection advertises a more specific route to the application's IP than the VPN connection, the ION will prefer that path. This would cause internal traffic to be sent to Prisma Access instead of the data center VPN, explaining why users cannot reach the application despite it being reachable from other sites.

Application Steering policies define which traffic classes are redirected into the Service Connection rather than sent direct to the internet. Without a steering policy matching the target applications, traffic bypasses the tunnel entirely, so no security inspection occurs.

Prisma SD-WAN ION devices establish secure tunnels to Prisma Access using IPsec. This protocol provides encryption and authentication for the traffic traversing the public internet between the branch and the Prisma Access service infrastructure. IPsec is the standard for site-to-cloud tunnels in Unified SASE deployments, ensuring confidentiality and integrity of data in transit.

Unified SASE integrates SD-WAN and security services (such as SWG, CASB, ZTNA, and FWaaS) into a single cloud platform. This consolidation allows administrators to define and enforce consistent policies across all locations and users from a central console, reducing the need to manage separate networking and security appliances. For a retail company with many branches, this greatly simplifies operations and ensures uniform security posture.

This approach uses Service Connections to steer internet-bound traffic to Prisma Access for Cloud SWG inspection, while internal traffic is routed to the data center via the default route. It meets the requirements by selectively directing traffic based on destination, ensuring security inspection for internet traffic and efficient routing for internal applications.

In Prisma SD-WAN, policy rules are the mechanism that determines how traffic is routed. By creating rules that match internet-bound traffic and set the Service Connection as the destination, the administrator can ensure that only that traffic is inspected by the cloud SWG. Private application traffic can be matched by separate rules to use the VPN, achieving the desired split.

The Service Connection object binds the ION device's service route to the specific Prisma Access tunnel, steering matching traffic into the service infrastructure. Without this binding, the ION cannot identify which tunnel carries the Automated Service Connection.

Unified SASE converges networking (SD-WAN) and security (SWG, FWaaS, ZTNA, CASB) into a single cloud-delivered service with a shared policy engine. This single-pass architecture eliminates the need for separate consoles and ensures consistent enforcement for all traffic types, directly meeting the requirement to reduce management overhead while applying uniform policies.

The problem is that internal traffic is being backhauled to Prisma Access, causing latency. Adjusting the application-based policy to match internal prefixes and steer them over a direct SD-WAN path restores optimal routing while keeping internet-bound traffic inspected. This directly addresses the root cause.

The Unified SASE policy action determines whether branch traffic traverses the Prisma Access service infrastructure or exits locally. 'Direct to Internet' bypasses Cloud SWG entirely, so SaaS traffic never reaches it despite the active SD-WAN path.

A service connection is the secure tunnel that carries traffic from the ION device to Prisma Access. Without it, traffic cannot be forwarded to Prisma Access for inspection. It is a fundamental component for integrating Prisma SD-WAN with Prisma Access in a Unified SASE architecture.

Prisma Access is the cloud-delivered security platform that inspects remote-user traffic, enforcing URL filtering and threat prevention through its security processing nodes. It satisfies the requirement because enforcement occurs in the SASE security layer, not on the SD-WAN fabric.

Tunnel interface MTU settings directly govern whether encapsulated SD-WAN packets survive transit without fragmentation or silent drops, making MTU a primary diagnostic axis for tunnel status. Mismatched MTU between overlay endpoints causes handshake failures and flapping, so verifying this parameter is essential when troubleshooting a Service Connection tunnel.

Local breakout rules are evaluated before tunnel forwarding, so matching traffic egresses the local internet path instead of entering the SD-WAN overlay. This precedence explains why those flows bypass the tunnels and receive no fabric optimisation.

The Cloud Identity Engine aggregates identity from multiple directories and IdPs into one normalised source that security policies reference. Rather than each policy querying separate identity stores, CIE supplies the authoritative user and group context, satisfying the requirement for a central identity source in Unified SASE.

To establish a service connection, the ION device must be configured with the Prisma Access tenant details (such as the tenant name or ID) and must have a way to reach Prisma Access, either via a public IP address or through NAT traversal if behind a NAT device. This allows the IPsec tunnel to be initiated and established. Without these, the service connection cannot come up.

Prisma Access and Prisma SD-WAN forward their security events into a shared unified logging service, which normalises and correlates records from both products. This common logging layer links activity across the SASE fabric, giving one consolidated view rather than separate per-product log stores.

IPSec provides the encrypted tunnel between the ION device and Prisma Access service infrastructure, authenticating both peers and protecting traffic in transit. It is the standard encapsulation for this site-to-cloud connection, satisfying the requirement for the primary tunnel protocol.

Linking Prisma Access to the Cloud Identity Engine via API Key and Tenant ID authorises the security nodes to query CIE for user-to-IP mappings. Without this binding, directory identity data cannot be retrieved, so identity-based policies fail to resolve users.

Unified SASE log correlation and unified policy require that Prisma Access and Prisma SD-WAN are managed under the same tenant or integrated portal. This allows the system to correlate events and apply consistent security policies across both products.

The Prisma SD-WAN Controller distributes user-based policy to branch devices, translating identity-aware rules into enforceable forwarding decisions at the SD-WAN edge. This satisfies the stem's requirement for the policy distribution component within the Unified SASE user-policy workflow.

Registering the device serial number in the controller is mandatory for zero-touch provisioning: it binds the physical ION appliance to its tenant and configuration profile before shipment. Without this pre-registration, the controller cannot authenticate or push the bootstrap configuration to the branch device, so the deployment fails.

This is the correct approach. In Prisma SD-WAN, you define policy rules that classify traffic by application, destination, or other criteria. Internet-bound traffic can be steered to a service connection that points to Prisma Access for inspection, while internal traffic follows the direct SD-WAN path. This ensures security for internet traffic without adding latency to internal applications.

The SD-WAN Application Policy defines per-application handling, including bandwidth limits, for traffic steered to Prisma Access. Configuring the limit there ties the restriction to the specific application and its SD-WAN path, satisfying the requirement to cap that application's bandwidth.