39 questions · Deployment And Configuration topic · All types, answers revealed
You need to ensure that traffic from a specific subnet is placed into a unique VRF. How is this achieved?
Interface-level mapping dictates VRF membership.
Why this answer
VRF assignment is mapped to local segments or subnets at the interface configuration level.
What is the purpose of 'Bandwidth Groups' in Prisma SD-WAN?
This simplifies policy application across grouped links.
Why this answer
Bandwidth groups aggregate multiple WAN links to manage total capacity and policy-based steering as a single logical pipe.
A branch office requires local breakout for SaaS traffic. How do you configure the policy to ensure this traffic does not traverse the data center?
Local breakout action directs traffic to the local WAN interface.
Why this answer
The destination-based policy for direct internet access (DIA) ensures local traffic exits locally.
You need to restrict administrative access to the ION device. Where is this configured?
This is the correct location for restricting management access.
Why this answer
Management access policies are defined under the device configuration settings in the Controller.
How does Prisma SD-WAN handle DNS queries for branch users?
DNS proxying is a standard feature to optimize performance.
Why this answer
Prisma SD-WAN can act as a DNS proxy or forwarder to improve efficiency.
Which Prisma SD-WAN component is responsible for orchestrating the overall security policy across the entire fabric?
The Controller is the central management authority.
Why this answer
The Controller manages global policies, including security policies, pushed to ION devices.
When configuring an ION device as a gateway for a cloud environment, what is the primary role of a 'Service' interface?
Service interfaces handle internal traffic segments.
Why this answer
Service interfaces are designated for specific traffic flows or service chains within the SD-WAN fabric.
Which TWO of the following are benefits of using Prisma SD-WAN?
Centralization is a key benefit.
Why this answer
The solution aims to simplify management and optimize performance.
What is the effect of changing the 'Path Selection' strategy from 'Latency' to 'Lowest Cost' in a policy?
Cost is the primary factor in this algorithm.
Why this answer
'Lowest Cost' prioritizes links with lower administrative or service costs rather than performance metrics.
If a user at a branch site reports that they cannot access a specific internal server, which diagnostic tool should you use first?
This allows you to see the traffic path and drop points.
Why this answer
Flow monitoring allows you to see if traffic is hitting the expected policy and where it is being dropped or steered.
Which TWO factors are used by Prisma SD-WAN to determine the health of a WAN path?
Loss is a primary performance metric.
Why this answer
The SD-WAN engine monitors latency and loss to calculate path quality.
What is the primary function of the 'Controller' dashboard in the Prisma SD-WAN UI?
The dashboard is for monitoring.
Why this answer
The dashboard provides a high-level view of health, status, and traffic analytics.
Which command or interface action is used to verify the current status of the SD-WAN overlay tunnels?
This interface specifically tracks SD-WAN overlay status.
Why this answer
The Controller dashboard or the ION CLI provides real-time tunnel status.
What is the impact of assigning a site to a specific 'Site Group' in a Prisma SD-WAN policy?
This is the core purpose of logical grouping.
Why this answer
Site Groups allow for scalable policy application across multiple sites with similar requirements.
You need to ensure that specific branch traffic is encrypted over a public internet link. Which configuration step is mandatory?
Auto-VPN is the primary mechanism for secure site-to-site connectivity.
Why this answer
VPN tunnels are established automatically between ION devices when policies are defined, but the path must be categorized to allow tunnel formation.
Which THREE types of information are displayed in the Prisma SD-WAN 'Flow Monitoring' view?
Identifies the endpoints.
Why this answer
Flow monitoring provides details on path, performance, and application statistics.
You are implementing a QoS policy. Why would you configure a 'Shaping' rate on a WAN interface?
Shaping aligns egress traffic with the ISP's bandwidth contract.
Why this answer
Shaping limits the outbound rate of traffic to match the committed information rate (CIR) of the circuit.
How does a 'Failover' policy differ from a 'Load Balancing' policy in Prisma SD-WAN?
Failover switches to a secondary link only upon primary failure.
Why this answer
Failover is reactive to link loss, while load balancing distributes traffic across links simultaneously.
A customer wants to prioritize Office 365 traffic over general web traffic. What is the most efficient way to achieve this?
Application-aware policies are designed for this purpose.
Why this answer
Using an application-based policy allows for granular control over Office 365 specifically.
What does the 'App-ID' feature provide in a security policy?
App-ID inspects traffic to identify apps.
Why this answer
App-ID identifies the application regardless of the port being used.
When using Prisma SD-WAN with Prisma Access, how is the secure tunnel established?
The integration automates the tunnel creation.
Why this answer
The ION device automatically provisions an IPsec tunnel to the Prisma Access Cloud Service Edge (CSE).
You are configuring a path policy to prioritize VoIP traffic. Which specific metric should you leverage to ensure the best call quality when multiple paths are available?
Performance metrics monitor latency, jitter, and loss to steer traffic.
Why this answer
Jitter and latency are critical for voice; the policy uses performance metrics to steer traffic dynamically.
Which THREE settings are typically defined during the initial ION site provisioning?
Required for connectivity.
Why this answer
Provisioning involves setting up basic connectivity, identifying the site, and assigning basic policies.
Which TWO components are essential for maintaining the SD-WAN control plane?
The heart of the control plane.
Why this answer
The control plane relies on the Controller and the secure communication between the Controller and the ION devices.
Which TWO items are considered 'Underlay' resources in a Prisma SD-WAN configuration?
A physical transport link.
Why this answer
Underlay refers to the physical transport connectivity.
Which THREE components are involved in configuring Prisma SD-WAN security policies?
Required to identify specific traffic types.
Why this answer
Security policies rely on application identification, zone definitions, and action rules.
When deploying a new ION device, which Prisma SD-WAN component is primarily used to initiate the zero-touch provisioning process?
The Controller manages the ZTP process and configuration pushing.
Why this answer
The ION device reaches out to the Controller during the initial bootstrap process to pull its configuration and firmware.
In a multi-VRF deployment, what must be configured to allow traffic to move between two different VRFs?
Policies are needed to permit traffic leakage between isolated VRFs.
Why this answer
Cross-VRF communication requires explicit route leaking or inter-VRF routing policies.
When configuring a security policy, what is the purpose of an 'Application' object?
This enables Layer 7 policy enforcement.
Why this answer
Application objects identify traffic by signature, allowing for specific policy control.
Which THREE actions can be performed by a Prisma SD-WAN 'Policy' object?
Determines which link traffic takes.
Why this answer
Policies can steer traffic, prioritize it, or apply security constraints.
Which THREE items are included in a Prisma SD-WAN 'Site' configuration?
Defines the physical connectivity.
Why this answer
A site definition includes location, hardware assignment, and local interface definitions.
When setting up a branch site, what is the purpose of the 'Underlay' configuration?
This defines the physical WAN characteristics.
Why this answer
Underlay configuration defines the physical WAN circuit parameters (ISP, bandwidth, etc.) for the SD-WAN tunnel overlay.
Which THREE types of traffic are commonly categorized for specific QoS treatment?
Business-priority traffic.
Why this answer
QoS focuses on real-time and business-critical traffic.
What is the primary benefit of enabling 'Forward Error Correction' (FEC) on a high-latency WAN link?
FEC helps recover lost packets, crucial for voice/video.
Why this answer
FEC adds redundant data to packets, allowing the receiver to reconstruct lost packets without retransmission.
Which TWO methods can be used to identify traffic for a policy?
Standard L3/L4 classification.
Why this answer
Traffic can be identified by application or by IP/port-based rules.
When configuring 'NAT', what is the difference between 'Source NAT' and 'Destination NAT'?
Correct definitions of NAT types.
Why this answer
Source NAT modifies the source IP for outbound traffic; Destination NAT modifies the destination IP for inbound traffic.
Which TWO features are used to monitor the performance of an application across the SD-WAN?
Tracks latency/loss of the tunnel.
Why this answer
Performance monitoring uses traffic flow data and path statistics.
You are troubleshooting a performance issue where traffic is not taking the preferred path. Which tool in the Controller helps you visualize the path taken?
Flow monitoring provides deep visibility into the path and policy enforcement.
Why this answer
The path visualization tool displays the real-time path selected by the SD-WAN engine.
Where are the primary SD-WAN routing policies defined?
The Controller is the central location for policy management.
Why this answer
Policies are defined centrally in the Controller and pushed to the edge devices.
Ready to test yourself?
Try a timed practice session using only Deployment And Configuration questions.