CCNA Deployment And Configuration Questions

VRF membership is bound at the interface level: assigning the subnet's interface to the target VRF places its traffic into that routing table. The stem's requirement for a unique VRF per subnet is met because interface-to-VRF mapping, not policy or prefix lists, determines forwarding separation.

Bandwidth Groups define aggregated capacity thresholds that path policies reference when selecting WAN links, satisfying the requirement to manage total available bandwidth across circuits. Rather than per-link limits, they let policies enforce admission control against combined capacity, ensuring traffic steering respects the aggregate ceiling configured for a site's paths.

ION devices initiate outbound connections to the management plane, so a DHCP-assigned address is sufficient for ongoing reachability and monitoring. No inbound static address is required because the device maintains the tunnel from behind the dynamic WAN address. This satisfies the requirement without ISP changes.

The ION device establishes a secure control plane connection to the Prisma SD-WAN controller over TCP port 443. This port is used for the initial registration and ongoing control communication. Ensuring outbound TCP 443 is allowed is mandatory for the device to be managed and to receive policies.

A destination-based policy matches traffic by its target address, so SaaS prefixes can be steered to a Local Breakout action that sends them directly out the branch WAN interface. This satisfies the requirement that SaaS traffic must not traverse the data centre.

Access Control under Device Configuration governs administrative access to the ION device, letting you restrict which users or roles may log in and manage it. This directly satisfies the requirement to limit admin access at the device level rather than through a broader template or orchestration layer.

Prisma SD-WAN can intercept branch DNS queries and proxy them to configured resolvers, letting the branch forward name resolution through the overlay rather than relying solely on local ISP DNS. This centralises resolution and enforces policy on outbound queries.

This is correct because a path selection policy with lowest-latency criteria continuously evaluates both WAN links and directs voice traffic over the best-performing path, while the failover action ensures traffic moves to the secondary link if the primary degrades. This directly satisfies the requirement for guaranteed low-latency voice routing without manual intervention.

The Prisma Controller is the centralised management plane that defines and distributes security policy across all Prisma SD-WAN branches and data centres. It orchestrates fabric-wide policy, unlike the forwarding elements that merely enforce it locally.

A Service interface on an ION device connects to LAN-side services or segments, allowing local traffic to reach internal resources. It is distinct from WAN or tunnel interfaces, which handle overlay connectivity toward remote sites or cloud environments.

Traffic policies in Prisma SD-WAN allow you to specify a preferred path and define failover conditions based on performance metrics like latency. By setting the preferred path to MPLS and configuring a failover condition when latency exceeds 100 ms, the policy will automatically switch to broadband when the threshold is breached. This meets the requirement precisely.

A path selection policy can monitor the MPLS link and automatically redirect traffic to the broadband link if the MPLS link fails. This provides the required automatic failover without manual intervention, ensuring continuous connectivity for all traffic.

Prisma SD-WAN's centralized Controller delivers a single management plane for all branches, eliminating per-device CLI configuration. This directly satisfies the stem's simplified-management benefit, since policy is defined once and pushed automatically to every site, reducing operational overhead and configuration drift across the fabric.

ZTP allows the ION to automatically discover the controller using its serial number and the LTE interface's dynamic IP. The ION initiates an outbound connection, so no inbound reachability is needed. This is the intended deployment method for dynamic WAN links and is fully supported for LTE.

Lowest Cost replaces the latency-based metric with administrator-defined cost values, so the policy selects the link with the lowest configured cost rather than the lowest measured latency. This satisfies scenarios where link expense, not performance, drives path preference.

Flow Monitoring logs record per-flow forwarding decisions, including which policy and tunnel a flow matched, so they reveal why traffic to that internal server was dropped or misrouted. Reviewing them first pinpoints the branch-level cause before deeper troubleshooting.

A path selection policy with latency and packet loss thresholds is essential because it defines the acceptable performance criteria for the primary link. When these thresholds are exceeded, the policy triggers failover to the secondary link, ensuring that traffic is moved based on real-time link quality.

A path group defines a set of WAN links that can be used for traffic steering. By including both MPLS and broadband in a path group and assigning it to the data center policy, the ION will use MPLS when available and fail over to broadband if MPLS fails. This provides automatic failover based on link health.

Source NAT (SNAT) translates the source IP of internal traffic to the public WAN IP when traffic egresses to the internet. This hides private addresses and allows return traffic to be routed back. It is the standard method for enabling internet access for private LAN users behind a single public IP.

Packet loss is a measured path-quality metric: Prisma SD-WAN continuously probes WAN paths and uses loss percentages to score health and trigger path selection. It satisfies the stem's health-determination criterion alongside latency and jitter, directly reflecting degraded forwarding.

The Controller dashboard aggregates telemetry from all branches and gateways, presenting fabric-wide health, link status and event summaries. This satisfies the question's focus on the primary function, giving operators a single pane for monitoring rather than per-device or per-policy configuration views.

Prisma SD-WAN policies are evaluated in order, and the first match wins. If a higher-priority policy matches voice traffic and directs it to the internet, the voice-specific policy will never be evaluated. Policy ordering is critical; the voice policy must be placed above any broader policies that could match the same traffic.

ION devices are the branch CPE that perform the actual data-plane forwarding, encryption, and policy enforcement. Each of the 200 branches needs an ION device to terminate the broadband circuit and participate in the SD-WAN fabric. Without a branch ION device, there is no data plane at the site, so this component is mandatory for the described deployment.

The Controller's Show tunnels view displays per-tunnel operational state, including BFD session status and uptime, for every WAN edge device in the overlay. This gives the authoritative control-plane and data-plane view needed to verify whether IPsec tunnels are up, down or flapping.

Site Groups are logical collections of sites, and policy sets are attached to the group rather than each site individually. Assigning a site to a group therefore lets one policy set apply to every member site at once, satisfying the requirement to configure multiple sites simultaneously.

Flow Monitoring correlates each flow's endpoints, so source and destination IP addresses appear alongside ports, protocol and application identification. This satisfies the question's requirement for one of the three displayed information types, letting operators trace which hosts exchanged traffic across the fabric.

VRRP allows two or more devices to share a virtual IP address and MAC address, providing a redundant default gateway for LAN hosts. If the master ION device fails, the backup takes over the virtual IP, ensuring continuous connectivity without changing host configurations.

Path quality monitoring continuously measures latency, jitter, and packet loss on each WAN path. When thresholds are exceeded, the system can automatically steer traffic to a healthier path. This provides the automatic failover on degradation that the engineer requires, without manual intervention.

Shaping buffers excess traffic and delays it, rather than dropping it as policing does, so egress never exceeds the provider's provisioned rate. This directly satisfies the stem's congestion-management goal by smoothing bursts to the contracted bandwidth, preventing downstream provider drops.

Failover policy sends traffic over a single active link and switches to the standby path only when that link degrades, whereas load balancing distributes flows across multiple links simultaneously. This active/standby behaviour is the defining difference between the two policy types.

Application-aware policies inspect traffic signatures to identify Office 365 flows, then apply QoS marking and path selection without manual IP or port lists. This directly satisfies the stem's requirement to prioritise Office 365 over general web traffic, since Microsoft's constantly changing service endpoints make static ACL-based classification impractical and inefficient.

Zero-Touch Provisioning lets an ION device authenticate to the controller and pull its configuration automatically once it has internet access. Pre-staging the device claim in the controller associates the hardware with the correct site and template. This eliminates the need for on-site IT staff and matches the requirement for automatic configuration at power-on.

Path affinity maintains flow stickiness so that return traffic traverses the same WAN interface that carried the outbound session. This preserves symmetric routing, allowing stateful inspection devices in the data center to observe both directions of each flow. It directly satisfies the stated design requirement for the dual-ISP branch.

App-ID classifies traffic by inspecting application signatures and behaviour, identifying applications dynamically regardless of port, protocol or encryption. This satisfies the requirement to recognise applications as they actually appear on the network, rather than relying on static port-based identification.

Source NAT translates private internal IP addresses to the public IP address of the WAN interface, allowing internal users to access the internet. This is the standard method for hiding private addresses and enabling outbound internet access. The ION device performs source NAT by default on WAN interfaces for traffic originating from the LAN, unless configured otherwise.

A direct internet breakout action in an application policy allows the ION device to forward matching traffic out of the local WAN interface without entering the SD-WAN overlay. This is exactly the behavior required for guest Wi-Fi traffic that should not consume overlay bandwidth or traverse the data center. It keeps guest traffic local to the branch.

Staging on a wired network lets the device download software and validate configuration without consuming metered LTE data. Once staged and verified, it can be moved to the branch and activated on the LTE circuit. This meets both the data-conservation and validation goals efficiently.

Prisma SD-WAN's Controller automates IPSec tunnel provisioning to Prisma Access, removing manual configuration of peer addresses and keys. This satisfies the stem's requirement for how the secure tunnel is established between the branch and Prisma Access, using the Controller's orchestration rather than static, hand-built tunnels.

ZTP allows the ION device to automatically connect to the Prisma SD-WAN controller using a pre-shared claim code, download its configuration, and establish tunnels without manual CLI input. This is the standard deployment method for branch devices and satisfies the requirement for automatic secure tunnel establishment.

This policy directly addresses the requirement: it identifies data center traffic, prioritizes MPLS as the primary path, and designates broadband as the backup with IPsec encryption. This ensures that data center traffic uses MPLS normally and securely fails over to broadband when MPLS fails, meeting both routing and security needs.

Path performance continuously measures latency, jitter and packet loss across available WAN paths, letting the policy steer VoIP flows onto the healthiest link. Voice quality depends on these real-time characteristics rather than static attributes, so this metric directly satisfies the prioritisation requirement.

WAN interface settings define the physical and logical uplink configuration — IP addressing, VLAN tagging and bandwidth — that the ION appliance needs before it can establish overlay tunnels to the SD-WAN controller. Without these, the device cannot reach the orchestrator, so they are provisioned at initial site setup.

The controller maintains the SD-WAN control plane, distributing fabric topology, policy and tunnel information to branches. It satisfies the stem's control-plane requirement because elements and sites rely on the controller for orchestration and reachability signalling, rather than forwarding user traffic themselves.

Dynamic ISP circuits require the WAN interface to use DHCP so it can receive the current public address. Applying the correct WAN label allows the controller to recognize the interface role and build tunnels properly. Together, DHCP addressing and the correct label ensure the ION device can register and establish SD-WAN tunnels even when the public IP changes.

Source NAT translates the private source IP addresses of the local subnet to the public WAN IP, allowing outbound internet access. This is the standard configuration for hiding internal addresses behind a single public IP, and it matches the requirement to translate all traffic from the local subnet.

Public Internet broadband is an underlay transport: it provides the physical IP reachability that Prisma SD-WAN overlays tunnels across. The stem asks which resources form the underlay, and broadband circuits supply the raw connectivity beneath the fabric, independent of any overlay policy.

Application objects are reusable definitions identifying traffic by signature, port or IP, and security policies reference them as match criteria. They satisfy the stem's configuration requirement because rules cannot target specific applications without these objects, which feed directly into policy construction.

The Controller orchestrates zero-touch provisioning: on first boot the ION device authenticates to the Controller, which pushes the assigned configuration and software, bringing the device online without manual intervention. This satisfies the requirement to initiate provisioning automatically during deployment.

VRFs are isolated routing tables, so routes and traffic never leak between them by default. Inter-VRF routing policies explicitly permit and direct traffic from one VRF into another, which is the required configuration for cross-VRF communication.

Application objects match traffic using deep packet inspection against application signatures, so policies can allow or block specific applications regardless of the port they use. This satisfies the requirement to identify traffic beyond port-based rules, which port-only policies cannot achieve.

If the ION device lacks a DNS server or has an incorrect DNS configuration, it cannot resolve the controller's FQDN. Without resolution, the device cannot initiate the control connection, even if basic IP connectivity exists. This is a common oversight during deployment.

Path selection is a policy action: Prisma SD-WAN policies evaluate traffic against match criteria and steer it across the best available WAN path. It satisfies the stem's action requirement because the policy object actively chooses the egress path rather than merely classifying or logging traffic.

A failover WAN bundle designates one member as active and keeps the other in standby. The ION device monitors the primary path and only shifts traffic to the standby LTE member when the primary fails, then automatically reverts when the fiber path recovers. This matches the active/standby requirement with automatic failback exactly.

Interface configuration is a core component of a Prisma SD-WAN Site, defining the WAN and LAN interfaces, their IP addressing, and the circuits bound to each. This satisfies the stem's requirement for included Site items, since interfaces determine how the site connects to underlay transports and the local network.

DHCP Client mode makes the ION device act as a DHCP client on the WAN interface, automatically requesting an IP address, default gateway, and DNS servers from the ISP's DHCP server. This matches the administrator's goal of zero-touch WAN addressing without manual configuration.

Underlay configuration defines the physical transport circuits beneath the overlay, capturing each ISP link's WAN interface, IP addressing, bandwidth and next-hop details. Prisma SD-WAN needs these ISP circuit parameters before it can build tunnels and apply overlay policies across the branch.

Application-based path selection policies allow you to define which applications use which WAN links based on real-time performance metrics. By setting health thresholds for latency, jitter, and packet loss, the system can dynamically steer traffic to the best-performing link and avoid links that exceed the thresholds. This directly meets the requirements.

Prisma SD-WAN path selection policies allow you to designate a primary WAN link and a backup link. When the primary link fails health checks, traffic automatically fails over to the backup. This matches the requirement to use LTE only when fiber fails, providing dynamic, health-based failover without manual intervention.

Source NAT rewrites the source address of outbound packets, masking internal IPs behind a public address; destination NAT rewrites the destination address of inbound packets, steering external traffic to internal hosts. This axis of difference satisfies the question's request to distinguish the two translation directions.

Path performance metrics measure latency, jitter, packet loss and bandwidth on each WAN link, allowing the SD-WAN to compare paths and steer application traffic accordingly. This satisfies the requirement to monitor application performance across the SD-WAN by exposing the underlay conditions affecting each application's delivery.

Prisma SD-WAN policies allow traffic steering based on destination prefixes. By creating a policy that matches data center prefixes and sets the action to use the MPLS link, the engineer ensures that traffic to the data center takes the desired path. This is the standard method for path selection.

Routing policies are authored centrally in the Controller's policy engine, which compiles and distributes them to branches and gateways. This satisfies the question's location constraint: definition occurs in the Controller, while enforcement happens at the edge devices, ensuring consistent fabric-wide routing behaviour.