Deployment And Configuration practice questions

Manually configure IPsec parameters

Why it fails: Prisma SD-WAN manages IPsec automatically.

Disable firewall policies

Why it fails: Security policies are needed, not disabled.

Configure a static route to the peer

Why it fails: Routing is handled by the SD-WAN fabric.

Interface counters

Why it fails: Interface counters give aggregate byte and packet totals per physical or logical interface, with no per-flow or per-application path detail, so they cannot reveal which WAN link a specific flow used. They are tempting because they do expose link utilisation and errors, and would be correct when confirming whether one interface is saturated.

System Logs

Why it fails: System Logs record discrete events and alarms, not per-flow forwarding decisions, so they cannot show which WAN path a packet traversed. They are tempting because they do capture tunnel state changes and control-plane events, and would be the right choice when diagnosing why a tunnel flapped rather than where traffic actually flowed.

Packet Capture

Why it fails: Packet Capture records headers or payloads traversing an interface for deep inspection; it does not render the hop-by-hop forwarding decision or policy path. It is tempting when diagnosing drops or malformed packets, and would be correct for verifying actual packet contents rather than visualising chosen routes.

It bypasses the firewall

Why it fails: Security is independent of FEC.

It replaces the need for QoS

Why it fails: FEC and QoS are complementary.

It reduces total bandwidth usage

Why it fails: FEC increases bandwidth usage.

Create a manual IPsec tunnel to the hub

Why it fails: The Controller automates this.

Install a local management agent

Why it fails: The ION includes the management agent.

Router model

Why it fails: Irrelevant to traffic policy.

Device serial number

Why it fails: Not a traffic identifier.

Physical port location

Why it fails: Not a standard way to classify traffic.

Public guest Wi-Fi browsing

Why it fails: Usually marked as best-effort.

Idle background system updates

Why it fails: Usually deprioritized.

Enable 'DSCP Trust' on the WAN interface.

Why it fails: DSCP Trust is used to trust incoming DSCP markings from the LAN side, not to mark traffic egressing the WAN. It does not enforce new markings; it only preserves existing ones. In this scenario, the goal is to apply a new DSCP value to voice traffic, so trusting existing markings would not achieve the desired result.

Enable 'Forward Error Correction' on the WAN interface.

Why it fails: Forward Error Correction (FEC) is a technique to recover lost packets on high-latency or lossy links. It does not modify DSCP markings. Enabling FEC would not set the DSCP value to EF for voice traffic; it only adds redundancy to improve reliability. Therefore, it does not meet the requirement of marking voice traffic.

Configure a QoS policy with a 'Mark' action for the voice application.

Why it fails: A QoS policy with a Mark action is used to set DSCP values on traffic, but it is applied at the policy level, not directly on the WAN interface. The question asks for the additional configuration element on the WAN interface. While marking is part of QoS, the enforcement on the interface typically requires a different setting.

Set the LTE interface to 'Passive' mode and enable 'Failover Only'.

Why it fails: 'Passive' mode and 'Failover Only' are not valid Prisma SD-WAN interface settings. The correct configuration to keep a link idle until failure is Standby mode. These terms may sound plausible but do not exist in the platform.

Enable 'Load Balancing' on both interfaces and set LTE weight to 0.

Why it fails: A weight of 0 is not a supported value for load balancing in Prisma SD-WAN; weights are positive integers. Even if set to a low weight, the LTE link would still carry some traffic, violating the requirement that it remain idle until fiber fails.

Configure the LTE interface as a 'Hot Standby' with preemption disabled.

Why it fails: Prisma SD-WAN does not have a 'Hot Standby' interface mode. The correct approach for an idle backup link is Standby mode. Hot Standby with preemption is a concept from other networking contexts and is not a valid interface state in Prisma SD-WAN.

Configure the management interface as a DHCP relay and point it at the controller's IP address so the controller can assign an address.

Why it fails: DHCP relay forwards client requests to a DHCP server, but the Prisma SD-WAN controller is not a DHCP server and does not allocate management addresses. Configuring relay on the management interface would simply forward requests to a non-DHCP endpoint, leaving the device without an address and unable to establish management connectivity.

Enable Zero-Touch Provisioning and let the device self-assign a link-local address, which the controller will discover automatically.

Why it fails: Zero-Touch Provisioning still requires the device to have a routable management address to reach the controller. A self-assigned link-local address is not routable beyond the local segment and cannot be used by the Prisma SD-WAN controller to establish management connectivity, so the device would never complete provisioning with this method.

Rely on the ION's built-in DHCP client to obtain an address from the upstream ISP modem on the management interface.

Why it fails: The ION management interface is meant for out-of-band management, not for obtaining an address from an ISP modem. Even if a modem offered DHCP, it would not place the device on the intended management subnet, so the controller could not reach the device on the expected management path. This approach fails the stated no-DHCP-server requirement.

Enable BGP on the branch ION device and peer with the firewall using an eBGP session.

Why it fails: BGP peering requires the firewall to support and be configured for BGP, but the scenario states it does not participate in dynamic routing. Attempting an eBGP session would fail to establish, and the data center prefix would never be learned. This violates the constraint that the firewall must remain unchanged.

Enable NAT on the branch ION device so the data center subnet appears as a directly connected network.

Why it fails: NAT translates addresses but does not advertise prefixes into a routing domain. Making the subnet appear directly connected via NAT would not inform other ION devices how to reach it, and it would break end-to-end addressing for return traffic. NAT is unrelated to the requirement to propagate the prefix.

Enable OSPF on the branch LAN interface and redistribute connected routes.

Why it fails: OSPF requires the neighboring device to run the same protocol and form an adjacency. The third-party firewall is explicitly static-only and does not participate in dynamic routing, so no adjacency can form. Advertising connected routes via OSPF on the LAN interface would not propagate the data center subnet into the fabric in this design.

The 'Low Latency' action requires a path quality profile to be associated with the policy.

Why it fails: While path quality profiles are used for monitoring, the 'Low Latency' action itself does not require a separate profile to be associated; it uses the built-in latency metric. The issue is more likely related to the order of policy evaluation or missing criteria.

The 'Low Latency' action only works for traffic that is already marked with DSCP EF.

Why it fails: The 'Low Latency' action does not depend on DSCP markings; it can match traffic based on application identification or other criteria. DSCP is not a prerequisite for this action, so this is not the cause of the problem.

The branch ION device does not have a second WAN link configured for failover.

Why it fails: The scenario states there are two WAN links, and the 'Low Latency' action can use any available path. The issue is not the absence of a second link but rather the policy evaluation order that prevents the action from taking effect.

Manually install the SD-WAN software image on the ION device.

Why it fails: ION devices come pre-installed with the necessary software image. ZTP automates the configuration and software updates if needed. Manually installing an image is not part of the ZTP process and is typically unnecessary. The device will automatically check for and apply updates from the controller if required.

Create a site and assign the ION device to it in the Prisma SD-WAN portal.

Why it fails: Creating a site and assigning the device is part of the initial setup, but it is not a separate step from claiming the device. In fact, claiming the device often includes associating it with a site. However, the question asks for two required steps; claiming and ensuring connectivity are the most critical. Site creation is typically done beforehand or as part of claiming.

Configure a static IP address on the WAN interface of the ION device.

Why it fails: While a static IP might be needed in some network designs, ZTP typically uses DHCP on the WAN interface to obtain an IP address and reach the orchestrator. Configuring a static IP manually would defeat the purpose of zero-touch provisioning, which aims to automate initial connectivity. Therefore, this is not a required step for ZTP.

Assign the LTE interface to a 'Failover' policy with a lower priority than the fiber interface.

Why it fails: While a Failover policy can designate a backup link, the native interface mode that achieves standby behavior without additional policy complexity is Hot Standby. A separate failover policy is not the direct interface setting used to keep an interface inactive until failure.

Enable 'Forward Error Correction' on the LTE interface.

Why it fails: Forward Error Correction improves reliability on lossy links but does not control which link is used for traffic. It would not prevent the LTE interface from being used for active traffic, so it does not satisfy the requirement of using LTE only when fiber fails.

Configure the LTE interface as a 'Load Balancing' member.

Why it fails: Load Balancing would actively distribute traffic across both the fiber and LTE links, consuming LTE bandwidth during normal operation. The scenario explicitly requires LTE to be used only when fiber fails, so this configuration would not meet the requirement and could incur unexpected costs.

Set the LTE interface's bandwidth to zero in the interface configuration so no traffic can be sent over it.

Why it fails: Setting bandwidth to zero would prevent the interface from being used at all, including during a broadband failure. The LTE circuit would be effectively disabled, so failover would not work. Bandwidth values are used for capacity planning and QoS, not for controlling active/standby state.

Apply a QoS policy that marks all traffic as low priority on the LTE interface, causing the SD-WAN fabric to avoid it.

Why it fails: QoS marking affects prioritization within a path but does not prevent a path from being used. Traffic could still be sent over LTE if the path is considered available. The requirement is strict: no LTE traffic unless the broadband fails. QoS alone cannot enforce that behavior; a standby WAN configuration is required.

Configure a load balancing policy across both WAN interfaces with a higher weight on the broadband circuit.

Why it fails: Load balancing distributes traffic across both interfaces, even if one has a lower weight. This would cause some traffic to traverse the LTE circuit during normal operation, violating the requirement that LTE must carry no traffic unless the broadband circuit fails. Weighted load balancing is not the same as active/standby failover.

A service policy that directs guest traffic to the internet breakout.

Why it fails: Service policies in Prisma SD-WAN are used to define which paths (e.g., VPN, internet, MPLS) traffic should take. However, the term 'service policy' is not the standard name; the correct policy type for routing decisions is a 'traffic policy' or 'routing policy'. A service policy might be confused with other policy types, but it is not the specific term used for this function.

A QoS policy with a high priority for guest traffic.

Why it fails: QoS policies are used to prioritize or shape traffic based on application or user groups, but they do not control routing decisions. A QoS policy cannot direct guest traffic to the internet; it only affects how packets are queued and marked. Therefore, it does not achieve the required routing behavior.

A NAT policy to translate guest traffic to a public IP.

Why it fails: NAT policies are used to translate IP addresses, not to determine the path or exit point of traffic. While NAT might be needed for internet-bound traffic, it does not bypass the VPN. The routing decision is separate from address translation. Thus, a NAT policy alone would not ensure guest traffic goes directly to the internet.

show tunnel status

Why it fails: The 'show tunnel status' command displays the status of data plane tunnels between ION devices, such as IPsec tunnels. It does not show the control plane connection to the controller. Therefore, it is not the correct command to verify control plane connectivity.

show ip route

Why it fails: The 'show ip route' command displays the routing table, which can help verify that a route to the controller exists. However, it does not indicate whether the control plane connection is established or its status. It is not the correct command to check control plane connectivity.

show interface wan0

Why it fails: The 'show interface wan0' command displays statistics and status for the WAN interface, such as link state, IP address, and packet counters. It does not show control plane connection status to the controller, so it does not verify control plane connectivity.

Configure a static route on the data center ION device for each branch subnet.

Why it fails: Static routes for branch subnets affect traffic forwarding inside the overlay but do not influence management reachability or tunnel endpoint discovery. They also do not help when a public address changes. This option addresses routing, not the resilience requirements in the scenario.

Configure the branch ION devices with the data center's static public IP address as the tunnel endpoint.

Why it fails: Hardcoding a static public address contradicts the requirement that tunnel establishment survive a public address change. If the data center address changes, branches would keep dialing the old endpoint and tunnels would fail. This design is brittle and does not meet the stated resilience goal.

Enable dynamic DNS registration on the ION device's WAN interfaces.

Why it fails: Dynamic DNS updates a public DNS record when an address changes, but the SD-WAN fabric does not rely on DNS to locate ION devices. Tunnel endpoints are learned through the controller, so dynamic DNS registration is unnecessary and does not improve resilience. It would not satisfy either stated requirement.

Install a DHCP server on the branch LAN to assign an address to the ION's management interface.

Why it fails: The management interface is separate from the WAN interface. For ZTP, the device uses its WAN interface to reach the controller. A LAN DHCP server would not help the WAN interface obtain a public IP. The scenario specifies a single ISP circuit with dynamic IP, so the WAN interface is the relevant path.

Enable inbound port forwarding on the ISP modem for the ION's management IP.

Why it fails: Inbound port forwarding is not needed because the ION initiates outbound connections to the controller. The controller does not initiate connections to the device during initial provisioning. Port forwarding would only be relevant if inbound access to the device were required, which is not the case here.

Configure a static route on the ION pointing to the controller's IP address.

Why it fails: A static route to the controller is not required for initial provisioning. The ION uses its default route learned from the WAN interface to reach the internet and then the controller. Adding a static route would be redundant and could cause issues if the controller's IP changes or if the route conflicts with the default gateway.

Enable 'Hub Clustering' on the hub devices.

Why it fails: Hub Clustering is used to provide redundancy and load balancing for hub devices, not to enable direct spoke-to-spoke communication. It ensures that if one hub fails, another takes over. However, it does not change the topology to allow spokes to communicate directly; traffic still goes through the hub cluster.

Set up 'Policy-Based Routing' on the hub to redirect traffic between spokes.

Why it fails: Policy-Based Routing on the hub would still route traffic through the hub, which contradicts the goal of bypassing the hub. It might be used to direct traffic to specific paths, but it does not create direct spoke-to-spoke tunnels. Therefore, it does not achieve the desired direct communication.

Enable 'Forward Error Correction' on all spoke WAN interfaces.

Why it fails: Forward Error Correction is a technique to improve reliability on lossy links, but it does not affect the topology or routing. It would not enable direct spoke-to-spoke communication; it only adds redundancy to packets. Thus, it is not relevant to the requirement of bypassing the hub.

Enable 'Forward Error Correction' on the fiber link and set the LTE link to 'always on' with a 30-second failback timer.

Why it fails: Forward Error Correction is a technique to improve link quality by adding redundancy, not for failover. Setting LTE to 'always on' would keep it active and potentially used even when fiber is up, contradicting the requirement. The failback timer alone does not enforce standby; the LTE link would not be restricted to failure-only usage.

Configure both interfaces as active and use a policy to prefer fiber for all traffic, with LTE as a lower-priority path.

Why it fails: This fails because configuring both interfaces as active would allow traffic to use LTE simultaneously with fiber, violating the requirement that LTE be used only when fiber fails. While a policy can prefer fiber, it does not enforce strict standby behavior; LTE could still carry traffic under certain conditions, and automatic failback after 30 seconds is not guaranteed.

Create a virtual interface pair and assign both physical interfaces to it, then set the fiber as primary and LTE as secondary with a 30-second failback.

Why it fails: Virtual interface pairs are used for redundancy at the IP layer, not for active/standby WAN link failover. Assigning both interfaces to a virtual interface pair would not provide the required standby behavior; it would typically aggregate or load-balance traffic. The failback timer is not applicable in this context, and the configuration would not meet the requirement.