Free SD-WAN-Engineer sample questions

Correct answer: Path Policy Rule

Path Policy rules in Prisma SD-WAN are used to define traffic steering logic. They allow administrators to select paths (Active/Backup) based on application types and specific SLA requirements (latency, jitter, packet loss).

Correct answer: CloudBlades Platform

CloudBlades are API-based integrations in the Prisma SD-WAN controller that automate connectivity to third-party services. For example, the Zscaler Internet Access CloudBlade automatically integrates the controller, the remote IONs and the Zscaler Enforcement Nodes, building the Standard VPN (IPsec/GRE) tunnels; the Admin Guide points to CloudBlades for streamlined autoconfiguration of IPsec or GRE tunnels. A virtual ION is a device form factor, and 'Prisma Access Connector' and 'App-Fabric Gateway' are not integration platforms.

Correct answer: Create a Path Policy rule for Guest Wi-Fi whose paths use the Direct overlay on the internet circuit category only; the default Source NAT translates traffic sent directly to internet interfaces

Path policy rules list Active, Backup and L3 Failure paths, each an overlay (Direct, Prisma SD-WAN VPN or Standard VPN) plus a circuit category. A guest rule whose only paths are Direct on the internet circuit category keeps guest traffic local, while corporate rules keep using the VPN to the data center. By default, Prisma SD-WAN performs Source NAT out of the box on traffic going directly to public internet interfaces, so no extra NAT rule is needed unless custom translation is required.

Correct answer: Configure DC-A and DC-B as data center sites interconnected over the DCI (or DC-to-DC Secure Fabric Links on ION 6.5.1+); branch IONs never act as transit points, so no branch setting is needed

Branch IONs treat each underlay and Standard VPN as a separate routing domain and do not advertise routes learned from one domain into another, so a branch never dynamically becomes a transit point. Branches build Secure Fabric VPNs to the data centers. From ION 6.5.1, DC-to-DC Secure Fabric Links can be created under Data Centers > Overlay Connections, and prefixes learned on inter-DC VPNs are not redistributed further, which prevents loops. There is no 'Transit' toggle on branch sites.

Correct answer: All App-Fabric traffic is automatically encrypted with IPsec ESP using per-tunnel keys derived from controller-distributed shared secrets and rotated hourly

Secure Fabric tunnels between IONs are always IPsec-encrypted with AES-256-GCM, AES-256-CBC, AES-128-GCM or AES-128-CBC; the controller picks the best common cipher. They do not use IKE. The controller sends three encrypted shared secrets (each valid for one day), the endpoints exchange nonces and derive tunnel-specific session keys, and the keys are renegotiated every hour without the controller (tunnels survive up to 3 days without it). IKEv1/IKEv2 apply only to Standard VPNs, and encryption cannot be turned off per circuit.

Correct answer: Create a Path Policy rule matching the Guest Wi-Fi network context or prefix whose Active, Backup and L3 Failure paths use only the Broadband and LTE (public) circuit categories, with no MPLS path.

A path policy rule can use only the paths it lists: Active paths (load-shared while SLA-compliant), Backup paths and L3 Failure paths, each an overlay plus a circuit category. If the guest rule lists only the public Broadband and LTE circuit categories, guest traffic can never be placed on MPLS. Listing MPLS as a Backup path would allow it, and a security rule is not the intended path-steering control.

Correct answer: The port used to reach the controller (the controller port, or port 1/2 on models without one) must be on a network that provides an IP address via DHCP plus DNS resolution and internet access.

Per the Prisma SD-WAN Administrator's Guide (Connect the ION Device), the ION controller port is DHCP-enabled by default and must be connected to a subnet with internet access; models without a dedicated controller port use port 1 or port 2 on a DHCP-enabled network. The device then resolves and connects to the controller (controller.cgnx.net / locator.cgnx.net over TCP 443), changes from Offline to Online, and can be claimed and assigned to its site, after which the controller pushes the site configuration. A static IP (set from the AUX console) is needed only when the circuit has no DHCP; there is no claim key and no MPLS-first requirement.

Correct answer: Variable Substitution in Templates

Prisma SD-WAN site configuration templates are Jinja blueprints. Values that differ per site, such as LAN subnets, are turned into variables with 'Make Variable' and rendered as {{ variable_name }}; each site's value is supplied in the CSV site data file (or entered manually) when the sites are deployed, so one template serves all 50 sites. Device shells only pre-stage a device configuration before the hardware arrives, 'Site Overrides' are not a Prisma SD-WAN template feature, and dynamic routing does not assign LAN subnets.

Correct answer: A route map that matches a Prefix List, applied as the BGP peer's Route Map Out

Prisma SD-WAN has no 'Redistribution Profile' (that is a PAN-OS object). Routes advertised to an ION BGP peer are filtered with a route map: its entries match a Prefix List (or IP Community List, AS Path List, IP Next Hop) with Permit/Deny, and the map is selected as the peer's Route Map Out on the Prefix Advertisement tab. The prefix list can carry length qualifiers (the ION routing configuration shows entries such as 'permit 10.10.10.0/24 ge 28 le 30'). After changing an associated prefix list, soft-reset the peer. Interface ACLs, a 'Global Routing Table Policy' or a peer password do not filter BGP advertisements.

Correct answer: VRFs (Virtual Routing and Forwarding)

VRF (Virtual Routing and Forwarding) allows multiple instances of a routing table to exist in a router and work simultaneously. This is the standard method for isolating traffic (segmentation) at Layer 3, ensuring Corporate, Guest, and IoT routes are kept separate.