I85PREP
⌘ K
PSE SASE study materials
PSE SASE study resources

PSE SASE practice questions

One question at a time. Build your PSE SASE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Prisma Access (ZTNA)

In Prisma Access, which component is responsible for enforcing security policy on traffic that a remote user sends after connecting through the GlobalProtect app?

  1. The service connection for the remote network
  2. The Cortex Data Lake ingestion broker
  3. The Panorama management server's MGT interface
  4. The Prisma Access mobile user security processing node Correct answer.

Explanation

Mobile user traffic is forwarded to a security processing node in the nearest Prisma Access location, where App-ID, Content-ID, and other security profiles are applied. Panorama and Cortex Data Lake are management and logging functions, not enforcement points for user traffic.

Question 2Prisma Access (ZTNA)

A security team wants to allow access to internal web applications without exposing them to inbound internet connections. Which Prisma Access capability is designed for this requirement?

  1. ZTNA Connector with private application publishing Correct answer.
  2. IPsec remote network tunnels
  3. Explicit proxy with SSL decryption
  4. GlobalProtect satellite configuration

Explanation

Prisma Access ZTNA uses connectors to publish private applications to users without opening inbound firewall ports. Users reach the app through the Prisma Access infrastructure, and the connector brokers the connection to the internal resource.

Question 3Prisma Access (ZTNA)

Which identity source does Prisma Access rely on to associate a GlobalProtect user with group-based security policy?

  1. The service connection routing table
  2. The User-ID agent or directory integration configured for the tenant Correct answer.
  3. The Cortex Data Lake tenant ID
  4. The connector's local certificate store

Explanation

Prisma Access uses User-ID from directory services such as Active Directory or cloud identity providers to map users to groups. Security policy then matches on user and group attributes.

Question 4Prisma Access (ZTNA)

What is the primary function of a ZTNA connector in a Prisma Access deployment?

  1. To host the Cortex Data Lake logging broker
  2. To decrypt outbound SSL traffic for inspection
  3. To establish outbound connections from the internal network to Prisma Access for brokered app access Correct answer.
  4. To terminate GlobalProtect tunnels from endpoints

Explanation

The ZTNA connector initiates outbound connections to Prisma Access, so no inbound ports are opened on the internal network. Prisma Access uses that channel to forward user requests to private applications.

Question 5Prisma Access (ZTNA)

Which GlobalProtect component must be configured so that endpoints automatically receive the Prisma Access configuration and connect to the closest gateway?

  1. The Cortex Data Lake license
  2. The ZTNA connector profile
  3. The service connection IPsec profile
  4. The GlobalProtect portal hosted in Prisma Access Correct answer.

Explanation

The GlobalProtect portal in Prisma Access delivers gateway lists, certificates, and client configuration to endpoints. Endpoints then select the best gateway based on the portal-provided configuration.

Question 6Prisma Access (ZTNA)

An administrator wants to enforce that only managed endpoints with a valid certificate can access private applications through Prisma Access ZTNA. Which control should be configured?

  1. An IP allowlist on the connector
  2. A URL filtering profile on the service connection
  3. A QoS profile on the mobile user gateway
  4. A certificate-based authentication profile applied to the ZTNA policy Correct answer.

Explanation

Certificate-based authentication verifies device or user identity before policy is evaluated, which is the standard way to restrict ZTNA access to managed endpoints. An allowlist on the connector does not validate device posture or certificates.

Question 7Prisma Access (ZTNA)

A remote user cannot reach an internal application published through a ZTNA connector, although the connector shows Connected. Which troubleshooting step is most appropriate first?

  1. Verify that the connector's internal host and port are reachable from the connector host Correct answer.
  2. Reboot the GlobalProtect portal
  3. Reissue the Cortex Data Lake certificate
  4. Change the mobile user gateway selection method

Explanation

When the connector is connected but the app is unreachable, the most likely cause is a connectivity or DNS problem between the connector and the internal application. Confirming host and port reachability from the connector host isolates that layer.

Question 8Prisma Access (ZTNA)

Which Prisma Access construct defines the internal subnets that a ZTNA connector is allowed to publish to users?

  1. The service connection static routes
  2. The remote network IPsec selector
  3. The connector's application and domain definitions Correct answer.
  4. The GlobalProtect split tunnel access route

Explanation

The connector configuration lists the applications, hosts, and ports it publishes, which scopes what users can reach. Service connection routes and split tunnel routes govern general network reachability, not per-app publishing.

Question 9Prisma Access (ZTNA)

What advantage does ZTNA app access provide over traditional VPN access for internal applications?

  1. All user traffic is backhauled to a single data center
  2. Users bypass all security inspection for performance
  3. Users get per-application access instead of broad network-level access Correct answer.
  4. Users receive a routable IP address on the corporate subnet

Explanation

ZTNA grants access to specific applications rather than placing the user on the corporate network, which reduces lateral movement risk. Traditional VPN typically grants broader network reachability after authentication.

Question 10Prisma Access (ZTNA)

Which setting determines whether a GlobalProtect mobile user's internet-bound traffic is inspected by Prisma Access or sent directly from the endpoint?

  1. The ZTNA connector's published app list
  2. The Cortex Data Lake retention policy
  3. The split tunnel configuration in the GlobalProtect gateway Correct answer.
  4. The service connection BGP configuration

Explanation

Split tunneling controls which traffic is routed into the GlobalProtect tunnel and which goes directly from the endpoint. Traffic included in the tunnel is inspected by Prisma Access.

Question 11Prisma Access (ZTNA)

An organization wants to apply different security profiles to contractors and employees accessing the same private application. What is the most appropriate design?

  1. Use a different GlobalProtect portal for each group
  2. Create separate ZTNA security policies that match on user group Correct answer.
  3. Publish the application on two different connectors
  4. Assign contractors to a different Cortex Data Lake tenant

Explanation

Policy in Prisma Access can match on user and group, so separate rules with different profiles can target the same application for different populations. This avoids duplicating connectors or tenants.

Question 12Prisma Access (ZTNA)

Which Prisma Access component is required when a customer wants to connect their data center to Prisma Access so that mobile users can reach data center applications without a ZTNA connector?

  1. A GlobalProtect satellite
  2. A remote network tunnel
  3. A service connection Correct answer.
  4. An explicit proxy

Explanation

A service connection links Prisma Access to a customer network such as a data center, allowing mobile users to reach those resources through Prisma Access. Remote networks connect branch sites, not data centers used by mobile users.

Question 13Prisma Access (ZTNA)

What is the purpose of the Prisma Access infrastructure subnet in a service connection deployment?

  1. It assigns public IP addresses to mobile users
  2. It stores connector logs
  3. It hosts the GlobalProtect portal certificate
  4. It provides the internal IP addresses used for tunnels and routing between Prisma Access and the customer network Correct answer.

Explanation

The infrastructure subnet supplies addresses for the tunnel endpoints and routing inside the service connection. It must not overlap with customer subnets used across the connection.

Question 14Prisma Access (ZTNA)

A security administrator wants to block access to a private application for users whose devices fail a disk-encryption check. Which Prisma Access feature supports this?

  1. HIP-based policy enforcement in the ZTNA rule Correct answer.
  2. URL filtering categories on the connector
  3. QoS marking on the mobile user gateway
  4. IP allowlisting on the service connection

Explanation

Host Information Profile checks collect endpoint posture such as disk encryption, and policy can match on HIP to allow or deny access. This ties application access to device compliance.

Question 15Prisma Access (ZTNA)

Which statement best describes how Prisma Access ZTNA differs from Prisma Access mobile user VPN for private application access?

  1. ZTNA brokers connections to specific apps through connectors, while mobile user VPN typically routes traffic to networks reachable through service connections Correct answer.
  2. ZTNA requires an IPsec tunnel from every endpoint, while mobile user VPN does not
  3. ZTNA only works for internet destinations, while mobile user VPN only works for internal destinations
  4. ZTNA bypasses identity checks, while mobile user VPN enforces them

Explanation

ZTNA publishes individual applications via connectors and grants narrow access, whereas mobile user VPN provides network-level reachability to connected networks. Both enforce identity, but their access models differ.

Question 16Prisma Access (ZTNA)

A customer reports that users in one region experience high latency to a private app published through a connector located in another region. What is the most likely cause?

  1. The Cortex Data Lake license is expired
  2. The service connection is using BGP instead of static routing
  3. The connector placement forces traffic to traverse long distances to reach the application Correct answer.
  4. The GlobalProtect portal certificate is about to expire

Explanation

Connector placement determines where traffic exits Prisma Access toward the private application. A distant connector adds round-trip latency, so deploying connectors closer to the app reduces delay.

Question 17Prisma Access (ZTNA)

Which Prisma Access feature lets an administrator publish an internal application to users without installing any client software on the endpoint?

  1. IPsec remote network tunnel
  2. Explicit proxy PAC file
  3. GlobalProtect app with split tunneling
  4. Agentless ZTNA access through a browser Correct answer.

Explanation

Agentless ZTNA provides browser-based access to published private applications, which suits unmanaged or contractor devices. It still brokers the connection through Prisma Access and the connector.

Question 18Prisma Access (ZTNA)

An administrator needs to confirm that a ZTNA connector is authenticating successfully to Prisma Access. Which artifact is most directly relevant?

  1. The service connection pre-shared key
  2. The connector certificate and its trust chain Correct answer.
  3. The Cortex Data Lake API key
  4. The GlobalProtect portal cookie

Explanation

Connectors authenticate to Prisma Access using certificates, so a valid certificate and trusted chain are required for a Connected state. Pre-shared keys are used for IPsec tunnels, not connector authentication.

Question 19Prisma Access (ZTNA)

Which element of a Prisma Access ZTNA policy determines the action taken when a user requests a published application?

  1. The connector's DNS server setting
  2. The Cortex Data Lake log forwarding profile
  3. The mobile user gateway's MTU value
  4. The security rule action matched by user, application, and source criteria Correct answer.

Explanation

Security rules evaluate criteria such as user, group, application, and source, then apply the configured action. Other settings affect connectivity or logging, not the authorization decision.

Question 20Prisma Access (ZTNA)

What is the recommended approach for granting third-party contractors access to a single internal application in Prisma Access?

  1. Add contractors to the corporate VPN group with full network access
  2. Provide contractors with a service connection pre-shared key
  3. Publish only that application on a connector and scope the ZTNA rule to the contractor group Correct answer.
  4. Give contractors Panorama read-only accounts

Explanation

Least privilege is achieved by publishing only the required application and scoping policy to the contractor identity group. Broad VPN access or management accounts violate least-privilege principles.

Question 21Prisma Access (ZTNA)

A ZTNA connector is deployed behind a NAT device and must reach Prisma Access over the internet. Which design consideration is most important?

  1. The connector must accept inbound connections from Prisma Access on a fixed port
  2. The connector must share a subnet with the GlobalProtect portal
  3. The connector must be placed in the DMZ with a public IP address
  4. The connector must be able to initiate outbound connections to Prisma Access endpoints Correct answer.

Explanation

Connectors are designed to initiate outbound connections, which allows them to operate behind NAT and firewalls without inbound rules. Requiring inbound access would defeat the security benefit of the architecture.

Question 22Prisma Access (ZTNA)

Two connectors publish overlapping application definitions, and users report intermittent access failures. What is the most likely explanation?

  1. The service connection is advertising a default route
  2. The Cortex Data Lake license has expired
  3. The GlobalProtect portal is using an outdated client version
  4. Connector selection or health is inconsistent, causing requests to reach a connector that cannot serve the app Correct answer.

Explanation

When multiple connectors publish overlapping apps, Prisma Access selects a connector based on availability and health. If one connector cannot actually reach the app, users see intermittent failures depending on selection.

Question 23Prisma Access (ZTNA)

An organization requires that private application traffic never traverse the public internet unencrypted between the connector and Prisma Access. Which mechanism satisfies this?

  1. The connector forwards traffic through the Cortex Data Lake
  2. The connector uses plain HTTP to the Prisma Access gateway
  3. The connector relies on the application's own TLS session only
  4. The connector establishes an encrypted outbound channel to Prisma Access Correct answer.

Explanation

The connector-to-Prisma Access channel is encrypted, protecting private application traffic in transit over the internet. Relying only on application TLS would leave other traffic exposed.

Question 24Prisma Access (ZTNA)

A customer wants ZTNA access to work even if a single connector host fails. What design provides resilience?

  1. Enable BGP on the service connection
  2. Add a second GlobalProtect portal
  3. Deploy multiple connectors for the same application in the same or different locations Correct answer.
  4. Increase the connector's CPU and memory on a single host

Explanation

Redundancy at the connector layer ensures the application remains reachable if one connector fails. Prisma Access can use another healthy connector publishing the same app.

Question 25Prisma Access (ZTNA)

Which log type in Prisma Access would an administrator review to determine whether a ZTNA connection to a private application was allowed or denied?

  1. HIP match logs
  2. Traffic logs Correct answer.
  3. System logs
  4. Configuration logs

Explanation

Traffic logs record session details including the policy action applied to a flow. They are the primary source for confirming whether a ZTNA request was allowed or denied.

Question 26Prisma Access (ZTNA)

In Prisma Access ZTNA, which component is responsible for initiating the outbound connection to Prisma Access and publishing private applications to users?

  1. The mobile user license
  2. The ZTNA connector Correct answer.
  3. The GlobalProtect app
  4. The service connection

Explanation

The ZTNA connector is a lightweight virtual machine or appliance deployed in the private network that establishes an outbound-only connection to Prisma Access and publishes internal applications to authorized users. It does not require inbound firewall openings, which reduces the exposed attack surface compared with traditional VPN termination.

Question 27Prisma Access (ZTNA)

Which Prisma Access ZTNA policy element specifies the set of users and groups to which an application access rule applies?

  1. The source zone
  2. The source user Correct answer.
  3. The application override
  4. The service connection

Explanation

In Prisma Access ZTNA policy, the source user field identifies the users or groups that the rule matches, typically populated from an identity provider or User-ID source. This allows granular access control so that different populations, such as employees and contractors, can be granted access to different applications.

Question 28Prisma Access (ZTNA)

What is the primary security benefit of using Prisma Access ZTNA instead of a traditional VPN concentrator for accessing internal applications?

  1. It provides a full tunnel that routes all user traffic through the corporate data center.
  2. It requires inbound firewall ports to be opened for each published application.
  3. It grants access on a per-application basis after verifying user and device posture, reducing lateral movement. Correct answer.
  4. It eliminates the need for any authentication because access is based on network location.

Explanation

ZTNA applies least-privilege access by authorizing users to specific applications only after identity and device posture checks, rather than placing users on the corporate network. This limits lateral movement because a compromised endpoint cannot freely reach other internal resources.

Question 29Prisma Access (ZTNA)

An administrator needs to verify that a newly deployed ZTNA connector has successfully registered with Prisma Access. Which status should be confirmed in the Prisma Access configuration?

  1. The connector is listed as a mobile user gateway in the license summary.
  2. The connector appears in the service connection list with an Up state.
  3. The connector shows as Connected in the ZTNA connector status view. Correct answer.
  4. The connector is assigned to a remote network in the infrastructure settings.

Explanation

A ZTNA connector reports its health and registration state to Prisma Access, and the connector status view shows whether it is Connected. This confirms that the outbound tunnel to Prisma Access is established and the connector can publish applications.

Question 30Prisma Access (ZTNA)

A security team wants to ensure that only users whose devices have disk encryption enabled can access a private application through Prisma Access ZTNA. Which configuration enforces this requirement?

  1. A security profile group applied to the ZTNA connector.
  2. A URL filtering profile attached to the mobile user policy.
  3. A HIP profile and HIP-based match condition in the ZTNA policy. Correct answer.
  4. An application override for the private application.

Explanation

Host Information Profile (HIP) collects endpoint posture such as disk encryption, and a HIP profile object can be referenced in ZTNA policy as a match condition. Only endpoints that satisfy the HIP check are granted access to the application.

Question 31Prisma Access (ZTNA)

Which Prisma Access ZTNA construct defines the internal IP subnets and ports that a connector is allowed to publish to users?

  1. The remote network
  2. The service connection
  3. The application definition Correct answer.
  4. The infrastructure subnet

Explanation

An application definition in Prisma Access ZTNA specifies the internal server addresses, ports, and protocols that the connector publishes. Users are granted access to these defined applications rather than to the entire internal network.

Question 32Prisma Access (ZTNA)

An administrator wants to apply a stricter security profile to contractors than to employees when both access the same private application through Prisma Access ZTNA. What is the most appropriate approach?

  1. Create separate ZTNA policies with different source user groups and attach different security profile groups. Correct answer.
  2. Use a single ZTNA policy and rely on the application's own authentication to differentiate users.
  3. Assign the contractors to a different ZTNA connector that has a stricter configuration.
  4. Apply a URL filtering profile to the connector's management interface.

Explanation

ZTNA policy can match on source user or group, so separate rules can be created for contractors and employees. Each rule can reference a different security profile group, allowing stricter inspection for the contractor group while both access the same application.

Question 33Prisma Access (ZTNA)

Which log type in Prisma Access should an administrator review to determine whether a ZTNA connection to a private application was allowed or denied by policy?

  1. The HIP match log
  2. The system log
  3. The GlobalProtect log
  4. The traffic log Correct answer.

Explanation

The traffic log records session details including the policy action, source user, destination application, and the rule that matched. For ZTNA sessions, it shows whether the connection was allowed or denied and which security policy rule was applied.

Question 34Prisma Access (ZTNA)

A ZTNA connector is deployed behind a NAT device and must reach Prisma Access over the internet. Which design consideration is most important for successful connector operation?

  1. The connector initiates outbound connections to Prisma Access, so NAT must permit outbound TLS and allow return traffic. Correct answer.
  2. The connector requires a public IP address with inbound ports opened for each published application.
  3. The connector must use a static route to the Prisma Access portal for user authentication.
  4. The connector must be placed in the same subnet as the Prisma Access infrastructure subnet.

Explanation

ZTNA connectors establish outbound-only connections to Prisma Access, so the NAT device must allow outbound TLS and the corresponding return traffic. No inbound ports need to be opened, which is a key advantage of the connector architecture.

Question 35Prisma Access (ZTNA)

Two ZTNA connectors publish overlapping application definitions, and users report intermittent access failures. What is the most likely cause?

  1. The connectors are exceeding the maximum number of published applications per connector.
  2. The connectors are load balancing the same application, causing session state to be lost between them. Correct answer.
  3. The application definitions are missing the correct source user group assignment.
  4. The overlapping definitions create conflicting policy matches that alternate between connectors.

Explanation

When multiple connectors publish the same application, Prisma Access may distribute sessions across them, and if session state is not shared, users can experience intermittent failures. Best practice is to ensure that overlapping definitions are intentional and that the application can tolerate multiple connectors or to avoid duplicate definitions.

Question 36Prisma Access (ZTNA)

Which Prisma Access component is required to route traffic from a data center to Prisma Access so that mobile users can reach data center applications through ZTNA?

  1. A ZTNA connector
  2. An infrastructure subnet
  3. A service connection Correct answer.
  4. A remote network

Explanation

A service connection provides connectivity between a customer data center or branch and Prisma Access, allowing mobile user traffic to reach internal resources. It is distinct from a ZTNA connector, which publishes applications, and from a remote network, which connects branch sites.

Question 37Prisma Access (ZTNA)

An administrator wants to block access to a private application for users whose devices fail a disk-encryption check, while allowing all other users. Which ZTNA policy configuration achieves this?

  1. An allow rule with a HIP profile match for disk encryption set to compliant, with no deny rule.
  2. A security profile group that blocks encrypted traffic from non-compliant devices.
  3. A deny rule with a HIP profile match for disk encryption set to not compliant, placed above the allow rule. Correct answer.
  4. A URL filtering profile that blocks the application for non-compliant users.

Explanation

A deny rule that matches non-compliant HIP posture and is placed above the allow rule ensures that devices failing the disk-encryption check are blocked. The allow rule then permits compliant users, implementing a positive and negative access decision.

Question 38Prisma Access (ZTNA)

A customer requires that private application traffic between the ZTNA connector and Prisma Access never traverse the public internet unencrypted. Which statement is correct?

  1. The connector uses an IPsec tunnel to Prisma Access, ensuring encryption.
  2. The connector relies on the application's native encryption only.
  3. The connector uses plaintext HTTP and depends on network segmentation.
  4. The connector uses TLS-encrypted outbound connections to Prisma Access. Correct answer.

Explanation

ZTNA connectors establish TLS-encrypted outbound connections to Prisma Access, so application traffic is encrypted while in transit over the public internet. This satisfies the requirement without needing a separate IPsec tunnel.

Question 39Prisma Access (ZTNA)

An organization wants ZTNA access to remain available if a single connector host fails. What design provides resilience?

  1. Deploy a single connector with redundant power supplies and network interfaces.
  2. Rely on the Prisma Access infrastructure subnet to provide automatic failover.
  3. Configure a service connection with a backup ISP for the data center.
  4. Deploy multiple connectors that publish the same applications in the same or different locations. Correct answer.

Explanation

Deploying multiple ZTNA connectors that publish the same applications provides redundancy; if one connector fails, Prisma Access can route sessions through another connector. This is the recommended approach for high availability of published applications.

Question 40Prisma Access (ZTNA)

Which Prisma Access ZTNA feature allows an administrator to publish an internal web application to users without requiring a client component on the endpoint?

  1. Remote network with BGP
  2. Clientless access through the Prisma Access portal Correct answer.
  3. Service connection with IPsec
  4. GlobalProtect app with full tunnel

Explanation

Prisma Access ZTNA supports clientless access, where users access published web applications through a browser-based portal without installing a client. This is useful for unmanaged devices or third parties who need access to a specific web application.

Question 41SD-WAN

In an SD-WAN architecture, which component is responsible for centrally defining and distributing policy and intent to the edge devices?

  1. The SD-WAN controller or orchestrator Correct answer.
  2. The underlay ISP's BGP route reflector
  3. The local DHCP server at the branch
  4. The forwarding plane on each branch router

Explanation

SD-WAN separates the control and management plane from the data forwarding plane. The controller/orchestrator holds the intended policy and topology and pushes it to the edge devices, which then enforce it locally. The underlay and local services do not define SD-WAN policy.

Question 42SD-WAN

Which statement best describes the role of an SD-WAN overlay tunnel?

  1. It encrypts only management traffic between the controller and the edge
  2. It replaces the physical underlay transport with a dedicated leased line
  3. It guarantees a fixed committed bandwidth on every underlay path
  4. It carries traffic between sites over one or more underlay transports independent of their technology Correct answer.

Explanation

An overlay tunnel is a logical path built on top of whatever underlay transports exist, such as MPLS, internet, or LTE. It decouples the SD-WAN fabric from the physical transport technology. It does not replace the underlay or guarantee bandwidth by itself.

Question 43SD-WAN

A branch has an MPLS circuit and a broadband internet circuit. The SD-WAN policy sends voice traffic over MPLS and bulk backup traffic over broadband. Which capability does this primarily illustrate?

  1. Topology hiding through NAT
  2. Control-plane rate limiting
  3. Route summarization at the aggregation layer
  4. Application-aware path selection Correct answer.

Explanation

SD-WAN identifies applications and steers each flow onto a preferred path according to policy. Choosing MPLS for voice and broadband for bulk traffic is application-aware path selection. NAT, rate limiting, and summarization are unrelated to this steering behavior.

Question 44SD-WAN

What is the primary purpose of a first-packet or application identification engine in an SD-WAN edge?

  1. To assign IP addresses to branch endpoints
  2. To synchronize clocks across the fabric
  3. To terminate IPsec tunnels from remote workers
  4. To classify traffic into applications so policy can be applied Correct answer.

Explanation

Application identification inspects flows, often using signatures and behavioral analysis, to classify them. Once classified, the SD-WAN edge can apply path selection, QoS, and security policy per application. Address assignment, tunnel termination, and clock sync are separate functions.

Question 45SD-WAN

Which SD-WAN feature continuously measures loss, latency, and jitter on candidate paths and reacts when thresholds are breached?

  1. Policy-based route redistribution
  2. Quality of Experience or performance-based steering Correct answer.
  3. Dynamic multipoint VPN
  4. Forward error correction

Explanation

Performance monitoring probes measure loss, latency, and jitter on each path, and QoE or performance-based steering uses those measurements to move traffic. FEC mitigates loss but does not measure and steer. DMVPN and redistribution are separate technologies.

Question 46SD-WAN

In a typical SD-WAN deployment, what distinguishes the underlay from the overlay?

  1. The underlay carries only voice while the overlay carries only data
  2. The underlay provides physical transport and reachability, while the overlay provides logical site-to-site connectivity Correct answer.
  3. The underlay is encrypted while the overlay is always cleartext
  4. The underlay is managed by the controller while the overlay is managed by the ISP

Explanation

The underlay consists of the physical transports and the routing that provides reachability between endpoints. The overlay is the logical tunnel fabric built over it, independent of transport type. Encryption and traffic type do not define the distinction.

Question 47SD-WAN

Which benefit most directly justifies replacing a hub-and-spoke WAN with an SD-WAN full-mesh overlay for site-to-site traffic?

  1. Elimination of the need for any routing protocol
  2. Direct branch-to-branch paths that avoid backhauling through the hub Correct answer.
  3. Removal of the requirement for encryption
  4. Guaranteed zero packet loss on internet transports

Explanation

A full-mesh overlay lets branches reach each other directly instead of tromboning traffic through a central hub. This reduces latency and hub congestion. SD-WAN does not remove routing or encryption needs, and no transport guarantees zero loss.

Question 48SD-WAN

What does a service-level agreement defined inside an SD-WAN policy typically specify?

  1. The BGP autonomous system number of the underlay provider
  2. The SNMP community string used by the controller
  3. The list of permitted MAC addresses on the branch switch
  4. Performance thresholds such as latency, jitter, and loss that a path must meet Correct answer.

Explanation

An in-fabric SLA expresses the performance envelope an application requires, such as maximum latency, jitter, and loss. The SD-WAN edge then selects or switches paths to satisfy it. MAC lists, AS numbers, and SNMP strings are unrelated configuration items.

Question 49SD-WAN

A branch edge receives policy from the controller but must keep forwarding traffic if the controller becomes unreachable. Which design property enables this?

  1. The underlay provider takes over policy enforcement
  2. Policy is cached locally on the edge so forwarding continues autonomously Correct answer.
  3. The edge reboots and loads a default route only
  4. All traffic is dropped until the controller returns

Explanation

SD-WAN edges are designed for graceful degradation: they retain the last-known policy and continue forwarding autonomously if the control plane is lost. This resilience is a core reason for separating control and forwarding. Dropping traffic or relying on the ISP would defeat the purpose.

Question 50SD-WAN

An administrator wants voice traffic to fail over from MPLS to internet only when MPLS latency exceeds 150 ms. Which combination of features is required?

  1. BGP route reflection plus route summarization
  2. Static routes plus NAT overload
  3. Performance monitoring plus a latency-threshold-based steering policy Correct answer.
  4. Port mirroring plus NetFlow export

Explanation

The edge must measure latency on the MPLS path and compare it to the configured threshold, then steer flows when breached. That requires performance monitoring feeding a threshold-based steering policy. Static routes, BGP reflection, and flow export do not perform this conditional steering.