I85PREP
⌘ K
Palo Alto SD-WAN Engineer study materials
Palo Alto SD-WAN Engineer study resources

Palo Alto SD-WAN Engineer practice questions

One question at a time. Build your Palo Alto SD-WAN Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1SD-WAN Deployment and Configuration

In a Prisma SD-WAN (formerly CloudGenix) deployment, which component is responsible for establishing the secure fabric tunnels between sites and for applying path selection policy?

  1. The Prisma SD-WAN controller (portal)
  2. The DNS forwarder at the branch
  3. The ION device at each site Correct answer.
  4. The standard IPsec gateway at the data center

Explanation

The ION device is the branch or data center edge appliance that builds the encrypted fabric tunnels over each WAN link and enforces the path selection and QoS policy pushed from the controller. The controller is the management and orchestration plane and does not carry user traffic.

Question 2SD-WAN Deployment and Configuration

Which Prisma SD-WAN construct groups WAN interfaces so that policy can treat them as a single logical path set for steering and SLA monitoring?

  1. A path group composed of member WAN interfaces Correct answer.
  2. A network policy stack
  3. A virtual interface pair
  4. A WAN interface profile bound to a site

Explanation

Path groups bundle one or more WAN interfaces per site so that traffic steering, SLA thresholds, and failover operate across the whole set. Policies then reference the path group rather than individual links.

Question 3SD-WAN Deployment and Configuration

An engineer wants branch traffic destined for a SaaS application to leave via the local internet link instead of backhauling to the data center. Which configuration element accomplishes this in Prisma SD-WAN?

  1. A NAT pool bound to the LAN interface
  2. A static route on the ION pointing to the data center
  3. A network policy rule that steers the SaaS prefix to the local internet path group Correct answer.
  4. A BGP community applied to the data center prefix

Explanation

Local internet breakout is achieved with a network policy rule that matches the SaaS application or prefix and directs it to the internet path group at the site. This avoids the hairpin to the data center and reduces latency.

Question 4SD-WAN Deployment and Configuration

What is the purpose of a site in the Prisma SD-WAN controller hierarchy?

  1. It stores the global address pool for NAT translations
  2. It defines the cryptographic algorithms used for fabric tunnels
  3. It schedules software upgrades for all ION devices
  4. It represents a physical or logical location that owns elements, interfaces, and path groups Correct answer.

Explanation

A site is the container object for a location; elements, WAN interfaces, path groups, and LAN networks are attached to it. Policy is then applied per site or per site group.

Question 5SD-WAN Deployment and Configuration

Which statement describes the role of the Prisma SD-WAN controller in the data plane?

  1. It inspects every packet and applies QoS marking inline
  2. It provides management, policy distribution, and orchestration while traffic flows directly between ION devices Correct answer.
  3. It acts as the DHCP server for all branch LANs
  4. It terminates all branch IPsec tunnels

Explanation

Prisma SD-WAN uses a split-plane design: the controller manages configuration and distributes policy, while the ION devices forward traffic and build tunnels directly with each other. This keeps the controller off the data path.

Question 6SD-WAN Deployment and Configuration

When configuring a WAN interface on an ION device for a DHCP-addressed internet link, which setting must be enabled so the device learns its public address and default gateway automatically?

  1. PPPoE client with a stored credential
  2. DHCP client on that WAN interface Correct answer.
  3. Static IP with a manually entered next hop
  4. Proxy ARP on the LAN interface

Explanation

Enabling the DHCP client on the WAN interface lets the ION obtain its IP address, mask, default gateway, and DNS from the upstream provider. Static addressing would require manually entering the same values.

Question 7SD-WAN Deployment and Configuration

Which object must exist before a network policy rule can steer traffic across multiple WAN links at a branch?

  1. A tooltip-enabled application definition
  2. A service link to a third-party cloud
  3. A BGP route reflector peering
  4. A path group containing those WAN interfaces Correct answer.

Explanation

Network policy rules reference path groups to decide which WAN links a flow may use. Without a path group that includes the intended interfaces, the rule has no eligible path to steer to.

Question 8SD-WAN Deployment and Configuration

An ION is deployed at a branch in dual-router mode with two ISP links. What does the controller use to decide whether a path meets the SLA required by a real-time application?

  1. The monitoring thresholds defined for latency, jitter, and packet loss on the path group Correct answer.
  2. The MTU value configured on the LAN interface
  3. The administrative distance of the learned routes
  4. The number of DHCP leases currently active

Explanation

Prisma SD-WAN continuously probes each path and compares measured latency, jitter, and loss against the thresholds configured for the application or path group. Flows are then steered to a path that satisfies the SLA.

Question 9SD-WAN Deployment and Configuration

A branch uses a single ION with two WAN links and needs traffic for a business-critical application to prefer the MPLS link while using the internet link only when the MPLS path degrades. Which policy approach fits?

  1. A NAT rule that translates the application to the internet address
  2. A static route pointing all traffic to the MPLS next hop
  3. A single rule with the internet path group as the only option
  4. A rule with the MPLS path group as primary and the internet path group as a fallback with SLA thresholds Correct answer.

Explanation

Ordering the MPLS path group as primary and the internet path group as fallback, with SLA thresholds on the primary, gives preference to MPLS and automatic failover when it degrades. This is the standard active/standby steering pattern.

Question 10SD-WAN Deployment and Configuration

Which statement correctly describes the difference between a network policy and a QoS policy in Prisma SD-WAN?

  1. QoS policy is applied before network policy and overrides path selection
  2. Network policy sets DSCP marking; QoS policy selects the WAN path
  3. Network policy decides path selection and forwarding; QoS policy classifies and schedules traffic within a path Correct answer.
  4. Both policies only apply to LAN-to-LAN traffic

Explanation

Network policy governs which path a flow takes and whether it is allowed, while QoS policy assigns traffic classes and controls bandwidth, priority, and marking on the chosen path. They are complementary and applied in sequence.

Question 11SD-WAN Deployment and Configuration

An engineer configures a service link on an ION to steer traffic to a cloud security provider. What is the primary function of this configuration?

  1. It assigns DHCP addresses to branch endpoints
  2. It provides a dedicated tunnel from the ION to a cloud service for inspection or optimized routing Correct answer.
  3. It encrypts LAN traffic between VLANs on the same ION
  4. It replaces the need for a path group on the WAN interfaces

Explanation

A service link creates a tunnel from the ION to a cloud service such as a security vendor or cloud gateway so that selected traffic can be inspected or routed through that provider. Network policy then steers matching flows into the service link.

Question 12SD-WAN Deployment and Configuration

What must be configured on an ION so it can participate in dynamic routing with a neighboring core router over a WAN interface?

  1. A DHCP relay pointing at the core router
  2. A BGP neighbor relationship with the correct AS number and authentication settings Correct answer.
  3. A proxy ARP entry for the core router address
  4. An application definition matching the core router's management IP

Explanation

Dynamic routing with an external peer requires a BGP neighbor configuration that specifies the peer address, remote AS, and any authentication or timers. The ION then advertises and learns prefixes over that session.

Question 13SD-WAN Deployment and Configuration

A branch ION must provide internet access to guest users on a separate VLAN while keeping guest traffic off the corporate fabric. Which combination achieves this?

  1. A guest VLAN mapped to a virtual interface with a network policy that steers it to the local internet path and blocks fabric prefixes Correct answer.
  2. A QoS policy that marks guest traffic as expedited forwarding
  3. A guest VLAN bridged directly to the corporate VLAN
  4. A static route from the guest VLAN to the data center default gateway

Explanation

Segmenting guests onto their own VLAN and virtual interface lets policy treat that segment separately, steering it to the local internet path and denying access to internal prefixes. Bridging or routing guests into the corporate fabric would defeat the isolation.

Question 14SD-WAN Deployment and Configuration

Which configuration is required for an ION to form a fabric tunnel with a remote site over an internet link that sits behind a NAT device?

  1. The remote site must disable all path groups
  2. The internet link must be placed in a separate autonomous system
  3. The ION must be able to initiate outbound tunnel traffic so NAT traversal can establish the session Correct answer.
  4. The NAT device must be configured with a static one-to-one mapping for the ION's LAN address

Explanation

When an ION is behind NAT, it initiates outbound tunnel traffic so the NAT device creates a translation and the tunnel can be established and maintained. Inbound static mappings are not generally required for this outbound-initiated model.

Question 15SD-WAN Deployment and Configuration

An administrator wants to confirm that a newly configured branch ION has successfully joined the fabric and is receiving policy. Which controller view provides the most direct confirmation?

  1. The ARP cache on the upstream ISP router
  2. The element status showing the device as claimed and operationally up with a recent policy version Correct answer.
  3. The QoS class map counters on the ION
  4. The DHCP lease table on the branch LAN

Explanation

The controller element view reports whether the device is claimed, its operational state, and the policy version it has applied. A recent policy version and up state confirm the ION has joined and is receiving configuration.

Question 16SD-WAN Deployment and Configuration

A network policy rule matches an application and lists two path groups with equal priority. What behavior should the engineer expect when both paths meet the SLA?

  1. Traffic is dropped until one path fails
  2. The rule is ignored because equal priority is invalid
  3. Traffic is distributed across the eligible paths according to the configured load-balancing method Correct answer.
  4. All matching flows are pinned to the first path group indefinitely

Explanation

When multiple path groups are eligible at the same priority and satisfy the SLA, the ION distributes flows across them using the configured load-balancing method, such as per-flow hashing. This uses available capacity on both links.

Question 17SD-WAN Deployment and Configuration

Which statement best explains why Prisma SD-WAN uses application definitions rather than only traditional five-tuple ACLs for steering?

  1. Application definitions replace the need for any routing protocol
  2. Application definitions assign IP addresses to endpoints dynamically
  3. Application definitions encrypt all matched traffic by default
  4. Application definitions identify traffic by signature and behavior so policy can steer SaaS and encrypted applications regardless of port Correct answer.

Explanation

Application definitions use signatures and behavioral inspection to classify traffic even when it uses dynamic ports or encryption, which five-tuple ACLs cannot do reliably. Policy can then steer those applications to the appropriate path.

Question 18SD-WAN Deployment and Configuration

An engineer needs to verify that a branch ION is correctly marking voice traffic with EF DSCP before it enters the fabric. Which approach provides the most direct verification?

  1. Examine the site's geolocation coordinates
  2. Check the BGP table for the voice prefix
  3. Review the DHCP option 43 settings
  4. Inspect the QoS policy class configuration and the interface statistics showing marked packet counts Correct answer.

Explanation

Confirming DSCP marking requires checking that the QoS policy places voice in the correct class with the intended marking and then reviewing interface statistics that show marked packets. Together these confirm the treatment applied to voice flows.

Question 19SD-WAN Deployment and Configuration

Which statement accurately describes how Prisma SD-WAN handles a path that repeatedly exceeds the configured latency threshold for a real-time application?

  1. The path is permanently removed from the path group
  2. All traffic on the path is dropped until an administrator intervenes
  3. The path's MTU is automatically reduced to compensate
  4. The path is marked as not meeting SLA and traffic is steered to an alternate eligible path while monitoring continues Correct answer.

Explanation

Continuous monitoring detects SLA violations and the ION steers affected flows to an alternate path that meets the threshold, while the degraded path remains monitored for recovery. This provides automatic remediation without manual intervention.

Question 20SD-WAN Deployment and Configuration

A branch has an ION with a single WAN link and no secondary path. Which statement about high availability for that site is true?

  1. QoS policy provides link redundancy
  2. Without a second WAN link or path, an SLA violation cannot be remediated by steering to another path Correct answer.
  3. The controller automatically provisions a backup link
  4. The ION can fail over to a fabric tunnel over the LAN if the WAN link fails

Explanation

Path steering requires at least one alternate eligible path; with only one WAN link there is nothing to steer to when that link degrades. Redundancy must come from an additional WAN link, a secondary element, or another designed path.

Question 21SD-WAN Deployment and Configuration

When a branch ION is added to a site that already has another ION, which configuration enables the two devices to share LAN-side redundancy for endpoints?

  1. Placing each ION in a different site
  2. Assigning both IONs the same WAN public address
  3. Configuring both elements at the site with a shared LAN network and a redundancy protocol such as VRRP Correct answer.
  4. Disabling path groups on both elements

Explanation

Placing both elements at the same site and attaching them to a shared LAN network allows a first-hop redundancy protocol to provide a virtual gateway for endpoints. If one element fails, the other continues forwarding for the LAN.

Question 22SD-WAN Deployment and Configuration

An engineer observes that traffic from a branch to a data-center application is being routed over the internet path even though the MPLS path is healthy and preferred. Which troubleshooting step best isolates the cause?

  1. Disable application definitions on the site
  2. Change the DHCP lease time on the branch
  3. Increase the MTU on the LAN interface
  4. Verify that the application flow matches the intended network policy rule and that the MPLS path group is listed as the primary option Correct answer.

Explanation

Unexpected path selection usually stems from rule ordering, a mismatch in application or prefix matching, or a path group that does not include the intended link. Confirming the matching rule and its primary path group isolates whether policy or path health is responsible.

Question 23SD-WAN Deployment and Configuration

A design requires that traffic from a branch to a private data-center prefix use the MPLS path, while internet-bound SaaS traffic uses local breakout, and both must fail over to the other link if their primary degrades. Which policy structure implements this correctly?

  1. One catch-all rule that sends all traffic to the internet path group
  2. A static route for the data-center prefix and no policy for SaaS traffic
  3. A single rule with both path groups listed at equal priority for all traffic
  4. Separate rules ordered by specificity: a data-center prefix rule with MPLS primary and internet fallback, and a SaaS application rule with internet primary and MPLS fallback Correct answer.

Explanation

Distinct rules matched on the data-center prefix and on SaaS applications allow each flow type to have its own primary and fallback path group. Ordering the more specific rules first ensures each flow receives the intended steering and failover behavior.

Question 24SD-WAN Deployment and Configuration

An administrator must ensure that a new ION at a site with two WAN links does not use the metered cellular link for bulk backup traffic unless both wired links fail. Which configuration achieves this?

  1. Place the cellular interface in a path group used only as a last-resort fallback in the relevant policy rules Correct answer.
  2. Assign the cellular interface the lowest administrative distance
  3. Apply a QoS policy that marks backup traffic as best effort
  4. Configure the cellular interface as the default static route

Explanation

Putting the metered link in its own path group and referencing it only as a lower-priority fallback ensures it is used only when the preferred wired paths fail to meet SLA. This controls cost while preserving last-resort connectivity.

Question 25SD-WAN Deployment and Configuration

A branch ION reports that fabric tunnels to a specific remote site stay down while tunnels to other sites are up. Which cause is most consistent with this symptom?

  1. The DHCP scope for the branch is exhausted
  2. A path group on the branch is missing the interface used to reach that remote site, or the remote site's reachable path is down Correct answer.
  3. The QoS policy on the branch marks traffic incorrectly
  4. The branch LAN VLAN is misconfigured for all endpoints

Explanation

Site-specific tunnel failure points to a path or reachability problem between those two sites rather than a global branch issue. Checking that the relevant interface is in a path group and that the remote site's path is healthy isolates the fault.

Question 26SD-WAN Deployment and Configuration

When an engineer creates a new site in Prisma SD-WAN before deploying any ION hardware, which element must be defined first so that WAN interfaces can later be associated with provider links?

  1. A WAN provider profile assigned to the site Correct answer.
  2. A QoS policy applied to the site
  3. A network policy rule set
  4. A service link to a cloud security provider

Explanation

WAN provider profiles describe link characteristics such as bandwidth and provider type, and they are attached to a site so that physical interfaces can be mapped to provider links. Without a provider profile the ION interfaces cannot be classified into the correct WAN path categories used by path selection.

Question 27SD-WAN Deployment and Configuration

During branch onboarding, an engineer must bind a physical WAN port on an ION to the correct provider so the controller can classify it as an internet versus private MPLS path. Where is this association made?

  1. In the fabric tunnel encryption template
  2. In the global application definition library
  3. In the controller's certificate authority settings
  4. In the device interface configuration, selecting the site's WAN provider profile Correct answer.

Explanation

Each WAN interface on an ION is configured with a network type and associated with a WAN provider profile defined at the site level. That binding lets the controller label the link correctly for path selection, monitoring, and policy enforcement.

Question 28SD-WAN Deployment and Configuration

An ION at a small branch is connected to a single ISP link. Which statement describes how the controller treats path selection for this site?

  1. It can still apply policy but has no alternate WAN path for failover or per-application steering. Correct answer.
  2. It provides active-active load balancing across the single link and the fabric.
  3. It converts the link into a private MPLS path through the fabric.
  4. It automatically disables all network policy rules until a second link is added.

Explanation

With only one WAN link, the controller has no second path to steer traffic toward, so policies still match and apply but cannot achieve path redundancy or per-application path preference. Failover and dynamic path selection require at least two usable paths.

Question 29SD-WAN Deployment and Configuration

Which object is used in Prisma SD-WAN to group WAN paths by provider and preference so that a network policy rule can steer an application across them?

  1. A prefix filter
  2. A path group Correct answer.
  3. A service link
  4. A NAT pool

Explanation

Path groups collect WAN paths, typically by provider or link type, and a network policy rule references them to decide which paths an application may use and in what order. They are the steering construct that ties policy to the underlying provider links.

Question 30SD-WAN Deployment and Configuration

An engineer wants guest traffic on a dedicated VLAN at a branch to reach the internet directly while corporate traffic uses the fabric. Which Prisma SD-WAN construct handles this separation?

  1. A single default route shared by all VLANs
  2. An application definition override for DHCP
  3. A fabric tunnel dedicated to guest VLANs
  4. A separate device policy stack applied per VLAN interface Correct answer.

Explanation

Prisma SD-WAN applies policy stacks per interface, so a guest VLAN interface can have its own network policy stack that steers traffic to a local internet breakout while the corporate interface uses fabric paths. This keeps guest traffic isolated from corporate steering.

Question 31SD-WAN Deployment and Configuration

Which statement describes the role of a service link in Prisma SD-WAN?

  1. It redirects selected traffic to a third-party service such as a cloud security provider. Correct answer.
  2. It establishes the site-to-site fabric tunnels between IONs.
  3. It assigns DHCP addresses to branch endpoints.
  4. It defines the physical WAN port speed on the ION.

Explanation

A service link represents a connection to an external service, such as a cloud security provider or a middlebox, and network policy can steer matching traffic through it. It is distinct from WAN provider links that carry normal site traffic.

Question 32SD-WAN Deployment and Configuration

An engineer is preparing an ION for zero-touch provisioning at a new branch. Which step allows the device to be claimed and associated with the correct site automatically?

  1. Manually configuring static routes on the console
  2. Creating a QoS policy before the device is online
  3. Installing a local DHCP server on the ION
  4. Registering the device serial number and assigning it to the site in the controller Correct answer.

Explanation

Zero-touch onboarding relies on the device serial number being claimed and assigned to a site in the controller, so that when the ION comes online it downloads its configuration automatically. No manual console configuration is needed for basic bring-up.

Question 33SD-WAN Deployment and Configuration

Which capability distinguishes Prisma SD-WAN application definitions from traditional five-tuple access control lists?

  1. They identify applications using signatures and behavior beyond static port and address matching. Correct answer.
  2. They replace the need for any routing configuration.
  3. They apply only to traffic leaving the data center.
  4. They match only on source and destination IP addresses.

Explanation

Application definitions use deeper inspection, such as protocol signatures and behavioral characteristics, to recognize applications even when they use dynamic ports or encryption. This lets policy steer by application identity rather than only by fixed five-tuple matches.

Question 34SD-WAN Deployment and Configuration

An engineer configures a network policy rule that matches a SaaS application and lists two path groups with equal priority. What should the engineer expect the controller to do when both paths are healthy?

  1. Send all matching flows over the first path group only.
  2. Drop matching traffic until one path fails.
  3. Send matching traffic over the lower-bandwidth path exclusively.
  4. Distribute matching flows across the eligible paths in the listed path groups. Correct answer.

Explanation

When multiple path groups are listed at equal priority, the controller treats them as equally eligible and can spread matching flows across the available healthy paths. This provides utilization and resilience benefits while the paths remain within SLA.

Question 35SD-WAN Deployment and Configuration

A branch ION must exchange routes dynamically with an adjacent core router over a WAN interface. Which configuration on the ION is required to support this?

  1. A QoS policy bound to the LAN interface
  2. A NAT pool applied to the WAN interface
  3. A service link pointing to the core router
  4. A BGP routing configuration bound to the WAN interface Correct answer.

Explanation

Dynamic route exchange with an external router requires a routing protocol configuration, such as BGP, associated with the interface that faces that router. The ION then advertises and learns prefixes over that WAN interface alongside its fabric participation.

Question 36SD-WAN Deployment and Configuration

An ION is deployed at a branch with two ISP links. The engineer wants voice traffic to prefer the lower-latency link and fail over automatically when latency degrades. Which mechanism accomplishes this?

  1. A service link to a cloud security provider
  2. Path quality monitoring combined with a network policy that steers voice by path SLA Correct answer.
  3. A QoS policy that marks voice with EF DSCP
  4. A static route with a lower administrative distance on the preferred link

Explanation

Prisma SD-WAN continuously measures path characteristics such as latency, jitter, and loss, and a network policy can steer an application to paths that meet its SLA. When the preferred link degrades, the controller moves matching traffic to a path that still satisfies the SLA.

Question 37SD-WAN Deployment and Configuration

An administrator wants to verify that a newly onboarded branch ION has joined the fabric and is exchanging traffic with other sites. Which controller view provides this confirmation?

  1. The device status and fabric topology view showing the ION as connected Correct answer.
  2. The certificate revocation list
  3. The QoS policy editor
  4. The application definition library listing

Explanation

The controller's device and topology views show whether an ION is connected, which sites it can reach, and the state of its fabric tunnels. That is the authoritative place to confirm successful fabric membership after onboarding.

Question 38SD-WAN Deployment and Configuration

A branch ION uses two WAN links, and the engineer wants bulk backup traffic to avoid the metered cellular link unless no other path is available. Which configuration achieves this?

  1. A static default route pointing to the cellular link
  2. A network policy rule for backup traffic that lists the cellular path group at a lower priority Correct answer.
  3. A service link bound to the cellular interface
  4. A QoS policy that marks backup traffic as best effort

Explanation

Listing the cellular path group at lower priority makes it a fallback that is used only when the preferred paths are unavailable or outside SLA. Higher-priority path groups carry the traffic whenever they are healthy.

Question 39SD-WAN Deployment and Configuration

An engineer observes that traffic to a data-center application is traversing the internet path even though an MPLS path is available and preferred. Which troubleshooting step best isolates the cause?

  1. Replacing the ION hardware at the branch
  2. Increasing the DHCP lease time on the LAN
  3. Disabling all QoS policies at the site
  4. Checking whether the application is matched by a policy rule and whether the MPLS path is in the rule's path group Correct answer.

Explanation

Unexpected path use usually means the traffic is not matching the intended rule, or the preferred path group does not include the MPLS path or is not healthy. Verifying rule match and path group membership isolates the cause before any hardware action.

Question 40SD-WAN Deployment and Configuration

Which statement accurately describes the relationship between a network policy and a QoS policy in Prisma SD-WAN?

  1. Both policies perform identical functions and are interchangeable.
  2. A QoS policy must be applied before any network policy can be created.
  3. A network policy decides which path traffic uses, while a QoS policy decides how traffic is queued and prioritized on a link. Correct answer.
  4. A network policy shapes bandwidth, while a QoS policy selects the WAN path.

Explanation

Network policies govern path selection and steering decisions for matched traffic, while QoS policies govern queuing, marking, and bandwidth treatment once traffic is on a link. They are complementary and are applied at different stages of the forwarding decision.

Question 41SD-WAN Deployment and Configuration

A site has two IONs deployed in dual-router mode. What does the controller use to decide whether traffic can fail over from one ION to the other when a WAN link fails?

  1. The application definition version installed on each ION
  2. The DHCP lease duration on the branch LAN
  3. The LAN-side VRRP priority and the fabric path availability reported by both devices Correct answer.
  4. The certificate serial number of each ION

Explanation

In dual-router mode the IONs share LAN reachability through a first-hop redundancy mechanism such as VRRP, and the controller tracks fabric path availability from both devices. Failover depends on the combination of LAN gateway priority and which WAN paths remain usable.

Question 42SD-WAN Deployment and Configuration

An engineer needs to confirm that a branch ION is marking voice traffic with EF DSCP before it enters the fabric. Which approach provides direct verification?

  1. Reviewing the application definition library for voice signatures
  2. Checking the DHCP server lease table
  3. Reading the certificate revocation list
  4. Capturing traffic on the WAN interface and inspecting the DSCP field of voice packets Correct answer.

Explanation

A packet capture on the WAN interface shows the actual DSCP value carried in the IP header, which directly confirms whether the ION is marking voice as EF. Policy and QoS configuration views show intent, but the capture shows the result on the wire.

Question 43SD-WAN Deployment and Configuration

A branch site has two IONs. Which configuration allows the pair to share a common LAN gateway address so endpoints keep connectivity if one device fails?

  1. A static route on each ION pointing to the other
  2. A separate DHCP pool on each ION LAN interface
  3. A distinct service link on each ION
  4. A VRRP group configured on the LAN interfaces of both IONs Correct answer.

Explanation

A first-hop redundancy protocol such as VRRP lets two IONs present a shared virtual LAN gateway address, so endpoints retain their default gateway when the active device fails. The backup device assumes the virtual address and continues forwarding.

Question 44SD-WAN Deployment and Configuration

Which statement best explains how the controller reacts when a WAN path repeatedly exceeds the latency threshold configured for an application's SLA?

  1. It drops all traffic until the latency returns to normal.
  2. It converts the path into a private MPLS link.
  3. It marks the path as out of compliance and steers matching traffic to a path that still meets the SLA. Correct answer.
  4. It permanently disables the path for all applications at the site.

Explanation

Path quality monitoring continuously evaluates each path against the SLA, and a path that persistently violates the threshold is treated as non-compliant for that application. The controller then moves matching traffic to an eligible path that satisfies the SLA.

Question 45SD-WAN Deployment and Configuration

An engineer configures a fabric tunnel between two sites over an internet link that sits behind a NAT device. Which setting allows the tunnel to establish correctly?

  1. Enabling NAT traversal so the tunnel endpoints can discover each other's translated addresses Correct answer.
  2. Configuring a static route to the remote public IP only
  3. Assigning the WAN interface a private address with no gateway
  4. Disabling encryption on the tunnel

Explanation

When a tunnel endpoint is behind NAT, the devices must detect the translated public address and port so the tunnel can be built. NAT traversal enables that discovery and keeps the tunnel alive through the address translation.

Question 46SD-WAN Deployment and Configuration

A design requires that traffic to a private data-center prefix use the MPLS path while internet-bound SaaS traffic uses the local internet breakout. Which configuration structure supports this cleanly?

  1. A QoS policy that marks all traffic as EF
  2. A static default route toward the MPLS link
  3. A single rule matching all traffic with one path group
  4. Separate network policy rules matching each traffic class with different path groups Correct answer.

Explanation

Distinct policy rules let each traffic class be matched and steered independently, so the data-center prefix can be pinned to the MPLS path group while SaaS traffic uses the internet path group. This separation keeps path intent explicit and maintainable.

Question 47SD-WAN Deployment and Configuration

An engineer is troubleshooting a branch ION whose fabric tunnels to one remote site stay down while tunnels to other sites are up. Which cause is most likely?

  1. The remote site's WAN provider profile or path group no longer includes a reachable path between the two sites Correct answer.
  2. The branch ION's LAN VRRP priority is set too low
  3. The branch DHCP lease time is too short
  4. The application definition library is outdated on the branch

Explanation

When only one remote site is unreachable, the problem is usually specific to the path between those two sites, such as a missing or unreachable path in the remote site's provider profile or path group. Tunnels to other sites working confirms the local device and fabric membership are healthy.

Question 48SD-WAN Deployment and Configuration

A branch ION has two WAN links in the same path group. The engineer wants one link preferred for interactive traffic while the other is used only when the first is out of SLA. Which configuration expresses this intent?

  1. A static route with equal cost on both links
  2. One path group containing both links with no priority ordering
  3. Two path groups listed in priority order within the policy rule for interactive traffic Correct answer.
  4. A QoS policy that marks interactive traffic as AF41

Explanation

Placing the preferred link's path group at a higher priority and the backup path group at a lower priority makes the backup eligible only when the preferred path is unavailable or non-compliant. This expresses explicit preference while retaining automatic failover.

Question 49SD-WAN Deployment and Configuration

An engineer must ensure that a new ION at a site with two WAN links does not use the metered cellular link for bulk traffic even during a primary link outage, while still allowing voice to fail over to cellular. Which configuration satisfies both requirements?

  1. A bulk-traffic rule limited to the wired path group and a voice rule that includes the cellular path group as a lower-priority option Correct answer.
  2. A QoS policy that marks bulk traffic as best effort on all links
  3. A static default route toward the cellular link with a high metric
  4. A single rule for all traffic that includes the cellular path group at equal priority

Explanation

Separate rules let bulk traffic be constrained to the wired path group so it never uses the metered link, while voice rules include the cellular path group at lower priority for failover. This satisfies both the cost constraint and the availability requirement for voice.

Question 50SD-WAN Deployment and Configuration

A branch ION is configured with a BGP session to a core router over MPLS and also participates in the fabric. An engineer wants prefixes learned from the core router to be reachable by other sites through the fabric. What is required?

  1. Applying a QoS policy to the BGP session
  2. Disabling the BGP session so the fabric learns the prefixes automatically
  3. Creating a service link for each learned prefix
  4. Redistributing the learned prefixes into the fabric routing so they are advertised to other sites Correct answer.

Explanation

Prefixes learned from an external routing peer must be redistributed into the fabric routing domain so the controller and other sites can use them. Without redistribution the routes remain local to the ION and are not advertised across the fabric.