This certification exam features multiple-choice questions (single and multi-select), interactive Hotspots, Hot Areas, and Drag-and-Drop scenario configurations designed to test real-world technical competency.
SD-WAN-Engineer Certification Study Guide & Architectural Master Blueprint
Welcome, aspiring SD-WAN Engineer! This comprehensive study guide and architectural blueprint is meticulously crafted to prepare you for the SD-WAN-Engineer certification exam. As an expert cloud architect and certification exam author, I understand the depth of knowledge required to excel in this specialized field. This exam validates your expertise in designing, deploying, configuring, and troubleshooting modern Software-Defined Wide Area Networks.
Exam Overview & Profile
The SD-WAN-Engineer certification targets seasoned network engineers, solution architects, and operations specialists who are responsible for implementing and managing advanced SD-WAN solutions. Candidates are expected to possess a deep understanding of networking fundamentals, security principles, and the unique architectural components that define SD-WAN. While the exact question count and duration can vary slightly by testing region, you can typically expect between 60-75 questions to be completed within a 90-120 minute timeframe. A passing score generally falls in the range of 700-750 out of 1000, signifying a strong command of the material and practical application skills.
Deep-Dive Domain Breakdown
The SD-WAN-Engineer exam covers several critical domains. Mastering these areas is essential for success:
SD-WAN Fundamentals & Architecture:
Understanding the logical separation of the control, data, and management planes.
Initial setup and configuration of controllers and edge devices.
Policy & Traffic Engineering:
Designing and implementing centralized policies for routing, QoS, and security.
Application identification and classification mechanisms.
Dynamic path selection based on real-time link performance (latency, jitter, packet loss).
Traffic steering and service chaining to security services.
Security Integration & Segmentation:
IPsec/DTLS tunnel establishment and key exchange.
Distributed firewall capabilities and policy enforcement at the branch.
Network segmentation using VRFs (Virtual Routing and Forwarding) within the SD-WAN fabric.
Integration with cloud security services and SASE principles.
Monitoring, Operations & Troubleshooting:
Utilizing centralized dashboards and analytics for network visibility and performance monitoring.
Identifying and resolving common connectivity, policy, and performance issues.
Log analysis, alarm interpretation, and diagnostic tools.
High availability, redundancy, and disaster recovery strategies for SD-WAN components.
High-Yield Exam Tips & Scenario Traps
Architectural Decision Rules: In scenario-based questions, always prioritize application performance and user experience. Design for resilience and high availability. Security should be baked into the design from the start, following a least privilege model. Consider scalability for future growth and automation to minimize operational overhead.
Common Exam Traps:
Overlooking Underlay Importance: While SD-WAN creates an overlay, the quality and redundancy of the underlay are critical. Don’t disregard its role.
Confusing Control vs. Data Plane: Understand which actions happen on the orchestrator/controller and which are executed by the edge devices.
Ignoring Security Implications: Never propose a solution that compromises security, even if it simplifies connectivity or reduces cost.
Misinterpreting Requirements: Read scenario questions carefully. A “cost-effective” solution might not be the “most performant” or “most secure” solution required.
Lack of Redundancy: Solutions lacking component or path redundancy are almost always incorrect for production environments.
Frequently Asked Questions (FAQ)
Q1: How should I structure my study time for the SD-WAN-Engineer exam? A1: Focus on a balanced approach. Dedicate time to understanding the core architectural concepts, review official documentation and design guides, and critically, get hands-on experience through labs or simulated environments. Practice troubleshooting common SD-WAN issues and designing policy configurations. Regularly test your knowledge with practice questions.
Q2: What kind of questions can I expect on the SD-WAN-Engineer exam? A2: The exam primarily features multiple-choice and multiple-select questions. You will also encounter scenario-based questions that require you to analyze a network problem or design requirement and select the most appropriate SD-WAN solution, configuration, or troubleshooting step. These questions test your practical application of SD-WAN principles.
Q3: Are there any specific prerequisites for taking this exam? A3: While there might not be strict prerequisite certifications, candidates are strongly advised to possess a robust background in general networking (routing protocols, switching, VPNs, QoS), security concepts, and ideally, some practical experience working with SD-WAN deployments. A foundational understanding of cloud networking is also highly beneficial.
Q4: What’s the best strategy for answering scenario-based questions effectively? A4: For scenario questions, first identify the core problem or goal. Next, pinpoint any constraints (e.g., budget, existing infrastructure, performance requirements). Then, evaluate each potential answer against these criteria, considering its architectural soundness, security implications, and operational impact. Choose the option that best addresses all aspects of the scenario holistically.
Free SD-WAN-Engineer Sample Practice Questions
Test your knowledge with these sample scenario questions complete with verified explanations:
General Practice Questions
QUESTION 1
A network administrator is troubleshooting a critical SaaS application, “SuperSaaSApp”, that is experiencing connectivity issues. Initially, the configured active and backup paths for the application were reported as completely down at Layer 3. The Prisma SD-WAN system attempted to route traffic for the application over an L3 failure path that was explicitly configured as a Standard VPN to Prisma Access.
However, users are still reporting a complete outage for the application and monitoring tools show application flows being dropped when attempting to use the Standard VPN L3 failure path, even though the tunnel itself appears to be up. The administrator suspects a policy misconfiguration related to how the Standard VPN path interacts with destination groups.
What is the most likely reason for flows being dropped when attempting to use the Standard VPN L3 failure path?
A. The “Move Flows Forced” action was not enabled in the performance policy for “SuperSaaSApp”, preventing the system from actively shifting traffic to the L3 failure path.
B. The path policy rule for “SuperSaaSApp” has the “Required” checkbox selected for its Service & DC Group, but no direct paths were configured alongside it, creating a conflict.
C. The path policy rule explicitly designates a Standard VPN as the L3 failure path, but it does not include a designated Standard Services and DC Group, causing traffic to be dropped.
D. The Standard VPN in the path policy was not configured to “Minimize Cellular Usage”, leading to the depletion of metered data and subsequent flow drops.
Click to View Verified Solution & Explanation
Correct Option:C
Explanation:
✅ Option C (Correct) Reasoning: When a Standard VPN is configured as an L3 failure path, it must be associated with a Standard Services and DC Group to correctly define the destinations reachable through that VPN. If this group is missing or misconfigured, the VPN tunnel might be up, but the system won’t know which destinations are valid for that path, causing flows for "SuperSaaSApp" to be dropped. This aligns with the administrator’s suspicion of a policy misconfiguration related to destination groups.❌ Why the other choices are incorrect:
Option A is incorrect: The question states the system "attempted to route traffic… over an L3 failure path", indicating traffic was shifted. "Move Flows Forced" dictates how aggressively traffic moves, not whether it drops once on the path.
Option B is incorrect: The "Required" checkbox affects how path availability is determined for a Service & DC Group. While a conflict could occur, the issue here is flows dropping on the VPN path itself, implying the path was selected but failed to deliver traffic due to destination policy.
Option D is incorrect: "Minimize Cellular Usage" relates to managing metered data on cellular interfaces. The scenario does not mention cellular paths or metered data, making this an unlikely cause for a Standard VPN L3 failure path to Prisma Access.
User-ID integration is configured for a Prisma SD-WAN deployment. Branch- 1 has the user-to-IP mappings available, and User-1 is mapped to IP-1.
To which two use cases can User-ID based zone-based firewall policies be applied? (Choose two.)
A. User-1 accessing a SaaS application on direct internet and source User-ID based zone-based firewall rules on Branch-1 ION
B. User-1 accessing a private application within Branch-1, and source User-ID based zone-based firewall rules on Branch-1 ION
C. User-1 accessing a private application in data center via SD-WAN overlay, and destination User-ID based zone-base firewall rules DC ION
D. User-1 accessing a private application in Branch-2 via SD-WAN overlay, and destination User-ID based zone-based firewall rules on Branch-2 ION
Click to View Verified Solution & Explanation
Correct Option:A,B
Explanation:
✅ Option A (Correct) Reasoning: User-ID identifies the source user. For User-1 accessing a direct internet SaaS application, the Branch-1 ION is the egress point. A source User-ID based firewall policy on Branch-1 ION can correctly identify User-1 and apply security rules.✅ Option B (Correct) Reasoning: When User-1 accesses a private application within Branch-1, the traffic originates from User-1 within the branch. The Branch-1 ION can apply a source User-ID based firewall policy to identify User-1 and enforce security policies for internal traffic.❌ Why the other choices are incorrect:
Option C is incorrect: User-ID primarily identifies the source user (User-1 at Branch-1). Applying a ‘destination User-ID based’ rule at the DC ION for a user originating from Branch-1 is not the correct application of source User-ID. The DC ION would not have User-1’s mapping unless a separate User-ID instance exists there for local users.
Option D is incorrect: Similar to option C, applying ‘destination User-ID based’ rules on the Branch-2 ION for User-1 from Branch-1 is incorrect. User-ID on Branch-2 would be for users within Branch-2, not for identifying a remote source user like User-1 from Branch-1.
What is the purpose of Secure Group Tag (SGT) propagation in Prisma SD-WAN?
A. To integrate with external identity-based security solutions
B. To manage QoS policies for traffic based on user and application type
C. To clarify the intent of rules or configuration objects and improve rule organization
D. To enable or disable SGT settings at the interface level and initiate services like NTP, DHCP, and App Probes
Click to View Verified Solution & Explanation
Correct Option:A
Explanation:
✅ Option A (Correct) Reasoning: Secure Group Tag (SGT) propagation in Prisma SD-WAN is used to integrate with external identity-based security solutions. This allows the SD-WAN fabric to carry identity context (SGTs) from users or devices, enabling consistent, granular security policies to be enforced by firewalls or other security devices across the network.
❌ Why the other choices are incorrect:
Option B is incorrect: SGTs are primarily for security segmentation based on identity, not directly for managing Quality of Service (QoS) policies. QoS typically uses classifications like DSCP, application IDs, or bandwidth requirements.
Option C is incorrect: This describes good documentation practices or naming conventions, not the technical function of SGT propagation itself. SGTs carry dynamic identity context for policy enforcement.
Option D is incorrect: While SGTs might be enabled/disabled at an interface, the purpose of propagation is not merely configuration. Initiating services like NTP, DHCP, or App Probes is unrelated to SGT propagation, which focuses on security context.
QUESTION 4
A site has two internet circuits: Circuit A with 500 Mbps capacity and Circuit B with 100 Mbps capacity.
Which path policy configuration will ensure traffic is automatically shifted from a saturated circuit to the circuit with available bandwidth?
A. Circuit A as an active, Circuit B as a backup
B. Circuit B as an active, Circuit A as a backup
C. Both circuits under active pathMost Voted
D. Circuit B as an L3 failure path
Click to View Verified Solution & Explanation
Correct Option:C
Explanation:
✅ Option C (Correct) Reasoning:Configuring both circuits as active enables the SD-WAN solution to dynamically distribute traffic across both links. The SD-WAN controller can monitor real-time bandwidth utilization and performance metrics, automatically shifting traffic from a saturated circuit to the one with available bandwidth to maintain optimal application experience and prevent congestion.❌ Why the other choices are incorrect:
Option A is incorrect: An active-backup configuration only engages the backup circuit if the primary active circuit experiences a complete failure, not merely saturation. This does not allow for dynamic shifting based on congestion.
Option B is incorrect: Similar to Option A, this active-backup setup only initiates a failover when the primary circuit fails, rather than providing intelligent load balancing or traffic shifting due to saturation.
Option D is incorrect: An L3 failure path typically addresses routing failures or link unavailability at Layer 3, not bandwidth saturation or performance degradation. It’s a different mechanism for network resilience.
QUESTION 5 (Multi-Select)
Site templates are to be used for the large-scale deployment of 100 Prisma SD-WAN branch sites across different regions.
Which two statements align with the capabilities and best practices for Prisma SD-WAN site templates? (Choose two.)
A. The use of Jinja conditional statements within a site template is not supported, thereby limiting dynamic customization options.
B. Mandatory variables for any site template include the site name, ION software version, and at least one ION serial number /device name pair.
C. Site templates offer the capability to pre-stage device configurations by creating a device shell.Most Voted
D. Once a site has been deployed using a template, its configuration can be updated or modified by applying an updated version of the template.Most Voted
Click to View Verified Solution & Explanation
Correct Option:B,D
Explanation:
✅ Option B (Correct) Reasoning: For large-scale Prisma SD-WAN deployments using site templates, key mandatory variables include the site name for identification, the ION software version for compatibility, and at least one ION serial number or device name for device onboarding. These are essential for proper provisioning.
✅ Option D (Correct) Reasoning: A core capability of Prisma SD-WAN site templates is centralized configuration management. Once sites are deployed, updating the associated site template allows for efficient, large-scale modification or updating of configurations across all linked sites.
❌ Why the other choices are incorrect:
Option A is incorrect: Prisma SD-WAN templates fully support Jinja2 templating, which includes conditional statements, loops, and variables. This feature allows for extensive dynamic customization within templates.
Option C is incorrect: While site templates enable pre-staging of configurations for devices, the templates themselves define configurations for a site to which a device is assigned. The term "device shell" is not standard terminology in Prisma SD-WAN for this process; templates define the configuration that is applied to the IONs.
Network segmentation is required due to overlapping IP address space and M&A scenarios.
Which Prisma SD-WAN feature will achieve the desired segmentation and end-to-end connectivity in this use case?
A. Virtual Routing and Forwarding (VRF) profiles with proper site bindings to achieve desired isolation across the underlay
B. Virtual Routing and Forwarding (VRF) profiles with proper site bindings to achieve desired isolation locally and across the secure fabric
C. Multiple contexts with interface segmentation to achieve desired isolation across the underlay
D. Multiple virtual routers with interface segmentation to achieve desired isolation across the secure fabric
Click to View Verified Solution & Explanation
Correct Option:B
Explanation:
✅ Option B (Correct) Reasoning: Prisma SD-WAN leverages Virtual Routing and Forwarding (VRF) profiles to create logical segmentation for networks, essential for overlapping IP address spaces and M&A scenarios. These profiles, with proper site bindings, ensure traffic isolation both at the local site and across the secure SD-WAN fabric, providing end-to-end connectivity for specific segments. ❌ Why the other choices are incorrect:
Option A is incorrect: While VRF profiles are correct, stating isolation only “across the underlay” is incomplete. Prisma SD-WAN extends this segmentation across the secure overlay fabric for end-to-end segmented connectivity.
Option C is incorrect: "Multiple contexts" is not the primary Prisma SD-WAN feature for this use case; VRF profiles are. Interface segmentation is a component of applying VRFs, but not the overarching feature.
Option D is incorrect: While virtual routers are part of VRF functionality, "Multiple virtual routers" is not the direct configuration object used for creating end-to-end segmentation across the fabric in Prisma SD-WAN; VRF profiles encapsulate this functionality.
Which implementation allows Prisma SD-WAN to improve application performance for organizations facing inconsistent user experiences across branch locations, especially due to varying device types and network conditions, by using Layer 4 and Layer 7 optimization to boost throughput?
A. Packet duplication
B. WAN optimization
C. Forward Error Correction (FEC)
D. Application acceleration
Click to View Verified Solution & Explanation
Correct Option:D
Explanation:
✅ Option D (Correct) Reasoning: Application acceleration directly employs Layer 4 and Layer 7 optimizations, such as protocol optimization, caching, and compression, to boost application throughput and improve inconsistent user experiences across varying network conditions. This aligns precisely with the question’s focus on L4/L7 methods for enhanced application performance.❌ Why the other choices are incorrect:
Option A is incorrect: Packet duplication is a redundancy technique for path resilience and reliability, not primarily a Layer 4/Layer 7 optimization for boosting application throughput.
Option B is incorrect: WAN optimization is a broad category encompassing various techniques. While application acceleration is a type of WAN optimization, ‘Application acceleration’ is a more specific and direct answer when Layer 4 and Layer 7 optimizations for application performance are explicitly mentioned.
Option C is incorrect: Forward Error Correction (FEC) is a technique for recovering lost packets to improve reliability and reduce retransmissions. It does not directly focus on Layer 4 or Layer 7 optimizations to boost application throughput.
Which metrics can be monitored at the individual Prisma SD-WAN ION device level to assess its health and operational performance?
A. Device software version and interface bandwidth
B. Device CPU, memory and disk use, interface bandwidth, and errors/discards
C. Device VPN tunnels and controller reachability status
D. Device application flow statistics, Autonomous Digital Experience Manager (ADEM) metrics, and site health score
Click to View Verified Solution & Explanation
Correct Option:B
Explanation:
✅ Option B (Correct) Reasoning: CPU, memory, and disk usage are direct indicators of an ION device’s internal resource health. Interface bandwidth, errors, and discards reflect the device’s network traffic load and physical layer health, all crucial for assessing individual device operational performance.
❌ Why the other choices are incorrect:
Option A is incorrect: Device software version is a configuration detail, not a dynamic performance metric. While interface bandwidth is relevant, this option is incomplete for a comprehensive health assessment.
Option C is incorrect: VPN tunnel and controller reachability status are critical operational states and connectivity metrics, but they represent the device’s functionality and network context rather than the fundamental internal resource health and interface performance as comprehensively as Option B.
Option D is incorrect: Application flow statistics and ADEM metrics relate to application performance through the device and user experience, not primarily the individual ION device’s internal health. Site health score is an aggregated metric for an entire site.
In which modes can a Prisma SD-WAN branch be deployed?
A. Testing, Control, POV
B. Production, Control, Disabled
C. Disabled, Analytics, ControlMost Voted
D. POV, Production, Analytics
Click to View Verified Solution & Explanation
Correct Option:D
Explanation:
✅ Option D (Correct) Reasoning: Prisma SD-WAN branches are deployed in Production for active operations and POV (Proof of Value) for pilot or testing phases. These are two of the three official branch deployment modes. ❌ Why the other choices are incorrect:
Option A is incorrect: While POV is valid, "Testing" is a concept, not a formal mode. "Control" refers to the control plane, not a branch deployment mode.
Option B is incorrect: While Production and Disabled are valid modes, "Control" refers to the system’s control plane, not a branch deployment mode.
Option C is incorrect: "Analytics" is a feature, and "ControlMost Voted" is not a recognized branch deployment mode. Only Disabled is a valid mode listed here.
For how many hours are Prisma SD-WAN VPN shared secrets valid?
A. 1
B. 8
C. 24
D. 72
Click to View Verified Solution & Explanation
Correct Option:B
Explanation:
✅ Option B (Correct) Reasoning: Prisma SD-WAN VPN shared secrets are valid for a default duration of 8 hours. This period is a common security practice for re-keying, ensuring frequent rotation of encryption keys and enhancing overall VPN security by limiting the exposure time of a single key.❌ Why the other choices are incorrect:
Option A is incorrect: 1 hour is too short for a typical default VPN shared secret validity and is not the standard for Prisma SD-WAN.
Option C is incorrect: 24 hours is a possible configuration but not the default validity period for Prisma SD-WAN VPN shared secrets.
Option D is incorrect: 72 hours is a prolonged validity period for a default shared secret, increasing security risks, and is not the default for Prisma SD-WAN.
Which component of Prisma SD-WAN is responsible for distributing User-IP and user-group mappings to branch devices that match the corresponding source IPs?
A. DC ION
B. Cloud Identity Engine
C. Controller
D. NGFW
Click to View Verified Solution & Explanation
Correct Option:B
Explanation:
✅ Option B (Correct) Reasoning: The Cloud Identity Engine (CIE) is a cloud-based service designed to collect user-IP and user-group mappings from various identity sources. It centrally distributes these mappings to Prisma SD-WAN ION devices, enabling identity-aware security policy enforcement. ❌ Why the other choices are incorrect:
Option A is incorrect: DC ION devices are endpoints within the Prisma SD-WAN fabric that consume identity mappings to apply policies, they do not distribute them.
Option C is incorrect: The Controller manages the Prisma SD-WAN fabric and policy orchestration, but the Cloud Identity Engine is responsible for the distribution of user-IP mappings to the IONs.
Option D is incorrect: An NGFW applies policies based on identity, but it is not the component within Prisma SD-WAN architecture that distributes user-IP mappings to branch ION devices.
When troubleshooting an issue at a site that is running on two cellular links from two carriers, the operations team shared some evidence shown in the graph below:
For the time duration shown in the graph, what are two inferencesout the site’s traffic that can be made? (Choose two.)
A. Using Carrier-1 as the WAN path may have experienced some performance degradation.
B. Using Carrier-2 as the WAN path may have experienced some performance degradation.
C. Using Carrier-2 as the WAN path may have switched over to Carrier-1.
D. Using Carrier-1 as the WAN path may have switched over to Carrier-2.
Click to View Verified Solution & Explanation
Correct Option:A,D
Explanation:
✅ Option A (Correct) Reasoning: The graph shows ‘cwan1 (Carrier-1)’ (blue line) experiencing a significant drop in Signal-to-Noise Ratio (SNR) from around 4.5 dB to near 0 dB between 15:00 and 23:00. A low SNR directly indicates poor signal quality, leading to performance degradation such as increased packet loss and latency.
✅ Option D (Correct) Reasoning: Due to the severe degradation of Carrier-1’s Signal-to-Noise Ratio, an SD-WAN solution, designed for path optimization, would likely re-route traffic from the impaired Carrier-1 to the more stable and higher-performing Carrier-2 path to maintain application performance and user experience.
❌ Why the other choices are incorrect:
Option B is incorrect: Carrier-2 (green line) maintains a relatively stable and higher Signal-to-Noise Ratio throughout the period (between 4.7 dB and 6.0 dB), indicating consistent and generally good signal quality, not significant performance degradation.
Option C is incorrect: A switch from Carrier-2 to Carrier-1 is highly improbable given Carrier-1’s severe signal degradation. SD-WAN policies typically steer traffic away from degraded links, not towards them, especially when a healthy alternative (Carrier-2) is available.
Which troubleshooting action should be taken when resources at one branch site can reach the internet but cannot be reached from the data center (DC)?
A. Create static route with DC ION as a next hop.
B. Ensure the LAN branch prefixes are set to “global.”
C. Set the site in a control mode.
D. Admin up the Prisma SD-WAN DC endpoints.
Click to View Verified Solution & Explanation
Correct Option:B
Explanation:
✅ Option B (Correct) Reasoning: When branch LAN prefixes are not set to “global” in Prisma SD-WAN, they are not advertised across the SD-WAN fabric. Consequently, the data center (DC) cannot learn these routes, making the branch site unreachable from the DC while local internet access remains functional.❌ Why the other choices are incorrect:
Option A is incorrect: Creating static routes is generally not the primary method for inter-site routing in an SD-WAN overlay; dynamic advertisement is preferred.
Option C is incorrect: "Control mode" relates to the operational state of the controller or device, not directly to the advertisement of LAN prefixes.
Option D is incorrect: If DC endpoints were administratively down, the DC would have broader connectivity issues, not just specific branch LAN unreachability.
By default, how many days will Prisma SD-WAN VPNs stay operational before the keys expire when an ION device loses connection with the controller?
A. 1
B. 3Most Voted
C. 5
D. 7
Click to View Verified Solution & Explanation
Correct Option:D
Explanation:
✅ Option D (Correct) Reasoning: By default, Prisma SD-WAN ION devices maintain operational VPNs for 7 days after losing connection to the controller. This grace period allows for controller connectivity restoration before VPN keys expire, ensuring business continuity.
❌ Why the other choices are incorrect:
Option A is incorrect: A 1-day period is too short and not the default setting for VPN key expiration in a controller-disconnected state, which prioritizes network resilience.
Option B is incorrect: The default key expiration period for a disconnected Prisma SD-WAN ION device is not 3 days; this duration would limit operational resilience.
Option C is incorrect: 5 days is not the default duration. Prisma SD-WAN provides a longer default grace period of 7 days for VPN key expiration.
