SD-WAN-Engineer Sample Questions & Answers

Branch IONs treat each underlay and Standard VPN as a separate routing domain and do not advertise routes learned from one domain into another, so a branch never dynamically becomes a transit point. Branches build Secure Fabric VPNs to the data centers. From ION 6.5.1, DC-to-DC Secure Fabric Links can be created under Data Centers > Overlay Connections, and prefixes learned on inter-DC VPNs are not redistributed further, which prevents loops. There is no 'Transit' toggle on branch sites.

Secure Fabric tunnels between IONs are always IPsec-encrypted with AES-256-GCM, AES-256-CBC, AES-128-GCM or AES-128-CBC; the controller picks the best common cipher. They do not use IKE. The controller sends three encrypted shared secrets (each valid for one day), the endpoints exchange nonces and derive tunnel-specific session keys, and the keys are renegotiated every hour without the controller (tunnels survive up to 3 days without it). IKEv1/IKEv2 apply only to Standard VPNs, and encryption cannot be turned off per circuit.

A path policy rule can use only the paths it lists: Active paths (load-shared while SLA-compliant), Backup paths and L3 Failure paths, each an overlay plus a circuit category. If the guest rule lists only the public Broadband and LTE circuit categories, guest traffic can never be placed on MPLS. Listing MPLS as a Backup path would allow it, and a security rule is not the intended path-steering control.

Per the Prisma SD-WAN Administrator's Guide (Connect the ION Device), the ION controller port is DHCP-enabled by default and must be connected to a subnet with internet access; models without a dedicated controller port use port 1 or port 2 on a DHCP-enabled network. The device then resolves and connects to the controller (controller.cgnx.net / locator.cgnx.net over TCP 443), changes from Offline to Online, and can be claimed and assigned to its site, after which the controller pushes the site configuration. A static IP (set from the AUX console) is needed only when the circuit has no DHCP; there is no claim key and no MPLS-first requirement.

Prisma SD-WAN site configuration templates are Jinja blueprints. Values that differ per site, such as LAN subnets, are turned into variables with 'Make Variable' and rendered as {{ variable_name }}; each site's value is supplied in the CSV site data file (or entered manually) when the sites are deployed, so one template serves all 50 sites. Device shells only pre-stage a device configuration before the hardware arrives, 'Site Overrides' are not a Prisma SD-WAN template feature, and dynamic routing does not assign LAN subnets.

Prisma SD-WAN has no 'Redistribution Profile' (that is a PAN-OS object). Routes advertised to an ION BGP peer are filtered with a route map: its entries match a Prefix List (or IP Community List, AS Path List, IP Next Hop) with Permit/Deny, and the map is selected as the peer's Route Map Out on the Prefix Advertisement tab. The prefix list can carry length qualifiers (the ION routing configuration shows entries such as 'permit 10.10.10.0/24 ge 28 le 30'). After changing an associated prefix list, soft-reset the peer. Interface ACLs, a 'Global Routing Table Policy' or a peer password do not filter BGP advertisements.

VRF (Virtual Routing and Forwarding) allows multiple instances of a routing table to exist in a router and work simultaneously. This is the standard method for isolating traffic (segmentation) at Layer 3, ensuring Corporate, Guest, and IoT routes are kept separate.

DHCP relay is an interface-level setting on a branch ION. In the DHCP Relay section of the interface that serves the subnet (a LAN port, the controller port, or a sub-interface with a static IP) you add the DHCP Server IP addresses (up to 16), optionally choose the source interface used to reach them (the controller port by default) and optionally enable Option 82. The ION then forwards client broadcasts to the servers as unicast. No NAT rule or dedicated static route is inherently required, although the source interface must be able to reach the servers.

DHCP relay is an interface-level setting on a branch ION. In the DHCP Relay section of the interface that serves the subnet (a LAN port, the controller port, or a sub-interface with a static IP) you add the DHCP Server IP addresses (up to 16), optionally choose the source interface used to reach them (the controller port by default) and optionally enable Option 82. The ION then forwards client broadcasts to the servers as unicast. No NAT rule or dedicated static route is inherently required, although the source interface must be able to reach the servers.

OSPF adjacencies require matching Area IDs. If the ION is in Area 0 (Backbone) and the switch expects Area 1, the adjacency will fail with an area mismatch error.

False. Prisma SD-WAN has no 'Site Profile' and 'Device Profile' with these roles. Circuits (name, ISP, Link Up/Link Down bandwidth used for QoS shaping, circuit category/label, cost, LQM and BW monitoring) are defined per site under Branch Sites/Data Centers > Configuration > Connectivity and Circuits, while interface IP addressing is configured on the ION device itself (ION Devices > Configure the device > Interfaces), where each WAN port is tied to a site circuit through its circuit label.