Home Certifications Editorials

Exam overview and study plan

SD-WAN Engineer 270-403 Practice Questions

SD-WAN Engineer

Read questions, check verified answers and discuss the reasoning. Use reading options to shape your revision, or switch to the simulator for timed practice.

View 45 free questions

45 questions in this view

Page 1 of 8

Question 1

A large-scale Prisma SD-WAN environment requires Security policies that are based on user roles rather than static IP addresses. The branch ingress points currently receive traffic that is already tagged with identity metadata from an external provider.

Why should the administrator enable Secure Group Tag (SGT) propagation on the AppFabric?

To provide a mechanism for establishing localized NAT policies for specific authenticated user groups to mask internal identities from the destination network
To synchronize local user identity databases and authentication credentials across all distributed ION devices to facilitate consistent local policy enforcement without the need for external servers
To transport identity metadata across the fabric so destination security controls can apply the correct policy based on user roles rather than static network addresses
To allow the ION device to perform automated path failover and priority-based optimization for identified executive users by mapping security tags to specific Path Quality Profiles

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

A branch site recently upgraded its local internet circuit from 200 Mbps to 1 Gbps. However, users report that speed tests still show a maximum throughput of 200 Mbps, even though the physical interface on the ION device shows a 1000 Mbps link state.

Which configuration setting must be updated to allow the ION device to use the full bandwidth of the upgraded link?

Physical interface speed and duplex settings on the ION device
QoS policy assigned to the site
Path Quality Profile thresholds for latency and jitter
Circuit capacity configuration within the site settings

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

An administrator notices that a specific branch site is successfully browsing the internet, yet internal applications hosted at the data center are unable to initiate a connection to the branch's local server. Upon inspection, the data center ION does not show the branch's local subnet in its routing table.

Which troubleshooting step should the administrator take on the branch ION device to resolve this reachability issue?

Administratively enable the Prisma SD-WAN AppFabric endpoints on the branch WAN interfaces.
Verify that the LAN branch prefixes are configured with a global scope.
Configure a manual BGP peering session between the branch ION and the data center ION device.
Set the site to Control Mode to force the resynchronization of the local routing table with the controller.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

Which statement is valid when integrating Prisma SD-WAN with Prisma Access remote networks?

Easy onboarding automatically recommends the closest preconfigured remote network security processing nodes and can be overridden manually.
Bandwidth must be allocated to each Prisma Access remote network compute location, and this bandwidth is shared between all branches that terminate on this remote network node.
Security policies for remote networks are configured in Prisma Access and pushed to Prisma SD-WAN for enforcement on the branch ION devices.
A branch with multiple internet circuits will automatically connect to Prisma Access on each circuit and will be used in an active/standby manner for internet-bound traffic.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

When using the SASE onboarding feature to connect Prisma SD-WAN branch sites to Prisma Access, which statement accurately applies to the deployment mode "Internet-Only-with-Mobile-Users"?

It limits route propagation inside Prisma Access with BGP no-advertise while supporting mobile users.
It is a default setting that enables access to both private applications and the internet.
It limits route propagation to mobile users.
It limits route propagation out of Prisma Access with BGP no-export while supporting mobile users.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

What are two potential causes when a secondary public circuit has been added to the branch site, but the Prisma SD-WAN tunnel is not forming to the data center? (Choose two.)

Interface role is not selected as "internet."
Interface scope is set to "local."
Circuit label is missing from interface type.
DNS is not configured.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Page 1 of 8

Build confidence for exam day with expert-reviewed questions and realistic practice. Your next certification starts here.

Company

About Contact Our Authors FAQ

Trust and policies

Methodology Editorial policy Terms and conditions Privacy policy

Contact

ExamPrepare LLC5203 Juan Tabo Blvd STE 2BAlbuquerque, NM 87111[email protected]

© 2026 ExamPrepare LLC. All rights reserved. All certification names, exam codes and logos are the property of their respective owners. All associated trademark and copyright rights belong to those owners. ExamPrepare is not affiliated with, endorsed by, or sponsored by any certification vendor.