3.6 Demonstrate Understanding of Monitoring and Managing SASE-related Events SD-WAN-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A remote user reports intermittent connectivity to a critical application. The firewall logs show that traffic is being allowed, but the SD-WAN logs show that the primary link is flapping. Which diagnostic step should the administrator take first to correlate the issue?

   • ACheck the SD-WAN path quality metrics (latency, jitter, packet loss) for the affected time period
   • BReboot the SD-WAN appliance to reset the link
   • CReview the firewall's threat logs for the user's IP address
   • DVerify the user's authentication status in the cloud security service
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a primary source of SASE-related events in a Palo Alto Networks Prisma Access deployment?

   • ASASE events come only from third-party security information and event management (SIEM) systems.
   • BSASE events are generated exclusively by the SD-WAN plugin on the firewall.
   • CThe Prisma Access cloud infrastructure generates events from firewalls, SD-WAN, and cloud security services.
   • DOnly the on-premises firewall generates SASE events; cloud services do not produce events.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A branch office is experiencing slow access to cloud applications. The SD-WAN dashboard shows that the primary link has high latency, but the secondary link is healthy. The administrator wants to ensure that traffic automatically uses the best-performing link. What should they do?

   • AConfigure SD-WAN path quality monitoring and automatic failover based on latency thresholds
   • BIncrease the bandwidth on the primary link
   • CManually switch the traffic to the secondary link
   • DDisable the secondary link to force traffic over the primary link
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of configuring alert thresholds for SASE events, such as SD-WAN link latency?

   • ATo automatically reroute traffic to another link
   • BTo change the firewall's security policy
   • CTo reduce the amount of log data stored
   • DTo trigger notifications when the metric exceeds a predefined value
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst notices that a user's device is repeatedly failing authentication to a cloud-based application. The analyst checks the firewall logs and sees the traffic being allowed, but the user still cannot access the application. Which additional data source should the analyst correlate to identify the root cause?

   • ASystem logs from the firewall management interface
   • BFirewall threat logs
   • CSD-WAN interface statistics
   • DCloud security service logs (e.g., CASB or Zero Trust)
   Reveal Solution Discussion Select an answer first