126 free Cisco 300-415 ENSDWI practice questions from the CertStash pack of 502, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 126 free here, all 502 in the pack, and each step includes the one before it.
Get all 502 questions (US$39) · Download the first 10 as a PDF
Question 1
For data plane resiliency, what does the Cisco SD-WAN software implement?
Show answer and explanation
Correct answer: D. BFD
BFD (Bidirectional Forwarding Detection) is implemented by Cisco SD-WAN to provide data plane resiliency by detecting link failures and enabling fast failover between WAN paths. BFD monitors the health of data plane connections between WAN Edge routers and quickly detects any failures, triggering traffic reroute to alternate paths.
Why the other options are wrong
- A. Multiple vBond orchestrators relate to control plane redundancy, not data plane resiliency.
- B. Affinity between vSmart controllers and WAN Edge routers is a control plane function, not data plane resiliency.
- C. OMP is a control plane routing protocol used for path information exchange, not data plane resiliency.
Question 2
An organization wants to use the Cisco SD-WAN regionalized service-chaining feature to optimize cost and user experience with applications in the network, which allows branch routers to analyze and steer traffic toward the required network function. Which feature meets this requirement?
Show answer and explanation
Correct answer: A. Cloud onRamp for Colocation
Cloud onRamp for Colocation is the Cisco SD-WAN feature that enables regionalized service-chaining by allowing branch routers to analyze traffic and dynamically steer it toward required network functions in colocation facilities, optimizing both cost and user experience.
Why the other options are wrong
- B. Cloud onRamp for IaaS is designed for connecting to public cloud infrastructure providers, not for regional service-chaining optimization.
- C. Cloud Services Platform is a broader platform component, not specifically the regionalized service-chaining feature.
- D. VNF Service Chaining refers to chaining virtual network functions but is not the specific SD-WAN feature for regionalized optimization.
Question 3
Which Cisco SD-WAN component facilitates the initial communication between WAN Edge devices to join the fabric?
Show answer and explanation
Correct answer: D. vBond Orchestrator
The vBond Orchestrator facilitates initial communication between WAN Edge devices and the SD-WAN fabric. It acts as a bootstrap element, enabling WAN Edge routers to discover and securely connect to vSmart controllers and vManage through its public IP address and certificates.
Why the other options are wrong
- A. WAN Edge routers require guidance to join the fabric; they cannot initiate fabric joining without orchestrator assistance.
- B. vSmart controllers handle control plane routing after the fabric is established but do not facilitate initial joining.
- C. vManage provides management and monitoring but is not responsible for the initial bootstrap communication.
Question 4
What is an attribute of TLOC?
Show answer and explanation
Correct answer: A. tag
Tag is an attribute of TLOC (Transport Locator) in Cisco SD-WAN. TLOC tags are used to group and categorize transport locations for routing policy enforcement and traffic steering decisions.
Why the other options are wrong
- B. Service is not a standard TLOC attribute; TLOCs identify transport endpoints, not services.
- C. Local preference is a BGP concept, not a TLOC attribute.
- D. Encryption is a connection property, not an attribute of the TLOC itself.
Question 5
What is the behavior of vBond orchestrator?
Show answer and explanation
Correct answer: A. It builds permanent connections with vSmart controllers.
The vBond orchestrator keeps persistent DTLS control connections with the vSmart controllers so it can tell new WAN Edge routers where the controllers are. Its connections with WAN Edge routers are only temporary, used during onboarding and NAT discovery.
Why the other options are wrong
- B. vBond connections with WAN Edge routers are transient and are torn down after onboarding.
- C. vBond does not run OMP; OMP runs between vSmart controllers and WAN Edge routers.
- D. vBond authenticates and orchestrates connections but does not maintain the connectivity state between vSmart and WAN Edge routers.
Question 6
Which routing protocol is used to exchange control plane information between vSmart controllers and WAN Edge routers in the Cisco SD-WAN secure extensible network?
Show answer and explanation
Correct answer: D. OMP
OMP (Overlay Management Protocol) is the routing protocol used to exchange control plane information between vSmart controllers and WAN Edge routers in Cisco SD-WAN. OMP distributes policies, path information, and device attributes across the secure overlay network.
Why the other options are wrong
- A. BGP is an underlay routing protocol, not the control plane protocol for SD-WAN overlay.
- B. OSPF is a traditional IGP and is not used for SD-WAN control plane communication.
- C. BFD is a failure detection mechanism, not a routing protocol for control plane information exchange.
Question 7
What is a requirement for a WAN Edge to reach vManage, vBond, and vSmart controllers in a data center?
Show answer and explanation
Correct answer: D. TLS
TLS (Transport Layer Security) is the requirement for a WAN Edge to securely reach vManage, vBond, and vSmart controllers. All control plane communications in Cisco SD-WAN are protected by TLS encryption, ensuring secure authentication and data confidentiality.
Why the other options are wrong
- A. OMP is used after control connectivity is established, not as a requirement to reach controllers.
- B. IGP protocols operate in the underlay and are not a requirement for WAN Edge to reach controllers.
- C. QoS is a data plane feature and is not a requirement for initial controller connectivity.
Question 8
Which secure tunnel type should be used to connect one WAN Edge router to other WAN Edge routers?
Show answer and explanation
Correct answer: C. IPsec
IPsec is the secure tunnel type used to connect one WAN Edge router to other WAN Edge routers in Cisco SD-WAN. IPsec provides encryption and authentication for data plane traffic flowing between branch and hub sites across the overlay network.
Why the other options are wrong
- A. DTLS is used for control plane communication between WAN Edge and controllers, not for edge-to-edge data tunnels.
- B. SSL VPN is used for remote user access, not for WAN Edge-to-WAN Edge secure tunnels.
- D. TLS is used for control plane security between WAN Edge and management controllers, not for data plane tunnels between edges.
Question 9
What is the default value (in milliseconds) set for the poll interval in the BFD basic configuration?
Show answer and explanation
Correct answer: B. 600,000
The default poll interval for BFD (Bidirectional Forwarding Detection) in basic configuration is 600,000 milliseconds (600 seconds or 10 minutes). This default value allows for periodic keepalive messages to detect link failures while minimizing control plane overhead in typical network deployments.
Why the other options are wrong
- A. 300,000 ms is too aggressive for a default poll interval and would consume unnecessary control plane resources.
- C. 900,000 ms exceeds the standard default BFD poll interval value.
- D. 1,200,000 ms is double the default interval and would be used only in specific configurations requiring longer detection times.
Question 10
Which plane builds and maintains the network topology and makes decisions on traffic flows?
Show answer and explanation
Correct answer: D. control
The control plane is responsible for building and maintaining the network topology, running routing protocols, and making decisions about traffic flows and path selection. It provides the intelligence that directs how data is forwarded through the network.
Why the other options are wrong
- A. The data plane forwards actual user traffic based on decisions made by the control plane but does not make routing decisions.
- B. The orchestration plane manages service deployment and policy automation but is distinct from the control plane functions.
- C. The management plane handles administrative functions and monitoring but is separate from the topology building and traffic flow decision functions.
What people say about the full 300-415 pack 5.0 from 2
Passed my 300-415 first try.
The 300-415 material was priced fairly for what you got. It covered detailed networking content that lined up with Cisco’s latest objectives, making it an affordable and reliable choice for anyone looking to boost their SD-WAN knowledge.
Question 11
Which policy allows communication between TLOCs of data centers and spokes and blocks communication between spokes?
Show answer and explanation
Correct answer: C. centralized control policy
Centralized control policy allows communication between TLOCs of data centers and spokes while blocking direct spoke-to-spoke communication. This creates a hub-and-spoke topology where all traffic flows through the centralized data center, ensuring security and traffic management.
Why the other options are wrong
- A. Centralized data policy applies to data plane traffic, not control plane connectivity between TLOCs.
- B. Localized control policy is applied at the edge device level and does not centralize hub-and-spoke control.
- D. Localized data policy applies data plane policies at the edge device level rather than enforcing hub-and-spoke topology.
Question 12
In a Cisco SD-WAN architecture, what is the role of the WAN Edge?
Show answer and explanation
Correct answer: D. It is the data plane that is responsible for forwarding traffic
The WAN Edge device functions as the data plane in Cisco SD-WAN architecture, responsible for forwarding user traffic across the overlay network and between sites. It processes and encrypts data packets according to policies established by the control plane.
Why the other options are wrong
- A. Orchestration and automatic provisioning are handled by vManage management plane.
- B. The management plane is handled by vManage, not WAN Edge devices.
- C. The control plane is handled by vSmart controllers, not WAN Edge devices.
Question 13
Which two metrics must a cloud Edge router use to pick the optimal path for a SaaS application reachable via a gateway site? (Choose two.)
Show answer and explanation
Correct answer: A, B. HTTP loss and latency metrics to the SaaS application; BFD loss and latency metrics to the gateway site
A cloud Edge router uses both HTTP loss and latency metrics to the SaaS application, combined with BFD loss and latency metrics to the gateway site, to determine the optimal path. HTTP metrics measure the direct application performance while BFD metrics assess the underlying tunnel quality to the gateway, providing comprehensive path evaluation for intelligent routing decisions.
Why the other options are wrong
- C. ICMP metrics are not used for SaaS path selection; BFD and HTTP metrics are the relevant protocols.
- D. HTTP metrics to the gateway site are not the correct measurement; metrics should target the SaaS application itself.
- E. BFD metrics should measure to the gateway site, not to the SaaS application endpoint.
Question 14
Which policy is configured to ensure that a voice packet is always sent on the link with less than a 50 msec delay?
Show answer and explanation
Correct answer: A. localized data policy
A localized data policy can be configured on WAN edges to ensure voice packets meeting specific SLA criteria (such as latency under 50 msec) are directed to appropriate links. This local enforcement allows immediate routing decisions based on link characteristics without waiting for centralized policy updates.
Why the other options are wrong
- B. Centralized control policy manages control plane operations and tunnel establishment, not traffic SLA enforcement.
- C. Localized control policy manages local control plane functions, not data traffic SLA requirements.
- D. While centralized data policy can define SLAs, localized data policy provides the local enforcement mechanism needed for real-time voice packet routing based on link delay characteristics.
Question 15
When a WAN Edge device joins the Cisco SD-WAN overlay, which Cisco SD-WAN component orchestrates the connection between the WAN Edge device and a vSmart controller?
Show answer and explanation
Correct answer: B. vBond
The vBond Orchestrator is responsible for orchestrating the connection between WAN Edge devices and vSmart controllers when devices join the SD-WAN overlay. vBond acts as the initial touchpoint, authenticating devices and directing them to appropriate vSmart controllers. vManage is for management and monitoring; OMP is a routing protocol; APIC-EM is an older Cisco management platform not used in SD-WAN.
Why the other options are wrong
- A. vManage is used for management and monitoring, not initial orchestration of connections.
- C. OMP is the Overlay Management Protocol for distributing policies, not device orchestration.
- D. APIC-EM is legacy software and not part of Cisco SD-WAN architecture.
Question 16
Which two criteria are supported to filter traffic on a Cisco Umbrella Cloud-delivered firewall? (Choose two.)
Show answer and explanation
Correct answer: C, D. URL; protocol
Cisco Umbrella Cloud-delivered firewall supports URL-based filtering to block or allow specific web destinations, and protocol-based filtering to control traffic by protocol type. These are standard filtering criteria for web and network security policies.
Why the other options are wrong
- A. Geolocation filtering is not a supported criterion in Umbrella's cloud firewall filtering options.
- B. Site ID is not a filtering criterion used by Umbrella's cloud-delivered firewall.
- E. Tunnel-based filtering is not a supported filtering criterion for Umbrella cloud firewall policies.
Question 17
Which vBond system configuration under VPN 0 allows for a routable public IP address even if the DNS name, hostname, or IP address of the vBond orchestrator are omitted?
Show answer and explanation
Correct answer: B. local
The 'local' configuration under VPN 0 on the vBond orchestrator allows assignment of a routable public IP address that can be used for device communication even when the DNS name, hostname, or primary IP address information is omitted or unavailable. This provides a fallback mechanism for connectivity.
Why the other options are wrong
- A. WAN is a general classification but not the specific vBond configuration parameter that assigns a routable public IP.
- C. dns-name configuration relies on DNS resolution and would not work if DNS information is omitted.
- D. vbond-only is not a standard vBond system configuration option in VPN 0.
Question 18
A vEdge platform is sending VRRP advertisement messages every 10 seconds. Which value configures the router back to the default timer?
Show answer and explanation
Correct answer: C. 1 second
The default VRRP advertisement interval on vEdge platforms is 1 second. Since the device is currently sending advertisements every 10 seconds, resetting to the default value of 1 second will restore the original timer configuration.
Why the other options are wrong
- A. 2 seconds is not the VRRP default advertisement interval.
- B. 5 seconds is not the VRRP default advertisement interval.
- D. 3 seconds is not the VRRP default advertisement interval.
Question 19
Which two products that perform lifecycle management for virtual instances are supported by WAN Edge cloud routers? (Choose two.)
Show answer and explanation
Correct answer: C, D. VMware vCenter; OpenStack
VMware vCenter and OpenStack are the supported lifecycle management products for virtual WAN Edge cloud router instances. These orchestration platforms can manage the deployment, configuration, and lifecycle of virtual SD-WAN edge routers in cloud environments.
Why the other options are wrong
- A. AWS uses its own native orchestration and is not listed as a supported lifecycle management product for WAN Edge routers.
- B. Azure uses its own native orchestration and is not listed as a supported lifecycle management product for WAN Edge routers.
- E. IBM Cloud uses its own native orchestration and is not listed as a supported lifecycle management product for WAN Edge routers.
Question 20
On which device is a service FW address configured to insert firewall service at the hub?
Show answer and explanation
Correct answer: C. vEdge at the hub
Service firewall address is configured on the vEdge device at the hub site. This configuration specifies where inbound traffic should be redirected for firewall inspection before being forwarded to branch sites or the wider network, implementing the hub-based security service insertion model.
Why the other options are wrong
- A. vSmart at the branch is a control plane device that does not configure service insertion.
- B. vEdge at the branch initiates traffic toward services but does not configure the service insertion point itself.
- D. vSmart at the hub is responsible for policy distribution, not for configuring service FW addresses.
Question 21
An enterprise has these three WAN connections: • public Internet • business Internet • MPLS An engineer must configure two available links to route traffic via both links. Which configuration achieves this objective?
Show answer and explanation
Correct answer: A. omp no shutdown ecmp-limit 2
The ecmp-limit parameter in OMP configuration specifies the maximum number of equal-cost paths that can be used for load balancing across multiple WAN links. Setting ecmp-limit 2 enables equal-cost multi-path routing across two available WAN connections, allowing traffic to be distributed via both links simultaneously.
Why the other options are wrong
- B. send-path-limit controls the number of paths advertised in OMP updates, not the number of links used for actual traffic forwarding.
- C. overlay-as specifies the autonomous system number for the overlay network and does not control multi-link traffic distribution.
- D. route-limit restricts the number of routes processed, not the number of WAN links used for load balancing.
Question 22
A network administrator is configuring VRRP to avoid a traffic black hole when the transport side of the network is down on the primary device. What must be configured to get the fastest failover to standby?
Show answer and explanation
Correct answer: D. lower timer interval
To achieve the fastest failover in VRRP when the transport side is down on the primary device, timer intervals must be lowered. Lower timer intervals (hello/advertisement intervals) enable faster detection of primary device failure and quicker transition to the standby device. This is the fundamental mechanism for controlling VRRP failover speed.
Why the other options are wrong
- A. OMP tracking is used in SD-WAN contexts but not a direct mechanism for VRRP failover speed.
- B. Group ID numbers do not affect failover speed; they only identify the VRRP group.
- C. Prefix-list tracking can trigger failover but is not the primary mechanism for optimizing failover speed compared to timer intervals.
Question 23
A network administrator is configuring an application-aware firewall between inside zones to an outside zone on a WAN Edge router using vManage GUI. Which kind of inspection is performed when the `inspect` action is used?
Show answer and explanation
Correct answer: D. stateful inspection for TCP and UDP
When the inspect action is configured in the application-aware firewall on a WAN Edge router, it performs stateful inspection for both TCP and UDP traffic. Stateful inspection maintains connection state information for both protocols, enabling more intelligent filtering and threat detection.
Why the other options are wrong
- A. TCP does not use Layer 7 inspection while UDP uses Layer 4 in this context; inspect action applies uniform stateful inspection to both.
- B. UDP traffic is also subject to stateful inspection when inspect action is applied, not stateless inspection.
- C. IPS inspection is a separate security function; the inspect action performs stateful firewall inspection for both protocols.
Question 24
At which layer does the application-aware firewall block applications on a WAN Edge?
Show answer and explanation
Correct answer: D. 7
The application-aware firewall blocks applications at Layer 7 (the Application layer) of the OSI model. This deep packet inspection capability allows the firewall to identify and block specific applications regardless of the port or protocol being used, providing granular control based on actual application signatures rather than just network or transport layer characteristics.
Why the other options are wrong
- A. Layer 3 is the Network layer, which handles IP-based filtering but not application identification.
- B. Layer 5 is the Session layer, which does not provide application-level blocking capabilities.
- C. Layer 2 is the Data Link layer, which operates at the MAC address level and cannot identify applications.
Question 25
Which timer specifies how long the router keeps routing information in the cache after all OMP sessions are lost at location S4317T8E35F76?
Show answer and explanation
Correct answer: A. graceful restart timer
The graceful restart timer specifies the duration that a router maintains routing information in its cache after all OMP sessions are lost. This timer allows the router to continue forwarding packets using cached route information while attempting to reestablish OMP sessions, providing continuity during temporary control plane disruptions.
Why the other options are wrong
- B. Advertisement interval controls the frequency of OMP route advertisements, not cache retention after session loss.
- C. EOR (End of Record) timer marks the completion of initial route advertisements, not cache timeout duration.
- D. Hold time specifies how long to wait for keepalive messages before declaring a session dead, not cache retention duration.
Question 26
In an AWS cloud, which feature provisions WAN Edge routers automatically in Cisco SD-WAN?
Show answer and explanation
Correct answer: A. Cloud OnRamp
Cloud OnRamp is the Cisco SD-WAN feature that automatically provisions WAN Edge router virtual instances in AWS cloud environments. It enables seamless extension of the SD-WAN overlay into cloud infrastructure. Cloud app refers to application optimization; vAnalytics is for analytics and monitoring; Network Designer is a planning tool.
Why the other options are wrong
- B. Cloud app is for application-level optimization, not infrastructure provisioning.
- C. vAnalytics provides monitoring and analytics capabilities, not provisioning.
- D. Network Designer is used for network planning and design, not automatic provisioning.
Question 27
Which plane assists in the automatic onboarding of the SD-WAN routers into the SD-WAN overlay?
Show answer and explanation
Correct answer: B. orchestration
The orchestration plane, managed by the vBond Orchestrator, is responsible for automatic onboarding and bootstrapping of SD-WAN routers into the overlay network. It facilitates the initial connection and registration of new WAN Edge devices into the SD-WAN fabric.
Why the other options are wrong
- A. The data plane forwards user traffic but does not handle onboarding.
- C. The management plane handles administrative functions through vManage but does not orchestrate automatic onboarding.
- D. The control plane manages routing and policy distribution but is not responsible for the initial automatic onboarding process.
Question 28
In which device state does the WAN Edge router create control connections, but data tunnels are not created?
Show answer and explanation
Correct answer: D. staging
The staging state is when a WAN Edge router has established control connections to the control plane devices but has not yet completed full initialization. In this state, control tunnels are created for management purposes, but data tunnels are not established until the device moves to the active state.
Why the other options are wrong
- A. The valid state indicates the device has completed all initialization and is fully operational with both control and data tunnels.
- B. The backup state is used for redundancy purposes and maintains connections differently than described.
- C. The active state indicates the device is fully operational with complete control and data tunnel functionality.
Question 29
An engineer must automate certificate signing through Cisco. Which vManage configuration achieves this task?
Show answer and explanation
Correct answer: C. vpn 0 dns 208.67.222.222 primary allow-service dns allow-service sshd allow-service netconf
VPN 0 configuration with DNS specification and enabled services (dns, sshd, netconf) enables automated certificate signing through Cisco. VPN 0 is the management VPN where control plane traffic and certificate operations occur, and the netconf service enables network configuration automation required for certificate signing automation.
Why the other options are wrong
- A. Without DNS configuration, this setup cannot properly resolve Cisco's certificate signing services.
- B. VPN 512 is the management VPN in some contexts, but certificate signing automation requires VPN 0 configuration.
- D. VPN 512 is not the correct VPN for certificate signing automation; VPN 0 must be used for this purpose.
Question 30
Which configuration step is taken on vManage after WAN Edge list is uploaded to support the onboarding process before the device comes online?
Show answer and explanation
Correct answer: C. Set the device as valid
After uploading the WAN Edge device list to vManage, the configuration step is to set the device as valid. This marks the devices in the list as authorized and ready to onboard when they come online, completing the pre-provisioning setup on the management plane.
Why the other options are wrong
- A. Device certificate verification happens during the onboarding handshake, not as a configuration step on vManage.
- B. ZTP process is system-enabled and not manually activated by uploading the device list.
- D. Sending the list to controllers is a system function that occurs automatically, not a manual configuration step.
Question 31
Which controller manages the orchestration plane of Cisco SD-WAN in a cloud deployment?
Show answer and explanation
Correct answer: C. vBond
In the Cisco SD-WAN architecture, vBond is the orchestration plane. It performs the initial authentication of devices, tells them where vSmart and vManage are, and helps with NAT traversal, whether it is deployed on premises or in the cloud.
Why the other options are wrong
- A. Cisco DNA Center manages campus networks and is not a component of the SD-WAN orchestration plane.
- B. vSmart is the control plane, distributing routes, policy and keys through OMP.
- D. vManage is the management plane, used for configuration, monitoring and troubleshooting.
Question 32
What prohibits deleting a VNF image from the software repository?
Show answer and explanation
Correct answer: B. if the image is referenced by a service chain
A VNF image cannot be deleted from the software repository if the image is referenced by a service chain. Service chains depend on specific VNF images to function, so deletion would break those chains. The system prevents deletion to maintain the integrity of active service chain configurations.
Why the other options are wrong
- A. Storage location by vManage does not prohibit deletion; images can be managed regardless of storage.
- C. Inclusion in a policy does not prevent deletion; the system allows deletion if not actively used in chains.
- D. The uploader's source device does not affect deletion permissions; deletion restrictions are based on active usage.
Question 33
Which device should be configured with the service chain IP address to route intersite traffic through a firewall?
Show answer and explanation
Correct answer: C. hub WAN Edge
The hub WAN Edge device should be configured with the service chain IP address to route intersite traffic through a firewall. In SD-WAN deployments, the hub serves as the central point for policy enforcement and traffic steering, making it the appropriate device to manage service chain configurations for firewall inspection of inter-site traffic.
Why the other options are wrong
- A. vSmart controllers manage policies and OMP routes but do not directly route user traffic through service chains.
- B. Spoke WAN Edge devices follow policies defined by the hub and do not originate service chain configurations.
- D. The firewall itself is the destination service, not the device that configures the service chain IP address.
Question 34
A network administrator is bringing up one WAN Edge router for branch connectivity. Which types of tunnels form when the WAN edge router connects to the Cisco SD-WAN fabric?
Show answer and explanation
Correct answer: D. DTLS or TLS tunnel with vSmart controller and IPsec tunnel with other WAN Edge routers
When a WAN Edge router connects to the SD-WAN fabric, it establishes a DTLS or TLS tunnel with the vSmart controller for control plane communications and an IPsec tunnel with other WAN Edge routers for secure data plane traffic. The connection to vBond is for initial orchestration using IPsec, and vManage connections are management-related, not fabric tunnels.
Why the other options are wrong
- A. IPsec tunnels are established with other WAN Edge routers, not vBond; vBond uses IPsec for orchestration only.
- B. Control plane tunnels are with vSmart, not vBond; vManage is management, not a fabric tunnel endpoint.
- C. Control plane tunnels use DTLS or TLS with vSmart, not vBond.
Question 35
Which two image formats are supported for controller codes? (Choose two.)
Show answer and explanation
Correct answer: B, D. .qcow2; .ova
The supported image formats for Cisco SD-WAN controller codes are .qcow2 (QEMU Copy-On-Write format for hypervisor deployments) and .ova (Open Virtualization Appliance format for virtual machine deployment). These formats enable controllers to be deployed across various virtualization platforms.
Why the other options are wrong
- A. .nxos is the image format for Cisco NX-OS network devices, not SD-WAN controllers.
- C. .iso is a disc image format not used for controller code distribution in SD-WAN deployments.
- E. .bin is a binary format not the standard distribution format for SD-WAN controller images.
Question 36
Which component of the Cisco SD-WAN secure extensible network provides a single pane of glass approach to network monitoring and configuration?
Show answer and explanation
Correct answer: C. vManage
vManage is the management and orchestration component of Cisco SD-WAN that provides a single pane of glass for network monitoring, configuration, policy management, and analytics across the entire SD-WAN fabric.
Why the other options are wrong
- A. APIC-EM is a legacy Cisco controller used for traditional network management, not for SD-WAN.
- B. vSmart is the control plane controller responsible for policy distribution and route management.
- D. vBond is the orchestrator that provides initial connectivity and certificate management for controllers and edge devices.
Question 37
Which two WAN Edge devices should be deployed in a cloud? (Choose two.)
Show answer and explanation
Correct answer: C, D. CSR1000v; vEdge cloud
CSR1000v and vEdge cloud are the WAN Edge devices designed for cloud deployment. CSR1000v is Cisco's cloud service router for virtualized environments, and vEdge cloud is the Cisco SD-WAN edge device specifically built for cloud platforms like AWS, Azure, and Google Cloud.
Why the other options are wrong
- A. ASR1000v is not a cloud-focused WAN Edge device.
- B. vEdge 100wm is designed for branch/remote sites, not cloud deployment.
- E. vEdge 5000v is not a cloud-specific platform.
Question 38
What is a default protocol for control plane connection?
Show answer and explanation
Correct answer: D. DTLS
DTLS (Datagram TLS) is the default protocol for control plane connections in Cisco SD-WAN. It provides secure, encrypted communication over UDP and is preferred for its performance characteristics. While TLS is used for management plane connections and HTTPS for vManage web access, DTLS is specifically the control plane default. IPsec is used for data plane encryption, not control plane signaling.
Why the other options are wrong
- A. HTTPS is used for vManage management interface access, not the control plane protocol.
- B. TLS is used for management plane connections, not the control plane.
- C. IPsec is used for data plane encryption between WAN Edge devices, not control plane connections.
Question 39
Which pathway under Monitor > Network > Select Device is used to verify service insertion configuration?
Show answer and explanation
Correct answer: C. Real Time
The Real Time pathway under Monitor > Network > Select Device is used to verify service insertion configuration. This provides live visibility into active service chains and their operational status.
Why the other options are wrong
- A. System Status displays overall system health metrics but not service insertion configuration details.
- B. ACL Logs show access control list activities and policy enforcement, not service insertion configuration.
- D. Events contains historical log entries but does not provide the real-time verification needed for service insertion configuration.
Question 40
Which component of the Cisco SD-WAN architecture oversees the control plane of overlay network to establish, adjust, and maintain the connections between the WAN Edge devices that form the Cisco SD-WAN fabric?
Show answer and explanation
Correct answer: B. vSmart
vSmart is the controller responsible for the control plane of the SD-WAN overlay network. It establishes, adjusts, and maintains connections between WAN Edge devices by distributing routing policies and network topology information. vManage handles management and monitoring, vBond facilitates orchestration and NAT traversal, and APIC-EM is a legacy Cisco management platform not part of the SD-WAN architecture.
Why the other options are wrong
- A. APIC-EM is a legacy controller platform and is not part of the SD-WAN architecture.
- C. vManage is the management plane controller that handles configuration and monitoring, not control plane functions.
- D. vBond orchestrates initial connections and handles NAT traversal but does not oversee the control plane.
Question 41
What is the procedure to upgrade all Cisco SD-WAN devices to a recent version?
Show answer and explanation
Correct answer: B. Upgrade and reboot are performed first on vManage, then on vBond, then on vSmart, and finally on the Cisco WAN Edge devices.
The correct upgrade sequence for all Cisco SD-WAN devices is: first upgrade and reboot vManage, then vBond, then vSmart, and finally the Cisco WAN Edge devices. This order ensures that the management and control planes are updated and stable before updating the data plane devices, maintaining system stability and avoiding connectivity issues during the upgrade window.
Why the other options are wrong
- A. Upgrading WAN Edge devices first is incorrect; controllers must be upgraded first to manage the process.
- C. The sequence is incorrect; vManage must be first, followed by controllers, not with WAN Edge devices in between.
- D. Omits vManage upgrade entirely, which must occur first in the upgrade sequence.
Question 42
An engineer is configuring a data policy for packets that must be captured through the policy. Which command accomplishes this task?
Show answer and explanation
Correct answer: C. policy > data-policy > vpn-list > sequence > action
The 'action' command under the sequence level is where traffic actions are defined in a data policy. This is where the policy specifies what to do with packets that match the criteria, including whether to accept, drop, redirect, or otherwise process captured traffic.
Why the other options are wrong
- A. default-action > accept defines fallback behavior for traffic not explicitly matched, not the primary mechanism for captured packets.
- B. match commands define the conditions to identify traffic, not the action to take on captured packets.
- D. default-action > drop sets the default behavior for non-matching traffic, not how to handle specifically captured traffic.
Question 43
Which routes are similar to the IP route advertisements when the routing information of WAN Edge routers is learned from the local site and local routing protocols?
Show answer and explanation
Correct answer: B. OMP
OMP (Overlay Management Protocol) route advertisements are similar to IP route advertisements when routing information is learned from local sites and local routing protocols on WAN Edge routers. OMP is the protocol used to advertise these learned routes throughout the SD-WAN overlay network, functioning analogously to traditional IP routing protocol advertisements.
Why the other options are wrong
- A. BGP is a traditional exterior routing protocol but is not the mechanism used for SD-WAN overlay route distribution.
- C. TLOC advertisements identify transport locations and WAN links, not the learned routing information from local protocols.
- D. Service routes are a specific subset of routes in SD-WAN but do not represent general routing information learned from local protocols.
Question 44
An engineer wants to automate the onboarding process for a WAN Edge router with vManage. Which command will accomplish this?
Show answer and explanation
Correct answer: B. request vedge-cloud activate chassis-number <chassis-number> token <token-number>
The command to automate WAN Edge router onboarding with vManage uses the chassis number and a security token. The correct syntax is 'request vedge-cloud activate chassis-number <chassis-number> token <token-number>', which provides secure automated onboarding by validating the device through its unique chassis identifier and an authentication token generated by vManage.
Why the other options are wrong
- A. Uses serial number instead of token; serial alone is insufficient for secure automated onboarding.
- C. Omits the chassis number, which is required to uniquely identify the WAN Edge device.
- D. Uses organization parameter which is not part of the automated activation command syntax.
Question 45
Which TCP Optimization feature is used by WAN Edge to prevent unnecessary retransmissions and large initial TCP window sizes to maximize throughput and achieve a better quality?
Show answer and explanation
Correct answer: A. SACK
SACK (Selective Acknowledgment) is the TCP optimization feature used by WAN Edge devices to prevent unnecessary retransmissions by allowing the receiver to acknowledge multiple non-contiguous packets, thereby reducing redundant packet transmission and improving throughput over WAN connections.
Why the other options are wrong
- B. SEQ is related to sequence numbering but not specifically a TCP optimization feature for preventing retransmissions.
- C. RTT (Round Trip Time) is a measurement metric, not a TCP optimization feature.
- D. SYN is used in connection establishment but not the primary feature for preventing unnecessary retransmissions.
Question 46
WAN Edge routers are configured manually to use UDP port offset to use nondefault offset values when IPsec tunnels are created. What is the offset range?
Show answer and explanation
Correct answer: C. 0-19
WAN Edge routers can be configured with a UDP port offset for IPsec tunnels using a range of 0-19. This offset allows devices to create multiple IPsec tunnels on different port numbers by adding the offset value to the default port, supporting multiple simultaneous connections.
Why the other options are wrong
- A. The range starts at 0, not 1, providing 20 total possible offset values.
- B. The maximum offset is 19, not 18, allowing for 0-19 inclusive.
- D. The range includes 0 as a valid starting point and extends to 19, not 1-18.
Question 47
Which pathway under Monitor > Network > Select Device is used to verify service insertion configuration?
Show answer and explanation
Correct answer: C. Real Time
The Real Time pathway under Monitor > Network > Select Device is used to verify service insertion configuration in Cisco SD-WAN environments. This pathway provides real-time data about active service chains and their status.
Why the other options are wrong
- A. System Status shows overall system health but not service insertion configuration details.
- B. Troubleshooting is used for diagnostic purposes, not for verifying service insertion configuration.
- D. Events logs historical occurrences but does not provide real-time service insertion configuration verification.
Question 48
Which command verifies a policy that has been pushed to the vEdge router?
Show answer and explanation
Correct answer: D. vEdge# show policy from-vsmart
The command 'show policy from-vsmart' is executed on a vEdge router to verify policies that have been pushed down from the vSmart controller. This command displays the active policies currently applied to the vEdge device.
Why the other options are wrong
- A. This command is run on vSmart and shows locally configured policies, not policies pushed to vEdge devices.
- B. This command syntax is incorrect and does not correspond to a valid vEdge policy verification command.
- C. This command references 'apply policy' which is not the correct syntax for viewing pushed policies on vEdge.
Question 49
What is a benefit of the application-aware firewall feature in the Cisco SD-WAN solution?
Show answer and explanation
Correct answer: A. application visibility
Application visibility is a key benefit of the application-aware firewall feature in Cisco SD-WAN. This feature provides deep visibility into applications traversing the network, allowing administrators to see and understand what applications are running and consuming bandwidth, enabling better traffic management and security decisions.
Why the other options are wrong
- B. Control policy enforcement is a separate SD-WAN function, not a specific benefit of the application-aware firewall.
- C. Application monitoring is related to visibility but is not the primary stated benefit of the application-aware firewall feature.
- D. Malware protection is provided by separate security services, not the primary function of the application-aware firewall.
Question 50
Which device information is required on PNP/ZTP to support the zero touch onboarding process?
Show answer and explanation
Correct answer: A. serial and chassis numbers
Serial number and chassis number are the required device identifiers for PNP/ZTP onboarding. These hardware identifiers uniquely and permanently identify the specific physical device and are used by the Plug and Play service to match the device to its pre-registered entry in the provisioning database.
Why the other options are wrong
- B. Interface IP address is dynamically assigned by DHCP during provisioning, not pre-required.
- C. Public DNS entry is not necessary for the initial onboarding process.
- D. System IP address is assigned during provisioning configuration, not required beforehand.
Question 51
What is a benefit of the application-aware firewall?
Show answer and explanation
Correct answer: C. It blocks traffic by application
The key benefit of the application-aware firewall is its ability to block traffic by application. Unlike traditional firewalls that operate only on IP addresses and ports, application-aware firewalls use deep packet inspection and application signatures to identify and control specific applications, providing much more granular and meaningful security policies.
Why the other options are wrong
- A. MTU-based blocking is a network-level function, not a primary benefit of application-aware firewalls.
- B. Application-aware firewalls cannot block all encrypted traffic as they often work with encrypted streams; encryption itself is not their blocking mechanism.
- D. MAC address-based blocking is a Layer 2 function unrelated to application awareness capabilities.
Question 52
Which two mechanisms are used to guarantee the integrity of data packets in the Cisco SD-WAN architecture data plane? (Choose two.)
Show answer and explanation
Correct answer: C, D. authentication headers; encapsulation security payload
Authentication Headers (AH) and Encapsulation Security Payload (ESP) are the two IPsec mechanisms used to guarantee the integrity of data packets in the SD-WAN data plane. AH provides authentication and integrity verification, while ESP provides confidentiality and can also provide integrity protection. Together, these mechanisms ensure data packets are not modified in transit.
Why the other options are wrong
- A. Certificates are used for authentication and key exchange, not directly for packet integrity verification in the data plane.
- B. Transport locations are not security mechanisms for data packet integrity.
- E. TPM chip is a hardware security module used for device authentication, not for data packet integrity in the data plane.
Question 53
Which command disables the logging of syslog messages to the local disk?
Show answer and explanation
Correct answer: C. no system logging disk enable
The command 'no system logging disk enable' disables the logging of syslog messages to the local disk by negating the enable parameter for disk-based logging.
Why the other options are wrong
- A. This syntax is incorrect; the proper command structure uses 'enable' not 'local'.
- B. Configuring a remote logging server does not disable local disk logging.
- D. The correct command uses 'no system logging disk enable', not 'system logging disk disable'.
Question 54
Which SD-WAN component detects path performance information in the organization to report the issue to the service provider at site ID:123456?
Show answer and explanation
Correct answer: D. vAnalytics
vAnalytics collects path and application performance data across the whole organization and shows carrier and circuit performance trends. That lets an administrator identify a poorly performing circuit at a specific site and take the evidence to the service provider.
Why the other options are wrong
- A. vBond handles device authentication and orchestration and does not analyse path performance.
- B. Cisco DNA Center manages campus networks and is not the SD-WAN tool for carrier performance analytics.
- C. vManage shows real-time monitoring and statistics, but the organization-wide carrier performance analysis for provider reporting comes from vAnalytics.
Question 55
Which action is performed during the onboarding process when a WAN Edge router is connected to ZTP server ztp.viptela.com?
Show answer and explanation
Correct answer: B. The router receives its vBond Orchestrator information.
During the Zero Touch Provisioning (ZTP) process, when a WAN Edge router connects to the ZTP server, the first critical action is to receive the vBond Orchestrator information. This information allows the router to locate and establish initial connectivity to the vBond Orchestrator, which serves as the control plane bootstrap element in the Cisco SD-WAN architecture.
Why the other options are wrong
- A. Connection to WAN Edge Cloud Center occurs after vBond information is obtained and the orchestrator is contacted.
- C. vSmart Controller synchronization via IPsec tunnel happens after initial bootstrap and authentication, not during ZTP.
- D. DTLS/TLS tunnel establishment with vSmart Controller occurs later in the onboarding process after vBond authentication.
Question 56
A policy is created to influence routing path in the network using a group of prefixes. Which policy application will achieve this goal when applied to a site list?
Show answer and explanation
Correct answer: A. control-policy
A control policy is used to influence routing decisions in the SD-WAN network by applying rules based on groups of prefixes or other traffic criteria. When applied to a site list, control policies determine which paths traffic takes through the network, achieving the goal of routing path influence.
Why the other options are wrong
- B. VPN-membership policy determines which devices belong to which VPNs, not routing path selection.
- C. App-route policy is used for application-based routing but is not the primary mechanism for prefix-based routing path influence.
- D. cflowd-template is used for NetFlow configuration and monitoring, not for routing path control.
Question 57
What are the two protocols redistributed into OMP? (Choose two.)
Show answer and explanation
Correct answer: A, E. OSPF; EIGRP
OSPF and EIGRP are the two routing protocols that are redistributed into OMP (Overlay Management Protocol) in Cisco SD-WAN. These protocols allow routes learned from the underlay network to be advertised into the overlay through the OMP process.
Why the other options are wrong
- B. RSVP is a signaling protocol, not a routing protocol that is redistributed into OMP.
- C. LDP is used for MPLS label distribution, not a protocol redistributed into OMP.
- D. RIP is a legacy protocol rarely used in modern SD-WAN deployments and is not among the protocols redistributed into OMP.
Question 58
Which two sets of identifiers does OMP carry when it advertises TLOC routes between WAN Edge routers? (Choose two.)
Show answer and explanation
Correct answer: A, C. TLOC public and private address, carrier, and preference; system IP address, link color, and encapsulation
OMP advertises TLOC routes between WAN Edge routers using two key sets of identifiers: the TLOC public and private address along with carrier and preference metrics, and the system IP address combined with link color and encapsulation type. These identifiers allow routers to identify tunnel endpoints and select appropriate overlay paths based on color-based preferences.
Why the other options are wrong
- B. Source and destination IP addresses, MAC, and site ID are not the primary OMP TLOC identifiers.
- D. VPN ID and BGP next-hop parameters are not part of standard OMP TLOC route advertisements.
- E. Tunnel ID and performance metrics are not the standard identifiers; carrier and preference are used instead.
Question 59
Which policy tracks path characteristics such as loss, latency, and jitter in vManage?
Show answer and explanation
Correct answer: C. app-route
The app-route policy in vManage tracks path characteristics such as loss, latency, and jitter. This policy enables application-aware routing by monitoring real-time network performance metrics and dynamically steering traffic based on application requirements and path quality conditions.
Why the other options are wrong
- A. VPN policy manages virtual private network configuration, not path characteristic tracking.
- B. Control policy governs control plane traffic and signaling, not data path performance metrics.
- D. Data policy manages data plane traffic rules but does not specifically track loss, latency, and jitter metrics.
Question 60
How many subnets are necessary in Azure VNet for a WAN Edge device to function in the cloud deployment?
Show answer and explanation
Correct answer: D. Public and services subnets are required in VNet. The Microsoft underlay cloud fabric performs the management function.
A WAN Edge device requires both public and services subnets in the Azure VNet, while the Microsoft underlay cloud fabric performs the management function. This configuration allows the edge device to handle data plane traffic through the public subnet and service-related communications through the services subnet while Azure's infrastructure manages the control plane.
Why the other options are wrong
- A. While CSR is a supported WAN Edge device, this option does not specify the correct subnet requirements.
- B. Three subnets are not necessary; only public and services subnets are required for WAN Edge functionality.
- C. A single public subnet is insufficient; both public and services subnets are required for proper WAN Edge operation.
Question 61
The network administrator is configuring a QoS scheduling policy on traffic received from transport side tunnels on WAN Edge 5000 routers at location:405608122. Which command must be configured on these devices?
Show answer and explanation
Correct answer: B. cloud-qos
The cloud-qos command is the SD-WAN specific command used to configure QoS scheduling policies on WAN Edge devices for traffic received from transport side tunnels. This command applies cloud-based QoS policies appropriate for SD-WAN environments.
Why the other options are wrong
- A. mls qos is a traditional IOS command for hardware-based QoS, not the SD-WAN cloud-based approach.
- C. service qos is not a valid SD-WAN QoS configuration command.
- D. cloud-mls qos is not the correct SD-WAN command syntax for this configuration.
Question 62
How is the scalability of the Manage increased in Cisco SD-WAN Fabric?
Show answer and explanation
Correct answer: D. Deploy multiple vManage controllers in a cluster
Scalability of the management function in Cisco SD-WAN is increased by deploying multiple vManage controllers in a cluster configuration. This distributed architecture enables load balancing, high availability, and the ability to manage larger fabric deployments by distributing the management workload across multiple controller instances.
Why the other options are wrong
- A. WAN link bandwidth to vManage does not directly increase the scalability of the management control plane itself.
- B. Licensing increases do not provide additional processing capacity or scalability improvements on a single vManage instance.
- C. While deploying multiple vManage controllers on different servers helps, clustering them is the proper architectural approach rather than simple separate deployments.
Question 63
An engineer must configure local redundancy on a site. Which configuration accomplishes the task?
Show answer and explanation
Correct answer: D. vpn 0 interface interface-name tloc-extension interface-name
Local redundancy on a site is configured using the command 'vpn 0 interface interface-name tloc-extension interface-name'. This syntax properly associates a TLOC extension interface with the primary interface within VPN 0, enabling local redundancy by allowing traffic to fail over between the primary and extension interfaces at the same location.
Why the other options are wrong
- A. This syntax is incomplete and does not properly specify the extension interface relationship.
- B. This syntax is not valid for SD-WAN TLOC extension configuration.
- C. This syntax is missing the VPN 0 context and interface name specification required for proper configuration.
Question 64
An engineer is configuring a WAN Edge router for DIA based on matching QoS parameters. Which two actions accomplish this task? (Choose two.)
Show answer and explanation
Correct answer: D, E. Configure NAT on the transport interface; Configure a centralized data policy
Direct Internet Access requires NAT to be enabled on the transport (VPN 0) interface so local traffic can break out to the Internet. A centralized data policy is then used to match the traffic, for example by DSCP or other QoS parameters, and set the NAT action to send it out locally instead of through the overlay.
Why the other options are wrong
- A. Data policies for DIA are centralized policies pushed by vSmart, not a policy applied directly on the WAN interface.
- B. Control policies manipulate routes and TLOCs in the control plane and cannot steer data traffic to a local Internet exit.
- C. A QoS map schedules and queues traffic on an interface but does not redirect traffic to the Internet.
Question 65
Which combination of platforms is managed by vManage?
Show answer and explanation
Correct answer: C. ISR4321, ASR1001, ENCS, ISRv
vManage manages ISR4321 and ASR1001 routers for WAN edge functionality, ENCS (Cisco Enterprise Network Compute System) for hosting SD-WAN services, and ISRv virtual routers for cloud-based SD-WAN deployments. This combination represents supported Cisco platforms within the SD-WAN management architecture.
Why the other options are wrong
- A. ASR1002HX and vEdge2000 are not standard platforms managed by vManage in typical SD-WAN deployments.
- B. Nexus switches are not managed by vManage; they operate in a different network layer.
- D. ASR1009 and CSR1000v are not the correct platform combinations for vManage management.
Question 66
Which two hardware platforms support Cisco IOS XE SD-WAN images? (Choose two.)
Show answer and explanation
Correct answer: A, E. ISR4000 series; ASR1000 series
The ISR 4000 and ASR 1000 series routers support Cisco IOS XE SD-WAN images. These are enterprise-grade hardware platforms capable of running the SD-WAN software. The ISR 9300 is designed for SD-WAN but uses different image types, vEdge series are classic SD-WAN devices with their own OS, and ASR 9000 is not qualified for IOS XE SD-WAN deployment.
Why the other options are wrong
- B. ISR 9300 series does not support IOS XE SD-WAN images; it uses different SD-WAN software.
- C. vEdge-1000 series are classic SD-WAN devices that run vOS, not IOS XE SD-WAN images.
- D. ASR 9000 series does not support Cisco IOS XE SD-WAN images.
Question 67
Which set of elements are verified by the controller to confirm the identity of edge devices?
Show answer and explanation
Correct answer: A. certificates, organization name, and serial number of the device
When a WAN Edge device joins, the controllers authenticate it by validating its certificate, checking that its organization name matches the overlay, and checking its serial or chassis number against the authorized WAN Edge list. Together these prove the device is genuine and belongs to this customer's fabric.
Why the other options are wrong
- B. This set leaves out the certificate, which is the core cryptographic proof of identity, and the system IP is not used to authenticate the device.
- C. The vBond domain is not an identity check, and this set omits the device serial number that is matched against the authorized list.
- D. The system IP and vBond domain are not identity checks; the controllers use the organization name and serial number alongside the certificate.
Question 68
Which protocol is used to measure loss, latency, jitter, and liveliness of the tunnel between WAN Edge router peers?
Show answer and explanation
Correct answer: C. BFD
BFD (Bidirectional Forwarding Detection) is the protocol used to measure loss, latency, jitter, and liveliness of tunnels between WAN Edge router peers. It provides rapid detection of forwarding path failures between adjacent routers.
Why the other options are wrong
- A. OMP (Overlay Management Protocol) manages overlay routing but does not measure tunnel health metrics like latency and jitter.
- B. NetFlow is used for network traffic analysis and flow monitoring, not tunnel health detection.
- D. IP SLA measures application performance and service level metrics but is not the primary protocol for WAN tunnel health monitoring in SD-WAN.
Question 69
A large retail organization decided to move some of the branch applications to the AWS cloud. How does the network architect extend the inhouse Cisco SD-WAN branch to cloud network into AWS?
Show answer and explanation
Correct answer: D. Create virtual WAN Edge devices Cloud through the AWS online software store
To extend an on-premises Cisco SD-WAN branch network to AWS, virtual WAN Edge devices are created and deployed as Cloud Router instances through the AWS marketplace. These virtual WAN Edge devices establish secure connections back to the on-premises SD-WAN fabric. Creating vSmart instances in AWS is not the correct approach; GRE tunnels bypass the SD-WAN benefits; and installing AWS Cloud Router in the data center doesn't extend to cloud workloads.
Why the other options are wrong
- A. vSmart controllers are control plane components and should not be instantiated in AWS for this use case.
- B. GRE tunnels bypass SD-WAN policy enforcement and optimal path selection benefits.
- C. A single cloud router in the data center does not scale for branch-to-cloud connectivity.
Question 70
Which policy configures an application-aware routing policy under Configuration > Policies?
Show answer and explanation
Correct answer: B. Centralized policy
A centralized policy in SD-WAN configuration enables application-aware routing, allowing traffic to be routed based on application characteristics and requirements. These policies are configured centrally through Configuration > Policies and determine which applications use which WAN paths.
Why the other options are wrong
- A. Data policy focuses on traffic classification and QoS treatment rather than application-aware routing decisions.
- C. Localized policy is applied at individual branch devices and does not provide centralized application-aware routing control.
- D. Control policy manages the control plane and tunnel establishment, not application-based routing decisions.
Question 71
Where on vManage does an engineer find the details of control node failure?
Show answer and explanation
Correct answer: A. Alarms
In vManage, details of control node failures are found in the Alarms section. Alarms provide real-time notifications and historical records of significant events including control node failures, connection issues, and other critical system events.
Why the other options are wrong
- B. Events logs contain detailed transaction information but alarms are the primary mechanism for reporting critical control node failures.
- C. Audit log tracks configuration changes and user actions, not control node failure details.
- D. Network monitoring shows topology and connectivity status but alarm details are specifically reported in the Alarms view.
Question 72
What is the purpose of `vpn 0` in the configuration template when onboarding a WAN Edge node?
Show answer and explanation
Correct answer: C. It carries control traffic over secure DTLS or TLS connections between vSmart controllers and vEdge routers, and between vSmart and vBond.
VPN 0 is the management and control plane VPN in Cisco SD-WAN that carries all control traffic over secure DTLS (Datagram Transport Layer Security) or TLS connections between vSmart controllers and vEdge routers, and between vSmart controllers and vBond orchestrators. This provides encrypted, authenticated communication for the control plane.
Why the other options are wrong
- A. VPN 0 does not use IPsec for control traffic and does not carry traffic between vEdge and vManager in this manner.
- B. While the destination devices are correct, VPN 0 uses DTLS/TLS, not IPsec for control traffic.
- D. Out-of-band management traffic uses different mechanisms and VPN configurations, not the primary purpose of VPN 0.
Question 73
How is TLOC defined?
Show answer and explanation
Correct answer: D. It is a unique collection of GRE or IPsec encapsulations, link color, and system IP address.
A TLOC (Transport Locator) is defined as a unique combination of three elements: GRE or IPsec encapsulation type, link color (WAN transport classification), and the system IP address of the device. This combination uniquely identifies an exit point from the SD-WAN fabric and enables the control plane to make intelligent routing decisions.
Why the other options are wrong
- A. While TLOCs help identify sites in SD-WAN, they are not simply unique identifiers for sites but rather specific transport connection characteristics.
- B. TLOCs are not related to multitenant vSMART deployments or SD-WAN overlay specification.
- C. TLOCs are not QoS policy groups; they represent transport characteristics and encapsulation methods.
Question 74
Which API call retrieves a list of all devices in the network?
Show answer and explanation
Correct answer: A. https://vmanage_IP_address/dataservice/system/device/{{model}}
The correct API call to retrieve a list of all devices in the network uses HTTPS (secure protocol) and the dataservice path: https://vmanage_IP_address/dataservice/system/device/{{model}}. This follows Cisco SD-WAN's secure API standards.
Why the other options are wrong
- B. HTTP is not secure and Cisco SD-WAN requires HTTPS for API calls.
- C. The path api-call is incorrect; the proper path is dataservice for system information retrieval.
- D. While this uses HTTPS correctly, the api-call path is not the correct endpoint for device retrieval.
Question 75
An organization requires the use of integrated preventative engines, exploit protection, and the most updated and advanced signature-based antivirus with sandboxing and threat intelligence to stop malicious attachments before they reach users and get executed. Which Cisco SD-WAN solution meets the requirements?
Show answer and explanation
Correct answer: B. Cisco AMP and Threat Grid
Cisco AMP (Advanced Malware Protection) and Threat Grid meet the requirements for integrated preventative engines, exploit protection, advanced signature-based antivirus with sandboxing, and threat intelligence to stop malicious attachments before execution. These solutions provide comprehensive endpoint and gateway-level protection with behavioral analysis and malware detonation capabilities.
Why the other options are wrong
- A. Trust Anchor module focuses on secure boot and device authentication, not malware protection or antivirus.
- C. URL filtering and Umbrella DNS provide web filtering and DNS-based security but lack sandboxing and advanced antivirus capabilities for attachments.
- D. Snort IPS is a network intrusion prevention system but does not provide sandboxing or advanced signature-based antivirus for malicious attachments.
Question 76
An administrator must configure an ACL for traffic coming in from the service-side VPN on a specific WAN Edge device with circuit ID 123456789. Which policy must be used to configure this ACL?
Show answer and explanation
Correct answer: A. local data policy
A local data policy is configured on a specific WAN Edge device (identified by its circuit ID) to apply ACLs to traffic on the service-side VPN. Local policies are device-specific and allow per-device customization without affecting other devices in the fabric.
Why the other options are wrong
- B. Central data policy applies to multiple devices across the fabric, not to a specific device with a particular circuit ID.
- C. App-aware policy is designed for application-based traffic steering, not for ACL configuration on specific circuits.
- D. Central control policy is for route advertisement and path control, not for service-side traffic ACLs.
Question 77
What is a description of vManage NMS?
Show answer and explanation
Correct answer: D. It is accessible only from VPN 512 (the management VPN).
vManage NMS is accessible only through VPN 512, which is the dedicated management VPN in Cisco SD-WAN. This provides administrative access and isolation of management traffic from data plane traffic, ensuring secure management plane separation.
Why the other options are wrong
- A. A vManage cluster requires a minimum of three nodes for high availability, not two.
- B. vManage is a dedicated management platform, not a software process running on a WAN Edge router.
- C. Device templates can be created and managed on vManage and applied across multiple devices; they do not require attachment to the same server.
Question 78
What is the minimum Red Hat Enterprise Linux operating system requirement for a Cisco SD-WAN controller deployment via KVM?
Show answer and explanation
Correct answer: A. RHEL 7.5
RHEL 7.5 is the minimum Red Hat Enterprise Linux operating system requirement for Cisco SD-WAN controller deployment via KVM. This version provides the necessary kernel features, virtualization support, and compatibility layers required for proper SD-WAN controller operation in a KVM environment.
Why the other options are wrong
- B. RHEL 4.4 is far too old and lacks modern virtualization and security features required for SD-WAN controllers.
- C. RHEL 6.7 predates the minimum requirement and lacks necessary kernel capabilities for SD-WAN controller deployment.
- D. RHEL 6.5 is below the minimum threshold and does not meet the virtualization requirements for SD-WAN controllers.
Question 79
Which issue triggers the Cisco Umbrella resolver to forward DNS requests to the intelligent proxy?
Show answer and explanation
Correct answer: D. A domain is grey-listed.
When a domain is grey-listed, the Cisco Umbrella resolver forwards DNS requests to the intelligent proxy. Grey-listed domains are those that require further inspection or policy evaluation beyond basic block-list checking, necessitating proxy processing to determine appropriate access policies.
Why the other options are wrong
- A. Locally reachable domains bypass Umbrella filtering and do not trigger proxy forwarding.
- B. Block-listed domains are immediately denied by Umbrella and do not reach the intelligent proxy for resolution.
- C. Nonexistent domains return NXDOMAIN responses and do not require intelligent proxy intervention.
Question 80
Which command on a WAN Edge device displays the information about the colors present in the fabric that are learned from vSmart via OMP?
Show answer and explanation
Correct answer: D. show omp tlocs
The command 'show omp tlocs' displays information about the colors (and other TLOC details) present in the fabric that are learned from vSmart controllers via OMP. This command shows the transport locators and their associated attributes including color values.
Why the other options are wrong
- A. show omp peers displays information about OMP peer connections, not colors.
- B. show omp route displays OMP route information but not specifically color attributes.
- C. show omp sessions displays OMP session details, not color fabric information.
Question 81
An engineer wants to track tunnel characteristics within a SLA-based policy for convergence. Which policy configuration will achieve this goal?
Show answer and explanation
Correct answer: A. app-route policy
An app-route policy is specifically designed to track tunnel characteristics and SLA metrics such as latency, jitter, and loss for application-aware routing decisions. This policy type enables convergence decisions based on real-time tunnel performance data.
Why the other options are wrong
- B. VPN membership policy defines which VPNs devices participate in, not tunnel performance tracking.
- C. Control policy manages control plane functions and tunnel establishment, not SLA monitoring.
- D. Data policy handles traffic classification and QoS but is not specifically designed for tunnel characteristic and SLA tracking.
Question 82
Which component of the Cisco SD-WAN control plane architecture facilitates the storage of certificates and configurations for network components?
Show answer and explanation
Correct answer: C. vManage
vManage is the management and orchestration component of the Cisco SD-WAN control plane that serves as the central repository for storing certificates, configurations, policies, and device information for all network components. It provides the GUI and API interfaces for administrators to manage the entire SD-WAN fabric.
Why the other options are wrong
- A. vSmart is a controller that processes and distributes policies and routing information, not a storage repository.
- B. WAN Edge (vEdge) routers are edge devices that participate in the data and control planes but do not store configurations for the network.
- D. vBond is an orchestrator that authenticates and authorizes devices but does not store configurations and certificates for the network.
Question 83
Which OMP route is selected for equal OMP route preference values on WAN Edge routers?
Show answer and explanation
Correct answer: D. route with higher TLOC preference value
In the OMP best-path algorithm, when OMP route preference values are equal, the WAN Edge compares TLOC preference and selects the route with the higher TLOC preference value. As with BGP local preference, a higher value is more preferred.
Why the other options are wrong
- A. Origin type is only compared after both the OMP route preference and TLOC preference are equal.
- B. Origin type is only compared after both the OMP route preference and TLOC preference are equal.
- C. A lower TLOC preference value is less preferred, not more.
Question 84
Which SD-WAN component is configured to enforce a policy to redirect branch-to-branch traffic toward a network service such as a firewall or IPS?
Show answer and explanation
Correct answer: B. vSmart
The vSmart controller is the centralized policy enforcement component in SD-WAN. It enforces policies to redirect branch-to-branch traffic toward network services such as firewalls or IPS systems by pushing policies to vEdge routers throughout the network.
Why the other options are wrong
- A. vBond is the orchestration and bootstrapping component that authenticates devices, not a policy enforcement engine.
- C. WAN Edge (vEdge) devices receive and execute policies but do not enforce policies, they are managed by vSmart.
- D. A firewall is the destination service that traffic is redirected toward, not the component that enforces redirection policy.
Question 85
When software is upgraded on a vManage NMS, which two image-adding options store images in a local vManage software repository? (Choose two.)
Show answer and explanation
Correct answer: C, D. To be downloaded over a control plane connection; To be downloaded over an out-of-band connection
Images can be stored in a local vManage software repository by downloading over a control plane connection or an out-of-band connection. Both of these pathways ensure secure, reliable transfer of software images to the vManage server for local storage.
Why the other options are wrong
- A. ICMP is not used for software image transfers in vManage deployments.
- B. SNMP is a network management protocol, not designed for large file transfers like software images.
- E. SMTP is for email communication and is not used for software image downloads to vManage.
Question 86
An engineer must use data prefixes to configure centralized data policies using the vManage policy configuration wizard. What is the first step to accomplish this task?
Show answer and explanation
Correct answer: D. Create groups of interest.
Before configuring traffic rules or applying policies in the vManage policy configuration wizard, you must first create groups of interest. These groups serve as the foundational elements that define which data prefixes and traffic flows will be subject to your centralized data policies. Groups of interest act as containers for the specific network entities and prefixes that policies will then reference and manage.
Why the other options are wrong
- A. Network topology configuration is not the first step in the policy configuration wizard workflow.
- B. Applying policies to sites and VPNs comes after you have created the groups and rules that will be applied.
- C. Configuring traffic rules occurs after establishing the groups of interest that those rules will govern.
Question 87
An engineer is configuring a centralized policy to influence network route advertisement. Which controller delivers this policy to the fabric?
Show answer and explanation
Correct answer: A. vSmart
The vSmart controller is responsible for delivering centralized policies to the fabric. It acts as the control plane component that computes and distributes routing policies, traffic policies, and other control information to all WAN Edge devices in the SD-WAN network.
Why the other options are wrong
- B. vBond is the orchestration controller that authenticates and manages the connection between vManage and vSmart controllers, not the policy delivery mechanism.
- C. vManage is the management and analytics platform where policies are configured, but vSmart is responsible for actual delivery to the fabric.
- D. WAN Edge devices are the endpoints that receive and enforce policies, not the controllers that deliver them.
Question 88
Which value is verified in the certificates to confirm the identity of the physical WAN Edge device?
Show answer and explanation
Correct answer: A. Serial Number
The Serial Number is the value verified in certificates to confirm the identity of the physical WAN Edge device. During the device onboarding process, the serial number embedded in the device certificate is validated against the device requesting authentication to ensure the physical hardware is genuine and authorized.
Why the other options are wrong
- B. OTP (One-Time Password) is used for temporary authentication challenges, not for verifying device identity in certificates.
- C. System-IP is a configuration parameter used for device identification in the SD-WAN control plane, not the certificate identity verification mechanism.
- D. Chassis-ID may be used for device identification but is not the primary value verified in certificates for physical WAN Edge device identity.
Question 89
How is multicast routing enabled on devices in the Cisco SD-WAN overlay network?
Show answer and explanation
Correct answer: A. The WAN Edge routers originate multicast service routes to the vSmart controller via OMP, which then forwards joins for requested multicast groups based on IGMP v2 or v3 toward the source or PIM-RP as specified in the original PIM join message.
Multicast routing is enabled when WAN Edge routers originate multicast service routes to the vSmart controller via OMP. The vSmart controller then forwards IGMP v2 or v3 join messages for requested multicast groups toward the source or PIM-RP as specified in the original PIM join, facilitating multicast delivery across the overlay.
Why the other options are wrong
- B. IGMP v1 is outdated and not used in modern multicast implementations; IGMP v2 or v3 are the correct versions.
- C. vSmart controllers do not originate multicast service routes; WAN Edge routers do.
- D. While the vSmart controller role is correct, IGMP v1 is not the appropriate protocol version used in current SD-WAN multicast implementations.
Question 90
Which command displays BFD session summary information per TLOC on vEdge routers?
Show answer and explanation
Correct answer: A. show bfd tloc-summary-list
The command 'show bfd tloc-summary-list' displays BFD session summary information organized per TLOC on vEdge routers, allowing operators to quickly view the status and health of BFD sessions associated with each transport locator.
Why the other options are wrong
- B. show bfd history displays historical BFD data, not current summary per TLOC.
- C. show bfd summary displays overall BFD summary but not organized specifically per TLOC.
- D. show bfd sessions shows detailed session information rather than a summary organized by TLOC.
Question 91
What are the two advantages of deploying cloud-based Cisco SD-WAN controllers? (Choose two.)
Show answer and explanation
Correct answer: B, C. infrastructure as a service; management of SLA
Hosting the Cisco SD-WAN controllers in the cloud means the controller infrastructure is consumed as a service, so there is no on-premises hardware to buy, rack or maintain. It also makes it easier to manage and meet SLAs, because Cisco or the cloud provider handles controller availability and scaling. Only the control and management planes are centralized; the data plane stays distributed on the WAN Edge routers.
Why the other options are wrong
- A. Cisco SD-WAN centralizes only the control plane; the data plane is always distributed across the WAN Edge routers, wherever the controllers are hosted.
- D. RAID storage is a server hardware detail and is not an advantage of cloud-hosted SD-WAN controllers.
- E. Authentication in Cisco SD-WAN is handled centrally by the controllers, and distributed authentication policies are not a benefit of cloud hosting.
Question 92
If Smart Account Sync is not used, which Cisco SD-WAN component is used to upload an authorized serial number file?
Show answer and explanation
Correct answer: D. vManage
vManage is the component used to upload an authorized serial number file when Smart Account Sync is not enabled. vManage provides the management interface for device licensing and authorization. WAN Edge devices cannot upload files to themselves, vSmart is a control plane controller not involved in licensing, and vBond handles orchestration but not license file uploads.
Why the other options are wrong
- A. WAN Edge devices do not upload authorized serial number files; they receive authorization from the management system.
- B. vSmart is the control plane controller and does not handle licensing or file uploads.
- C. vBond is the orchestration controller and does not manage license file uploads.
Question 93
A bank is looking for improved customer experience for applications and reduce overhead related to compliance and security. Which key feature or features of the Cisco SD-WAN solution will help the bank to achieve their goals?
Show answer and explanation
Correct answer: B. QoS including application prioritization and meeting critical applications SLA for selecting optimal path
QoS with application prioritization and SLA enforcement enables the bank to improve customer experience by ensuring critical applications receive optimal network paths and performance guarantees. This directly addresses application experience and helps meet compliance requirements for financial systems. PaaS integration is not a core SD-WAN feature; BGP is legacy routing; and core banking systems are business applications, not network infrastructure features.
Why the other options are wrong
- A. PaaS integration is not a primary SD-WAN feature for addressing customer experience and compliance.
- C. BGP is traditional routing protocol; SD-WAN uses OMP and application-based path selection instead.
- D. Core banking system implementation is a business system decision, not an SD-WAN network feature.
Question 94
In a customer retail network with multiple data centers, what does the network administrator use to create a regional hub topology?
Show answer and explanation
Correct answer: C. control policy on vSmart
Control policies on vSmart are used to create regional hub topologies in multi-data center networks. Control policies govern how devices connect and communicate across the overlay network, allowing administrators to establish preferred routing paths and connectivity patterns that define regional hub-and-spoke or hub-to-hub relationships among data centers.
Why the other options are wrong
- A. App route policies manage application-based routing, not overlay topology structure.
- B. Data policies govern traffic handling and quality of service, not the fundamental overlay topology.
- D. Control policies must be configured on vSmart, not vManage, as vSmart enforces the control plane policies that shape the overlay network topology.
Question 95
Which two algorithms authenticate a user when configuring SNMPv3 monitoring on a WAN Edge router? (Choose two.)
Show answer and explanation
Correct answer: B, C. MD5; SHA-2
MD5 and SHA-2 are the two algorithms that authenticate a user when configuring SNMPv3 monitoring on a WAN Edge router. These are hash-based authentication mechanisms used for SNMPv3 user authentication, providing data integrity and origin verification.
Why the other options are wrong
- A. AES-256 is an encryption algorithm, not an authentication algorithm for SNMPv3.
- D. AES-128 is an encryption algorithm used in SNMPv3 for confidentiality, not for user authentication.
- E. SHA-1 is considered deprecated and is not recommended for SNMPv3 authentication in modern implementations.
Question 96
An enterprise needs DIA on some of its branches with a common location ID: A042:B49C:D02E::72. Which WAN Edge configuration meets the requirement?
Show answer and explanation
Correct answer: D. vpn 0 interface ge0/0 ip address 172.16.0.1/24 nat vpn 1 ip route 0.0.0.0/0 vpn 0
To implement Direct Internet Access (DIA) on WAN Edge devices, the configuration must establish a default route in VPN 0 (the transport VPN) pointing to VPN 0, allowing data to exit directly to the internet. The correct configuration is 'vpn 0 interface ge0/0 ip address 172.16.0.1/24 nat vpn 1 ip route 0.0.0.0/0 vpn 0', which configures the WAN interface in VPN 0 with NAT and routes all traffic destined for the internet directly out VPN 0.
Why the other options are wrong
- A. Routes default traffic to VPN 512 which is invalid; VPN 0 must be the target for DIA.
- B. Routes default traffic within VPN 1 instead of exiting to VPN 0 for internet access.
- C. Has correct VPN 0 default route but incorrectly places VPN 1 configuration; the order and context are wrong.
Question 97
Which two prerequisites must be met before the Cloud onRamp for IaaS is initiated on vManage to expand to the AWS cloud? (Choose two.)
Show answer and explanation
Correct answer: C, D. Subscribe to the SD-WAN Edge router AMI in the AWS account; Attach a device template to the cloud WAN Edge router to be deployed in the AWS.
Before initiating Cloud OnRamp for IaaS in vManage to deploy to AWS, the AWS AMI subscription for the SD-WAN Edge router must be activated in the AWS account, and a device template must be configured and attached to define the cloud WAN Edge router's properties. OSPF is not required for cloud edge routing; IAM permissions need to be correct but specific policy names may vary; and transit VPC provisioning is automatic as part of the OnRamp process.
Why the other options are wrong
- A. OSPF is not required; SD-WAN uses OMP for routing and policy distribution.
- B. While IAM permissions are needed, the exact policy names and scope differ from those listed.
- E. Transit VPC provisioning is handled automatically by the Cloud OnRamp process, not a prerequisite.
Question 98
When redistribution is configured between OMP and BGP at two Data Center sites (DC) that have Direct Connection Interlink, which step avoids learning the same routes on WAN Edge routers of the DCs from LAN?
Show answer and explanation
Correct answer: A. Set down-bit on WAN Edge routers on DC1
Setting the down-bit on WAN Edge routers in DC1 prevents the same routes from being learned back through the OMP-BGP redistribution at the other DC site. The down-bit is a loop prevention mechanism in OMP that marks routes as already seen, preventing them from being re-advertised back to the originating domain and creating redundant paths through the LAN.
Why the other options are wrong
- B. Different VRFs would create routing isolation but don't specifically address the bidirectional redistribution loop problem.
- C. Adjusting admin distance affects path selection but doesn't prevent learning routes from both directions simultaneously.
- D. Using the same overlay AS on both DCs would not prevent the redistribution loop and could actually contribute to it.
Question 99
In Cisco SD-WAN, which protocol is used for control connections between Cisco SD-WAN devices?
Show answer and explanation
Correct answer: B. DTLS
Control connections between Cisco SD-WAN devices, such as between WAN Edge routers and vSmart, vBond and vManage, are established and secured with DTLS by default, with TLS as an option. OMP then runs inside those secure connections to exchange routes and policy.
Why the other options are wrong
- A. BGP is used on the service or transport side to peer with non-SD-WAN routers, not for SD-WAN control connections.
- C. OSPF is a service-side or transport-side routing protocol and does not build SD-WAN control connections.
- D. OMP carries routes, TLOCs and policy over the control connections, but the connections themselves are built with DTLS.
Question 100
Which hardware component is involved in the Cisco SD-WAN authentication process for ISR platforms?
Show answer and explanation
Correct answer: C. SUDI
SUDI (Secure Unique Device Identifier) is the hardware component involved in the Cisco SD-WAN authentication process for ISR platforms. SUDI is a security credential embedded in Cisco hardware that provides a secure identity for the device, enabling trustworthy device authentication and certificate-based identity verification.
Why the other options are wrong
- A. ZTP (Zero-Touch Provisioning) is a provisioning method, not a hardware component for authentication.
- B. OTPC is not a standard Cisco hardware component for SD-WAN authentication.
- D. TPMD appears to be a malformed reference; TPM (Trusted Platform Module) exists but TPMD is not the correct component for SD-WAN ISR authentication.
Question 101
A Cisco SD-WAN customer has a requirement to calculate the SHA value for files as they pass through the device to see the returned disposition and determine if the file is good, unknown, or malicious. The customer also wants to perform real-time traffic analysis and generate alerts when threats are detected. Which two Cisco SD-WAN solutions meet the requirements? (Choose two.)
Show answer and explanation
Correct answer: C, E. Cisco AMP; Cisco Snort IPS
Cisco AMP computes the SHA-256 hash of files passing through the WAN Edge and looks it up in the cloud to get a disposition of clean, unknown or malicious. Snort IPS performs real-time traffic inspection against signatures and generates alerts when threats are detected. Together they cover both requirements on the SD-WAN router.
Why the other options are wrong
- A. Threat Grid is a sandbox that detonates unknown files for deeper analysis; it does not perform real-time traffic analysis on the router.
- B. The Trust Anchor module secures device identity and boot integrity and does no file or traffic inspection.
- D. Cisco Secure Endpoint is an agent that runs on end hosts, not a security feature running on the SD-WAN router.
Question 102
An engineer is adding a tenant with location ID 123456789 in vManage. What is the maximum number of alphanumeric characters that is accepted in the tenant name field?
Show answer and explanation
Correct answer: C. 128
The maximum number of alphanumeric characters accepted in the tenant name field when adding a tenant in vManage is 128 characters. This limit applies regardless of the location ID assigned to the tenant.
Why the other options are wrong
- A. 8 characters is too restrictive for practical tenant naming requirements.
- B. 256 characters exceeds the actual vManage tenant name field limit.
- D. 64 characters is below the actual maximum allowed length.
Question 103
An engineer is configuring a data policy for IPv4 prefixes for a single WAN Edge device on a site with multiple WAN Edge devices. How is this policy added using the policy configuration wizard?
Show answer and explanation
Correct answer: B. In vManage NMS, select the configure --> policies screen, select the localized policy tab, and click add policy.
Localized policies for individual WAN Edge devices are configured through vManage NMS, not vBond or vSmart. The vManage platform is the network management system where administrators access the Configure menu, navigate to the Policies screen, select the Localized Policy tab, and click add policy to create device-specific policies for single WAN Edge devices.
Why the other options are wrong
- A. vBond orchestrator is used for overlay management and bootstrapping, not policy configuration.
- C. vSmart controller enforces centralized policies across the network, not localized device-specific policies.
- D. While vManage is correct, localized policies use the localized policy tab, not the centralized policy tab which is for network-wide policies.
Question 104
An administrator is configuring the severity level on the vManage NMS for events that indicate that an action must be taken immediately. Which severity level must be configured?
Show answer and explanation
Correct answer: B. critical
The critical severity level must be configured for events that indicate an action must be taken immediately. Critical represents the highest severity in the standard syslog severity hierarchy, reserved for conditions that require urgent administrative intervention to prevent system failure or data loss.
Why the other options are wrong
- A. Error severity is lower than critical and does not indicate the most urgent action required.
- C. Warning severity is even lower and indicates potentially problematic situations rather than immediate action requirements.
- D. Alert severity, while serious, is conventionally lower in priority than critical in standard logging frameworks.
Question 105
Which table is used by the vSmart controller to maintain service routes of the WAN Edge routers in the hub and local branches?
Show answer and explanation
Correct answer: A. RIB
The vSmart controller maintains service routes of WAN Edge routers using the Routing Information Base (RIB). The RIB stores all routing information learned from various sources including OMP (Overlay Management Protocol), and from the RIB, routes are selected and installed in the Forwarding Information Base (FIB) for actual packet forwarding decisions.
Why the other options are wrong
- B. FIB is the forwarding table used by edge devices for packet forwarding, not maintained by vSmart for route tracking.
- C. OMP is the protocol used to distribute routing information, not the table that stores the routes themselves.
- D. TLOC (Transport Locator) is a construct identifying edge devices and their transport connections, not a routing table.
Question 106
Which two features does the application firewall provide? (Choose two.)
Show answer and explanation
Correct answer: A, E. blocks traffic by application or application-family; classification of 1400+ layer 7 applications
The application firewall blocks traffic by application or application-family to enforce granular application-level policies, and classifies 1400+ layer 7 applications to provide comprehensive visibility and control at the application layer. These are core features that enable application-aware security.
Why the other options are wrong
- B. Numbered sequences of match-action pairs describe access control lists, not application firewall features.
- C. Layer 4 application classification at 1000+ is not accurate; the firewall operates at layer 7 with 1400+ classifications.
- D. Application match parameters are part of policy configuration, not a primary firewall feature description.
Question 107
When VPNs are grouped to create destination zone in Zone-Based Firewall, how many zones can a single VPN be part of?
Show answer and explanation
Correct answer: C. one
In Zone-Based Firewall configuration within SD-WAN, a single VPN can belong to only one zone. This ensures clear security boundaries and prevents ambiguous zone membership that could complicate policy application and security rule enforcement.
Why the other options are wrong
- A. A VPN cannot be part of two zones simultaneously in Zone-Based Firewall design.
- B. A VPN cannot be part of four zones; zone membership is limited to one per VPN.
- D. A VPN cannot be part of three zones in the Zone-Based Firewall model.
Question 108
An engineer is tasked to improve throughput for connection-oriented traffic by decreasing round-trip latency. Which configuration will achieve this goal?
Show answer and explanation
Correct answer: C. turn on "Enable TCP Optimization"
Enabling TCP Optimization improves throughput for connection-oriented traffic by decreasing round-trip latency. TCP Optimization applies various techniques to reduce latency and improve performance for TCP-based connections, including acknowledgment acceleration and window scaling optimization.
Why the other options are wrong
- A. Turning off TCP Optimization would decrease performance and increase latency, the opposite of the goal.
- B. Enhance ECMP Keying is related to load balancing across multiple paths, not TCP latency optimization.
- D. Turning off ECMP Keying enhancements would not improve TCP latency for connection-oriented traffic.
Question 109
An engineer wants to change the configuration of the certificate authorization mode from manual to automated. Which GUI selection will accomplish this?
Show answer and explanation
Correct answer: C. Administration > Settings
The controller certificate authorization mode, which chooses between Cisco automated, Symantec manual, enterprise root CA and similar options, is set in vManage under Administration > Settings. The Configuration > Certificates page is used afterwards to view and act on device and controller certificates.
Why the other options are wrong
- A. Maintenance > Security is used for tasks like rekeying and is not where the certificate authorization mode is set.
- B. Configuration > Certificates lists device and controller certificates but does not hold the authorization mode setting.
- D. Tools > Operational Commands runs commands on devices and has no certificate authorization setting.
Question 110
An engineer provisions a WAN Edge router. Which command should be used from the WAN Edge router to activate it with vManage?
Show answer and explanation
Correct answer: D. request vedge-cloud activate chassis-number token
The correct command to activate a WAN Edge router with vManage is 'request vedge-cloud activate chassis-number token'. This command uses the chassis number as the device identifier and the token as the authentication credential provided by vManage during the onboarding process.
Why the other options are wrong
- A. Serial number is not the correct identifier; the chassis number is required for activation.
- B. Organization is not a valid parameter for the activation command; the token is required.
- C. While chassis-number is correct, serial is not the appropriate authentication parameter for activation.
Question 111
In a Cisco SD-WAN network, which component is responsible for distributing route and policy information via the OMP?
Show answer and explanation
Correct answer: B. vSmart Controller
The vSmart Controller is the component responsible for distributing route and policy information throughout the SD-WAN overlay network via OMP (Overlay Management Protocol). vSmart controllers receive policies from vManage and propagate them to all connected WAN Edge routers using OMP. vManage is the management plane; vBond handles orchestration; WAN Edge routers receive but do not distribute OMP information.
Why the other options are wrong
- A. vManage is the management interface for creating policies but does not distribute via OMP.
- C. vBond Orchestrator handles device authentication and controller assignment, not OMP distribution.
- D. WAN Edge routers are OMP clients that receive information, not the distributors of it.
Question 112
What are two components of vSmart? (Choose two.)
Show answer and explanation
Correct answer: A, B. key reflection; policy engine
The vSmart controller contains two main components: the policy engine, which processes and enforces policies, and key reflection, which manages encryption keys for secure communication within the overlay network. Device templates are created in vManage, monitoring occurs in vManage, and NAT traversal is handled by vBond.
Why the other options are wrong
- C. NAT traversal is a function of vBond Orchestrator, not vSmart.
- D. Device template creation is performed in vManage, not vSmart.
- E. Monitoring and analytics are functions of vManage, not vSmart.
Question 113
In the Cisco SD-WAN solution, vSmart controller is responsible for which two actions? (Choose two.)
Show answer and explanation
Correct answer: C, E. Distribute route and policy information via OMP; Distribute crypto key information among WAN Edge routers.
vSmart is the control plane brain of the overlay. It distributes routes, TLOCs and policy to WAN Edge routers through OMP, and it also distributes the IPsec data plane key material between edges so they can build tunnels without a traditional IKE exchange between every pair.
Why the other options are wrong
- A. Initial authentication and authorization of WAN Edge routers is the job of vBond, working with the authorized device list.
- B. Configuring and monitoring WAN Edge routers is done by vManage, the management plane.
- D. Handing out DHCP addresses is not a vSmart function; DHCP is provided by a DHCP server or by the edge itself.
Question 114
Which two platforms for the Cisco SD-WAN architecture are deployable in a hypervisor on-premises or in IAAS Cloud? (Choose two.)
Show answer and explanation
Correct answer: A, E. CSR 1000v; vEdge Cloud
CSR 1000v (Cloud Services Router) and vEdge Cloud are both virtual platforms that can be deployed on hypervisors in on-premises environments or in IaaS cloud services. These software-based platforms provide flexibility for diverse deployment scenarios without requiring dedicated hardware appliances.
Why the other options are wrong
- B. ISR 4431 is a physical hardware appliance and cannot be deployed as a virtual instance on hypervisors.
- C. vEdge 100c is a physical hardware device and is not deployable in hypervisors or cloud environments.
- D. vEdge 2000 is a high-end physical hardware platform designed for on-premises deployment only.
Question 115
Which device in the Cisco SD-WAN solution receives and categorizes event reports, and generates alarms?
Show answer and explanation
Correct answer: D. vManage NMS
vManage NMS (Network Management System) is the central management component that receives event reports from all SD-WAN devices, categorizes these events, generates alarms based on severity and rules, and provides alerting and monitoring capabilities to administrators.
Why the other options are wrong
- A. WAN Edge routers generate events and reports but do not receive and categorize them centrally.
- B. vSmart controllers manage routing and policy enforcement but do not perform centralized event management and alarming.
- C. vBond controllers handle device orchestration and authentication but do not manage events and alarms.
Question 116
Two sites have one WAN Edge each. Each WAN Edge has two public TLOCs with no restrict configured. There is full reachability between the TLOCs. How many data tunnels are formed on each WAN Edge router?
Show answer and explanation
Correct answer: C. 4
With two sites each having one WAN Edge with two public TLOCs and full reachability between all TLOCs with no restrict configured, a full mesh of data tunnels is created. Each TLOC on the first WAN Edge creates tunnels to both TLOCs on the second WAN Edge (2×2=4 tunnels), and the same occurs from the second WAN Edge perspective. This results in 4 data tunnels formed on each WAN Edge router.
Why the other options are wrong
- A. Six tunnels would only occur with three TLOCs per edge or a different topology.
- B. Two tunnels represent only partial connectivity between the TLOCs.
- D. Eight tunnels would result from a different configuration with additional TLOCs or sites.
Question 117
Which logs verify when a device was upgraded?
Show answer and explanation
Correct answer: D. Audit
Audit logs verify when a device was upgraded in Cisco SD-WAN. Audit logs track all administrative actions and configuration changes, including device upgrades and their timestamps.
Why the other options are wrong
- A. ACL logs record access control list activities, not software upgrade events.
- B. Email logs track email-related activities and notifications, not device upgrades.
- C. SNMP logs are related to SNMP trap and monitoring data, not upgrade tracking.
Question 118
An engineer must configure a centralized policy on a site in which all HTTP traffic should use the Public Internet circuit if the loss on this circuit is below 10%, otherwise MPLS should be used. Which configuration wizard fulfills this requirement?
Show answer and explanation
Correct answer: C. Create Applications or Groups of Interest > Configure Traffic Rules > Apply Policies to Sites and VPNs.
The 'Create Applications or Groups of Interest > Configure Traffic Rules > Apply Policies to Sites and VPNs' wizard enables configuration of application-based traffic rules with conditional path selection based on metrics like loss. This allows specifying that HTTP traffic uses the Public Internet circuit when loss is below 10%, otherwise using MPLS.
Why the other options are wrong
- A. Configure Traffic Data is not the correct wizard step for creating conditional traffic rules with metric-based switching.
- B. VPN Membership configuration handles which devices belong to VPNs, not application-level traffic rules with conditional logic.
- D. Configure Topology manages network topology definition but does not provide the granularity needed for application-specific conditional routing based on circuit metrics.
Question 119
A customer must upgrade the Cisco SD-WAN devices and controllers from version 19.2 to version 20.3. The devices include WAN Edge Cloud, vManage, vSmart, and vBond. Which types of image files are needed for this upgrade?
Show answer and explanation
Correct answer: D. one file for vManage, one for vSmart, and one for vBond + WAN Edge Cloud with extension tar.gz
Cisco SD-WAN upgrades from 19.2 to 20.3 require tar.gz format image files. The upgrade process requires three separate image files: one for vManage, one for vSmart controllers, and one combined image for vBond and WAN Edge Cloud devices. The tar.gz format is the standard compressed archive format used for SD-WAN controller and edge device images in this version range.
Why the other options are wrong
- A. Incorrect file extension; .bin files are not used for SD-WAN controller upgrades in this version.
- B. Correct file separation but uses incorrect .bin extension instead of tar.gz.
- C. Correct file format (tar.gz) but incorrect file separation; vSmart upgrades use a separate image from vBond and WAN Edge Cloud.
Question 120
A network administrator is configuring a centralized control policy based on match action pairs for multiple conditions. Which order must be configured to prefer Prefix List over TLOC and TLOC over Origin?
Show answer and explanation
Correct answer: B. lowest to highest sequence number
In centralized control policies, the lowest to highest sequence number order determines preference. Prefix Lists are evaluated first, followed by TLOCs, then Origin attributes. Lower sequence numbers execute first and take precedence, establishing the preference hierarchy required by the question.
Why the other options are wrong
- A. Deterministic order is not the correct technical term for SD-WAN policy sequencing.
- C. Highest to lowest sequence number would reverse the intended preference order, placing Origin before TLOC and TLOC before Prefix List.
- D. Nonsequential order would be unpredictable and does not guarantee the required preference hierarchy.
Question 121
Which type of certificate is installed on vManage for a user to access vManage via a web browser?
Show answer and explanation
Correct answer: B. Web Server Certificate
A Web Server Certificate is installed on vManage to enable secure HTTPS web browser access. This certificate authenticates the vManage server to clients and encrypts the communication channel between the browser and the vManage management interface.
Why the other options are wrong
- A. Controller Certificate is used for control plane communications between controllers and WAN Edge devices, not for web browser access.
- C. SD-AVC Certificate is related to Advanced Visibility and Control features, not web server authentication.
- D. WAN Edge Certificate is installed on edge routers for device authentication and control plane security, not for vManage web access.
Question 122
Which scheduling method is configured by default for the eight queues in the cloud vEdge router?
Show answer and explanation
Correct answer: A. weighted round robin
The eight queues in cloud vEdge routers are configured by default to use weighted round robin scheduling. This scheduling method distributes traffic across the queues based on assigned weights, ensuring fair allocation of bandwidth while allowing prioritization through different weight values for different queue types.
Why the other options are wrong
- B. Priority queue scheduling is a different method where higher priority queues are serviced before lower priority ones, not the default for vEdge.
- C. Low latency queue is a specific queue type, not the scheduling method used for the eight queues.
- D. Weighted random early detection (WRED) is a congestion avoidance mechanism, not a queue scheduling method.
Question 123
A network administrator is creating an OMP feature template from the vManage GUI to be applied to WAN Edge routers. Which configuration attribute will avoid the redistribution of the routes back into the OMP from the LAN side?
Show answer and explanation
Correct answer: D. configure "Overlay AS Number"
Configuring the Overlay AS Number in the OMP feature template prevents redistribution of routes back into OMP from the LAN side. The AS number acts as a boundary for route propagation and prevents feedback loops where LAN routes would be readvertised back into the overlay network.
Why the other options are wrong
- A. ECMP limit controls the number of equal-cost paths but does not prevent route redistribution.
- B. Send Backup Paths controls advertising backup routes in OMP but does not prevent LAN route redistribution.
- C. Number of Paths Advertised per Prefix controls path selection but does not prevent route redistribution.
Question 124
Which Cisco SD-WAN WAN Edge platform supports LTE and Wi-Fi?
Show answer and explanation
Correct answer: A. ISR 1101
The ISR 1101 is a compact WAN Edge platform that supports both LTE and Wi-Fi connectivity options, making it suitable for flexible branch deployments. The ASR 1001 is a high-performance edge router without LTE/Wi-Fi support, the CSR 1000v is a virtual platform without wireless capabilities, and the vEdge 2000 is a classic SD-WAN device focused on wired WAN interfaces.
Why the other options are wrong
- B. ASR 1001 does not support LTE or Wi-Fi connectivity.
- C. CSR 1000v is a virtual platform and does not include LTE or Wi-Fi support.
- D. vEdge 2000 is designed for wired WAN connectivity and does not support LTE or Wi-Fi.
Question 125
Which two requirements must be met for DNS inspection when integrating with Cisco Umbrella? (Choose two.)
Show answer and explanation
Correct answer: A, E. Attach security policy to the device template; Configure the Umbrella token on the vManage.
DNS inspection with Cisco Umbrella integration requires attaching a security policy to the device template to enforce DNS policies, and configuring the Umbrella token on vManage to establish the connection between the SD-WAN fabric and Umbrella's cloud services for DNS threat prevention.
Why the other options are wrong
- B. System feature templates with Umbrella credentials are not the primary requirement; the token configuration on vManage is what's needed.
- C. Registering vManage public IP and serial number is not a direct requirement for DNS inspection integration.
- D. Uploading WAN Edge serial allow lists to Umbrella portal is not a standard requirement for DNS inspection functionality.
Question 126
An engineer is configuring a list that matches all IP prefixes with lengths from /1 to /16 in a centralized control policy. Which list accomplishes this task?
Show answer and explanation
Correct answer: A. 0.0.0.0/0 le 16
The base prefix 0.0.0.0/0 covers the whole IPv4 address space, and le 16 matches every prefix length up to /16 within it. This is the list that captures all routes from /1 to /16 among the choices. Using 0.0.0.0/1 as the base would only cover the lower half of the address space.
Why the other options are wrong
- B. 0.0.0.0/1 only covers addresses 0.0.0.0 to 127.255.255.255, so prefixes in the upper half of the address space would be missed.
- C. ge 1 with no upper bound matches every prefix length from /1 to /32, not just up to /16.
- D. 0.0.0.0/16 ge 1 is not a valid range, because the ge value cannot be shorter than the base prefix length.
That was 126 of 502.
The full Cisco 300-415 ENSDWI pack has all 502 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 220 free as one PDF by email. Get the Half Pack →