CCNP SD-WAN Architecture — 30 Questions

Question 1

A network engineer is deploying a Cisco SD-WAN solution for a global enterprise with multiple regional hubs. The engineer wants to ensure that traffic from branch offices to the internet is always forwarded directly from the branch, even if the branch has a primary MPLS link and a backup broadband link. The engineer configures the vSmart policy to direct internet-bound traffic to use the local exit at the branch. However, after deployment, the engineer notices that some internet traffic is still being sent to the regional hub before reaching the internet. What is the most likely cause of this behavior?

Accepted Answer

The engineer configured the data policy under VPN 0 instead of the service VPN (e.g., VPN 10).. Option A is correct because in Cisco SD-WAN, data policies that control traffic forwarding (such as forcing local internet exit) must be applied to the service VPN (e.g., VPN 10) where the branch’s LAN and internet-bound traffic resides. Configuring the policy under VPN 0 (the transport VPN) only affects overlay tunnel traffic and control-plane packets, not user traffic. Since the engineer applied the policy to VPN 0, the policy did not match internet-bound traffic in the service VPN, causing it to follow the default route toward the regional hub.

Answer

The branch router does not have a default route in its routing table for the service VPN.

Answer

The engineer used a localized data policy instead of a centralized data policy.

Answer

The OMP route redistribution is not enabled on the branch router.

Question 2

An enterprise is migrating from a traditional MPLS WAN to Cisco SD-WAN. The network team has deployed vEdge routers at all branch offices and a vSmart controller in the data center. The engineer configures a centralized control policy to influence path selection based on cost and latency. After the policy is activated, the engineer notices that some branches are not receiving the updated policy and are still using the default best-path selection. The vSmart is reachable from all branches, and the vEdge routers show that they are connected to the vSmart. What is the most likely reason for this issue?

Accepted Answer

The control policy is not attached to the appropriate site list or VPN list.. In Cisco SD-WAN, centralized control policies must be explicitly attached to a site list or VPN list to define which devices or traffic the policy applies to. If the policy is not attached to the appropriate list, the vSmart controller will not push the policy to the targeted vEdge routers, causing them to continue using the default OMP best-path selection (based on administrative distance and cost). The fact that the vEdge routers are connected to the vSmart confirms the issue is with policy application, not reachability.

Answer

The vEdge routers have not been rebooted after the policy change.

Answer

The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.

Answer

The BFD sessions between vEdge and vSmart are flapping.

Question 3

A network engineer is configuring a Cisco SD-WAN fabric with vManage, vSmart, and vBond controllers. The engineer wants to ensure that all branch routers automatically discover the vSmart and vBond controllers without manual configuration on each branch. The engineer has configured the vBond with a public IP address and enabled NAT traversal. However, branch routers are failing to establish control connections. The engineer verifies that the branch routers have the correct organization name and that the vBond is reachable from the branches. What is the most likely missing configuration?

Accepted Answer

The vBond IP address is not configured on the branch routers.. In Cisco SD-WAN, branch routers use a two-phase discovery process: they first connect to the vBond controller to authenticate and receive the list of vSmart and vManage controllers. Since the engineer has already configured the vBond with a public IP and enabled NAT traversal, and the branch routers have the correct organization name and can reach the vBond, the missing piece is that the vBond IP address must be explicitly configured on each branch router (via the 'system vbond' CLI command or the equivalent in the device template). Without this, the branch routers have no initial target to contact for the bootstrap discovery process, so they cannot automatically learn the vSmart and vManage addresses.

Answer

The vManage IP address is not configured on the branch routers.

Answer

The vSmart IP address is not configured on the branch routers.

Answer

The DTLS port 12346 is not open on the branch routers' firewall.

Question 4

A large enterprise uses Cisco SD-WAN with multiple transport clouds (MPLS and Internet). The network team wants to ensure that voice traffic between two branch offices always uses the MPLS link, even if the Internet link has lower latency. The engineer creates a centralized data policy on the vSmart to match voice traffic based on DSCP EF and sets the preferred color to 'mpls'. After applying the policy, the engineer tests and finds that voice traffic is still using the Internet link. The vEdge routers show that the policy is received and active. What is the most likely reason for this failure?

Accepted Answer

The policy does not include a match condition for the correct VPN or site list.. Option D is correct because a centralized data policy on the vSmart must include match conditions for both the traffic (e.g., DSCP EF) and the scope of the policy (e.g., VPN list or site list). Without a site list or VPN list match, the policy may not apply to the specific branch-to-branch traffic, causing the vEdge to fall back to the default routing behavior (e.g., using the Internet link if it has lower latency). The vSmart distributes the policy to vEdges, but the vEdge only enforces it for matched traffic within the specified sites or VPNs.

Answer

The vEdge routers have not rebooted after the policy was applied.

Answer

The data policy was applied on the vEdge instead of the vSmart.

Answer

The DSCP EF marking is not supported in SD-WAN data policies.

Question 5

A network engineer is troubleshooting a Cisco SD-WAN deployment where a branch office has two WAN links: a primary MPLS link and a backup LTE link. The engineer wants to configure application-aware routing so that critical applications (e.g., Salesforce) always use the MPLS link as long as its loss is below 2% and latency below 150 ms. The engineer configures an app-route policy on the vSmart with the appropriate SLA requirements. After deployment, the engineer notices that Salesforce traffic is still using the LTE link even when the MPLS link meets the SLA. What is the most likely cause?

Accepted Answer

The app-route policy is not attached to the correct site list or VPN list.. Option A is correct because the app-route policy must be attached to the correct site list and VPN list to be applied to the traffic. If the policy is not properly associated with the site list containing the branch office or the VPN list that includes Salesforce traffic, the vSmart will not enforce the application-aware routing rules, allowing the LTE link to be used even when the MPLS link meets the SLA.

Answer

The LTE link has a lower cost metric than the MPLS link.

Answer

The app-route policy was applied on the vEdge instead of the vSmart.

Answer

The SLA requirements are not configured correctly in the policy.

Question 6

An enterprise is deploying Cisco SD-WAN with a hub-and-spoke topology. The hub site has a vSmart controller and a vEdge router. The branch sites have vEdge routers. The engineer wants to ensure that all inter-branch traffic goes through the hub for security inspection. The engineer configures a centralized control policy on the vSmart to set the 'hub' as the preferred path for all routes. After the policy is applied, the engineer notices that branch-to-branch traffic is still going directly, bypassing the hub. The vEdge routers show that the control policy is received. What is the most likely issue?

Accepted Answer

The hub site is not configured with a different site ID than the branches.. In Cisco SD-WAN, a centralized control policy that sets a preferred path for routes only influences route preference within the OMP routing table. However, for branch-to-branch traffic to be forced through the hub, the hub must have a different site ID than the branches. Without a distinct site ID, the vEdge routers treat the hub as part of the same site and will attempt direct branch-to-branch tunnels (using TLOC resolution) instead of routing through the hub. The control policy is received but cannot override the default behavior of same-site direct connectivity.

Answer

The control policy is not attached to the correct site list.

Answer

The engineer should have used a data policy instead of a control policy.

Answer

The OMP admin distance is set too high on the hub.

Question 7

A network engineer is configuring a Cisco SD-WAN solution for a retail chain with hundreds of stores. The engineer wants to use a centralized data policy to steer all YouTube traffic to a specific WAN link (broadband) to save MPLS bandwidth. The engineer creates a policy that matches YouTube traffic by destination IP and sets the preferred color to 'biz-internet'. After applying the policy, the engineer tests and finds that YouTube traffic is still using the MPLS link. The vEdge routers show that the policy is received and active. What is the most likely reason?

Accepted Answer

The policy does not include a match condition for the correct VPN or site list.. Option C is correct because a centralized data policy in Cisco SD-WAN must include match conditions for both the VPN (service-side VRF) and the site list to which the policy applies. Without specifying the correct VPN or site list, the policy may be received and active on the vEdge but will not match the traffic flows, causing them to fall through to the default routing behavior (e.g., MPLS). The policy matches destination IPs, but if the VPN or site scope is missing or incorrect, the vEdge will not apply the policy to the relevant traffic.

Answer

The vEdge routers have not rebooted after the policy was applied.

Answer

The data policy was applied on the vEdge instead of the vSmart.

Answer

YouTube traffic is encrypted and cannot be matched by destination IP.

Question 8

An enterprise is deploying Cisco SD-WAN with multiple vSmart controllers for redundancy. The engineer configures the vEdge routers to connect to two vSmart controllers. After deployment, the engineer notices that the vEdge routers are only connected to one vSmart, and the second vSmart is not being used. The vEdge routers show that the second vSmart is reachable. What is the most likely reason for this behavior?

Accepted Answer

The vEdge routers are designed to use only one vSmart at a time; the second is for redundancy.. In Cisco SD-WAN, vEdge routers are designed to establish a control connection to only one active vSmart controller at a time, even when multiple vSmart controllers are configured for redundancy. The second vSmart serves as a standby; the vEdge will fail over to it only if the primary vSmart becomes unreachable. Since the vEdge shows the second vSmart is reachable but not actively used, this confirms the expected behavior of active/standby redundancy rather than load balancing.

Answer

The vEdge routers can only connect to one vSmart at a time.

Answer

The vEdge routers need to be rebooted to establish a connection to the second vSmart.

Answer

The second vSmart has a different site ID than the first.

Question 9

A network engineer is configuring a Cisco SD-WAN solution for a multinational corporation. The engineer wants to use a centralized data policy to steer all traffic from the Finance department (VPN 10) to a specific WAN link (MPLS) for security reasons. The engineer creates a policy that matches traffic from VPN 10 and sets the preferred color to 'mpls'. After applying the policy, the engineer tests and finds that traffic from VPN 10 is still using the Internet link. The vEdge routers show that the policy is received and active. What is the most likely reason?

Accepted Answer

The policy is not attached to the correct site list or VPN list.. The most likely reason is that the centralized data policy was not attached to the correct site list or VPN list. In Cisco SD-WAN, a centralized data policy must be explicitly associated with the sites (via site list) and VPNs (via VPN list) where it should be applied. Even if the policy is received and active on the vEdge routers, without proper attachment to the VPN 10 site list, the policy will not enforce the preferred color 'mpls' for Finance traffic, leaving it to use the default Internet link.

Answer

The vEdge routers have not rebooted after the policy was applied.

Answer

The data policy was applied on the vEdge instead of the vSmart.

Answer

The preferred color is not configured correctly in the policy.

Question 10

A multinational enterprise is deploying Cisco SD-WAN to interconnect 500 branch sites with two data centers. The network architect must ensure that the control plane remains operational even if the vSmart controllers become unreachable. Which design approach should the architect choose to meet this requirement?

Accepted Answer

Configure local policies on WAN edge routers to allow forwarding based on the last known OMP routes and locally originated routes.. Option C is correct because Cisco SD-WAN WAN edge routers can continue forwarding traffic using locally originated routes and the last known OMP routes even when vSmart controllers are unreachable. This is achieved through local policies that allow the router to maintain forwarding decisions based on cached OMP information, ensuring the control plane remains operational without requiring vSmart reachability.

Answer

Deploy redundant vSmart controllers in active/standby mode and configure WAN edge routers to use both for OMP sessions.

Answer

Enable OMP graceful restart on all WAN edge routers so that routes are preserved for a configurable period after vSmart loss.

Answer

Use static routes on the WAN edge routers as a backup for all OMP-learned routes.

Question 11

An architect is designing an SD-Access fabric for a large campus network. The design must support wireless clients that roam across different access switches without requiring a centralized wireless LAN controller. Which fabric component and protocol combination should the architect use to enable this mobility?

Accepted Answer

Fabric edge switches with VXLAN and LISP; APs in fabric mode (SD-Access enabled).. Option B is correct because SD-Access fabric uses fabric edge switches with VXLAN (data plane) and LISP (control plane) to create a distributed overlay that supports seamless wireless client roaming. APs in fabric mode (SD-Access enabled) integrate directly with the fabric, allowing the fabric edge to handle mobility without a centralized WLC, as the client's context is maintained across the VXLAN overlay.

Answer

Fabric edge switches with VXLAN and LISP; APs in local mode with a centralized WLC.

Answer

Fabric border nodes with VXLAN and LISP; APs in flexconnect mode with a local switch.

Answer

Fabric control plane nodes with VXLAN and LISP; APs in monitor mode.

Question 12

A service provider is deploying NFV to offer managed SD-WAN services to enterprise customers. The architect must place virtual network functions (VNFs) such as vEdge routers and firewalls in the provider's data center. Which VNF placement model allows the provider to chain these functions efficiently and scale per customer?

Accepted Answer

Use a centralized service chain with a service graph that defines the order of VNFs, and deploy VNFs on separate hosts for redundancy.. Option B is correct because a centralized service chain with a service graph allows the provider to define the ordered sequence of VNFs (e.g., vEdge router then firewall) and deploy them on separate hosts for redundancy. This model aligns with NFV MANO (Management and Orchestration) principles, enabling efficient scaling per customer by instantiating VNFs as needed while maintaining the service chain across hypervisors.

Answer

Place all VNFs for a customer on a single hypervisor host and use internal virtual switches to chain them.

Answer

Deploy each VNF as a separate virtual machine on a dedicated physical server to maximize performance.

Answer

Use a single VNF that combines routing and firewall functions to avoid chaining complexity.

Question 13

A campus network architect is redesigning the LAN to support high availability and east-west traffic growth. The current design uses a traditional three-tier hierarchy with a collapsed core. The architect must choose a new design that provides predictable latency, simple scalability, and efficient use of uplinks. Which design should the architect select?

Accepted Answer

Leaf-spine design with all leaf switches connected to all spine switches.. The leaf-spine design (option B) provides predictable latency because every leaf switch is exactly one hop away from any other leaf switch via the spine, regardless of traffic path. This design also scales simply by adding more leaf or spine switches without reconfiguring existing connections, and it uses uplinks efficiently through equal-cost multipath (ECMP) load balancing, making it ideal for east-west traffic growth in a modern data center or campus LAN.

Answer

Collapsed core design with redundant core switches and distribution layers.

Answer

Mesh design where every switch connects to every other switch.

Answer

Traditional three-tier design with access, distribution, and core layers.

Question 14

An enterprise is deploying a virtualized network function (VNF) for a next-generation firewall on a KVM-based hypervisor. The architect must ensure that the VNF can handle high throughput without CPU bottlenecks. Which hypervisor configuration technique should the architect use to dedicate physical CPU cores to the VNF?

Accepted Answer

Configure NUMA pinning and CPU pinning to dedicate physical cores to the VNF's virtual CPUs.. Option B is correct because CPU pinning (also called CPU affinity) binds specific virtual CPUs (vCPUs) of the VNF to dedicated physical CPU cores, eliminating context-switching overhead and ensuring deterministic performance. NUMA pinning further aligns vCPUs and memory with the same Non-Uniform Memory Access node, reducing latency. This configuration is critical for VNFs like next-generation firewalls that require high throughput and low jitter.

Answer

Enable CPU overcommitment to allow the VNF to use any available CPU cycles.

Answer

Use VMware vSphere instead of KVM for better VNF performance.

Answer

Increase the number of virtual CPUs assigned to the VNF to improve throughput.

Question 15

A network architect is designing the QoS architecture for a Cisco SD-WAN deployment that carries voice, video, and data traffic across MPLS and Internet transports. The design must use a consistent DiffServ marking strategy across all transports and ensure that voice traffic is prioritized over video. Which QoS policy type and marking approach should the architect use?

Accepted Answer

Use a centralized QoS policy that marks traffic with DSCP and applies per-queue shaping on the WAN edge.. Option B is correct because Cisco SD-WAN uses centralized QoS policies applied via vSmart to ensure consistent DiffServ marking (DSCP) across all transports (MPLS and Internet). Per-queue shaping on the WAN edge router allows voice traffic to be prioritized over video by assigning voice to a higher-priority queue (e.g., queue 4 with DSCP EF) and video to a lower queue (e.g., queue 3 with DSCP AF41), ensuring voice is always serviced first.

Answer

Use localized QoS policies on each WAN edge router with CoS markings based on the transport type.

Answer

Use MPLS EXP markings for MPLS transport and IP Precedence for Internet transport.

Answer

Use NBAR2 to automatically classify traffic and apply markings based on application signatures.

Question 16

An enterprise is deploying Cisco SD-WAN with vManage, vSmart, vBond, and vEdge routers. The architect must design the control plane to securely onboard new vEdge routers and establish DTLS/TLS tunnels. Which component is responsible for the initial authentication and coordination of control plane connections?

Accepted Answer

vBond. In Cisco SD-WAN, vBond is the orchestrator responsible for the initial authentication and coordination of control plane connections. When a new vEdge router attempts to join the fabric, it first contacts vBond, which authenticates the device using its serial number and certificate, then provides the IP addresses of the vSmart controllers and vManage. This establishes the DTLS/TLS tunnels for the control plane.

Answer

vManage

Answer

vSmart

Answer

vEdge

Question 17

A network architect is designing a Cisco SD-Access fabric for a university campus that requires segmentation between student, faculty, and guest traffic. The design must use Cisco TrustSec for scalable security group tags (SGTs) and integrate with Cisco ISE for policy enforcement. Which fabric component should the architect use to enforce SGT-based policies at the access layer?

Accepted Answer

Fabric edge node. The fabric edge node is the correct component because it is the access-layer switch in Cisco SD-Access that performs SGT-based enforcement. It receives SGT-to-SGT policy from Cisco ISE via the control plane node and applies the corresponding security ACLs (SGACLs) at the port level, ensuring segmentation between student, faculty, and guest traffic at the point of entry.

Answer

Fabric border node

Answer

Fabric control plane node

Answer

Wireless LAN controller

Question 18

A company is deploying a virtualized network function (VNF) for a Cisco CSR1000v router on a VMware vSphere hypervisor. The architect must choose the hypervisor type to ensure the best performance for the VNF. Which hypervisor type is VMware vSphere classified as, and why is it suitable for VNF deployment?

Accepted Answer

Type 1 hypervisor; it runs directly on the hardware, offering near-native performance for VNFs.. VMware vSphere is a Type 1 (bare-metal) hypervisor because it installs directly onto the physical server hardware without requiring a host operating system. This architecture eliminates OS overhead, allowing the Cisco CSR1000v VNF to achieve near-native performance for packet processing and routing functions, which is critical for meeting throughput and latency requirements in SD-WAN deployments.

Answer

Type 2 hypervisor; it runs on top of an operating system, providing flexibility for VNF management.

Answer

Type 1 hypervisor; it requires a host OS for management, adding overhead.

Answer

Type 2 hypervisor; it is embedded in the hardware firmware.

Question 19

Consider the following SD-WAN configuration snippet on a Cisco IOS-XE router:

interface GigabitEthernet0/0/1
 ip address 10.1.1.1 255.255.255.0
 tunnel-interface
 encapsulation ipsec
 color biz-internet
 no allow-service bgp
 allow-service dhcp
 allow-service dns
 allow-service icmp
!

What is the effect of this configuration?

Accepted Answer

The interface is configured as an SD-WAN tunnel interface with color biz-internet, allowing DHCP, DNS, and ICMP traffic but blocking BGP.. The configuration applies to a GigabitEthernet interface that is placed into SD-WAN tunnel mode using the 'tunnel-interface' command. The 'color biz-internet' assigns the transport color, and the 'allow-service' and 'no allow-service' commands explicitly control which control-plane services are permitted over the tunnel. DHCP, DNS, and ICMP are allowed, while BGP is explicitly denied, making option A correct.

Answer

The interface is configured as a standard WAN interface with IPsec encryption, allowing all services including BGP.

Answer

The configuration enables the interface as a loopback tunnel for OMP traffic only, blocking all other services.

Answer

The interface is configured for SD-WAN with color biz-internet, but the 'no allow-service bgp' command is invalid on a tunnel interface.

Question 20

Given the following SD-WAN configuration on a Cisco IOS-XE router:

router ospf 1
 redistribute bgp 65000 subnets
 network 192.168.1.0 0.0.0.255 area 0
!
interface GigabitEthernet0/0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
!

Which statement is true?

Accepted Answer

The OSPF network type is point-to-point, so the hello interval defaults to 10 seconds on this interface.. Option A is correct because on a Cisco IOS-XE router, when the OSPF network type is set to point-to-point, the default hello interval is 10 seconds (not 30 seconds as on broadcast networks). The dead interval defaults to 40 seconds (four times the hello interval), not 120 seconds. This configuration is valid and does not require a manually configured router-id, as OSPF can dynamically select one. The redistribution of BGP into OSPF only injects routes that are in the BGP table; it does not automatically include all SD-WAN overlay routes unless they are present in BGP.

Answer

The OSPF network type is point-to-point, so the dead interval defaults to 120 seconds.

Answer

The redistribution of BGP into OSPF will cause OSPF to advertise all BGP routes, including those learned via SD-WAN overlay.

Answer

The configuration is incomplete because OSPF requires a router-id to be manually configured.