350-401 SD-WAN Architecture Practice Test 2 — 15 Questions

Question 1

An enterprise is deploying Cisco SD-WAN with vManage, vSmart, vBond, and vEdge routers. The architect must design the control plane to securely onboard new vEdge routers and establish DTLS/TLS tunnels. Which component is responsible for the initial authentication and coordination of control plane connections?

Accepted Answer

vBond. In Cisco SD-WAN, vBond is the orchestrator responsible for the initial authentication and coordination of control plane connections. When a new vEdge router attempts to join the fabric, it first contacts vBond, which authenticates the device using its serial number and certificate, then provides the IP addresses of the vSmart controllers and vManage. This establishes the DTLS/TLS tunnels for the control plane.

Answer

vManage

Answer

vSmart

Answer

vEdge

Question 2

A network architect is designing a Cisco SD-Access fabric for a university campus that requires segmentation between student, faculty, and guest traffic. The design must use Cisco TrustSec for scalable security group tags (SGTs) and integrate with Cisco ISE for policy enforcement. Which fabric component should the architect use to enforce SGT-based policies at the access layer?

Accepted Answer

Fabric edge node. The fabric edge node is the correct component because it is the access-layer switch in Cisco SD-Access that performs SGT-based enforcement. It receives SGT-to-SGT policy from Cisco ISE via the control plane node and applies the corresponding security ACLs (SGACLs) at the port level, ensuring segmentation between student, faculty, and guest traffic at the point of entry.

Answer

Fabric border node

Answer

Fabric control plane node

Answer

Wireless LAN controller

Question 3

A company is deploying a virtualized network function (VNF) for a Cisco CSR1000v router on a VMware vSphere hypervisor. The architect must choose the hypervisor type to ensure the best performance for the VNF. Which hypervisor type is VMware vSphere classified as, and why is it suitable for VNF deployment?

Accepted Answer

Type 1 hypervisor; it runs directly on the hardware, offering near-native performance for VNFs.. VMware vSphere is a Type 1 (bare-metal) hypervisor because it installs directly onto the physical server hardware without requiring a host operating system. This architecture eliminates OS overhead, allowing the Cisco CSR1000v VNF to achieve near-native performance for packet processing and routing functions, which is critical for meeting throughput and latency requirements in SD-WAN deployments.

Answer

Type 2 hypervisor; it runs on top of an operating system, providing flexibility for VNF management.

Answer

Type 1 hypervisor; it requires a host OS for management, adding overhead.

Answer

Type 2 hypervisor; it is embedded in the hardware firmware.

Question 4

Consider the following SD-WAN configuration snippet on a Cisco IOS-XE router:

interface GigabitEthernet0/0/1
 ip address 10.1.1.1 255.255.255.0
 tunnel-interface
 encapsulation ipsec
 color biz-internet
 no allow-service bgp
 allow-service dhcp
 allow-service dns
 allow-service icmp
!

What is the effect of this configuration?

Accepted Answer

The interface is configured as an SD-WAN tunnel interface with color biz-internet, allowing DHCP, DNS, and ICMP traffic but blocking BGP.. The configuration applies to a GigabitEthernet interface that is placed into SD-WAN tunnel mode using the 'tunnel-interface' command. The 'color biz-internet' assigns the transport color, and the 'allow-service' and 'no allow-service' commands explicitly control which control-plane services are permitted over the tunnel. DHCP, DNS, and ICMP are allowed, while BGP is explicitly denied, making option A correct.

Answer

The interface is configured as a standard WAN interface with IPsec encryption, allowing all services including BGP.

Answer

The configuration enables the interface as a loopback tunnel for OMP traffic only, blocking all other services.

Answer

The interface is configured for SD-WAN with color biz-internet, but the 'no allow-service bgp' command is invalid on a tunnel interface.

Question 5

Given the following SD-WAN configuration on a Cisco IOS-XE router:

router ospf 1
 redistribute bgp 65000 subnets
 network 192.168.1.0 0.0.0.255 area 0
!
interface GigabitEthernet0/0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
!

Which statement is true?

Accepted Answer

The OSPF network type is point-to-point, so the hello interval defaults to 10 seconds on this interface.. Option A is correct because on a Cisco IOS-XE router, when the OSPF network type is set to point-to-point, the default hello interval is 10 seconds (not 30 seconds as on broadcast networks). The dead interval defaults to 40 seconds (four times the hello interval), not 120 seconds. This configuration is valid and does not require a manually configured router-id, as OSPF can dynamically select one. The redistribution of BGP into OSPF only injects routes that are in the BGP table; it does not automatically include all SD-WAN overlay routes unless they are present in BGP.

Answer

The OSPF network type is point-to-point, so the dead interval defaults to 120 seconds.

Answer

The redistribution of BGP into OSPF will cause OSPF to advertise all BGP routes, including those learned via SD-WAN overlay.

Answer

The configuration is incomplete because OSPF requires a router-id to be manually configured.

Question 6

Examine the following SD-WAN policy configuration on a Cisco vSmart controller:

policy
 control-policy CONTROL_POLICY
 sequence 10
 match route
 prefix-list PL_10
 action accept
 set
 community 100:10
!
 prefix-list PL_10
 sequence 10
 match ip-address 10.0.0.0/24
!

What is the effect of this control policy?

Accepted Answer

The policy matches routes with prefix 10.0.0.0/24 and sets the community value 100:10 on those routes before advertising them via OMP.. This control policy matches OMP routes that have the prefix 10.0.0.0/24 (as defined by the prefix-list PL_10) and, upon a match, sets the community value 100:10 on those routes. The action 'accept' means the route is permitted and the 'set community' modifies the route's attributes before it is advertised via OMP to other vSmart or vEdge devices. This is a standard SD-WAN control policy operation for manipulating route attributes within the overlay.

Answer

The policy matches routes with prefix 10.0.0.0/24 and sets the community 100:10 on the local router's routing table.

Answer

The policy denies all routes except 10.0.0.0/24 and sets community 100:10.

Answer

The policy is invalid because prefix-list names cannot contain underscores.

Question 7

Consider the following SD-WAN device configuration on a Cisco IOS-XE router:

sdwan
 interface GigabitEthernet0/0/1
 tunnel-interface
 encapsulation ipsec
 color public-internet
 allow-service all
!
 interface GigabitEthernet0/0/2
 tunnel-interface
 encapsulation ipsec
 color 3g
 allow-service all
!

Which statement about this configuration is true?

Accepted Answer

The router will establish two separate SD-WAN tunnels, one for each color, and load balance traffic across them.. In Cisco SD-WAN, each WAN interface configured under the `sdwan` configuration with a unique `color` creates a separate SD-WAN transport tunnel (TLOC). The router will establish two distinct IPsec tunnels—one for `public-internet` and one for `3g`—and can load balance traffic across them using ECMP or policy-based steering. This is the standard behavior for multi-homed SD-WAN edge routers.

Answer

The router will use only the first tunnel interface (GigabitEthernet0/0/1) because the second interface has an invalid color name.

Answer

The 'allow-service all' command is invalid on a tunnel-interface; only specific services can be allowed.

Answer

The configuration will cause a conflict because both interfaces use the same encapsulation (ipsec).

Question 8

Given the following SD-WAN CLI output on a Cisco IOS-XE router:

show sdwan omp routes

10.1.1.0/24, received, admin-distance: 250
   via 10.0.0.1, interface GigabitEthernet0/0/1, color biz-internet, loss: 0, latency: 10
   via 10.0.0.2, interface GigabitEthernet0/0/2, color 3g, loss: 1, latency: 50

Which statement is true?

Accepted Answer

The route via 10.0.0.1 (biz-internet) is preferred because it has lower loss and latency.. Option A is correct because OMP (Overlay Management Protocol) in Cisco SD-WAN selects the best path based on the lowest path cost, which is calculated using metrics such as loss, latency, and jitter. In this output, the route via 10.0.0.1 (biz-internet) has loss 0 and latency 10, which is lower than the route via 10.0.0.2 (3g) with loss 1 and latency 50, making it the preferred path. The admin-distance of 250 is specific to OMP routes and does not affect this comparison.

Answer

The route via 10.0.0.2 (3g) is preferred because it has a higher latency, which indicates a more stable path.

Answer

Both routes are equally preferred because OMP uses ECMP by default.

Answer

The admin-distance of 250 indicates that these routes are learned via BGP.

Question 9

Examine the following SD-WAN configuration on a Cisco vEdge router:

vpn 0
 interface ge0/0
 ip address 10.0.0.1/24
 tunnel-interface
 encapsulation ipsec
 color public-internet
 allow-service all
!
 interface ge0/1
 ip address 10.0.0.2/24
 tunnel-interface
 encapsulation ipsec
 color 3g
 allow-service all
!

Which statement is correct?

Accepted Answer

Both interfaces are in VPN 0, which is the transport VPN, and they will establish tunnels with the vSmart controller.. VPN 0 is the transport VPN in Cisco SD-WAN, used exclusively for underlay network connectivity and control plane traffic. The two interfaces ge0/0 and ge0/1 are configured as tunnel interfaces with IPsec encapsulation and different colors (public-internet and 3g), which allows them to establish secure DTLS/TLS tunnels to the vSmart controller for orchestration and policy distribution. This is correct because transport VPN interfaces are designed to carry overlay control traffic, not customer data.

Answer

The interfaces are in VPN 0, which is the service VPN, and they will be used for customer traffic.

Answer

The configuration is invalid because tunnel interfaces cannot have IP addresses in the same VPN.

Answer

The 'allow-service all' command is not supported on vEdge routers.

Question 10

In Cisco SD-WAN, what is the default OMP hello interval (in seconds) between a vEdge router and a vSmart controller?

Accepted Answer

10 seconds. The default OMP hello interval between a vEdge router and a vSmart controller in Cisco SD-WAN is 10 seconds. OMP (Overlay Management Protocol) uses these periodic hello messages to maintain adjacency and detect failures, with a default dead interval of 60 seconds (6 times the hello interval).

Answer

30 seconds

Answer

60 seconds

Answer

5 seconds

Question 11

Which component in Cisco SD-WAN is responsible for orchestrating the overlay network, including authentication and NAT traversal?

Accepted Answer

vBond orchestrator. The vBond orchestrator is responsible for the initial authentication of all SD-WAN components (vSmart, vManage, vEdge/cEdge) into the overlay network. It also performs NAT traversal by discovering and distributing the public IP addresses and port numbers of vEdge routers behind NAT, enabling secure DTLS/TLS connections between them. Without vBond, new devices cannot securely join the fabric or establish control-plane connectivity.

Answer

vSmart controller

Answer

vManage NMS

Answer

vEdge router

Question 12

In Cisco SD-WAN, what is the maximum number of TLOCs that can be associated with a single OMP route?

Accepted Answer

8. In Cisco SD-WAN, a single OMP route can have up to 8 TLOCs (Transport Locations) associated with it. This limit is enforced by the OMP protocol to balance path diversity and control-plane scalability, ensuring that the vSmart controller does not advertise an excessive number of next-hop paths for a single prefix.

Answer

4

Answer

16

Answer

Unlimited

Question 13

Drag and drop the steps of SD-WAN edge device (vEdge/cEdge) bring-up sequence into the correct order, from first to last.

Accepted Answer

Obtain IP address via DHCP. The correct order follows the Cisco SD-WAN device bootstrapping process: first the device obtains an IP address via DHCP, then it discovers the vManage using DNS or a redirect server, establishes a DTLS/TLS control connection to vManage, downloads its configuration, and finally establishes OMP sessions with vSmart controllers.

Question 14

Drag and drop the steps of SD-WAN overlay routing protocol (OMP) route advertisement sequence into the correct order, from first to last.

Accepted Answer

Edge device learns local routes via connected/static/dynamic. In OMP, the sequence starts with the edge device learning routes locally (connected, static, or dynamic), then redistributing them into OMP and sending to vSmart. vSmart processes and installs routes in its RIB, then advertises the best routes to other edge devices. The receiving edge device installs the route in its forwarding table and optionally redistributes into its local routing protocol.

Question 15

Drag and drop the steps of Cisco SD-WAN control plane establishment sequence into the correct order, from first to last.

Accepted Answer

vBond orchestrates initial authentication and redirect. The control plane setup begins with vBond orchestrating initial authentication and directing devices to vManage and vSmart. Then each device establishes a DTLS/TLS connection to vManage for management. Next, devices establish DTLS/TLS connections to vSmart for control. After that, OMP peering is set up between edges and vSmart. Finally, BFD sessions are established between edge devices for data plane liveliness detection.