350-401 SD-WAN Architecture — Timed 10 Questions

Question 1

A network engineer is deploying a Cisco SD-WAN solution for a global enterprise with multiple regional hubs. The engineer wants to ensure that traffic from branch offices to the internet is always forwarded directly from the branch, even if the branch has a primary MPLS link and a backup broadband link. The engineer configures the vSmart policy to direct internet-bound traffic to use the local exit at the branch. However, after deployment, the engineer notices that some internet traffic is still being sent to the regional hub before reaching the internet. What is the most likely cause of this behavior?

Accepted Answer

The engineer configured the data policy under VPN 0 instead of the service VPN (e.g., VPN 10).. Option A is correct because in Cisco SD-WAN, data policies that control traffic forwarding (such as forcing local internet exit) must be applied to the service VPN (e.g., VPN 10) where the branch’s LAN and internet-bound traffic resides. Configuring the policy under VPN 0 (the transport VPN) only affects overlay tunnel traffic and control-plane packets, not user traffic. Since the engineer applied the policy to VPN 0, the policy did not match internet-bound traffic in the service VPN, causing it to follow the default route toward the regional hub.

Answer

The branch router does not have a default route in its routing table for the service VPN.

Answer

The engineer used a localized data policy instead of a centralized data policy.

Answer

The OMP route redistribution is not enabled on the branch router.

Question 2

An enterprise is migrating from a traditional MPLS WAN to Cisco SD-WAN. The network team has deployed vEdge routers at all branch offices and a vSmart controller in the data center. The engineer configures a centralized control policy to influence path selection based on cost and latency. After the policy is activated, the engineer notices that some branches are not receiving the updated policy and are still using the default best-path selection. The vSmart is reachable from all branches, and the vEdge routers show that they are connected to the vSmart. What is the most likely reason for this issue?

Accepted Answer

The control policy is not attached to the appropriate site list or VPN list.. In Cisco SD-WAN, centralized control policies must be explicitly attached to a site list or VPN list to define which devices or traffic the policy applies to. If the policy is not attached to the appropriate list, the vSmart controller will not push the policy to the targeted vEdge routers, causing them to continue using the default OMP best-path selection (based on administrative distance and cost). The fact that the vEdge routers are connected to the vSmart confirms the issue is with policy application, not reachability.

Answer

The vEdge routers have not been rebooted after the policy change.

Answer

The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.

Answer

The BFD sessions between vEdge and vSmart are flapping.

Question 3

A network engineer is configuring a Cisco SD-WAN fabric with vManage, vSmart, and vBond controllers. The engineer wants to ensure that all branch routers automatically discover the vSmart and vBond controllers without manual configuration on each branch. The engineer has configured the vBond with a public IP address and enabled NAT traversal. However, branch routers are failing to establish control connections. The engineer verifies that the branch routers have the correct organization name and that the vBond is reachable from the branches. What is the most likely missing configuration?

Accepted Answer

The vBond IP address is not configured on the branch routers.. In Cisco SD-WAN, branch routers use a two-phase discovery process: they first connect to the vBond controller to authenticate and receive the list of vSmart and vManage controllers. Since the engineer has already configured the vBond with a public IP and enabled NAT traversal, and the branch routers have the correct organization name and can reach the vBond, the missing piece is that the vBond IP address must be explicitly configured on each branch router (via the 'system vbond' CLI command or the equivalent in the device template). Without this, the branch routers have no initial target to contact for the bootstrap discovery process, so they cannot automatically learn the vSmart and vManage addresses.

Answer

The vManage IP address is not configured on the branch routers.

Answer

The vSmart IP address is not configured on the branch routers.

Answer

The DTLS port 12346 is not open on the branch routers' firewall.

Question 4

A large enterprise uses Cisco SD-WAN with multiple transport clouds (MPLS and Internet). The network team wants to ensure that voice traffic between two branch offices always uses the MPLS link, even if the Internet link has lower latency. The engineer creates a centralized data policy on the vSmart to match voice traffic based on DSCP EF and sets the preferred color to 'mpls'. After applying the policy, the engineer tests and finds that voice traffic is still using the Internet link. The vEdge routers show that the policy is received and active. What is the most likely reason for this failure?

Accepted Answer

The policy does not include a match condition for the correct VPN or site list.. Option D is correct because a centralized data policy on the vSmart must include match conditions for both the traffic (e.g., DSCP EF) and the scope of the policy (e.g., VPN list or site list). Without a site list or VPN list match, the policy may not apply to the specific branch-to-branch traffic, causing the vEdge to fall back to the default routing behavior (e.g., using the Internet link if it has lower latency). The vSmart distributes the policy to vEdges, but the vEdge only enforces it for matched traffic within the specified sites or VPNs.

Answer

The vEdge routers have not rebooted after the policy was applied.

Answer

The data policy was applied on the vEdge instead of the vSmart.

Answer

The DSCP EF marking is not supported in SD-WAN data policies.

Question 5

A network engineer is troubleshooting a Cisco SD-WAN deployment where a branch office has two WAN links: a primary MPLS link and a backup LTE link. The engineer wants to configure application-aware routing so that critical applications (e.g., Salesforce) always use the MPLS link as long as its loss is below 2% and latency below 150 ms. The engineer configures an app-route policy on the vSmart with the appropriate SLA requirements. After deployment, the engineer notices that Salesforce traffic is still using the LTE link even when the MPLS link meets the SLA. What is the most likely cause?

Accepted Answer

The app-route policy is not attached to the correct site list or VPN list.. Option A is correct because the app-route policy must be attached to the correct site list and VPN list to be applied to the traffic. If the policy is not properly associated with the site list containing the branch office or the VPN list that includes Salesforce traffic, the vSmart will not enforce the application-aware routing rules, allowing the LTE link to be used even when the MPLS link meets the SLA.

Answer

The LTE link has a lower cost metric than the MPLS link.

Answer

The app-route policy was applied on the vEdge instead of the vSmart.

Answer

The SLA requirements are not configured correctly in the policy.

Question 6

An enterprise is deploying Cisco SD-WAN with a hub-and-spoke topology. The hub site has a vSmart controller and a vEdge router. The branch sites have vEdge routers. The engineer wants to ensure that all inter-branch traffic goes through the hub for security inspection. The engineer configures a centralized control policy on the vSmart to set the 'hub' as the preferred path for all routes. After the policy is applied, the engineer notices that branch-to-branch traffic is still going directly, bypassing the hub. The vEdge routers show that the control policy is received. What is the most likely issue?

Accepted Answer

The hub site is not configured with a different site ID than the branches.. In Cisco SD-WAN, a centralized control policy that sets a preferred path for routes only influences route preference within the OMP routing table. However, for branch-to-branch traffic to be forced through the hub, the hub must have a different site ID than the branches. Without a distinct site ID, the vEdge routers treat the hub as part of the same site and will attempt direct branch-to-branch tunnels (using TLOC resolution) instead of routing through the hub. The control policy is received but cannot override the default behavior of same-site direct connectivity.

Answer

The control policy is not attached to the correct site list.

Answer

The engineer should have used a data policy instead of a control policy.

Answer

The OMP admin distance is set too high on the hub.

Question 7

A network engineer is configuring a Cisco SD-WAN solution for a retail chain with hundreds of stores. The engineer wants to use a centralized data policy to steer all YouTube traffic to a specific WAN link (broadband) to save MPLS bandwidth. The engineer creates a policy that matches YouTube traffic by destination IP and sets the preferred color to 'biz-internet'. After applying the policy, the engineer tests and finds that YouTube traffic is still using the MPLS link. The vEdge routers show that the policy is received and active. What is the most likely reason?

Accepted Answer

The policy does not include a match condition for the correct VPN or site list.. Option C is correct because a centralized data policy in Cisco SD-WAN must include match conditions for both the VPN (service-side VRF) and the site list to which the policy applies. Without specifying the correct VPN or site list, the policy may be received and active on the vEdge but will not match the traffic flows, causing them to fall through to the default routing behavior (e.g., MPLS). The policy matches destination IPs, but if the VPN or site scope is missing or incorrect, the vEdge will not apply the policy to the relevant traffic.

Answer

The vEdge routers have not rebooted after the policy was applied.

Answer

The data policy was applied on the vEdge instead of the vSmart.

Answer

YouTube traffic is encrypted and cannot be matched by destination IP.

Question 8

An enterprise is deploying Cisco SD-WAN with multiple vSmart controllers for redundancy. The engineer configures the vEdge routers to connect to two vSmart controllers. After deployment, the engineer notices that the vEdge routers are only connected to one vSmart, and the second vSmart is not being used. The vEdge routers show that the second vSmart is reachable. What is the most likely reason for this behavior?

Accepted Answer

The vEdge routers are designed to use only one vSmart at a time; the second is for redundancy.. In Cisco SD-WAN, vEdge routers are designed to establish a control connection to only one active vSmart controller at a time, even when multiple vSmart controllers are configured for redundancy. The second vSmart serves as a standby; the vEdge will fail over to it only if the primary vSmart becomes unreachable. Since the vEdge shows the second vSmart is reachable but not actively used, this confirms the expected behavior of active/standby redundancy rather than load balancing.

Answer

The vEdge routers can only connect to one vSmart at a time.

Answer

The vEdge routers need to be rebooted to establish a connection to the second vSmart.

Answer

The second vSmart has a different site ID than the first.

Question 9

A network engineer is configuring a Cisco SD-WAN solution for a multinational corporation. The engineer wants to use a centralized data policy to steer all traffic from the Finance department (VPN 10) to a specific WAN link (MPLS) for security reasons. The engineer creates a policy that matches traffic from VPN 10 and sets the preferred color to 'mpls'. After applying the policy, the engineer tests and finds that traffic from VPN 10 is still using the Internet link. The vEdge routers show that the policy is received and active. What is the most likely reason?

Accepted Answer

The policy is not attached to the correct site list or VPN list.. The most likely reason is that the centralized data policy was not attached to the correct site list or VPN list. In Cisco SD-WAN, a centralized data policy must be explicitly associated with the sites (via site list) and VPNs (via VPN list) where it should be applied. Even if the policy is received and active on the vEdge routers, without proper attachment to the VPN 10 site list, the policy will not enforce the preferred color 'mpls' for Finance traffic, leaving it to use the default Internet link.

Answer

The vEdge routers have not rebooted after the policy was applied.

Answer

The data policy was applied on the vEdge instead of the vSmart.

Answer

The preferred color is not configured correctly in the policy.

Question 10

A multinational enterprise is deploying Cisco SD-WAN to interconnect 500 branch sites with two data centers. The network architect must ensure that the control plane remains operational even if the vSmart controllers become unreachable. Which design approach should the architect choose to meet this requirement?

Accepted Answer

Configure local policies on WAN edge routers to allow forwarding based on the last known OMP routes and locally originated routes.. Option C is correct because Cisco SD-WAN WAN edge routers can continue forwarding traffic using locally originated routes and the last known OMP routes even when vSmart controllers are unreachable. This is achieved through local policies that allow the router to maintain forwarding decisions based on cached OMP information, ensuring the control plane remains operational without requiring vSmart reachability.

Answer

Deploy redundant vSmart controllers in active/standby mode and configure WAN edge routers to use both for OMP sessions.

Answer

Enable OMP graceful restart on all WAN edge routers so that routes are preserved for a configurable period after vSmart loss.

Answer

Use static routes on the WAN edge routers as a backup for all OMP-learned routes.