CCNP Architecture Practice Question
A network architect is designing a new branch office that must run Cisco SD-WAN with a single WAN transport and requires all control-plane and data-plane traffic to be encrypted by default using DTLS/TLS tunnels managed by the controller. Which SD-WAN component is responsible for establishing the secure control connections and distributing route and policy information to the branch edge devices?
⚠ Common exam trap
The trap here is assuming that vManage, because it is the centralized GUI, also acts as the control plane that distributes routes and policy to edge devices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vSmart controller
In Cisco SD-WAN, the control plane is handled by the vSmart controller, which peers with each edge device over DTLS/TLS and uses OMP to advertise TLOCs, routes, and centralized policy. The branch edge in this design needs those control connections, so the vSmart controller is the component that satisfies the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
vAnalytics engine
Why it's wrong here
vAnalytics provides reporting, forecasting, and application-aware visibility, not control-plane peering or route distribution. It consumes data exported from the overlay but never establishes DTLS control connections with branch edges. It therefore cannot satisfy the requirement to distribute route and policy information in this single-transport SD-WAN design.
- ✗
vManage NMS
Why it's wrong here
vManage is the management plane used for configuration templates, monitoring, and provisioning. Although it is reached over the control plane, it does not establish the OMP peering that distributes routes and policy. The branch edge needs vSmart for that function, so vManage is not the correct control-plane component here.
- ✓
vSmart controller
Why this is correct
The vSmart controller is the SD-WAN control-plane component that builds DTLS/TLS control connections with each vEdge/cEdge and distributes OMP routes, TLOCs, and centralized policy. In this branch scenario, the edge device registers to vSmart, which pushes the routing and policy information needed for the single-transport overlay, making it the component that owns control-plane distribution.
- ✗
vBond orchestrator
Why it's wrong here
The vBond orchestrator performs initial authentication and NAT traversal, telling the edge which vSmart and vManage to contact, but it does not carry route or policy information. Once the edge is onboarded, vBond steps out of the data path, so it cannot distribute OMP routes or centralized policy to the branch device in this scenario.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.