CCNP Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  VPN segments in vManage

  Why this is correct

  VPN segments in vManage allow the creation of separate virtual private networks (VPNs) within the SD-WAN overlay. Each segment has its own routing table and can be assigned to different VRFs on the WAN Edge devices. This provides isolation between guest, employee, and IoT traffic. Policies can be applied per VPN segment, enabling granular control. This is a core mechanism for segmentation in Cisco SD-WAN.

• ✗

  Application-aware routing policies

  Why it's wrong here

  Application-aware routing policies control path selection based on application performance, but they do not provide traffic segmentation. They are used to steer traffic based on SLA, not to isolate segments. While they can be applied per VPN, they are not the component that creates the segmentation itself. The question asks for components used to achieve segmentation, not policy enforcement.

• ✓

  VRF instances on WAN Edge devices

  Why this is correct

  VRF instances on WAN Edge devices are used to instantiate VPN segments. Each VPN segment maps to a VRF, which maintains a separate routing table and forwarding instance. This ensures that traffic from different segments is isolated. The VRF is the actual implementation of the segmentation on the device, working in conjunction with vManage to distribute the configuration. This is a correct component for achieving segmentation.

• ✗

  IPsec tunnels between branches

  Why it's wrong here

  IPsec tunnels provide secure transport between branches, but they do not inherently provide segmentation. All segments can share the same IPsec tunnels, with segmentation enforced via VPN segments and VRFs. IPsec ensures confidentiality and integrity, but without VPN segmentation, traffic from different segments would mix. Therefore, IPsec tunnels alone do not achieve the required isolation.

• ✗

  VLANs on the WAN Edge routers

  Why it's wrong here

  VLANs on WAN Edge routers are used for local LAN segmentation, but they do not provide end-to-end segmentation across the SD-WAN fabric. VLANs are Layer 2 constructs and are not carried across the overlay. While they can map to VPN segments, they alone do not achieve the required isolation and policy enforcement across all branches. They are a local mechanism, not a fabric-wide segmentation solution.