Question 245 of 1,840
hardMultiple ChoiceObjective-mapped
Cisco SD-WAN Centralized Data Policy Troubleshooting
A large enterprise uses Cisco SD-WAN with multiple transport clouds (MPLS and Internet). The network team wants to ensure that voice traffic between two branch offices always uses the MPLS link, even if the Internet link has lower latency. The engineer creates a centralized data policy on the vSmart to match voice traffic based on DSCP EF and sets the preferred color to 'mpls'. After applying the policy, the engineer tests and finds that voice traffic is still using the Internet link. The vEdge routers show that the policy is received and active. What is the most likely reason for this failure?
Quick Answer
The answer is that the centralized data policy lacks a match condition for the correct VPN or site list. This is the most likely reason for the failure because a Cisco SD-WAN centralized data policy on the vSmart must define not only the traffic match (like DSCP EF for voice) but also the scope of enforcement through a site list or VPN list. Without this scope, the vEdge routers, even though they receive and activate the policy, have no instruction to apply the preferred color 'mpls' specifically to the branch-to-branch traffic, so they fall back to default routing, which may choose the lower-latency Internet link. On the ENCOR 350-401 exam, this tests your understanding of how centralized data policies are structured and applied, with a common trap being that engineers focus only on the traffic match and forget the site or VPN context. Remember the mnemonic "Traffic plus Scope equals Policy"—without both, the policy is just a template with no teeth.
⚠ Common exam trap
Cisco often tests the misconception that a centralized data policy with only traffic match conditions (like DSCP) will automatically apply to all traffic, when in reality the policy must also include a site list or VPN list to define the scope of enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not include a match condition for the correct VPN or site list.
A centralized data policy on the vSmart must include match conditions for both the traffic (e.g., DSCP EF) and the scope of the policy (e.g., VPN list or site list). Without a site list or VPN list match, the policy may not apply to the specific branch-to-branch traffic, causing the vEdge to fall back to the default routing behavior (e.g., using the Internet link if it has lower latency). The vSmart distributes the policy to vEdges, but the vEdge only enforces it for matched traffic within the specified sites or VPNs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The vEdge routers have not rebooted after the policy was applied.
Why it's wrong here
Incorrect because policy changes take effect immediately without reboot.
- ✗
The data policy was applied on the vEdge instead of the vSmart.
Why it's wrong here
Incorrect because the engineer stated the policy was applied on the vSmart.
- ✗
The DSCP EF marking is not supported in SD-WAN data policies.
Why it's wrong here
Incorrect because DSCP EF is fully supported.
- ✓
The policy does not include a match condition for the correct VPN or site list.
Why this is correct
Correct because the policy must be associated with the specific VPN and site list to apply to the traffic.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is configuring a Cisco SD-WAN solution for a multinational corporation. The engineer wants to use a centralized data policy to steer all traffic from the Finance department (VPN 10) to a specific WAN link (MPLS) for security reasons. The engineer creates a policy that matches traffic from VPN 10 and sets the preferred color to 'mpls'. After applying the policy, the engineer tests and finds that traffic from VPN 10 is still using the Internet link. The vEdge routers show that the policy is received and active. What is the most likely reason?
easy- A.The vEdge routers have not rebooted after the policy was applied.
- ✓ B.The policy is not attached to the correct site list or VPN list.
- C.The data policy was applied on the vEdge instead of the vSmart.
- D.The preferred color is not configured correctly in the policy.
Why B: The most likely reason is that the centralized data policy was not attached to the correct site list or VPN list. In Cisco SD-WAN, a centralized data policy must be explicitly associated with the sites (via site list) and VPNs (via VPN list) where it should be applied. Even if the policy is received and active on the vEdge routers, without proper attachment to the VPN 10 site list, the policy will not enforce the preferred color 'mpls' for Finance traffic, leaving it to use the default Internet link.
Last reviewed: Jun 24, 2026
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.