mediumMultiple ChoiceObjective-mapped
CCNP Practice Question: Consider the following SD-WAN device…
Consider the following SD-WAN device configuration on a Cisco IOS-XE router:
sdwan
interface GigabitEthernet0/0/1
tunnel-interface
encapsulation ipsec
color public-internet allow-service all !
interface GigabitEthernet0/0/2
tunnel-interface
encapsulation ipsec
color 3g allow-service all !
Which statement about this configuration is true?
⚠ Common exam trap
Cisco often tests the misconception that `color` values are limited to a small set or that duplicate encapsulation causes a conflict, when in fact `3g` is a valid color and multiple IPsec tunnels are expected for multi-homed SD-WAN designs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The router will establish two separate SD-WAN tunnels, one for each color, and load balance traffic across them.
In Cisco SD-WAN, each WAN interface configured under the `sdwan` configuration with a unique `color` creates a separate SD-WAN transport tunnel (TLOC). The router will establish two distinct IPsec tunnels—one for `public-internet` and one for `3g`—and can load balance traffic across them using ECMP or policy-based steering. This is the standard behavior for multi-homed SD-WAN edge routers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The router will establish two separate SD-WAN tunnels, one for each color, and load balance traffic across them.
Why this is correct
Each tunnel-interface with a different color creates a separate transport tunnel. SD-WAN can use multiple transports for load balancing and redundancy.
- ✗
The router will use only the first tunnel interface (GigabitEthernet0/0/1) because the second interface has an invalid color name.
Why it's wrong here
The color '3g' is a valid SD-WAN color (for cellular/3G transport). Both interfaces are valid.
- ✗
The 'allow-service all' command is invalid on a tunnel-interface; only specific services can be allowed.
Why it's wrong here
The 'allow-service all' command is valid and permits all services through the tunnel.
- ✗
The configuration will cause a conflict because both interfaces use the same encapsulation (ipsec).
Why it's wrong here
Multiple interfaces can use the same encapsulation (IPsec) without conflict; they are separate tunnels.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.