hardMultiple Select
CCNP Practice Question: Which three statements about SD-WAN overlay…
Which three statements about SD-WAN overlay tunnels and transport are true? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Control plane communication between vSmart and edge devices uses DTLS or TLS encryption.
Option A is correct because in Cisco SD-WAN the control plane connections between vSmart controllers and edge devices (vEdge/cEdge) are secured with DTLS or TLS, protecting OMP and other control traffic. Option B is correct because the data plane overlay tunnels between edge devices are IPsec tunnels whose keys are negotiated using IKEv2, providing encryption and authentication for payload traffic. Option C is correct because a TLOC is uniquely identified by the tuple of system IP, color, and encapsulation type (for example, system-ip, color biz-internet, encapsulation ipsec), which tells OMP how to reach the transport. Option D is incorrect because SD-WAN supports many transport colors beyond MPLS and Internet, including LTE/5G, and LTE is explicitly supported. Option E is incorrect because OMP distributes routing and TLOC information but does not itself establish IPsec tunnels; tunnel establishment is handled by the data plane using IKE/IPsec based on TLOC and policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Control plane communication between vSmart and edge devices uses DTLS or TLS encryption.
Why this is correct
vSmart controllers establish control connections with edge devices over DTLS, or TLS where configured, protecting OMP route and policy exchanges. This satisfies the control plane security requirement distinguishing controller-to-edge signalling from the separate data plane tunnels.
- ✓
Data plane tunnels between edge devices are encrypted using IPsec with IKEv2 key exchange.
Why this is correct
Edge-to-edge data plane tunnels use IPsec, with IKEv2 performing key exchange and establishing security associations between TLOCs. This satisfies the overlay encryption requirement, distinguishing data plane protection from the DTLS or TLS used on the control plane.
- ✓
A TLOC (Transport Location) is defined by the combination of system IP, color, and encapsulation type.
Why this is correct
A TLOC uniquely identifies a WAN transport interface by combining system IP, colour, and encapsulation type, such as IPsec or GRE. This satisfies the requirement that OMP advertise reachable transport locations, since each attribute must match for two TLOCs to be identical.
- ✗
SD-WAN edge devices can only use MPLS or Internet as transport; LTE is not supported.
Why it's wrong here
SD-WAN edge devices support LTE/5G cellular transports alongside MPLS and Internet, so restricting transport to MPLS or Internet is false. It is tempting because MPLS and Internet are the two most commonly deployed underlay transports in enterprise SD-WAN designs, making the claim sound accurate.
- ✗
OMP is responsible for dynamically establishing IPsec tunnels between edge devices based on policy.
Why it's wrong here
OMP advertises routes, TLOC attributes and policies, but IPsec tunnel establishment is handled by the data-plane/control-plane negotiation itself, not OMP. It is tempting because OMP does distribute the policy and TLOC information that governs which tunnels form, so it appears to drive tunnel creation.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.