Sd Access Architecture practice questions

Drag and drop the steps of SD-WAN zero-touch provisioning (ZTP) flow into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2mediummatching

Drag and drop each SD-WAN policy type on the left to its matching application point on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Applied to data traffic for SLA-based path selection

Applied to enable NetFlow-like traffic monitoring

Applied to modify forwarding, NAT, or QoS on data packets

Applied to OMP routes and TLOCs for route manipulation

Applied to define which VPNs are provisioned on a device

Question 3mediummatching

Drag and drop each WAN transport type on the left to its matching SD-WAN characteristic on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Predictable latency and SLA, private Layer 3 VPN

Low cost, best-effort, public IP addressing

Wireless backup, variable throughput, cellular network

High latency, global coverage, limited bandwidth

High bandwidth, low latency, metro-area Layer 2 connectivity

Question 4mediummulti select

Which two statements about SD-WAN control plane components are true? (Choose two.)

Trap 1: The vManage controller is the primary control plane component that…

Incorrect because vManage is the management plane (NMS), not a control plane; OMP sessions are between vSmart and edge devices.

Trap 2: vEdge and cEdge routers are both control plane devices that…

Incorrect because vEdge and cEdge are data plane devices; they do run OMP but are not control plane components.

Trap 3: The OMP protocol runs between vManage and vSmart to exchange…

Incorrect because OMP runs between vSmart and edge devices (vEdge/cEdge), not between vManage and vSmart.

A
The vSmart controller is responsible for distributing OMP routes and policies to all edge devices in the SD-WAN fabric.
Correct because vSmart is the centralized control plane that uses OMP to advertise routes and apply policies.
B
The vBond orchestrator is responsible for authenticating and onboarding vEdge and cEdge routers into the SD-WAN overlay.
Correct because vBond provides NAT traversal and initial authentication, and directs devices to vManage and vSmart.
C
The vManage controller is the primary control plane component that establishes OMP sessions with all edge routers.
Why wrong: Incorrect because vManage is the management plane (NMS), not a control plane; OMP sessions are between vSmart and edge devices.
D
vEdge and cEdge routers are both control plane devices that participate in OMP route exchange.
Why wrong: Incorrect because vEdge and cEdge are data plane devices; they do run OMP but are not control plane components.
E
The OMP protocol runs between vManage and vSmart to exchange routing information and policy updates.
Why wrong: Incorrect because OMP runs between vSmart and edge devices (vEdge/cEdge), not between vManage and vSmart.

Question 5mediumdrag order

Read the full MPLS explanation →

Drag and drop the steps of the SD-Access fabric deployment sequence into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 6mediummultiple choice

An enterprise is migrating from a traditional MPLS WAN to Cisco SD-WAN. The network team has deployed vEdge routers at all branch offices and a vSmart controller in the data center. The engineer configures a centralized control policy to influence path selection based on cost and latency. After the policy is activated, the engineer notices that some branches are not receiving the updated policy and are still using the default best-path selection. The vSmart is reachable from all branches, and the vEdge routers show that they are connected to the vSmart. What is the most likely reason for this issue?

Trap 1: The vEdge routers have not been rebooted after the policy change.

Incorrect because policy changes take effect immediately without reboot.

Trap 2: The OMP graceful restart timer has expired, causing the vEdge to…

Incorrect because OMP graceful restart affects route convergence, not policy application.

Trap 3: The BFD sessions between vEdge and vSmart are flapping.

Incorrect because BFD is for data plane failure detection, not for policy distribution.

A
The vEdge routers have not been rebooted after the policy change.
Why wrong: Incorrect because policy changes take effect immediately without reboot.
B
The control policy is not attached to the appropriate site list or VPN list.
Correct because a control policy must be associated with a list to be applied; otherwise, it is not enforced.
C
The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.
Why wrong: Incorrect because OMP graceful restart affects route convergence, not policy application.
D
The BFD sessions between vEdge and vSmart are flapping.
Why wrong: Incorrect because BFD is for data plane failure detection, not for policy distribution.

Review the full OSPF breakdown →

Question 7mediummatching

Drag and drop each OSPF router role on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Generates the Network LSA and maintains full adjacencies with all routers on the segment

Monitors the DR and assumes the DR role if the DR fails

Forms full adjacencies only with the DR and BDR

Connects multiple areas and advertises inter-area routes

Redistributes external routes into OSPF

Question 8easymulti select

Which two statements about RESTCONF are true? (Choose two.)

Trap 1: RESTCONF supports only XML encoding for data.

Incorrect because RESTCONF supports both XML and JSON encoding.

Trap 2: RESTCONF uses SSH as the transport protocol.

Incorrect because RESTCONF uses HTTP/HTTPS, not SSH; NETCONF uses SSH.

Trap 3: RESTCONF defines its own data modeling language.

Incorrect because RESTCONF uses YANG as the data modeling language.

A
RESTCONF uses HTTP methods like GET, PUT, POST, and DELETE to manipulate YANG data.
Correct because RESTCONF maps HTTP methods to CRUD operations on YANG data.
B
RESTCONF supports only XML encoding for data.
Why wrong: Incorrect because RESTCONF supports both XML and JSON encoding.
C
RESTCONF uses SSH as the transport protocol.
Why wrong: Incorrect because RESTCONF uses HTTP/HTTPS, not SSH; NETCONF uses SSH.
D
RESTCONF provides a 'data' resource as the entry point for accessing YANG data stores.
Correct because the base URI for RESTCONF includes the 'data' resource to access configuration and state data.
E
RESTCONF defines its own data modeling language.
Why wrong: Incorrect because RESTCONF uses YANG as the data modeling language.

Question 9mediummultiple choice

A network engineer is troubleshooting a problem where Cisco DNA Center is not receiving syslog messages from a critical core switch. The switch is configured to send syslog to the DNA Center's IP address. The engineer checks the DNA Center syslog collector and finds that it is enabled. What should the engineer check next?

Trap 1: Check if the syslog messages are in the correct format.

Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.

Trap 2: Ensure that the switch is in the Inventory and managed by DNA…

Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.

Trap 3: Restart the syslog collector service on DNA Center.

Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.

A
Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.
Correct because syslog uses UDP 514, and if the port is blocked, messages will not reach DNA Center.
B
Check if the syslog messages are in the correct format.
Why wrong: Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.
C
Ensure that the switch is in the Inventory and managed by DNA Center.
Why wrong: Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.
D
Restart the syslog collector service on DNA Center.
Why wrong: Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.

Question 10mediumdrag order

Drag and drop the steps of 802.1X port authentication with MAB fallback into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11easymultiple choice

A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows:

{
  "response": [
    {
      "deviceId": "1234567890",
      "hostname": "Core-Switch-1",
      "score": 8,
      "overallHealth": "good",
      "timestamp": 1623456789
    }
  ],
  "version": "1.0"
}

The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?

Trap 1: health = response['overallHealth']

This would fail because 'overallHealth' is not a top-level key.

Trap 2: health = response['response']['overallHealth']

This would fail because 'response' contains a list, not a dictionary.

Trap 3: health = response[0]['overallHealth']

This would fail because the top-level object is a dictionary, not a list.

A
health = response['response'][0]['overallHealth']
Correct. This accesses the first element of the list inside 'response' and then retrieves 'overallHealth'.
B
health = response['overallHealth']
Why wrong: This would fail because 'overallHealth' is not a top-level key.
C
health = response['response']['overallHealth']
Why wrong: This would fail because 'response' contains a list, not a dictionary.
D
health = response[0]['overallHealth']
Why wrong: This would fail because the top-level object is a dictionary, not a list.

Question 12hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 150

10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    
20 deny tcp any any eq 23 (8 matches)
    
30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    
40 deny tcp any any eq 22 (1 match)
    
50 permit ip any any (15 matches)

Based on this output, what can be concluded?

Trap 1: Telnet from 10.0.0.0/8 is denied.

Entry 10 permits Telnet from 10.0.0.0/8.

Trap 2: SSH from 172.16.0.0/16 is denied.

Entry 30 permits SSH from 172.16.0.0/16.

Trap 3: All traffic is permitted.

Telnet and SSH from unauthorized sources are denied.

A
Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.
Telnet from 192.168.1.0/24 matches entry 20 (deny), and SSH from 10.0.0.0/8 does not match entry 30 (which permits only from 172.16.0.0/16), so it matches entry 40 (deny).
B
Telnet from 10.0.0.0/8 is denied.
Why wrong: Entry 10 permits Telnet from 10.0.0.0/8.
C
SSH from 172.16.0.0/16 is denied.
Why wrong: Entry 30 permits SSH from 172.16.0.0/16.
D
All traffic is permitted.
Why wrong: Telnet and SSH from unauthorized sources are denied.

Question 13mediumdrag order

Drag and drop the steps of the hierarchical campus network design process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediummultiple choice

Examine the following partial Cisco IOS-XE configuration:

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
 ip access-group ACL_IN in
 spanning-tree portfast

What is the effect of this configuration?

Trap 1: The port will become a trunk port and participate in VLAN trunking.

The port is configured as an access port, not a trunk.

Trap 2: The port will use Rapid PVST+ and immediately forward after a link…

PortFast does not change the STP mode; it only affects initial convergence.

Trap 3: The port will block all inbound traffic due to the ACL.

The ACL is applied inbound but does not block all traffic; it filters based on the ACL entries.

A
The port will immediately transition to forwarding state, reducing STP convergence time for end hosts.
spanning-tree portfast on an access port causes immediate forwarding, as intended for host ports.
B
The port will become a trunk port and participate in VLAN trunking.
Why wrong: The port is configured as an access port, not a trunk.
C
The port will use Rapid PVST+ and immediately forward after a link failure.
Why wrong: PortFast does not change the STP mode; it only affects initial convergence.
D
The port will block all inbound traffic due to the ACL.
Why wrong: The ACL is applied inbound but does not block all traffic; it filters based on the ACL entries.

Question 15mediummatching

Drag and drop each SD-Access fabric role on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Connects the SD-Access fabric to external Layer 2 or Layer 3 networks

Attaches wired endpoints to the fabric and enforces access policies

Hosts the LISP map-server and map-resolver functions

Manages wireless endpoints and integrates with the fabric edge

Provides wireless connectivity and tunnels client traffic to the fabric edge

Question 16mediummatching

Drag and drop each SD-WAN plane on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Distributes OMP routes, TLOCs, and policy information between vSmart and WAN edges

Forwards user traffic over IPsec tunnels between WAN edge routers

Provides REST API, CLI, and web GUI for configuring and monitoring the fabric

Automates initial authentication, NAT detection, and vBond discovery

(Not a standard SD-WAN plane; used as a distractor) Handles application-level services

Question 17easymulti select

Which three statements about Cisco SD-WAN architecture components and their roles are true? (Choose three.)

Trap 1: vSmart controllers are responsible for NAT traversal and public IP…

Incorrect because NAT traversal and public IP discovery are functions of the vBond orchestrator, not vSmart.

Trap 2: vManage distributes OMP routes to vEdge routers to populate the…

Incorrect because vManage does not distribute routes; route distribution is performed by vSmart controllers via OMP.

A
vManage provides a centralized dashboard for configuration, monitoring, and troubleshooting of the entire SD-WAN fabric.
Correct because vManage is the management plane that offers a GUI and API for network administrators to manage all devices.
B
vSmart controllers are responsible for distributing routing information and policies to all WAN Edge routers in the overlay.
Correct because vSmart is the control plane that uses OMP to disseminate routes and centralized policies.
C
vBond orchestrators authenticate WAN Edge routers and assist in NAT traversal for establishing tunnels.
Correct because vBond performs initial authentication and provides the public IP/port information needed for NAT traversal.
D
vSmart controllers are responsible for NAT traversal and public IP discovery for WAN Edge routers behind NAT.
Why wrong: Incorrect because NAT traversal and public IP discovery are functions of the vBond orchestrator, not vSmart.
E
vManage distributes OMP routes to vEdge routers to populate the overlay routing table.
Why wrong: Incorrect because vManage does not distribute routes; route distribution is performed by vSmart controllers via OMP.

Question 18mediummatching

Drag and drop each DTP mode on the left to its matching trunking behavior on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Actively sends DTP frames to form trunk

Passively waits for DTP frames to form trunk

Forces the port to become a trunk regardless of neighbor

Forces the port to be an access port, no trunking

Disables DTP, trunking only if manually configured

Question 19easymulti select

Which two statements about VLAN configuration and verification on a Cisco IOS switch are true? (Choose two.)

Trap 1: The 'switchport access vlan 10' command automatically creates VLAN…

Incorrect because the command assigns the port to VLAN 10, but VLAN 10 must already be created; otherwise the port remains inactive.

Trap 2: The 'no switchport' command on a switch port places it into the…

Incorrect because 'no switchport' makes the interface a Layer 3 routed port, removing it from VLAN operation.

Trap 3: Extended VLANs (1006-4094) are stored in the vlan.dat file by…

Incorrect because extended VLANs are stored in the running configuration, not in vlan.dat, unless VTP version 3 is used.

A
VLAN 1 and VLANs 1002-1005 cannot be deleted.
Correct because these are default VLANs that are automatically created and cannot be removed.
B
The 'show vlan brief' command only displays VLANs that have been created on the switch.
Correct because it shows only configured VLANs, not all possible VLAN numbers.
C
The 'switchport access vlan 10' command automatically creates VLAN 10 if it does not exist.
Why wrong: Incorrect because the command assigns the port to VLAN 10, but VLAN 10 must already be created; otherwise the port remains inactive.
D
The 'no switchport' command on a switch port places it into the default VLAN.
Why wrong: Incorrect because 'no switchport' makes the interface a Layer 3 routed port, removing it from VLAN operation.
E
Extended VLANs (1006-4094) are stored in the vlan.dat file by default.
Why wrong: Incorrect because extended VLANs are stored in the running configuration, not in vlan.dat, unless VTP version 3 is used.

Question 20mediummulti select

Which two statements about DTP (Dynamic Trunking Protocol) are true? (Choose two.)

Trap 1: DTP frames are sent continuously on a trunk port to maintain the…

DTP frames are sent only during negotiation; once a trunk is established, DTP frames are no longer sent.

Trap 2: The 'switchport nonegotiate' command enables DTP on an interface.

The 'switchport nonegotiate' command disables DTP, preventing the interface from sending DTP frames.

Trap 3: DTP supports both 802.1Q and ISL trunking encapsulation.

DTP can negotiate both 802.1Q and ISL, but ISL is obsolete and not supported on modern switches; the statement is technically true but misleading in modern contexts, and the question focuses on current implementations where ISL is deprecated.

A
DTP is a Cisco proprietary protocol.
DTP is indeed Cisco proprietary and is not standardized in IEEE 802.1Q.
B
The default switchport mode on a Cisco Catalyst switch is dynamic desirable.
By default, Cisco Catalyst switches use dynamic desirable mode, which actively sends DTP frames to negotiate trunking.
C
DTP frames are sent continuously on a trunk port to maintain the trunk.
Why wrong: DTP frames are sent only during negotiation; once a trunk is established, DTP frames are no longer sent.
D
The 'switchport nonegotiate' command enables DTP on an interface.
Why wrong: The 'switchport nonegotiate' command disables DTP, preventing the interface from sending DTP frames.
E
DTP supports both 802.1Q and ISL trunking encapsulation.
Why wrong: DTP can negotiate both 802.1Q and ISL, but ISL is obsolete and not supported on modern switches; the statement is technically true but misleading in modern contexts, and the question focuses on current implementations where ISL is deprecated.