350-401 Architecture Practice Question
A network architect is designing a Cisco SD-WAN fabric for a company with 30 branch sites and two data centers. The architect wants to ensure that control plane information is exchanged securely and that data plane traffic can be forwarded even if the control plane is temporarily unavailable. Which component should be deployed to meet these requirements?
⚠ Common exam trap
The trap here is assuming that the control plane component (vSmart) also forwards data traffic, when in fact SD-WAN separates control, data, management, and orchestration planes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco vEdge routers
The data plane in Cisco SD-WAN is handled by vEdge/cEdge routers, which forward traffic and maintain secure connections to the control plane. They can continue forwarding based on last-known routing and policy information if the control plane is disrupted. The management plane (vManage), orchestration plane (vBond), and control plane (vSmart) do not forward production data traffic, so they cannot meet the requirement for continued data plane forwarding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cisco vEdge routers
Why this is correct
Cisco vEdge routers (or cEdge routers) are the data plane components at branch and data center sites. They establish secure control connections to vSmart and vBond, and they forward data plane traffic based on policies and routes received. They can continue forwarding traffic using cached control information if the control plane is temporarily unavailable, satisfying the scenario.
- ✗
Cisco vSmart
Why it's wrong here
Cisco vSmart is the control plane component that distributes routing and policy information to SD-WAN edges using OMP. It does not forward data plane traffic. If vSmart becomes unavailable, existing data plane traffic can continue, but it does not itself provide the data plane forwarding required by the scenario.
- ✗
Cisco vBond
Why it's wrong here
Cisco vBond is the orchestration component that authenticates and authorizes SD-WAN edge devices and helps them discover each other. It does not store routing information or forward data plane traffic. While it is critical for initial bring-up and NAT traversal, it does not provide the control plane or data plane functions needed for ongoing secure routing and forwarding.
- ✗
Cisco vManage
Why it's wrong here
Cisco vManage is the management plane component that provides a GUI for configuration, monitoring, and troubleshooting of the SD-WAN fabric. It does not handle control plane or data plane forwarding. If vManage is down, existing data plane traffic continues, but it does not provide the secure control plane or data plane forwarding required by the scenario.
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.