350-401 Architecture Practice Question
A network engineer is designing a Cisco SD-WAN fabric with two data centers and 200 branch sites. The requirement is that branch sites use direct internet access for SaaS applications while business-critical traffic to the data centers traverses a secure IPsec tunnel. Which Cisco SD-WAN feature should the engineer use to define and enforce these traffic steering policies?
⚠ Common exam trap
The trap here is assuming that OMP or BFD alone can steer traffic by application, when application-based forwarding requires centralized data policy plus application-aware routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application-aware routing with centralized data policy
Cisco SD-WAN centralized data policy is the mechanism for defining traffic steering rules based on application and other match criteria. Combined with application-aware routing, which measures path performance, the engineer can direct SaaS traffic out the local internet connection and force business-critical traffic through IPsec tunnels to the data centers. This combination directly addresses the stated requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Application-aware routing with centralized data policy
Why this is correct
Cisco SD-WAN centralized data policy lets the engineer define traffic steering rules based on application, source, destination, and other match criteria, and then apply actions such as directing traffic over a specific VPN or out the local internet connection. Application-aware routing continuously measures path characteristics to select the best path. Together they satisfy the requirement to send SaaS traffic directly to the internet while forcing critical traffic through IPsec tunnels to the data centers.
- ✗
TLOC extension between WAN edge routers at each branch
Why it's wrong here
TLOC extension allows a WAN edge router to use the transport connection of another WAN edge router at the same site, providing redundancy. It does not define application-based steering or direct internet access policies. This feature addresses transport redundancy, not the requirement to route SaaS traffic locally while sending critical traffic through IPsec tunnels to the data centers.
- ✗
BFD-based path selection with static routes
Why it's wrong here
BFD provides fast failure detection for tunnels and can influence path selection, but static routes alone cannot match applications or enforce application-aware steering. The requirement is to differentiate SaaS traffic from business-critical traffic and steer each appropriately, which requires application-aware routing and centralized data policy rather than static routing with BFD.
- ✗
Control plane and data plane separation with OMP
Why it's wrong here
OMP is the Cisco SD-WAN routing protocol that distributes control plane information such as routes, TLOCs, and policies between controllers and WAN edges. While it is foundational to the architecture, it does not itself define application-based traffic steering. The engineer needs a policy framework to match applications and set forwarding actions, which OMP alone does not provide.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
QoS and Network Performance Management
Key term
Cisco SD-WAN
Cisco SD-WAN is a software-defined wide area network architecture that separates the control and data planes to centrally manage and optimize traffic across multiple WAN connections.
Key term
IPsec Tunnel
An IPsec tunnel is a secure, encrypted connection between two network devices that protects data as it travels across the internet or another untrusted network.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.