Sd Access Architecture practice questions

Drag and drop the steps of SD-WAN zero-touch provisioning (ZTP) flow into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2mediummatching

Drag and drop each SD-WAN policy type on the left to its matching application point on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Applied to data traffic for SLA-based path selection

Applied to enable NetFlow-like traffic monitoring

Applied to modify forwarding, NAT, or QoS on data packets

Applied to OMP routes and TLOCs for route manipulation

Applied to define which VPNs are provisioned on a device

Question 3mediummatching

Review the full OSPF breakdown →

Drag and drop each WAN transport type on the left to its matching SD-WAN characteristic on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Predictable latency and SLA, private Layer 3 VPN

Low cost, best-effort, public IP addressing

Wireless backup, variable throughput, cellular network

High latency, global coverage, limited bandwidth

High bandwidth, low latency, metro-area Layer 2 connectivity

Question 4easymultiple choice

What is the default OSPF hello interval on an Ethernet link in a Cisco router?

Trap 1: 30 seconds

Incorrect. 30 seconds is the default for NBMA networks.

Trap 2: 5 seconds

A 5-second hello interval is the default for OSPF on NBMA (Non-Broadcast Multi-Access) networks, not for Ethernet. On an Ethernet broadcast multi-access link, the default hello interval is 10 seconds. This option is tempting because 5 seconds is the default for OSPF point-to-point and NBMA interfaces, so it is correct for those specific network types, but the stem explicitly specifies an Ethernet link.

Trap 3: 40 seconds

Incorrect. 40 seconds is the default dead interval for Ethernet.

A
10 seconds
Correct. The default hello interval for Ethernet is 10 seconds.
B
30 seconds
Why wrong: Incorrect. 30 seconds is the default for NBMA networks.
C
5 seconds
Why wrong: A 5-second hello interval is the default for OSPF on NBMA (Non-Broadcast Multi-Access) networks, not for Ethernet. On an Ethernet broadcast multi-access link, the default hello interval is 10 seconds. This option is tempting because 5 seconds is the default for OSPF point-to-point and NBMA interfaces, so it is correct for those specific network types, but the stem explicitly specifies an Ethernet link.
D
40 seconds
Why wrong: Incorrect. 40 seconds is the default dead interval for Ethernet.

Question 5mediummulti select

Which two statements about SD-WAN control plane components are true? (Choose two.)

Trap 1: The vManage controller is the primary control plane component that…

Incorrect because vManage is the management plane (NMS), not a control plane; OMP sessions are between vSmart and edge devices.

Trap 2: vEdge and cEdge routers are both control plane devices that…

Incorrect because vEdge and cEdge are data plane devices; they do run OMP but are not control plane components.

Trap 3: The OMP protocol runs between vManage and vSmart to exchange…

Incorrect because OMP runs between vSmart and edge devices (vEdge/cEdge), not between vManage and vSmart.

A
The vSmart controller is responsible for distributing OMP routes and policies to all edge devices in the SD-WAN fabric.
Correct because vSmart is the centralized control plane that uses OMP to advertise routes and apply policies.
B
The vBond orchestrator is responsible for authenticating and onboarding vEdge and cEdge routers into the SD-WAN overlay.
Correct because vBond provides NAT traversal and initial authentication, and directs devices to vManage and vSmart.
C
The vManage controller is the primary control plane component that establishes OMP sessions with all edge routers.
Why wrong: Incorrect because vManage is the management plane (NMS), not a control plane; OMP sessions are between vSmart and edge devices.
D
vEdge and cEdge routers are both control plane devices that participate in OMP route exchange.
Why wrong: Incorrect because vEdge and cEdge are data plane devices; they do run OMP but are not control plane components.
E
The OMP protocol runs between vManage and vSmart to exchange routing information and policy updates.
Why wrong: Incorrect because OMP runs between vSmart and edge devices (vEdge/cEdge), not between vManage and vSmart.

Question 6mediumdrag order

Read the full MPLS explanation →

Drag and drop the steps of the SD-Access fabric deployment sequence into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 7mediummultiple choice

An enterprise is migrating from a traditional MPLS WAN to Cisco SD-WAN. The network team has deployed vEdge routers at all branch offices and a vSmart controller in the data center. The engineer configures a centralized control policy to influence path selection based on cost and latency. After the policy is activated, the engineer notices that some branches are not receiving the updated policy and are still using the default best-path selection. The vSmart is reachable from all branches, and the vEdge routers show that they are connected to the vSmart. What is the most likely reason for this issue?

Trap 1: The vEdge routers have not been rebooted after the policy change.

Incorrect because policy changes take effect immediately without reboot.

Trap 2: The OMP graceful restart timer has expired, causing the vEdge to…

Incorrect because OMP graceful restart affects route convergence, not policy application.

Trap 3: The BFD sessions between vEdge and vSmart are flapping.

Incorrect because BFD is for data plane failure detection, not for policy distribution.

A
The vEdge routers have not been rebooted after the policy change.
Why wrong: Incorrect because policy changes take effect immediately without reboot.
B
The control policy is not attached to the appropriate site list or VPN list.
Correct because a control policy must be associated with a list to be applied; otherwise, it is not enforced.
C
The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.
Why wrong: Incorrect because OMP graceful restart affects route convergence, not policy application.
D
The BFD sessions between vEdge and vSmart are flapping.
Why wrong: Incorrect because BFD is for data plane failure detection, not for policy distribution.

Question 8easymultiple choice

A network team is planning to migrate from a Type 2 hypervisor to a Type 1 hypervisor for their production VMs. They need to understand the architectural impact. Which statement correctly describes a key difference between Type 1 and Type 2 hypervisors?

Trap 1: Type 1 hypervisors require a host OS for device drivers, while Type…

Type 1 hypervisors have their own drivers; Type 2 rely on the host OS.

Trap 2: Type 2 hypervisors are always more secure than Type 1 because of…

The additional OS layer increases attack surface, reducing security.

Trap 3: Type 1 hypervisors cannot support hardware passthrough, but Type 2…

Both types can support hardware passthrough; Type 1 typically does it more efficiently.

A
Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.
This is the fundamental architectural difference.
B
Type 1 hypervisors require a host OS for device drivers, while Type 2 hypervisors include their own drivers.
Why wrong: Type 1 hypervisors have their own drivers; Type 2 rely on the host OS.
C
Type 2 hypervisors are always more secure than Type 1 because of the additional OS layer.
Why wrong: The additional OS layer increases attack surface, reducing security.
D
Type 1 hypervisors cannot support hardware passthrough, but Type 2 can.
Why wrong: Both types can support hardware passthrough; Type 1 typically does it more efficiently.

Review the full OSPF breakdown →

Question 9mediummatching

Drag and drop each OSPF router role on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Generates the Network LSA and maintains full adjacencies with all routers on the segment

Monitors the DR and assumes the DR role if the DR fails

Forms full adjacencies only with the DR and BDR

Connects multiple areas and advertises inter-area routes

Redistributes external routes into OSPF

Question 10easymulti select

Which two statements about RESTCONF are true? (Choose two.)

Trap 1: RESTCONF supports only XML encoding for data.

Incorrect because RESTCONF supports both XML and JSON encoding.

Trap 2: RESTCONF uses SSH as the transport protocol.

Incorrect because RESTCONF uses HTTP/HTTPS, not SSH; NETCONF uses SSH.

Trap 3: RESTCONF defines its own data modeling language.

Incorrect because RESTCONF uses YANG as the data modeling language.

A
RESTCONF uses HTTP methods like GET, PUT, POST, and DELETE to manipulate YANG data.
Correct because RESTCONF maps HTTP methods to CRUD operations on YANG data.
B
RESTCONF supports only XML encoding for data.
Why wrong: Incorrect because RESTCONF supports both XML and JSON encoding.
C
RESTCONF uses SSH as the transport protocol.
Why wrong: Incorrect because RESTCONF uses HTTP/HTTPS, not SSH; NETCONF uses SSH.
D
RESTCONF provides a 'data' resource as the entry point for accessing YANG data stores.
Correct because the base URI for RESTCONF includes the 'data' resource to access configuration and state data.
E
RESTCONF defines its own data modeling language.
Why wrong: Incorrect because RESTCONF uses YANG as the data modeling language.

Study the full QoS explanation →

Question 11hardmultiple choice

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

Trap 1: CoS 5, DSCP AF41

AF41 is used for video, not voice.

Trap 2: CoS 5, DSCP CS3

CS3 is lower priority than EF.

Trap 3: CoS 4, DSCP EF

CoS 4 is for video conferencing.

A
CoS 5, DSCP AF41
Why wrong: AF41 is used for video, not voice.
B
CoS 5, DSCP CS3
Why wrong: CS3 is lower priority than EF.
C
CoS 5, DSCP EF
CoS 5 and DSCP EF are the standard marks for voice.
D
CoS 4, DSCP EF
Why wrong: CoS 4 is for video conferencing.

Question 12mediummultiple choice

A network engineer is troubleshooting a problem where Cisco DNA Center is not receiving syslog messages from a critical core switch. The switch is configured to send syslog to the DNA Center's IP address. The engineer checks the DNA Center syslog collector and finds that it is enabled. What should the engineer check next?

Trap 1: Check if the syslog messages are in the correct format.

Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.

Trap 2: Ensure that the switch is in the Inventory and managed by DNA…

Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.

Trap 3: Restart the syslog collector service on DNA Center.

Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.

A
Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.
Correct because syslog uses UDP 514, and if the port is blocked, messages will not reach DNA Center.
B
Check if the syslog messages are in the correct format.
Why wrong: Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.
C
Ensure that the switch is in the Inventory and managed by DNA Center.
Why wrong: Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.
D
Restart the syslog collector service on DNA Center.
Why wrong: Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.

Question 13mediummultiple choice

An organization uses Cisco DNA Center to automate network provisioning. A network engineer deploys a new access switch but finds that the switch does not receive the intended configuration template. The switch appears in DNA Center inventory with status 'Managed'. What is the most likely cause?

Trap 1: The switch has not been discovered by DNA Center

The switch is in 'Managed' status, so it has been discovered.

Trap 2: The switch is not in Plug and Play mode

Plug and Play is used for initial provisioning, not post-discovery.

Trap 3: The switch does not have a valid DNA license

Licensing issues would cause different symptoms.

A
The switch has not been discovered by DNA Center
Why wrong: The switch is in 'Managed' status, so it has been discovered.
B
The switch is not in Plug and Play mode
Why wrong: Plug and Play is used for initial provisioning, not post-discovery.
C
The switch does not have a valid DNA license
Why wrong: Licensing issues would cause different symptoms.
D
The switch is not assigned to a site
Site assignment is required for template application.

Question 14mediumdrag order

Drag and drop the steps of 802.1X port authentication with MAB fallback into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediummultiple choice

A network architect is designing a Cisco SD-Access fabric for a university campus that requires segmentation between student, faculty, and guest traffic. The design must use Cisco TrustSec for scalable security group tags (SGTs) and integrate with Cisco ISE for policy enforcement. Which fabric component should the architect use to enforce SGT-based policies at the access layer?

Trap 1: Fabric border node

The border node connects the fabric to external networks but does not enforce SGT policies at the access layer.

Trap 2: Fabric control plane node

The control plane node maintains the LISP mapping database but does not enforce SGT policies.

Trap 3: Wireless LAN controller

The WLC may assign SGTs to wireless clients, but the enforcement of SGT policies occurs at the fabric edge switch.

A
Fabric border node
Why wrong: The border node connects the fabric to external networks but does not enforce SGT policies at the access layer.
B
Fabric control plane node
Why wrong: The control plane node maintains the LISP mapping database but does not enforce SGT policies.
C
Fabric edge node
The fabric edge switch enforces SGT-based policies by applying SGACLs based on the SGT assigned by ISE during authentication.
D
Wireless LAN controller
Why wrong: The WLC may assign SGTs to wireless clients, but the enforcement of SGT policies occurs at the fabric edge switch.

Question 16easymultiple choice

A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows:

{
  "response": [
    {
      "deviceId": "1234567890",
      "hostname": "Core-Switch-1",
      "score": 8,
      "overallHealth": "good",
      "timestamp": 1623456789
    }
  ],
  "version": "1.0"
}

The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?

Trap 1: health = response['overallHealth']

This would fail because 'overallHealth' is not a top-level key.

Trap 2: health = response['response']['overallHealth']

This would fail because 'response' contains a list, not a dictionary.

Trap 3: health = response[0]['overallHealth']

This would fail because the top-level object is a dictionary, not a list.

A
health = response['response'][0]['overallHealth']
Correct. This accesses the first element of the list inside 'response' and then retrieves 'overallHealth'.
B
health = response['overallHealth']
Why wrong: This would fail because 'overallHealth' is not a top-level key.
C
health = response['response']['overallHealth']
Why wrong: This would fail because 'response' contains a list, not a dictionary.
D
health = response[0]['overallHealth']
Why wrong: This would fail because the top-level object is a dictionary, not a list.

Question 17easymultiple choice

A network engineer needs to automate the backup of running configurations from multiple Cisco IOS XE devices to a central TFTP server. Which tool is best suited for this task in a Python-based automation framework?

Trap 1: RESTCONF

RESTCONF is a protocol for model-driven APIs, not for CLI-based backup.

Trap 2: Ansible

Ansible is a configuration management tool, not a Python library.

Trap 3: Netmiko

Netmiko is a high-level library built on Paramiko, but Paramiko is the underlying SSH implementation.

A
RESTCONF
Why wrong: RESTCONF is a protocol for model-driven APIs, not for CLI-based backup.
B
Ansible
Why wrong: Ansible is a configuration management tool, not a Python library.
C
Paramiko
Paramiko provides SSH connectivity to network devices.
D
Netmiko
Why wrong: Netmiko is a high-level library built on Paramiko, but Paramiko is the underlying SSH implementation.

Question 18hardmultiple choice

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

Trap 1: Implement PIM-SM for multicast routing in the underlay.

Multicast is not required for the underlay; the overlay handles group communication.

Trap 2: Preserve existing VLANs across the fabric to minimize changes.

The underlay should be IP routed; VLANs are not used in the underlay.

Trap 3: Deploy VRF-lite on all edge nodes to isolate tenants.

VRF-lite is not a requirement; the overlay provides segmentation.

A
Configure a routed access layer with a link-state routing protocol (IS-IS or OSPF).
A routed underlay with IS-IS or OSPF is a key design requirement for SD-Access.
B
Implement PIM-SM for multicast routing in the underlay.
Why wrong: Multicast is not required for the underlay; the overlay handles group communication.
C
Preserve existing VLANs across the fabric to minimize changes.
Why wrong: The underlay should be IP routed; VLANs are not used in the underlay.
D
Deploy VRF-lite on all edge nodes to isolate tenants.
Why wrong: VRF-lite is not a requirement; the overlay provides segmentation.

Open the full VLAN trunking answer →

Question 19mediummultiple choice

An engineer is troubleshooting a problem where a host in VLAN 20 cannot communicate with a host in VLAN 30, even though both are connected to the same access switch. The access switch is configured with VLANs 20 and 30, and the uplink to the distribution switch is a trunk that allows both VLANs. The distribution switch has SVIs for both VLANs and IP routing is enabled. The engineer verifies that the trunk is up and both VLANs are allowed. What is the most likely cause of the communication failure?

Trap 1: The trunk is not allowing VLAN 20 or VLAN 30.

Incorrect because the engineer verified the trunk allows both VLANs.

Trap 2: Spanning Tree Protocol is blocking the SVI interfaces.

Incorrect because SVIs are logical interfaces and are not affected by STP.

Trap 3: The native VLAN mismatch on the trunk is causing the issue.

Incorrect because the trunk is up, so native VLAN mismatch is not present.

A
The hosts are not configured with the correct default gateway pointing to the SVI on the distribution switch.
Correct because hosts need a default gateway to route traffic to other VLANs; if misconfigured, inter-VLAN communication fails.
B
The trunk is not allowing VLAN 20 or VLAN 30.
Why wrong: Incorrect because the engineer verified the trunk allows both VLANs.
C
Spanning Tree Protocol is blocking the SVI interfaces.
Why wrong: Incorrect because SVIs are logical interfaces and are not affected by STP.
D
The native VLAN mismatch on the trunk is causing the issue.
Why wrong: Incorrect because the trunk is up, so native VLAN mismatch is not present.

Question 20mediummultiple choice

A data center architect is designing a virtualized environment to host critical applications. The design must maximize performance by allowing virtual machines (VMs) to directly access physical CPU cores and memory without hypervisor overhead for latency-sensitive workloads. Which hypervisor configuration should be used?

Trap 1: Enable hyper-threading and overcommit CPU resources

Overcommitting CPU resources increases contention and latency, which is unsuitable for latency-sensitive workloads.

Trap 2: Use a Type 2 hypervisor (e.g., VMware Workstation) for better…

Type 2 hypervisors run on top of an OS, adding overhead; Type 1 is preferred for performance in data centers.

Trap 3: Enable memory ballooning to reclaim unused memory from VMs

Memory ballooning can cause performance variability and is not suitable for latency-sensitive workloads.

A
Enable hyper-threading and overcommit CPU resources
Why wrong: Overcommitting CPU resources increases contention and latency, which is unsuitable for latency-sensitive workloads.
B
Use a Type 2 hypervisor (e.g., VMware Workstation) for better isolation
Why wrong: Type 2 hypervisors run on top of an OS, adding overhead; Type 1 is preferred for performance in data centers.
C
Configure NUMA pinning and CPU pinning for each VM to dedicated cores and memory nodes
NUMA pinning and CPU pinning reduce latency by ensuring VMs use local memory and dedicated cores, avoiding hypervisor scheduling delays.
D
Enable memory ballooning to reclaim unused memory from VMs
Why wrong: Memory ballooning can cause performance variability and is not suitable for latency-sensitive workloads.