350-401 · topic practice
Practise ENCOR 350-401 Sd Wan Architecture practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
What the exam tests
Sd Wan Architecture questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Watch out for
Practice set
20 questions · select your answer, then reveal the explanation
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Applied to data traffic for SLA-based path selection
Applied to enable NetFlow-like traffic monitoring
Applied to modify forwarding, NAT, or QoS on data packets
Applied to OMP routes and TLOCs for route manipulation
Applied to define which VPNs are provisioned on a device
Drag a concept onto its matching description — or click a concept then click the description.
Predictable latency and SLA, private Layer 3 VPN
Low cost, best-effort, public IP addressing
Wireless backup, variable throughput, cellular network
High latency, global coverage, limited bandwidth
High bandwidth, low latency, metro-area Layer 2 connectivity
Trap 1: The vManage controller is the primary control plane component that…
Incorrect because vManage is the management plane (NMS), not a control plane; OMP sessions are between vSmart and edge devices.
Trap 2: vEdge and cEdge routers are both control plane devices that…
Incorrect because vEdge and cEdge are data plane devices; they do run OMP but are not control plane components.
Trap 3: The OMP protocol runs between vManage and vSmart to exchange…
Incorrect because OMP runs between vSmart and edge devices (vEdge/cEdge), not between vManage and vSmart.
The vSmart controller is responsible for distributing OMP routes and policies to all edge devices in the SD-WAN fabric.
Correct because vSmart is the centralized control plane that uses OMP to advertise routes and apply policies.
The vBond orchestrator is responsible for authenticating and onboarding vEdge and cEdge routers into the SD-WAN overlay.
Correct because vBond provides NAT traversal and initial authentication, and directs devices to vManage and vSmart.
The vManage controller is the primary control plane component that establishes OMP sessions with all edge routers.
Why wrong: Incorrect because vManage is the management plane (NMS), not a control plane; OMP sessions are between vSmart and edge devices.
vEdge and cEdge routers are both control plane devices that participate in OMP route exchange.
Why wrong: Incorrect because vEdge and cEdge are data plane devices; they do run OMP but are not control plane components.
The OMP protocol runs between vManage and vSmart to exchange routing information and policy updates.
Why wrong: Incorrect because OMP runs between vSmart and edge devices (vEdge/cEdge), not between vManage and vSmart.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Trap 1: The vEdge routers have not been rebooted after the policy change.
Incorrect because policy changes take effect immediately without reboot.
Trap 2: The OMP graceful restart timer has expired, causing the vEdge to…
Incorrect because OMP graceful restart affects route convergence, not policy application.
Trap 3: The BFD sessions between vEdge and vSmart are flapping.
Incorrect because BFD is for data plane failure detection, not for policy distribution.
The vEdge routers have not been rebooted after the policy change.
Why wrong: Incorrect because policy changes take effect immediately without reboot.
The control policy is not attached to the appropriate site list or VPN list.
Correct because a control policy must be associated with a list to be applied; otherwise, it is not enforced.
The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.
Why wrong: Incorrect because OMP graceful restart affects route convergence, not policy application.
The BFD sessions between vEdge and vSmart are flapping.
Why wrong: Incorrect because BFD is for data plane failure detection, not for policy distribution.
Trap 1: The engineer used 'ip default-network' which is not supported in…
Ly states that 'default-information originate' should be used for EIGRP. That command is for OSPF, not EIGRP. While 'ip default-network' is indeed not supported in EIGRP, the correct method is to redistribute a properly configured static default route, not to use 'default-information originate'. Therefore, this is not the most likely reason.
Trap 2: The internal routers have a route to the default network with a…
Internal routers are not receiving the default route at all, so they cannot have a route with a better metric from another source. This option describes a scenario where the route is received but not preferred, which does not match the problem.
Trap 3: The engineer needs to configure 'eigrp stub' on the router to allow…
Configuring 'eigrp stub' on the router would restrict route advertisement, not allow it. To advertise a default route from a stub router, you would need the 'summary' keyword, but the router is not necessarily a stub. This would not be the most likely reason for the failure.
The engineer used 'ip default-network' which is not supported in EIGRP; instead, 'default-information originate' should be used.
Why wrong: Ly states that 'default-information originate' should be used for EIGRP. That command is for OSPF, not EIGRP. While 'ip default-network' is indeed not supported in EIGRP, the correct method is to redistribute a properly configured static default route, not to use 'default-information originate'. Therefore, this is not the most likely reason.
The static default route is not configured correctly; the engineer should use 'ip route 0.0.0.0 0.0.0.0 <next-hop>'.
Correct. The static default route must be correctly configured with a next-hop IP address. If the static route is missing or uses an interface instead of a next-hop, it may not be valid, and the redistribution will not propagate the route to internal routers, despite appearing in the topology table with a metric.
The internal routers have a route to the default network with a better metric from another source.
Why wrong: Internal routers are not receiving the default route at all, so they cannot have a route with a better metric from another source. This option describes a scenario where the route is received but not preferred, which does not match the problem.
The engineer needs to configure 'eigrp stub' on the router to allow default route advertisement.
Why wrong: Configuring 'eigrp stub' on the router would restrict route advertisement, not allow it. To advertise a default route from a stub router, you would need the 'summary' keyword, but the router is not necessarily a stub. This would not be the most likely reason for the failure.
Drag a concept onto its matching description — or click a concept then click the description.
Generates the Network LSA and maintains full adjacencies with all routers on the segment
Monitors the DR and assumes the DR role if the DR fails
Forms full adjacencies only with the DR and BDR
Connects multiple areas and advertises inter-area routes
Redistributes external routes into OSPF
A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows:
{
"response": [
{
"deviceId": "1234567890",
"hostname": "Core-Switch-1",
"score": 8,
"overallHealth": "good",
"timestamp": 1623456789
}
],
"version": "1.0"
}The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?
Trap 1: health = response['overallHealth']
This would fail because 'overallHealth' is not a top-level key.
Trap 2: health = response['response']['overallHealth']
This would fail because 'response' contains a list, not a dictionary.
Trap 3: health = response[0]['overallHealth']
This would fail because the top-level object is a dictionary, not a list.
health = response['response'][0]['overallHealth']
Correct. This accesses the first element of the list inside 'response' and then retrieves 'overallHealth'.
health = response['overallHealth']
Why wrong: This would fail because 'overallHealth' is not a top-level key.
health = response['response']['overallHealth']
Why wrong: This would fail because 'response' contains a list, not a dictionary.
health = response[0]['overallHealth']
Why wrong: This would fail because the top-level object is a dictionary, not a list.
Trap 1: The IKEv2 proposal is not configured correctly.
The proposal is configured with valid parameters.
Trap 2: The IPsec transform set is missing.
The transform set is for Phase 2, not Phase 1.
Trap 3: The pre-shared key is not defined in the keyring.
The keyring is configured, but not applied.
The IKEv2 proposal is not configured correctly.
Why wrong: The proposal is configured with valid parameters.
The IKEv2 profile is not attached to the crypto map or interface.
Correct because the profile must be applied to activate the configuration.
The IPsec transform set is missing.
Why wrong: The transform set is for Phase 2, not Phase 1.
The pre-shared key is not defined in the keyring.
Why wrong: The keyring is configured, but not applied.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Examine the following telemetry configuration:
telemetry ietf subscription 500 encoding encode-kvgpb filter xpath /interfaces/interface/state/counters stream yang-push update-policy periodic 500 receiver ip address 10.1.1.1 50000 protocol grpc
A network engineer wants to add a second receiver for redundancy. Which additional configuration is correct?
Trap 1: Create a new subscription with the same parameters and a different…
Creating a new subscription duplicates the entire telemetry stream, including a separate filter and update-policy, rather than adding a second receiver to the existing subscription 500; the correct approach uses the `receiver` command under the same subscription to achieve redundancy without duplicating the data path. This option is tempting because adding a second subscription mirrors the familiar pattern of configuring separate monitoring streams for distinct endpoints, which would be correct if each receiver required independent filtering or update intervals, but here the requirement is simply redundant delivery of the identical telemetry.
Trap 2: Modify the existing receiver to use multicast address 239.1.1.1.
Telemetry receivers use unicast IP addresses, not multicast.
Trap 3: Use the backup-receiver command under the receiver.
There is no backup-receiver command; simply add another receiver line.
Add a second receiver under the same subscription: receiver ip address 10.1.1.2 50000 protocol grpc
Multiple receivers can be added to a single subscription for redundancy.
Create a new subscription with the same parameters and a different receiver.
Why wrong: Creating a new subscription duplicates the entire telemetry stream, including a separate filter and update-policy, rather than adding a second receiver to the existing subscription 500; the correct approach uses the `receiver` command under the same subscription to achieve redundancy without duplicating the data path. This option is tempting because adding a second subscription mirrors the familiar pattern of configuring separate monitoring streams for distinct endpoints, which would be correct if each receiver required independent filtering or update intervals, but here the requirement is simply redundant delivery of the identical telemetry.
Modify the existing receiver to use multicast address 239.1.1.1.
Why wrong: Telemetry receivers use unicast IP addresses, not multicast.
Use the backup-receiver command under the receiver.
Why wrong: There is no backup-receiver command; simply add another receiver line.
Drag a concept onto its matching description — or click a concept then click the description.
Connects the SD-Access fabric to external Layer 2 or Layer 3 networks
Attaches wired endpoints to the fabric and enforces access policies
Hosts the LISP map-server and map-resolver functions
Manages wireless endpoints and integrates with the fabric edge
Provides wireless connectivity and tunnels client traffic to the fabric edge
Drag a concept onto its matching description — or click a concept then click the description.
Distributes OMP routes, TLOCs, and policy information between vSmart and WAN edges
Forwards user traffic over IPsec tunnels between WAN edge routers
Provides REST API, CLI, and web GUI for configuring and monitoring the fabric
Automates initial authentication, NAT detection, and vBond discovery
(Not a standard SD-WAN plane; used as a distractor) Handles application-level services
Trap 1: vSmart controllers are responsible for NAT traversal and public IP…
Incorrect because NAT traversal and public IP discovery are functions of the vBond orchestrator, not vSmart.
Trap 2: vManage distributes OMP routes to vEdge routers to populate the…
Incorrect because vManage does not distribute routes; route distribution is performed by vSmart controllers via OMP.
vManage provides a centralized dashboard for configuration, monitoring, and troubleshooting of the entire SD-WAN fabric.
Correct because vManage is the management plane that offers a GUI and API for network administrators to manage all devices.
vSmart controllers are responsible for distributing routing information and policies to all WAN Edge routers in the overlay.
Correct because vSmart is the control plane that uses OMP to disseminate routes and centralized policies.
vBond orchestrators authenticate WAN Edge routers and assist in NAT traversal for establishing tunnels.
Correct because vBond performs initial authentication and provides the public IP/port information needed for NAT traversal.
vSmart controllers are responsible for NAT traversal and public IP discovery for WAN Edge routers behind NAT.
Why wrong: Incorrect because NAT traversal and public IP discovery are functions of the vBond orchestrator, not vSmart.
vManage distributes OMP routes to vEdge routers to populate the overlay routing table.
Why wrong: Incorrect because vManage does not distribute routes; route distribution is performed by vSmart controllers via OMP.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Provides guaranteed SLA, low jitter, and private connectivity
Cost-effective transport with variable latency and potential packet loss
Cellular transport enabling mobility and rapid deployment with moderate bandwidth
High-bandwidth, low-latency cellular transport with network slicing capabilities
High-latency transport used for remote or maritime connectivity
Drag a concept onto its matching description — or click a concept then click the description.
Centralized management, monitoring, and configuration of the SD-WAN fabric
Control plane distribution of OMP routes, TLOCs, and policies
Orchestration of initial authentication and NAT traversal for WAN edge devices
WAN edge router that forwards data plane traffic and terminates overlay tunnels
Historical and real-time analytics for network visibility and troubleshooting
Trap 1: SD-WAN edge devices can only use MPLS or Internet as transport; LTE…
Incorrect because LTE is supported as a transport type in addition to MPLS and Internet.
Trap 2: OMP is responsible for dynamically establishing IPsec tunnels…
Incorrect because OMP distributes routes and policies; IPsec tunnels are built based on TLOC reachability, not directly by OMP.
Control plane communication between vSmart and edge devices uses DTLS or TLS encryption.
Correct because the control plane (vSmart to edge) uses DTLS by default, with TLS as an option.
Data plane tunnels between edge devices are encrypted using IPsec with IKEv2 key exchange.
Correct because IPsec is used for secure data plane tunnels between vEdge/cEdge routers.
A TLOC (Transport Location) is defined by the combination of system IP, color, and encapsulation type.
Correct because TLOC is uniquely identified by the system IP, color, and encapsulation (IPsec/GRE).
SD-WAN edge devices can only use MPLS or Internet as transport; LTE is not supported.
Why wrong: Incorrect because LTE is supported as a transport type in addition to MPLS and Internet.
OMP is responsible for dynamically establishing IPsec tunnels between edge devices based on policy.
Why wrong: Incorrect because OMP distributes routes and policies; IPsec tunnels are built based on TLOC reachability, not directly by OMP.
Free account
Create a free account to save your results and see which topics improve across sessions.
Focused Sd Wan Architecture sessions
Every question in these sessions is drawn from the Sd Wan Architecture domain — nothing else.
Related practice questions
Move into related areas when this topic feels solid.
Sharpen your 350-401 knowledge of Architecture.
Practise 350-401 questions linked to Virtualization.
Work through 350-401 questions on Infrastructure.
Sharpen your 350-401 knowledge of Network Assurance.
Security practice questions for 350-401.
Targeted 350-401 practice covering Automation.
Practise eBGP/iBGP peering, path attributes, route selection and BGP troubleshooting.
Practise OSPF area types, LSA types, neighbour states and multi-area design.
Practise EIGRP DUAL, metrics, stub routing and route redistribution.
Practise VLAN configuration, trunk negotiation and inter-VLAN routing.
Practise RSTP, MSTP, port roles and STP protection features.
Practise extended ACLs, CoPP rate-limiting and control-plane protection.
A free account saves results across sessions and highlights which topics need work.
Sign up free