mediumMultiple Select
350-401 Practice Question: Which three statements about SD-WAN (Cisco…
Which three statements about SD-WAN (Cisco Catalyst SD-WAN) are true? (Choose three.)
⚠ Common exam trap
350-401 often tests the roles of SD-WAN controllers; candidates may incorrectly assign data forwarding to vManage or think OMP runs between vEdge and vManage, confusing the management plane with the control plane.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The vSmart controller is responsible for distributing control plane information such as OMP routes and policies to the WAN edge routers.
Option A is correct because in Cisco Catalyst SD-WAN the vSmart controller owns the control plane: it receives OMP routes and policies from WAN edge devices, runs the route/policy decision process, and redistributes the resulting OMP routes and policies to the other WAN edge routers. Option B is correct because the vBond controller (orchestrator) performs initial device authentication and authorization, and it tells each WAN edge router how to reach the vManage and vSmart controllers so the overlay tunnels can be established. Option D is correct because a WAN edge router supports multiple WAN transport interfaces (MPLS, Internet, LTE/5G, etc.) and can build secure IPsec/GRE overlay tunnels over each, enabling application-aware path selection and transport failover. Option C is wrong because vManage is the management/analytics plane and does not forward data-plane traffic between branches; user traffic traverses the IPsec/GRE overlay tunnels directly between WAN edge routers. Option E is wrong because OMP is a control-plane protocol that runs between WAN edge routers and the vSmart controller (over DTLS/TLS), not between WAN edge routers and vManage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The vSmart controller is responsible for distributing control plane information such as OMP routes and policies to the WAN edge routers.
Why this is correct
The vSmart controller distributes OMP routes, policies and TLOC information across the overlay, satisfying the need for centralised control plane intelligence. It computes and pushes routing and policy decisions to WAN edge routers, which forward data plane traffic directly without transiting the controller.
- ✓
The vBond controller is primarily used for device authentication and orchestration of initial connections.
Why this is correct
The vBond orchestrator authenticates WAN edge devices and coordinates initial NAT traversal and connection setup, satisfying the requirement for secure onboarding. It acts as the first point of contact, validating device identity before controllers and edges establish their overlay tunnels.
- ✗
The vManage controller forwards all data traffic between branch sites.
Why it's wrong here
vManage is the management plane; it never carries data-plane traffic between branches. Forwarding happens directly between vEdge/cEdge devices over IPsec tunnels, with vSmart distributing routes. It is tempting because vManage's centralised GUI and configuration push make it appear to sit in the traffic path, which it does not.
- ✓
WAN edge routers can connect to the SD-WAN fabric using multiple transport interfaces (e.g., MPLS, Internet, LTE).
Why this is correct
SD-WAN edge devices support multiple WAN transports simultaneously, with each interface bound to a distinct tunnel. This satisfies the stem's requirement for true statements, since mixed MPLS, Internet and LTE uplinks let the router steer traffic per application policy and survive any single circuit failing.
- ✗
OMP (Overlay Management Protocol) runs between vEdge routers and the vManage controller.
Why it's wrong here
OMP peering is between vEdge routers and the vSmart controller, not vManage. vManage handles management, orchestration and configuration only. It is tempting because vManage is the most visible controller in the Catalyst SD-WAN fabric, so candidates assume all control-plane protocols terminate there.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.