A sanitation department must ensure WAN Edge to controller sessions cannot be trivially spoofed or read on the underlay. Which control-plane security property should they verify?
Select an answer to reveal the explanation.
Short Explanation
Control connections are the private radio channel between Edges and controllers—they need crypto and identity checks, not cleartext Telnet. DTLS/TLS with the SD-WAN certificate trust model keeps sanitation sites from getting spoofed on the underlay. Broadcasting OMP in the clear on the ISP handoff would be a civic disaster.
Full Explanation
A sanitation department must ensure WAN Edge to controller sessions cannot be trivially spoofed or read on the underlay by verifying that control connections are authenticated and encrypted with DTLS/TLS based on the SD-WAN trust model. Certificate-grounded control-plane security is foundational for civic overlays.
Control connections using cleartext Telnet with shared enable passwords only are insecure and not the SD-WAN control model.
Edges forming control sessions using HTTP without certificates to simplify onboarding abandons authenticated trust.
OMP advertisements sent as unauthenticated Layer-2 broadcasts on the ISP handoff invent an insecure, non-SD-WAN transport for overlay routing.
Exam caveat: protect certificate private keys and vBond allow-lists—encryption without identity lifecycle discipline still fails.
Operational check: verify DTLS/TLS control connections and valid certificates on a sample Edge, attempt to confirm cleartext absence with a capture on a lab span, and rotate/renew certs per policy. Record control-plane security checks in the sanitation SD-WAN hardening baseline. In municipal operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the platform code and policy revisions used by the civic network team.