ENSDWI practice questions
Cisco · ENSDWI · 300 questions
Original practice questions for the Implementing Cisco SD-WAN Solutions exam, covering every domain of the official exam outline.
This course contains the use of artificial intelligence.
About the ENSDWI exam
- Questions
- not published
- Passing score
- not published
- Format
- 90-minute exam associated with the CCNP Enterprise certification; languages English and Japanese
Schedule this exam The certification this earns
Exam details published by the vendor, checked 3 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Architecture (20%) · 60 questions
- A global fabric with 800 WAN Edges uses two SD-WAN Controllers in the US and one in EMEA with controller groups per region. The design must survive a controller loss without control-plane churn and keep regional affinity. Which control-plane scale and redundancy approach preserves stability with regional affinity?
- A service provider will grow to 2,000 WAN Edges across three regions and must survive loss of any single SD-WAN Controller without mass re-convergence, while keeping regional control traffic local where possible. Which control-plane scale and redundancy design with multiple controllers and groups meets regional resilience?
- A new manufacturing fabric has Manager and Controllers online, but two WAN Edges behind NAT cannot find peers and show no DTLS sessions. Staging confirmed certificates and organization name are correct. Which Validator orchestration and NAT discovery behavior should the engineer verify to allow initial authentication?
- A global logistics firm with 800 sites needs the control plane to survive a controller failure and to scale OMP load, considering three SD-WAN Controllers with affinity for regional edges. Connections must reconverge without full outage. Which control-plane scale and redundancy design using multiple controllers and controller groups meets the need?
- A manufacturing overlay sees new WAN Edge routers stuck with private addresses behind branch NAT that cannot establish DTLS to the Controller. The design relies on a reachable orchestrator to authenticate devices and help peers discover public mappings. Which SD-WAN Validator behavior provides initial authentication, orchestration, and NAT discovery?
- A new manufacturing site powers on its WAN Edge behind NAT with only the controller DNS name configured. It must authenticate its identity, learn the SD-WAN Controller and Manager addresses, and report its public IP and port. Which SD-WAN Validator role explains that bootstrap sequence?
- A retail chain needs rugged in-store routers, a virtual form for its private data center, and a cloud-hosted presence in AWS for SaaS breakout. Architects must justify placement by platform strengths and limits. Which statement correctly differentiates hardware, virtual, and cloud-hosted WAN Edge options for the rollout?
- A company needs ten rugged branches, fifty retail sites with local compute, and bursting cloud workloads in AWS. The architect must balance ruggedization, virtualization and cloud integration while keeping centralized management. Which WAN Edge platform mix best matches hardware, virtual and cloud-hosted capabilities?
- A global enterprise with 300 sites needs a single pane for provisioning templates, software upgrades, certificate management, and historical performance graphs plus programmatic access for its NetOps tools. No data-plane forwarding can depend on this element. Which SD-WAN Manager capability satisfies the centralized management requirement?
- A healthcare network needs a single pane to onboard gateways, push Day-0 configs, monitor tunnel health, retain alarms, and expose automation for its ticketing system. Which SD-WAN Manager capability set meets those management-plane needs?
- A distributed retailer with 120 stores needs one portal for zero-touch onboarding, configuration templates, software operations, and fabric-wide monitoring with API access. Regional admins require role-based access and audit logs. Which SD-WAN Manager management-plane capability should the architect designate for these tasks?
- A retailer needs hardware routers for 80 stores, virtual appliances on VMware in its data center, and auto-scaling gateways inside AWS to terminate SD-WAN tunnels. Which WAN Edge platform mix matches hardware, virtual and cloud-hosted needs?
- A regional hub aggregates 40 branches with dual transport and needs high aggregate throughput, redundant power and diverse WAN interface capacity, while small stores need only a compact branch router. Which edge selection best satisfies the hub throughput and resiliency needs for this design?
- A bank is troubleshooting why a new branch prefix is missing at remote sites while data-plane tunnels are up, and the design review must confirm control-plane responsibilities. Controllers show OMP peering established and policies unchanged. Which description correctly states the SD-WAN Controller role for control plane, route and policy distribution over OMP?
- A bank adds 60 new branches to its SD-WAN fabric with hubs in two data centers. Branch routes flap during maintenance and hub policies change weekly. Operations asks how routes and policy stay consistent without full mesh peering. Which description of the SD-WAN Controller role correctly explains control-plane distribution over OMP?
- A 60-user branch needs 500 Mbps encrypted throughput with PoE switching and Wi-Fi, a regional hub needs 5 Gbps aggregation for 30 branches with deep crypto scale, and a data center needs 20 Gbps core with redundancy. Budget is tight and only SD-WAN Edge models may be proposed. Which platform mapping best aligns throughput and feature needs to site roles?
- A company has 25 small shops needing basic routing, two regional hubs aggregating 500 Mbps of encrypted traffic with services, and a data center needing multi-gigabit throughput and redundancy. Budget limits overprovisioning. Which edge platform selection aligns throughput and feature needs to each site role?
- An enterprise with vEdge and cEdge sites reports inconsistent routing and missing centralized policies after adding a second Controller. All edges show control connections, but OMP routes differ between sites. Which Controller control-plane function should the engineer verify first to explain consistent route and policy distribution over OMP?
- A new site WAN Edge router has just received its certificate and organization name. Connectivity to the fabric controllers over the Internet must be authenticated before OMP can start. Which WAN Edge control-connection behavior correctly establishes its secure channels to each controller type?
- A campus team has IOS XE routers running classic EIGRP today and wants to migrate one pilot site to SD-WAN with centralized policy while keeping another router autonomous for local testing, using the same hardware family. Reboot flexibility and license needs matter. Which mode choice best fits centralized versus autonomous operation on this hardware?
- A campus has IOS XE routers running traditional routing that must join the SD-WAN overlay, while one router must stay on classic CLI routing for a legacy lab. Which operating mode distinction allows fabric membership versus standalone routing on these platforms?
- A manufacturing firm deploys 80 WAN Edges with dual transports to redundant Managers, Controllers, and Validators. Operations requires encrypted control and expects each edge to keep persistent control connections to its Manager and Controllers. Which WAN Edge data-plane and connection behavior should the engineer verify to meet the design?
- A new engineer diagrams steady-state connectivity for a single-homed branch WAN Edge and must label control versus data connections to each controller type. Tunnels to other branches are already shown. Which description correctly states the WAN Edge role in the data plane and which DTLS/TLS connections it forms to each controller?
- A distributor owns IOS XE routers capable of SD-WAN that currently run traditional routing with EIGRP and ZBFW, and IT wants to migrate selected sites to SD-WAN without replacing hardware. Some sites must stay traditional. Which mode distinction guides migration of IOS XE SD-WAN-capable routers?
- A retailer connects 40 stores to two data centers over MPLS and internet. Stores must learn LAN prefixes with their VPN IDs, edge routers must learn which WAN next-hops are reachable, and two hubs must advertise firewall service insertion. Which OMP route type should the engineer check for the firewall advertisement?
- A retail company is refreshing 80 branches that each carry about 300 Mbps of mixed MPLS and Internet traffic, need on-box intrusion prevention with TLS inspection, and must run application-aware routing with active SLA probes while keeping headroom for bursts. Which platform sizing principle ensures the WAN Edge sustains security and app-QoE services?
- A new engineer sees SD-WAN Controller advertising three tables and confuses customer prefixes with tunnel endpoints and firewall services. The fabric uses MPLS and internet TLOCs with a firewall service at HQ. Which description correctly maps OMP routes, TLOC routes and service routes to what each carries?
- A 300-user headquarters needs integrated threat defense, SSL proxy, and application-aware QoE with analytics on its WAN Edge while keeping throughput headroom for growth. Budget requires right-sizing hardware and entitlements upfront. Which sizing decision best aligns platform and licensing to those security and QoE needs?
- A multinational reports that branch prefixes appear in SD-WAN Manager but internet exits and firewall services are not advertised correctly, and engineers debate which OMP advertisements carry what. The fabric uses SD-WAN Controller for route reflection with service-side and transport attachments. Which OMP route type mapping correctly describes OMP routes, TLOC routes, and service routes and what each carries?
- A healthcare group is sizing 25 new clinics where each WAN Edge must run on-box firewall, IPS, URL filtering and continuous application QoE monitoring for telehealth, with room for throughput growth. Procurement wants the lowest cost that still meets services. Which sizing consideration should the architect prioritize to support security and app-QoE services?
- A branch uses Cloud OnRamp for SaaS for Microsoft 365 with dual Internet transports and a gateway site offering a cleaner path. Probes show the local Internet path degrading while the gateway path stays excellent. Which Cloud OnRamp for SaaS behavior selects the best exit for the application?
- An energy utility has dual-transport routers where internet and MPLS links flap and tunnels form unpredictably. The engineer must explain why a private 10.1.1.1 MPLS link and a public 203.0.113.5 internet link build separate tunnels. Which TLOC description should the engineer use to explain deterministic tunnel formation?
- A logistics company adds LTE and MPLS at 50 branches and sees tunnels forming unpredictably, with some branches preferring the wrong transport despite policy. The architect must explain how endpoint identity steers IPsec tunnel formation. Which TLOC structure description correctly links system IP, color, and encapsulation to how TLOCs drive tunnel formation?
- A head office uses Cloud OnRamp for SaaS for Microsoft 365 with DIA at three branches and a gateway site. Users complain about Teams quality when a branch Internet path degrades. Which Cloud OnRamp for SaaS behavior best selects the best exit for the SaaS application?
- Two branches each have dual transports but only one IPsec tunnel forms instead of four. Both use the same system IP scheme and colors look mismatched in SD-WAN Manager. Which TLOC-structure insight explains how system IP, color and encapsulation drive tunnel formation?
- A media company with 60 branches uses Cloud OnRamp for SaaS for Microsoft 365, with dual transports at each site and both regional and local internet exits available. Users report variable Teams quality while direct internet is underutilized. Which Cloud OnRamp for SaaS path selection behavior should the engineer verify to choose the best exit for the SaaS application?
- A national retailer with 90 stores uses SD-WAN Manager to monitor Microsoft 365. Stores have uneven ISP quality and IT wants cloud probing from two hub sites to pick the best egress for SaaS. Local DIA alone lacks visibility. Which Cloud OnRamp for SaaS model should the engineer select to meet centralized probing requirements?
- A 200-store retailer uses Microsoft 365 and Salesforce from every branch with dual internet transports and no regional hub. Stores need the lowest latency path with continuous performance probing and automatic best-path selection, while IT wants no extra tunnel hops. Which Cloud OnRamp for SaaS path selection model meets these SaaS performance requirements?
- A manufacturer connects plants with private MPLS and public internet. Compliance requires encrypted transport over internet, but operations wants lightweight overhead for native MPLS with no encryption. The WAN Edge routers support both encapsulations per tunnel. Which data plane encapsulation choice should the engineer apply to satisfy both transport requirements?
- A 300-user SaaS-heavy firm sees variable Microsoft 365 performance across branches, has no regional gateways, and wants automated best-path SaaS selection without deploying new data-center hubs. Which Cloud OnRamp for SaaS model best fits this SaaS performance requirement?
- A logistics firm runs encrypted SD-WAN over DIA and private MPLS where voice needs confidentiality on Internet but legacy probes on MPLS need unencrypted encapsulation for inspection. The design must preserve overlay routing while matching per-transport security needs. Which data plane encapsulation choice correctly applies IPsec versus GRE for this traffic?
- A logistics firm encrypts all inter-site traffic over the Internet but needs unencrypted transport for a private MPLS leg to support non-IPsec inspection, while keeping overlay routing intact. Which data-plane encapsulation choice correctly distinguishes IPsec versus GRE usage?
- An enterprise runs voice and video over dual Internet links, needs sub-second failure detection, and wants SD-WAN to steer traffic using live loss, latency and jitter per tunnel. Which BFD design on tunnels best provides purpose, timers and path-quality measurement?
- A multinational needs predictable, private-like connectivity from 40 branches to workloads in AWS and Azure VPCs/VNets without backhauling through its data centers. Security requires auto-provisioned IPsec to cloud gateways with OMP routing end to end. Which Cloud OnRamp for IaaS connectivity design meets this multicloud transit requirement?
- A manufacturer extends its fabric to AWS and Azure, hosts workloads in multiple VPCs and VNets, and needs scalable private transit without per-branch IPsec sprawl to each VPC. Which Cloud OnRamp for IaaS connectivity design best meets this cloud transit requirement?
- An e-commerce firm needs subsecond failover for payment traffic and historical loss, latency and jitter per tunnel to guide SLA policies. Links show intermittent brownouts that routing protocols miss, so continuous liveness and quality measurement on every tunnel is required. Which BFD role with timers and path-quality reporting meets this need?
- A financial firm runs voice over dual internet and MPLS tunnels and needs sub-second detection of brownouts plus continuous measurement of loss, latency and jitter for SLA steering. Probes must run on every tunnel without user traffic. Which BFD on tunnels design should the engineer configure to feed path-quality measurement?
- A logistics company is extending its SD-WAN fabric to AWS and Azure with VPCs and VNets in three regions. It needs scalable private connectivity from branches without per-branch IPsec sprawl and with centralized routing control. Which Cloud OnRamp for IaaS design should the engineer describe to provide transit cloud access?
- A service provider is building a Cloud OnRamp for Colocation cluster in a downtown colo with two compute hosts, needing firewall plus WAN optimization in a chain and shared DNS for tenants. Which design statement should the architect present to describe Cloud OnRamp for Colocation service chaining and shared services?
- A regional hub uses a public transport address while a new remote office sits behind a firewall doing port address translation. The branch must build control connections and direct IPsec tunnels to the hub without a public address on its transport. Which statement correctly describes NAT effects and the Validator role in NAT discovery?
- A retail chain places WAN Edge routers behind broadband NAT at 200 stores, with a SD-WAN Validator and SD-WAN Controller reachable on public IPs in the cloud. Stores must form control connections and then direct IPsec tunnels between sites. Which statement describes NAT handling and the Validator role in NAT discovery?
- A retailer wants firewall and IDS inspection for branch Internet traffic at two colocation sites, sharing the same security stack across tenants and steering selected branches through it without backhauling to the data center. Which Cloud OnRamp for Colocation design meets this service chaining requirement?
- Two branches sit behind carrier NAT with only private addresses, while the data center has public IPs. Edges can reach the Validator and Controller but peer IPsec fails until NAT addresses are learned. Which statement correctly describes NAT impact and the Validator role in NAT discovery for control and data connections?
- A healthcare group needs firewall, IDS and load-balancer functions hosted in two colocation facilities to serve 120 clinics with shared inspection before cloud access. Which Cloud OnRamp for Colocation design should you deploy for service chaining and shared services in a colo cluster?
- A global enterprise is expanding to a Multi-Region Fabric with North America and Europe as separate regions connected through a core, requiring inter-region traffic to transit border routers and preferred hierarchical paths. The design team asks how regions and roles enforce this hierarchy. Which Multi-Region Fabric description answers how access, core, and path selection interact for this requirement?
- A manufacturer uses AWS and Azure plus a private cloud exchange to reach SaaS, with branches needing automated optimal paths and consistent segmentation across clouds. New VPCs appear weekly. Which multicloud and interconnect integration best extends the SD-WAN fabric to these clouds?
- A global enterprise adopts Multi-Region Fabric with 12 access regions in Americas, EMEA and APAC plus a high-capacity core backbone. Intercontinental spokes suffer suboptimal paths and excessive peering. Which hierarchical design correctly uses regions, border routers, and path selection for scalable inter-region routing?
- A global enterprise with 500 sites across Americas, EMEA and APAC suffers suboptimal tromboning when all traffic transits one hub, and needs hierarchical routing with regional isolation. Planners propose Multi-Region Fabric with access and core roles. Which hierarchical path selection design meets the isolation requirement?
- A retailer runs workloads in AWS and Azure, needs consistent segmentation from branches to VPCs/VNets, and wants automated connectivity without manual IPSec to each cloud. Which integration approach should the architect propose for multicloud and cloud interconnect with the SD-WAN fabric?
- A retailer expanding to AWS and Azure needs branch inventory traffic to reach cloud workloads securely, needs consistent segmentation, and must avoid manual IPsec tunnels per VPC. Which multicloud and cloud interconnect integration should you deploy with the SD-WAN fabric?
Controller Deployment (15%) · 45 questions
- A bank must deploy SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator in a closed network with no internet access, using its internal PKI to issue all controller identities and requiring manual vetting of each device. Which certificate authorization option supports closed-network controller identity with enterprise PKI?
- A midsize bank wants cloud-delivered controllers to avoid data-center hardware but must retain ownership of overlay design, security policy, and daily operations for audit compliance. The architect must explain the shared responsibility boundary before signing. Which division between Cisco-hosted and customer-managed duties describes cloud-delivered controller deployment?
- A manufacturer is bringing up a new fabric with an enterprise CA, and controllers plus 40 WAN Edges fail authentication because the root chain is missing. Installations must trust the same enterprise root on all devices before certificates validate. Which installation of the root certificate chain on controllers and WAN Edges establishes trust correctly?
- A retail chain with 120 stores has no spare data-center capacity and orders Cisco-hosted controllers to speed rollout. Internal IT must retain device onboarding, configuration templates, and routing and security policy design for compliance. Which shared-responsibility split correctly describes Cisco-hosted controller cloud deployment?
- A new deployment has SD-WAN Manager, two controllers and fifty WAN Edges that show certificate errors and fail to establish DTLS/TLS sessions despite reachability to the Validator. The root CA chain was recently renewed. Which certificate-chain installation step restores trusted control connections for controllers and edges?
- A 30-site retailer wants cloud-delivered controllers to avoid managing Linux, hypervisors, and controller upgrades, but must retain control of policies, device configs, and WAN Edge routers. Which shared-responsibility split describes that cloud deployment?
- A retail chain approved cloud-hosted controllers and must gather everything Cisco needs to instantiate its overlay before cutover. The team owns its Smart Account, WAN Edge serials, and WAN bandwidth details. Which information and prerequisites package enables onboarding of the cloud-hosted controller overlay?
- A startup ordered 15 WAN Edge routers and purchased cloud-hosted controllers for a new overlay with company domain cisco-start.example. The deployment must pass authentication and allow zero-touch onboarding. Which prerequisite set must the engineer gather before onboarding the cloud overlay?
- An enterprise using private PKI sees DTLS failures after replacing controllers because WAN Edges do not trust the new controller certificates. The chain was never pushed beyond the CA server. Which root-certificate installation restores trust on controllers and WAN Edges?
- An enterprise onboards 200 WAN Edges through SD-WAN Manager, where the procurement list must authorize devices and operators must track which routers are approved, testing, or rejected before control connections form. Sync failures currently block onboarding. Which upload of the WAN Edge authorized serial number list and handling of device validation states resolves onboarding?
- A regional retailer with 40 stores approved hosted SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator in AWS. Branches have internet only, the overlay must use valid certificates, and all controllers must share the same organization name. Which prerequisite set must the engineer confirm first to onboard the cloud-hosted controller overlay?
- A retailer is staging 25 new WAN Edge routers for stores. The engineer syncs the Smart Account and uploads the authorized serial file in SD-WAN Manager, but five routers show Invalid while the rest show Valid. Which validation check determines that an Invalid device cannot establish control connections?
- An enterprise received 80 new WAN Edge serial numbers and chassis numbers from logistics, and SD-WAN Manager shows some devices as staging while new routers cannot join the fabric. The validator is reachable and certificates are valid. Which certificate and device-list action authorizes the routers and clarifies validation states?
- A manufacturer plans redundant controllers in two company data centers for control-plane resilience. One site runs VMware ESXi and the other runs KVM, and leadership may later extend controllers into AWS or Azure without changing deployment model. Which controller hosting statement correctly describes supported on-premises deployment platforms?
- A logistics firm replaced its PKI and several WAN Edge routers show control connections flapping after a root CA rollover, with one branch certificate past expiry and another listed on the CRL. Controllers remain reachable and clocks are correct. Which action addresses the certificate states that keep these two edges from holding control connections?
- A government agency requires all SD-WAN controllers to run in its own data centers and approved public cloud accounts for sovereignty, with no Cisco-hosted option. The architect must list viable placements for the Manager, Controller, and Validator. Which set identifies supported hosting platforms for customer-hosted controllers?
- A branch edge with a valid certificate suddenly loses all control connections after an administrator revokes its certificate, and another edge warns of impending expiry. Which certificate lifecycle effect explains the revoked device losing fabric access immediately?
- A bank requires all SD-WAN controllers to run in its own data centers or its approved public cloud for data sovereignty. It uses VMware ESXi on premises and hosts workloads in AWS and Azure, with no bare-metal provisioning team. Which hosting approach satisfies the on-premises and cloud controller requirement?
- A regional retailer has 40 WAN Edge routers with enterprise CA certificates, and overnight three stores lost OMP routes while DTLS to the SD-WAN Controller stays down after a certificate renewal window. Valid serials still appear in SD-WAN Manager but one device shows an expired validity date. Which certificate lifecycle condition should the engineer validate first to explain the failed control connections?
- A regional bank is installing Cisco SD-WAN controllers on-premises in its own data center with an isolated management network, three static public IPs for VPN 0 reachability, and a single registered enterprise name to bind all devices. The engineer must bring up SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator consistently. Which initial installation sequence correctly applies system IP, VPN 0, and organization name for controller on-premises deployment?
- A logistics firm installs three on-premises controllers in its data center for a new overlay with organization name LogiCorp. Edge routers fail to authenticate and form no control connections despite reachable IPs. Which initial installation setting should the engineer verify first to restore controller adjacency?
- A new WAN Edge at a warehouse shows no OMP routes and users report no SD-WAN reachability. SD-WAN Manager shows the Edge flapping between connect and challenge, then tear-down toward the SD-WAN Controller. Which interpretation of these control-connection states guides troubleshooting?
- A partner must stage SD-WAN Manager, SD-WAN Controller and SD-WAN Validator for a new customer isolated lab with no prior controllers. They have IPs, certificates and WAN links ready but devices cannot join. Which initial installation sequence with system IP, VPN 0 and organization name allows controllers to form the fabric?
- After a certificate renewal, a branch WAN Edge shows no OMP routes and users report intermittent reachability. SD-WAN Manager shows one controller connection stuck in challenge and another in tear-down. Which interpretation of the control connection states best guides troubleshooting?
- A new branch WAN Edge shows no OMP routes, and the operations team reports the control connection to the SD-WAN Controller flaps between challenge and tear-down even though the Validator is reachable. Authentication was recently changed. Which interpretation of the control connection states should guide the next troubleshooting step for control plane connectivity?
- A service provider outgrows a single SD-WAN Manager handling 800 devices, with statistics lagging and configuration commits queuing. The plan adds two nodes for scale and resiliency without splitting the overlay. Which cluster design should the architect deploy to distribute Manager load?
- A service provider manages 2,000 WAN Edges from a single SD-WAN Manager that now suffers slow upgrades, search timeouts, and statistics gaps during peak polling. The team plans a three-node cluster while preserving services. Which Manager cluster scaling description correctly states the role of each node service for this growth?
- A bank is deploying controllers on premises across two data centers to survive loss of a full site and a single node, with 400 WAN Edges needing deterministic rehoming without manual reconfiguration. WAN Edges receive multiple addresses and must maintain control during failures. Which redundancy design ensures WAN Edges use multiple Validators and Controllers correctly?
- A new WAN Edge at a warehouse never reaches the controllers. It reaches the SD-WAN Validator on UDP 12346, but its DTLS handshake is repeatedly rejected, and the serial is already whitelisted. Which control-connection failure cause best explains this symptom set for control-plane troubleshooting?
- A new WAN Edge at a warehouse shows DTLS down to the SD-WAN Controller and SD-WAN Validator, its system clock is 18 minutes behind, its certificates were issued 10 minutes ago and the organization name matches. Underlay ping to controllers succeeds. Which control-plane connectivity issue should the engineer fix first to restore secure peering?
- A bank plans an on-premises SD-WAN Manager cluster for 800 WAN Edge routers with high availability and separate statistics collection. The design must keep configuration, control messaging and analytics available during a single server loss. Which Manager cluster scaling approach should the architect describe to satisfy resilience and service separation?
- Four new WAN Edges at a warehouse fail to establish control connections after a template push. SD-WAN Validator is reachable, certificates show valid, organization name matches, but logs show TLS errors and the devices are five minutes behind NTP. Which control-plane connectivity failure reason explains this onboarding symptom?
- A financial customer deploys controllers on-premises across two data centers, requires survival of a full site loss, and needs deterministic WAN Edge behavior when controllers become unreachable. Which redundancy design correctly uses multiple Validators and Controllers and WAN Edge connectivity?
- A healthcare network deploys two Validators and two Controllers on premises across data centers for 300 branches. A single controller-site failure must not block new branch onboarding or policy updates. How should the engineer describe WAN Edge use of redundant Validators and Controllers to ensure control-plane resilience?
- A district store router shows no control connections after staging, the template push failed, and the operations lead needs the fastest isolation of certificate versus reachability causes. Which show-command and Manager GUI workflow best diagnoses this join failure?
- A service provider plans an on-premises deployment for 1800 WAN Edges, dual transports per site, and 120k OMP routes with headroom for 30% growth and controller failover. The design must account for control load, tunnel scale and route capacity together. Which sizing approach correctly factors devices, tunnels and OMP routes for controllers?
- A new branch WAN Edge at a retail store shows no control connections, the site has Internet reachability, the serial is in Plug-and-Play, and the admin suspects certificate or Validator reachability. Which diagnostic approach should the engineer use to determine why the WAN Edge fails to join the control plane?
- A regional bank plans an on-premises SD-WAN Controller deployment for 1,200 WAN Edges, each with dual transports and full routing tables pushing 180,000 OMP routes fabric-wide. The server team asks what drives vCPU, RAM and scale limits. Which sizing factor should the engineer assess first to size the on-premises controller deployment?
- A new WAN Edge at a retail store will not join the fabric. It has DHCP Internet access, correct system clock, and reaches the Validator, but the Manager GUI shows the device as invalid and no control connection is established. Which troubleshooting check best identifies why this WAN Edge does not join the fabric?
- A defense supplier must deploy SD-WAN Controllers on-premises with no Internet access to Cisco cloud services, using its internal PKI to issue all identities with short-lived certificates. Which certificate authorization approach should the engineer select for controller identity and onboarding?
- A bank places WAN Edges behind a stateful firewall with NAT to reach hosted Controllers over the Internet. Control connections intermittently fail during initial bring-up, while user data sessions work after establishment. Which firewall and NAT handling allows DTLS/TLS control connections to form reliably?
- A healthcare company must onboard SD-WAN Controllers and 80 WAN Edges with strict audit rules: production controllers need automated scalable trust, while a isolated lab needs temporary bring-up without external PKI. Security approved Cisco cloud PKI for production and manual install for lab. Which certificate authorization plan satisfies both environments for this deployment?
- A bank WAN Edge behind a branch firewall must build DTLS control to a cloud-hosted Controller and Validator, outbound HTTPS is open, but control never forms while data traffic works. Which firewall and NAT port requirement should the engineer verify to restore DTLS/TLS control connections?
- A hospital behind a strict firewall is onboarding new branches where control connections stall during DTLS handshake, NAT hides private addresses, and only HTTPS is currently allowed outbound. Which firewall and NAT ports should you open for DTLS/TLS control connections?
- A service provider plans an on-premises controller cluster for 800 WAN Edge routers with dual transports and a full internet routing table redistributed at data centers, expecting 150,000 OMP routes. Architects must choose server resources and clustering. Which sizing factor for on-premises controllers addresses the scale requirement?
Router Deployment (20%) · 60 questions
- A branch cEdge has Internet transport in VPN 0 and LAN subnets in VPN 10 with OMP running to the fabric. Users need Internet-bound traffic steered centrally while intra-VPN routes stay isolated and service routes redistribute correctly. Which data-plane routing design correctly links the service side to the overlay?
- A national retailer has 60 stores with MPLS color gold and broadband color blue on each WAN Edge, and policy requires gold TLOCs talk only to gold and blue only to blue to honor transport contracts. Adjacencies are forming across colors today. Which restrict configuration on colors limits tunnel formation across colors as required?
- A regional bank connects branch LANs with eBGP to a core switch in VPN 20 and must advertise those LAN prefixes into the SD-WAN overlay. Templates are mandatory, and the WAN Edge must still form OMP peerings over both transports. Which BGP and overlay advertisement design using feature templates should the engineer deploy for service-side BGP?
- A logistics firm must upgrade two SD-WAN Controllers overnight while 300 WAN Edges keep forwarding voice traffic without drops. OMP peering will flap during the upgrade and the team needs forwarding to continue on stale routes briefly. Which OMP graceful-restart and timer configuration preserves forwarding during controller maintenance?
- A university streams commencement video from a source behind its data-center WAN Edge to receivers at 12 campus WAN Edge sites over the SD-WAN overlay. The transport providers do not carry multicast and several campuses sit behind NAT. Which overlay multicast design delivers the stream to all campus receivers?
- A logistics firm ships 40 unconfigured WAN Edge routers to branches with only DHCP internet and no onsite CLI skills. Each router must power on, reach Plug and Play Connect, authenticate, and become fully managed without manual login. Which zero-touch provisioning flow from device boot describes the correct WAN Edge onboarding sequence?
- An MSP must onboard 200 retail WAN Edge routers with reusable VPN, interface, and routing blocks that assemble differently per store size, plus a guided deployment workflow with configuration preview. Which modeling choice best contrasts configuration groups and feature profiles with legacy device templates?
- A small clinic has one WAN Edge with only a single MPLS circuit, while a neighboring admin router on the same LAN has both MPLS and internet transports. The clinic must use the neighbor's internet without adding a circuit. Which TLOC extension design lets a router borrow another router's transport and how is it configured?
- A manufacturer has dual transports at each plant, MPLS for bulk replication and internet for interactive apps, and needs branch routers to prefer internet TLOCs when reaching the cloud gateway. Which TLOC preference configuration steers path selection toward the destination over internet?
- A campus edge runs EIGRP with two distribution switches in VPN 30 and must share campus subnets with remote sites over SD-WAN. The WAN Edge must keep EIGRP adjacency local while making routes visible to OMP peers. Which EIGRP and OMP redistribution design should the engineer configure?
- An oil-field site has no DHCP, no internet, and no Plug and Play Connect reachability, but the engineer onsite can paste CLI via console to bring one WAN Edge online. The router has its certificate and root CA installed. Which manual bootstrap configuration versus ZTP distinction brings the isolated WAN Edge into the overlay?
- A campus WAN Edge runs OSPF to the LAN in VPN 10 and eBGP to a data-center peer in VPN 20, but remote sites receive every LAN prefix including test subnets. The engineer must limit overlay advertisements to production prefixes. Which OMP redistribution control advertises only intended prefixes into the overlay?
- A retailer has dual-transport branches with MPLS and internet TLOCs and a central policy must keep guest Wi-Fi off MPLS during normal operation while allowing failover if internet is down. Centralized data policy already matches guest traffic. Which control in the policy action steers guest traffic to specific transports?
- A regional retailer is opening 40 stores with identical dual-transport WAN Edge routers, and the operations lead wants junior staff to follow guided steps for onboarding and site setup without editing CLI templates. The deployment must use reusable feature profiles and enforce consistency. Which Manager workflow should the lead select to guide onboarding and site configuration?
- A retailer has 400 spokes with full-mesh policy but most stores rarely call each other, and operations wants fewer idle IPsec tunnels to save resources while keeping direct spoke-to-spoke voice optimal when needed. Spokes already have control connections and data-plane reachability. Which on-demand tunnel behavior achieves direct optimal forwarding only when traffic appears?
- A university streams commencement over IPv4 multicast from the data center to 30 campuses. Campuses run PIM on their LANs, WAN links are mixed internet and MPLS, and the design must carry multicast across the overlay without native multicast on transports. Which multicast support combination should the engineer describe to meet all three facts?
- An enterprise has four diverse transports at each data center edge and wants OMP to load-share to a branch prefix over all healthy paths. The engineer sees only one path installed. Which OMP best-path and multipath behavior explains expanded forwarding over equal-cost paths?
- A logistics firm redesigns its network with data center hubs in Frankfurt and Chicago plus 120 spokes. It needs deterministic spoke-to-spoke paths via hubs, no spoke transit, and survival if one hub or its WAN links fail. Which hub deployment design meets the resiliency and path-control requirement?
- A healthcare group shipped 25 unconfigured WAN Edge routers to clinics with only internet access and DHCP, requiring plug-and-play onboarding with no console access and full Manager control afterward. Certificates must be validated and configuration delivered automatically. Which sequence describes the zero-touch provisioning flow from device boot to a fully managed WAN Edge?
- A data center edge must survive a brief SD-WAN Controller outage and software upgrade without dropping existing overlay data flows. Which OMP graceful restart and timer behavior preserves forwarding during short control-plane interruptions?
- A retail chain streams training video from headquarters to 200 stores over the overlay. The design names two data-center edges as replicators, stores act only as receivers, and PIM runs only on store LANs. Which role behavior should the engineer verify to ensure overlay multicast delivery works as designed?
- A branch WAN Edge has MPLS on ge0/0 and broadband on ge0/1, both in VPN 0. MPLS must carry private TLOC with GRE, broadband must carry public TLOC with IPsec, and only HTTPS and SSH may terminate on the broadband interface. Which transport interface configuration meets the encapsulation and service requirement?
- A bank must onboard 60 identical branches with routed ports, VPNs and security policies, allow one site-specific IP per branch, and minimize future change windows. Engineers have tested feature templates in the lab. Which device-template workflow builds reusable configuration and attaches it correctly to devices?
- A clinic edge has patient VLAN 10 needing Internet via SD-WAN overlay and printer VLAN 20 staying local, but users report VLAN 10 cannot reach the fabric while underlay to the ISP is up. Service VPN 10 and transport VPN 0 exist with correct DIA policy. Which underlay-overlay routing linkage most likely restores VLAN 10 forwarding into the fabric?
- A regional clinic deploys a WAN Edge with a connected LAN in VPN 10, a static route to a printer subnet, and OSPF-learned clinical subnets in VPN 10. OMP must share the LAN and printer routes to remotes but withhold OSPF routes until migration completes. Which OMP redistribution control achieves this selective advertisement?
- A bank manages 300 branches with legacy device templates attached per device, and every WAN interface change forces a full template re-push. The team wants modular reusable blocks for system, transport and service VPNs with separate variables. Which configuration approach should the architect choose to replace legacy device templates?
- A bank migration team standardizes 80 branches with feature templates in SD-WAN Manager but needs per-site OSPF timers and a syslog tweak not exposed in any feature template field. Change control requires reusable structured config with rollback via templates. Which template strategy should the engineer choose to deliver the standardized branch configuration?
- A manufacturer has dual transports MPLS and Internet at a hub, both reaching remote Site 10. Engineering wants Internet preferred for bulk replication traffic to that prefix, with MPLS as backup, without changing system-wide defaults for other sites. Which TLOC preference configuration best influences path selection toward that destination?
- A retail chain must onboard 80 stores with no on-site engineers, strict change windows, and two flagship sites needing custom certificates and static addressing for audit. The lead must choose between ZTP with Plug and Play Connect and manual bootstrap for WAN Edge deployment. Which WAN Edge deployment comparison correctly distinguishes manual bootstrap versus ZTP and Plug and Play Connect?
- A manufacturer uses MPLS private color and internet public color on all WAN Edges. Compliance forbids any tunnel that would bridge private MPLS to internet transport via the fabric, but each color must still mesh fully with the same color. Which restrict-attribute design on colors enforces this tunnel separation?
- A bank is consolidating two data centers and four regional hubs serving 300 branches that need deterministic exit, sub-second failover, and localized policy without full mesh complexity. Architects debate hub roles, redundancy, and peering. Which data center and regional hub deployment consideration correctly applies hub-and-spoke and resiliency for WAN Edge deployment?
- A small clinic has one router with only a private MPLS circuit and a neighboring warehouse router with MPLS plus internet. The clinic must use the warehouse internet for DIA without adding a circuit. Which TLOC-extension design lets the clinic borrow transport correctly?
- A logistics site has MPLS, Internet, and LTE transports. Dispatch traffic must use MPLS primarily with LTE as backup, while guest traffic must use Internet only. Centralized data policy already matches the apps. Which TLOC list design best steers traffic to the specific transports?
- A school district has two WAN Edge routers sharing one LAN gateway address for 300 classroom devices, requiring subsecond failover if the primary access switch link or router fails. Templates must keep both routers consistent. Which VRRP design should the engineer implement on the service side for LAN redundancy?
- A retail chain must onboard 120 stores quickly with consistent WAN, LAN and security settings, but junior staff make CLI errors and skip steps. The lead wants guided tasks with validation and reusable site variables. Which Manager capability should the lead use to streamline repeatable onboarding?
- A data-center Edge receives the same 10.50.0.0/16 prefix from two branches over different transports with identical OMP attributes and loss, latency, and weight. Users expect load sharing while preserving deterministic best-path behavior for unequal paths. Which OMP best-path and multipath outcome applies?
- A retail chain uses 80 spoke stores with dual transports behind a regional hub. Full-mesh tunnels overload small routers, but occasional store-to-store voice needs direct paths. The design requires tunnels to appear only when spoke-to-spoke traffic arrives. Which on-demand tunnel behavior should the engineer configure to meet direct spoke communication?
- A new retail branch receives a factory-default WAN Edge router with its serial added to Plug and Play Connect and DHCP on Internet transport. The branch needs automatic authentication, controller discovery, certificate enrollment and template attachment with no staging. Which ZTP sequence provisions the router from boot to fully managed state?
- A bank must onboard 40 WAN Edge routers with common VPN, routing and security settings plus per-site TLOC colors. The engineer built system, VPN and interface feature templates in SD-WAN Manager and needs consistent push with site variables. Which device template workflow should the engineer perform to complete centralized provisioning correctly?
- A regional bank maintains OMP peering between WAN Edges and two SD-WAN Controllers during a planned controller upgrade, needs forwarding to continue briefly if OMP drops, and wants predictable reconvergence. Which OMP graceful-restart and timer behavior best supports this OMP requirement?
- A new manufacturing site has dual transports for Internet and MPLS, must build IPsec tunnels on each uplink, identify each path correctly, and permit SSH and NTP inbound only on the MPLS interface. Which transport interface configuration correctly implements color, tunnel interface, encapsulation and allowed services?
- A campus edge connects to an OSPF area 0 LAN in VPN 10 with two equal paths and must advertise only the 10.10.0.0/16 summary into the SD-WAN overlay for remote sites. OSPF adjacency is up but remote branches see every /24 instead of the summary. Which OSPF and OMP redistribution control fixes this service-side route advertisement?
- A regional hospital group runs a central records hub with fiber and LTE TLOCs in VPN 20 advertising patient-imaging prefixes. Clinics must send imaging uploads to the fiber TLOC for throughput, fail over automatically to LTE if fiber is unreachable, and require no extra routing policy on clinic routers. Which TLOC preference configuration on the hub best controls path selection toward the destination?
- A mining site has no Internet or DNS for ZTP, strict change control forbids Plug and Play Connect, and a field tech has a console cable plus a USB with certificates. The router must join controllers manually with verifiable bootstrap and minimal exposure. Which bootstrap method contrasts correctly with ZTP and Plug and Play Connect for this offline site?
- A retailer’s operations team uses standardized feature templates in SD-WAN Manager but needs a one-off banner and OSPF cost tweak on ten stores without rebuilding templates. Changes must survive reattaches and stay visible for audit. Which template strategy should the engineer choose to deliver device-specific customization correctly?
- A campus adds SD-WAN with OSPF on the service side and OMP in the overlay. LAN subnets must be advertised into the fabric, remote site prefixes must be injected back to OSPF, and transport interfaces must stay isolated from service routes. Which underlay and overlay interaction should the engineer configure to achieve correct routing exchange?
- A distribution site connects to an eBGP peer AS 65020 in VPN 20 and must advertise its three local aggregates (172.16.0.0/16, 172.17.0.0/16 and 172.18.0.0/16) to remote branches via the overlay while preventing a 192.168.99.0/24 management prefix from leaving the site. BGP is established but all routes appear remotely. Which BGP and overlay advertisement control meets this site requirement?
- A retail chain has 60 stores and two hubs, each with an MPLS interface using color mpls and a broadband interface using color biz-internet. Compliance requires that MPLS TLOCs never form data-plane tunnels to any other color, while broadband TLOCs may tunnel to any color they can reach. Which configuration meets this requirement with no additional policy?
- A logistics firm has dual transports at each branch, MPLS for voice and broadband Internet for bulk data, but video conferencing flaps when both TLOCs are equal cost. Which TLOC list design should you apply in policy to steer traffic to specific transports?
- Two WAN Edges serve a hospital access LAN from the same service VPN and subnet. Nurses require one stable gateway IP during a router reload, with fast failover and consistent service-VPN routing. Which VRRP template design provides LAN redundancy for this service-side requirement?
- A campus WAN Edge connects to legacy EIGRP switches in VPN 10, must advertise three campus subnets to remote sites, and must prevent routing loops when learning OMP routes back. Which configuration approach should the engineer implement to redistribute EIGRP service-side routes into OMP?
- A national retailer is consolidating two data centers as regional hubs for 300 stores in a hub-and-spoke design, requiring continued store-to-DC access if one DC fails and no store-to-store transit through a single point. Budget allows dual routers per DC but not full mesh. Which data center and regional hub deployment approach satisfies resiliency for this hub-and-spoke requirement?
- A logistics firm runs OSPF and connected subnets at 60 sites and must advertise only selected branch prefixes into the SD-WAN overlay while preventing core loopback prefixes from entering OMP. OMP is enabled with default behavior on all Edges. Which control for redistribution into OMP satisfies the selective advertisement requirement?
- A retail store has one router with LTE and a second router with wired broadband only 2 meters away, but pulling a second carrier into both routers is too costly. The engineer wants the LTE-less router to use its neighbor for path diversity. Which TLOC extension design correctly shares transport between the collocated routers?
- A 400-site retail fabric runs full mesh-capable transports, but constant IPsec to every spoke wastes resources and 95% of store-to-store traffic is occasional inventory lookup. The engineer wants tunnels only when needed. Which on-demand tunnel behavior correctly triggers dynamic spoke-to-spoke data-plane tunnels?
- An e-commerce company has four equal-cost MPLS and internet transports at large data centers and needs active-active load sharing across all healthy paths, with fast failover if one degrades. OMP has selected multiple equal paths to key prefixes. Which OMP best-path selection and equal-cost multipath behavior enables the load-sharing requirement?
- A branch WAN Edge has two ISP links that must be distinguished as biz-internet and public-internet colors, carry IPsec with GRE fallback, and allow only HTTPS and SSH for management from the overlay. The engineer must configure the transport interfaces correctly. Which transport interface configuration on the WAN Edge router fulfills this color, encapsulation, and service requirement?
- A university streams lectures to three campuses, sources sit behind service VPNs, the overlay traverses the Internet, and RPT must avoid flooding all sites. Which multicast support approach should the engineer implement in the Cisco SD-WAN fabric?
- A campus edge router connects OSPF Area 0 on the LAN to service VPN 10, with several campus subnets that must appear in OMP for remote branches while preserving OSPF metric type. Which OSPF and redistribution configuration integrates the campus into the overlay?
- A university deploying 80 identical branch routers as WAN Edges needs reusable interface and VPN settings, needs per-site system values, and must minimize per-device CLI. Which template workflow should you use for building a device template from feature templates and attaching it to devices?
Policies (20%) · 60 questions
- A regional retailer runs dual SD-WAN Controllers for two VPNs and must stop Site 20 prefixes from being advertised to Site 30 while keeping both sites reachable from headquarters. The engineer will use a centralized policy that filters OMP route advertisements. Which control policy direction on the SD-WAN Controller achieves the route-filtering requirement?
- A retailer with 40 branches runs guest Internet in VPN 10 and a firewall service at DC site 100 advertising a service TLOC. The design requires guest prefixes to be reachable only through that firewall TLOC, with failover if it is withdrawn. Which control policy set action for service chaining should the engineer configure to steer traffic through the firewall TLOC?
- A national retailer uses VPN 10 for stores that must send all traffic through regional hubs and VPN 20 for distribution centers that need direct site-to-site exchange. Both VPNs run across the same SD-WAN fabric with two SD-WAN Controllers. Which control-policy topology configuration delivers segmentation using different topologies per VPN?
- A bank runs voice over two transports, preferring low-delay MPLS color gold but tolerating broadband color blue, and requires loss under 2%, latency under 150ms, and jitter under 30ms before moving calls. The policy must measure performance and steer per tunnel. Which app-route policy with SLA class criteria and preferred colors meets the voice need?
- A retailer with 60 stores must force all inter-store traffic through two data-center hubs for inspection, while hubs still exchange routes directly. Spokes must not learn each other's TLOCs via OMP. Which control policy construction creates that hub-and-spoke topology?
- A retailer runs POS in VPN 30 and staff devices in VPN 40 on the same WAN Edge and needs POS to reach a shared printer in VPN 40 without merging routing tables. Shared services must stay controlled and leak only specific prefixes. Which route-leaking design provides selective end-to-end segmentation with controlled sharing?
- A school district with one hub and 25 spokes needs spokes to reach each other only through the hub for inspection, while the hub reaches all spokes directly. Spokes currently learn each other's TLOCs and form direct tunnels. Which control policy construction creates the hub-and-spoke topology requirement?
- An insurer must limit partner routes from site 200 to data-center prefixes 10.0.0.0/8, allow only Internet transport TLOCs, and drop the rest. The policy must use reusable lists and explicit actions. Which control policy match and set construction should the engineer build?
- A hospital runs clinical VPN 20 and guest VPN 30 on the same WAN Edges but guest kiosks need controlled access to a scheduling server in VPN 20, while all other guest routes must stay isolated. Which route-leaking policy between VPNs grants selective access to the shared service?
- A pharmaceutical maker runs 25 spokes and a headquarters hosting an IPS appliance behind a service-side attachment in a service VPN. Regulated research subnets must pass through the IPS, guest traffic must go direct, and routing must stay centralized. Which control-policy action inserts service chaining for the research prefixes through the IPS service?
- A trading firm steers market-data over app-route policy with strict loss and latency limits, preferring fiber color gold, but during congestion no tunnel of any color meets the SLA class for 30 seconds. Sessions must continue on the tunnel closest to meeting the SLA rather than drop until quality recovers. Which fallback behavior when no tunnel meets the SLA class keeps market-data flowing?
- A healthcare network runs voice over MPLS and broadband with requirements of under 150 ms latency, under 30 ms jitter and under 1% loss, preferring MPLS but failing over to broadband on violation. Which app-route policy design enforces SLA-class criteria with preferred colors for voice traffic?
- A healthcare network runs voice and EHR over MPLS and broadband, and clinicians report choppy calls when broadband degrades while EHR must stay stable. The design needs voice to prefer low loss, latency and jitter paths and move if SLA fails. Which app-aware routing configuration enforces voice SLA criteria and preferred colors?
- A bank has two data centers advertising 10.0.0.0/8 to 60 branches over OMP. Operations requires the hub routes to be filtered before they enter the Controller topology, but branch prefixes must still reach the hubs unchanged. Which control-policy design should the engineer apply to change only the intended routes?
- A hospital runs voice over two transports with an application-aware routing policy requiring low loss and latency, but during a fiber brownout both tunnels violate the SLA class. Which fallback behavior keeps critical voice flowing when no tunnel meets the SLA class?
- A manufacturer chains branch Internet traffic through a firewall service hosted at hub Site 20 before breakout. The firewall advertises a service TLOC, but default OMP best-path sends branches directly to the NAT TLOC at Site 20. Which control-policy action enforces the required service chaining through the firewall?
- A logistics firm must keep regulated warehouse prefixes off the internet transport by matching site lists, specific prefixes, and TLOC characteristics in a centralized control policy. The architect must choose match criteria and resulting set actions. Which control-policy match-and-set combination correctly uses site lists, prefix lists and TLOCs?
- A hospital runs app-aware routing for telehealth over two transports with BFD at 500 ms and app-route poll at 5 minutes, but failover to the better path takes minutes after brownout and clinicians complain. Loss starts suddenly while BFD stays up briefly. Which tuning of BFD and app-route polling best speeds application-aware convergence for this brownout case?
- A trading firm needs voice to fail over in seconds when WAN quality degrades, but the default application-aware routing feels slow to react. Which BFD and app-route polling adjustment accelerates SLA detection and convergence for this requirement?
- A university wants Zoom and Workday to take the low-latency path while YouTube and bulk downloads take broadband, but port-based rules keep misclassifying traffic because apps use dynamic ports and CDNs. Policy must match applications reliably before app-aware routing acts. Which classification approach correctly feeds application-aware routing for these dynamic apps?
- A hospital prioritizes Epic traffic from 10.10.0.0/16 to its data center 172.16.5.0/24. The centralized application-aware routing policy must match the source prefix, destination prefix, approved application, and voice DSCP before setting the SLA path. Which sequence match set should the engineer configure to enforce that precise classification?
- An enterprise merges two regions and must stop one data-center prefix from spreading to a partner site while still advertising all other routes, with minimal side effects. The control policy is applied on the Controller. Which description correctly states control-policy direction and which routes the policy actually changes?
- A logistics firm uses app-aware routing for barcode scanners over LTE and broadband with strict loss and latency limits, but remote sites occasionally lose both preferred paths during storms. Operations requires scanners to keep working on the single best available path. Which fallback behavior applies when no tunnel meets the SLA class?
- A retailer needs a control policy where Site 10 advertises 10.10.0.0/16 to Sites 20-30, but Hub Site 5 must filter TLOCs with lossy MPLS color and prefer broadband TLOCs for that prefix. Which match-and-set combination implements the site, prefix, and TLOC requirement?
- A 40-user branch has one MPLS transport and one Internet transport with NAT enabled on its interface in VPN 0. Users in service VPN 10 need direct Internet access for all traffic while MPLS stays preferred for corporate prefixes. Which branch DIA design provides full local Internet breakout?
- A seaport logistics hub runs voice dispatch, a warehouse management system, and nightly database replication over MPLS and broadband. Dispatch voice marked EF freezes when replication bursts, and managers need voice protected without blocking replication. Which centralized data-policy sequence match uses source, destination, application, and DSCP?
- A bank has two data centers advertising 10.0.0.0/8 to SD-WAN Controller from different regions. Engineers must ensure branches prefer DC-West for those prefixes without changing TLOC reachability or underlay tunnels. The policy is built in SD-WAN Manager. Which control-policy direction and effect achieves this route preference change?
- A manufacturer runs dual transports with MPLS for voice and internet for bulk data. Voice from VPN 10 must stay on MPLS TLOCs with EF marking, guest traffic must be forced to VPN 20, and malware flows must be blocked. Which data policy action set should the engineer configure to meet all three needs?
- A retailer needs Zoom to use MPLS only while loss stays under 2% while Office 365 can use Internet, with automatic classification even when ports change. The WAN Edge runs IOS XE with DPI enabled. Which application-aware routing classification meets the dynamic-app requirement?
- A logistics firm runs voice over two transports and wants app-aware routing to shift traffic within seconds when loss rises, but BFD flaps on a brownout link cause excessive reroutes. SLA targets require fast detection without instability. Which timer adjustment should the engineer evaluate first to tune application-aware routing convergence behavior?
- A university wants lecture video over MPLS and dorm Netflix over broadband, matching by source subnet, destination prefix, application and DSCP. A centralized data policy is planned in SD-WAN Manager. Which sequence match design selects this traffic correctly for forwarding action?
- A branch in VPN 20 needs selective DIA so only guest web traffic breaks out locally while corporate traffic stays on OMP overlays. Both transports have NAT, and blanket local default routing is prohibited. Which DIA approach provides app-selective local breakout?
- A financial firm wants its trading application to prefer low-jitter MPLS unless loss exceeds threshold, but port-based rules keep misclassifying the app when it moves to cloud ports. Classification must stay accurate without manual ACL updates. Which classification approach should the engineer choose to support application-aware routing for the trading traffic?
- An insurer must divert guest traffic to a scrubbing firewall, preserve voice markings end to end, and drop known malicious prefixes at the edge branches with dual transports. The policy team must encode forwarding and marking in one centralized data policy. Which data policy action set correctly uses set local TLOC, next hop, VPN, DSCP, and drop or accept for this control?
- A university applies a data policy to Site 10 that must filter user traffic entering the fabric toward the data center and also filter DC return traffic leaving the fabric toward users. The first draft applies only one direction and misses return flows. Which direction semantics should the engineer use to cover both paths?
- A small branch has one Internet transport on GigabitEthernet1 with DHCP, needing local web breakout for VPN 10 users while corporate traffic stays on the overlay. Which DIA configuration best enables direct Internet access at the branch?
- A 40-site retailer needs direct Internet access for guest Wi-Fi and Microsoft 365, must keep PCI card data on the VPN overlay, and has small branches with no local security staff. Which DIA security enforcement design best balances these DIA trade-off requirements?
- A single-router branch with one MPLS and one internet transport must send guest VPN 20 traffic directly to the internet while corporate VPN 10 stays on the overlay. The internet interface needs NAT and the service VPN needs a local default route without leaking to OMP. Which direct Internet access configuration satisfies this branch isolation requirement?
- A hospital has 40 clinics needing identical hub preference for telehealth centrally, but each clinic must translate its overlapping 10.1.0.0/16 LAN and enable local Internet breakout on site. Compliance requires central intent with per-site exceptions handled locally. Which statement correctly separates localized policy scope from centralized data policy enforcement scope?
- A hospital has dual hubs with separate TLOCs and needs MRI traffic from Clinic Site 20 to prefer the low-latency hub, remark voice to expedited forwarding, and drop guest traffic to the data center. The policy is centralized from the Controller. Which data policy action set should the engineer configure to enforce preferred path and QoS handling?
- A bank has LAN printers and servers behind a branch router and must filter traffic leaving the LAN toward the SD-WAN overlay differently from traffic arriving from the overlay to the LAN across all sites in one site list. Which data-policy direction design correctly applies from-service versus from-tunnel semantics?
- A healthcare group with 25 clinics wants only Salesforce and Workday to break out locally with NAT, while all other traffic stays on MPLS to headquarters. Engineers need per-application path and NAT control on WAN Edge routers. Which DIA control for selective application breakout should the engineer configure to meet NAT requirements?
- A national retailer with 180 small stores plans DIA for point-of-sale cloud access and guest browsing. All Internet traffic must receive URL filtering and malware inspection. Store WAN Edges run high CPU, sites have no local security staff, and MPLS bandwidth is limited. Which DIA security enforcement design should the engineer choose?
- An enterprise has Guest VPN 10 at branches and MPLS VPN 20 toward the data center. A centralized data policy must handle internet-bound traffic leaving the Edge and tunnel-bound traffic arriving from the fabric differently, applied only to Site 30 and Site 40. Which direction and site-list application should the engineer configure to enforce correct data policy semantics?
- A network team must block a specific site prefix from being advertised to partners, keep all other OMP routes flowing, and enforce the filter consistently across the overlay. Which centralized control-policy application best achieves this OMP filtering requirement?
- An international retailer operates 35 stores with dual transports and requires voice traffic to prefer MPLS with failover to broadband at every site, while each store also needs local OSPF redistribution and service-VPN route maps unique to its LAN. The design must apply the common steering once and keep site-specific routing on the routers. Which policy scope and enforcement design correctly separates localized policy from centralized policy?
- A branch must allow only marketing VLAN 30 in VPN 10 to break out locally to the internet for HubSpot, while finance VLAN 40 in the same VPN must stay on the overlay to the data center. Both VLANs share one internet transport and need source NAT only for breakout traffic. Which selective DIA forwarding approach meets this per-application isolation requirement?
- A manufacturer must isolate guest, IoT and ERP traffic end to end, keep Internet transport separate from LAN, and preserve out-of-band management even if the overlay fails. Templates must map each use case to the correct VPN identifier consistently. Which VPN assignment correctly uses service VPNs, VPN 0 and VPN 512 for segmentation?
- A manufacturing branch has one MPLS and one Internet circuit, four user VLANs, plus a need for out-of-band management if the overlay fails. The engineer drafts templates with VPN 0, VPN 10 and VPN 512. Which VPN assignment correctly maps transport, service, and management roles for end-to-end segmentation?
- A bank with 60 branches must prevent direct branch-to-branch routes for audit isolation, must allow all branches to reach two data-center hubs, and must keep OMP peering scalable. Which control policy design should you build to enforce hub-and-spoke topology?
- A manufacturer uses a centralized security policy for internet breakout at headquarters while each plant needs unique OSPF costs and VLAN mappings on its own Edge routers. Engineers debate where to enforce each requirement efficiently. Which distinction between localized policy versus centralized policy guides enforcement placement?
- An enterprise runs dual data centers with regional hubs and needs to prevent specific branch TLOCs from being advertised to a partner site, while allowing all other overlay routes. Central changes must apply fabric-wide without touching branch CLIs. Which centralized control policy application achieves this routing control?
- A 40-site retailer wants guest and Microsoft 365 traffic offloaded locally at each branch, PCI traffic must stay on MPLS to the data center, and IT has no staff for branch firewalls. Which design trade-off should the engineer recommend for direct Internet access with security enforcement?
- A bank needs VPN 20 for teller traffic restricted to hub-and-spoke through the data center and VPN 30 for voice engineers requiring full mesh between campuses, both running over the same SD-WAN fabric. The architect must enforce different topologies per VPN centrally. Which end-to-end segmentation approach with control policy meets this dual-topology requirement?
- A logistics company has one headquarters hub and forty spokes that must communicate only through the hub for inspection, but spokes must still establish data tunnels directly to the hub. Underlay connectivity is full mesh capable. Which control policy construction creates this hub-and-spoke behavior?
- A manufacturer runs a centralized firewall service at its headquarters and needs Cambridge plant traffic to detour through that firewall before reaching the partner VPN, with failover to a second firewall. Which centralized policy design should you use to provide this service chaining?
- A hospital deploys SD-WAN with isolated traffic for clinical devices, guest Wi-Fi, transport underlay, and router management, requiring separation even if overlays fail. Engineers must assign VPNs correctly on WAN Edge routers. Which assignment of service VPNs, VPN 0 and VPN 512 reflects their roles?
- A logistics firm must block a merger-acquired site from learning data-center prefixes, allow all other sites full routes, and enforce this centrally without touching WAN Edges. Which centralized control policy action should the engineer configure to meet this routing requirement?
- A university runs staff in VPN 10 and research instruments in VPN 20 on the same fabric, and a shared printer subnet in VPN 20 must be reachable from VPN 10 without merging the full tables. Security requires explicit controlled leaking only for that subnet. Which route-leaking approach between VPNs with policy enforces this selective shared-service requirement?
- A logistics firm needs VPN 30 as hub-and-spoke via Chicago and VPN 40 as full mesh between warehouses, both over the same physical overlay. Application teams demand no cross-VPN leakage. Which segmentation approach correctly delivers different topologies per VPN with control policy?
Security and Quality of Service (15%) · 45 questions
- A 200-user branch WAN Edge runs two transports and hosts trusted LAN in VPN 10 and guest Wi-Fi in VPN 20. Compliance requires application-aware inspection between zones, logging of denied sessions, and default deny between VPNs. Which zone-based firewall design enforces application-aware segmentation on the WAN Edge?
- A healthcare company needs secure Internet gateway access for two DC WAN Edges to a cloud security provider with frequent key rotation. Operations wants tunnels built and refreshed from SD-WAN Manager without manual IKE configuration on each router. Which SIG tunnel provisioning method should the engineer choose for automated creation?
- A logistics firm runs voice and bulk backup over a single MPLS transport with variable bandwidth due to carrier policing. The operations team wants per-tunnel queuing plus automatic shaping-rate adjustment when the path degrades. Which QoS treatment on the WAN Edge routers satisfies both needs?
- A healthcare network adds a third-party firewall with a service TLOC at the data center and requires all guest VPN traffic from branches to traverse it before internet breakout. Spoke routes must be redirected through the service while return traffic still works. Which service-chaining design via control policy directs the guest traffic to the firewall service TLOC?
- A university backs up research data nightly over a constrained 20-Mbps MPLS link with highly repetitive file transfers, while interactive browsing shares the same path. Leaders want lower backup time without buying bandwidth. Which App-QoE data redundancy elimination use best reduces repeated bytes where it helps most?
- A school district sees rising malware from student devices resolving malicious domains over branch internet exits and wants to block risky lookups before connections form, without backhauling DNS to headquarters. Which DNS security policy using a cloud resolver to filter DNS requests blocks malicious domains at branches?
- A financial branch WAN Edge must block known malware callbacks and exploit attempts for Internet-bound traffic without adding appliances. The security team wants automatic signature updates and logging within the existing SD-WAN security workflow. Which IPS/IDS design in Unified Security policy meets inline prevention needs?
- A logistics site prioritizes voice, warehouse scanning, and bulk file sync over one 100-Mbps Internet circuit with congestion at peak hours. The design needs classification, queuing, and scheduling on egress. Which QoS treatment on the WAN Edge should the engineer configure for application-aware queuing?
- A mining site uses LTE with 8% bursty loss for voice and SCADA, with ample spare bandwidth but strict latency targets and limited router CPU. Voice needs immediate repair for single-packet loss while bulk telemetry tolerates delay. Which App-QoE loss-mitigation choice best fits these stated loss and latency needs?
- A retail chain adds a firewall service at its data center WAN Edge in VPN 10 serving stores in VPN 20. Stores must reach the firewall via OMP, and the firewall must return traffic to store prefixes. The service node is only reachable inside VPN 10. Which service-route advertisement approach satisfies the reachability requirement?
- A manufacturer reports slow file transfers and ERP sync over a high-latency MPLS and internet mix, with packet captures showing mostly long-lived TCP sessions and window constraints. Loss is low and UDP voice is fine, so the team wants App-QoE optimization without touching voice. Which statement correctly describes TCP optimization benefits and the traffic it applies to?
- A financial firm must send branch internet traffic to a third-party Secure Internet Gateway over the public transport with encrypted tunnels and survive a gateway PoP outage without manual reconfiguration. Each branch has dual internet links. Which cloud security integration design provides encrypted SIG connectivity and redundancy?
- A school district must block adult and gambling sites, block domains with a high-risk web reputation, and always allow the district learning portal even if its category or reputation scores poorly. Which URL filtering design enforces category, reputation and exception needs together?
- A manufacturer must steer file transfers and backup traffic to a central WAN optimization farm without hairpinning branch routers, with automatic load sharing across two optimizers and health-aware bypass on failure. Branches run SD-WAN with limited CPU. Which App-QoE service-steering design meets load sharing and bypass needs?
- A retail chain must connect 150 branches to Zscaler and Cisco Umbrella SIGs quickly, enforce consistent IKE parameters, and let operations audit tunnels centrally. Engineers debate portal automation versus CLI. Which statement correctly contrasts automated SIG tunnel creation versus manual configuration?
- A university WAN Edge hosts student VPN 30, research VPN 40, and Internet transport in VPN 0. Policy requires research traffic to pass inspection before Internet breakout, student peer traffic blocked, and zones tied to VPN membership. Which zone-based firewall design enforces the application-aware inspection requirement?
- An engineering firm replicates large CAD files daily between two data centers over a constrained MPLS link, sending the same blocks repeatedly with ample memory on the routers. Branch voice and small web flows see no benefit. Which statement correctly describes data redundancy elimination and where it helps most?
- A call center has 500 agents with voice, video, and bulk file transfers sharing a 100 Mbps edge. Voice needs strict priority with policing, while video and bulk need assured shares without starvation during congestion. Which scheduling and queue-class approach should the engineer apply to meet both needs?
- A 40-site retailer runs guest Wi-Fi and POS traffic through cEdge routers with a Unified Security policy already doing URL filtering. Leadership requires malicious payloads to be blocked automatically at the branch, with alerts visible in SD-WAN Manager, without sending traffic to cloud. Which IPS/IDS choice in the Unified Security policy meets these branch requirements?
- A financial campus must inspect all branch-to-data-center traffic in VPN 20 through a firewall service attached to a hub Edge before delivery. The firewall advertises a service TLOC and OMP carries the service route. Which control policy design chains traffic through the firewall correctly?
- A clinic branch allows USB file transfers and web downloads, but ransomware incidents require blocking known-malicious files and analyzing suspicious ones in the cloud. The WAN Edge has integrated security licensing. Which WAN Edge capability best delivers file reputation and verdicting?
- A trading firm runs real-time voice over a lossy transoceanic link with 4% packet loss and jitter spikes, tolerating extra bandwidth but not retransmission delay. Engineers must choose Application Quality of Experience mitigation for sustained loss versus single-packet gaps. Which App-QoE choice correctly contrasts packet duplication versus forward error correction for lossy links?
- An enterprise call center reports voice clipping on a 50 Mbps MPLS uplink from a WAN Edge while bulk file transfers saturate the same interface during business hours. The design requires voice in a priority queue and remaining traffic fairly shared. Which QoS configuration should the engineer apply on the WAN Edge to enforce egress treatment?
- A hospital edge has a 50 Mbps MPLS circuit where voice needs smooth pacing during bursts and guest internet must be capped at 10 Mbps with excess dropped. CPU is limited and buffer memory is adequate. Which QoS mechanism should the engineer apply to satisfy both traffic types?
- A colocation Edge hosts a firewall for VPN 30 service chaining, with a 10.30.50.0/24 subnet behind it. Remote sites in VPN 30 must reach the subnet through the firewall, but traffic bypasses the firewall even though the firewall is deployed. Which service-route advertisement requirement enables reachable service chaining?
- A financial firm must inspect outbound HTTPS to block data exfiltration, but auditors require that internal clients trust the inspection without browser errors and private keys stay protected. Which SSL/TLS proxy certificate handling best enables decrypt-and-inspect?
- A healthcare group must block phishing and adult sites, block sites with a poor reputation score, and explicitly permit the patient portal despite its miscategorization. CCT traffic stays local with Unified Security policy. Which URL-filtering design meets categorization, reputation and list requirements?
- A regional retailer with 40 branches runs bulk file transfers and virtual desktops over MPLS and broadband, needs TCP optimization without per-branch appliances, and wants flows automatically distributed across optimization resources. Which AppNav and service-node design best supports App-QoE WAN optimization steering?
- A hospital branch prioritizes voice with strict 256-kbps priority and no queuing delay, while file backup in the same VPN needs a guaranteed minimum share during congestion but can wait. Both classes share a 10-Mbps tunnel where voice must never starve data. Which WAN Edge scheduling and queue class combination meets this voice latency guarantee?
- A university uses TrustSec to group students, faculty and IoT cameras and needs those group tags preserved across an SD-WAN fabric with mixed MPLS and internet for policy at the data center. Inline tagging on all links is unreliable. Which Cisco SD-WAN security feature should the engineer describe to carry group context end to end?
- A call center marks voice EF and signaling AF31 at phones, but the MPLS provider re-marks all inbound traffic to default and Internet traffic arrives untrusted. The WAN Edge must enforce enterprise markings outbound and restore them on return traffic consistently. Which QoS DSCP marking and remarking approach on the Edge achieves this requirement?
- A clinic WAN Edge terminates guest Internet, clinical VPN traffic, and a service VPN, needs application-aware inspection between zones, and must deny inter-zone traffic by default. Which zone-based enterprise firewall design best meets this WAN Edge security requirement?
- A logistics firm enables internet breakout at branches and must block malicious downloads and stop known-bad files from executing, with verdicts refreshed from cloud intelligence. Branch routers have security licensing and limited bandwidth. Which WAN Edge advanced malware protection behavior should the engineer describe to meet file-based threat defense?
- A school district with 30 sites allows local DIA for students but suffers malware from malicious domains. It wants DNS requests filtered before resolution without deploying branch appliances, using SD-WAN policy to redirect queries. Which DNS security integration should the engineer configure to block malicious domains centrally?
- A hospital must send all guest VPN traffic through a centralized firewall service before Internet exit, needs automatic route advertisement for the service location, and wants to avoid per-branch static routes. Which service-chaining design via control policy correctly steers to the firewall TLOC?
- A branch has a 50-Mbps internet circuit carrying voice and bulk replication where excess replication bursts cause drops for voice during congestion. Replication must be capped at 20 Mbps with excess dropped, while total egress must be smoothed to the circuit rate without discarding conforming voice. Which shaping and policing treatment meets this congestion requirement?
- A regional bank with 40 branches must inspect outbound HTTPS for malware while preserving privacy for banking apps via an allow-list, and auditors require no browser warnings for users. Edge routers will perform decrypt-and-inspect for selected flows. Which certificate handling for SSL/TLS proxy meets the decrypt-and-inspect requirement?
- A regional retailer with 40 stores runs POS traffic and guest Wi-Fi on the same WAN Edge routers, must inspect inbound Internet traffic for exploits, and needs automatic signature updates without a separate appliance. Which IPS/IDS design should you deploy in the Unified Security policy to meet these requirements?
- A retail branch uses dual broadband transports with highly variable throughput during peak hours, and voice in VPN 10 must stay protected while bulk traffic is shaped per tunnel. The design requires shaping that tracks actual path bandwidth instead of a static shaper. Which QoS treatment on the WAN Edge router achieves adaptive per-tunnel shaping for this requirement?
- A hospital WAN Edge carries voice in VPN 20 and data in VPN 30 over one MPLS transport, voice arrives unmarked from legacy phones, and queuing must prioritize voice upstream. Which QoS configuration should the engineer apply to ensure correct marking and remarking of DSCP at the edge?
- A school district with 25 campuses must block adult and gambling sites for students, allow teachers to access social media for lessons, and override miscategorized educational domains quickly. Which URL filtering design should you deploy for categories, reputation and allow/block lists?
- A hospital inserts a service-side firewall cluster behind two data-center WAN Edges in VPN 20 to inspect guest traffic, but remote sites cannot reach the firewall IP and return traffic drops. The firewall is up and VRRP is healthy. Which service-route advertisement and reachability design makes the centralized security service usable?
- A university with wired TrustSec domains in two campuses wants student and staff SGT tags preserved over the SD-WAN fabric so firewall policy at the data center enforces role-based access. Edges connect to switches carrying SGTs in service VPNs. Which TrustSec SGT propagation method preserves role tags across the fabric?
- A financial firm must send branch Internet traffic to a Secure Internet Gateway provider requiring scalable onboarding, with active-standby resilience if a provider site fails and no per-tunnel manual reconfiguration. Branches run dual transports. Which branch-to-SIG connectivity design meets these needs?
- A logistics firm complains that file transfers and database sync over long-haul Internet paths suffer from slow start and packet-loss stalls, while real-time voice is already optimized elsewhere. The WAN architect proposes App-QoE TCP optimization on selected WAN Edges to improve throughput without changing applications. Which statement of TCP optimization benefits and traffic scope justifies this App-QoE proposal for this use case?
Management and Operations (10%) · 30 questions
- A regional bank is upgrading 40 WAN Edge routers from SD-WAN Manager during a short maintenance window. The change plan requires automatic recovery if a router loses control connectivity after activation and proof that images were staged before reboot. Which software image management behavior should the engineer verify to meet the upgrade safeguard?
- A hospital must centralize logins with its existing RADIUS servers, requiring SD-WAN Manager GUI users to authenticate externally and 100 clinic WAN Edges to authenticate CLI admins externally with local fallback. Auditors demand separate handling for management versus device access. Which external AAA design for the Manager and for WAN Edges satisfies both needs?
- A NOC manages 150 WAN Edges from SD-WAN Manager and must forward critical tunnel-down and certificate alarms to Splunk via webhook and to PagerDuty via email, while avoiding alert storms during ISP flaps. Which alarm and notification configuration meets centralized monitoring and dampening needs?
- You support a retail SD-WAN fabric with 80 WAN Edge routers managed by SD-WAN Manager. Leadership wants an emailed weekly availability summary without manual logins, while the NOC needs immediate notice of tunnel and BFD failures during business hours. Which monitoring and reporting design satisfies both periodic and real-time visibility needs?
- A bank plans a weekend fabric upgrade from 20.9 to 20.12 across redundant Manager, Validator, Controllers, and 80 WAN Edges with no maintenance window for rollback failures. Compatibility and control-plane stability are mandatory. Which software upgrade sequence from SD-WAN Manager should the change plan enforce?
- A service provider must give its NOC read-only visibility, its senior engineers full configuration rights, and its customer tenants access only to their own VPN data while logging every change. The platform is SD-WAN Manager with multiple organizations sharing controllers. Which user-group and role-based access design enforces the tenancy requirement?
- A healthcare company manages its SD-WAN Manager cluster with 40 operators who already use corporate Okta with MFA. Security requires centralized deprovisioning on job change, no local password vault, and full browser login to the Manager UI without per-device CLI accounts. Which external authentication approach best meets the centralized UI login requirement?
- A logistics firm with 120 WAN Edges schedules a Manager-initiated upgrade from 20.9 to 20.12 overnight. The change window is short, WAN links are unstable, and leadership requires automatic recovery if edges lose contact after the new image boots. Which rollback behavior should the engineer explain to satisfy the recovery requirement?
- A bank NOC needs critical SD-WAN alarms in its Splunk collector and on-call mailbox with severity filtering, but engineers currently log into the GUI to spot outages and miss after-hours events. Audit requires centralized retention and no missed critical faults. Which alarm and forwarding design centralizes critical event visibility for this NOC workflow?
- A university SD-WAN team needstiered Manager access where NOC staff monitor alarms only, senior engineers change policies, and auditors view reports without edits. The solution must enforce least privilege and track actions. Which capability describes user groups and role-based access control in the Manager?
- A NOC developer must poll SD-WAN Manager for alarms every five minutes from a Python service without storing admin passwords, and POST requests fail after login succeeds. The script uses HTTPS to port 8443. Which REST API authentication approach establishes the session token and CSRF protection?
- A managed services team must email weekly application-health and monthly audit summaries to different customers without manual exports. Which reporting capability in SD-WAN Manager automates recurring delivery for these operational needs?
- A NOC engineer builds a Python monitor that polls SD-WAN Manager alarms every five minutes. Security requires authenticated HTTPS calls with protection against cross-site request forgery on POST operations. Which authentication sequence enables the Manager REST API monitoring session correctly?
- A managed service provider monitors 600 WAN Edge routers from a NOC dashboard and needs hourly serial-to-site inventory, interface statistics and tunnel health without manual clicks in SD-WAN Manager. Scripting must scale with pagination and filtering. Which REST API monitoring approach should the automation engineer select for efficient bulk collection?
- A healthcare company uses SD-WAN Manager with three teams: helpdesk needs read-only monitoring, network engineers need policy and template changes, and auditors need reports without configuration rights. A shared admin account violates compliance. Which access control should the administrator configure to enforce least privilege?
- A healthcare network must centralize SD-WAN Manager logins for 40 NOC operators, enforce per-command authorization for CLI users, and offer single sign-on for helpdesk staff using the corporate identity provider. Auditors require distinct protocols for each need. Which external authentication mapping correctly applies RADIUS, TACACS+, and SAML SSO for Manager authentication, monitoring, and reporting access?
- A NOC lead inherits a 200-site fabric with complaints about slow SAP, flapping tunnels and missing edge routers. She opens SD-WAN Manager needing device health, tunnel loss/jitter, and per-application scores in separate views. Which monitoring dashboard combination gives each required visibility?
- An operations team managing 500 SD-WAN sites needs weekly executive summaries of application usage, tunnel health, and security events without manual dashboard exports. Audit also requires archived copies for review. Which reporting capability in SD-WAN Manager meets these needs?
- A university must integrate SD-WAN Manager logins and WAN Edge admin logins with campus RADIUS and TACACS+ servers, preserving local fallback if external servers fail. Auditors require command authorization for network operators. Which external AAA design should the engineer configure to cover Manager and WAN Edge access?
- A NOC team managing 200 WAN Edges reports voice complaints, needs to isolate whether the issue is device health, specific tunnel performance, or application behavior, and wants a quick triage path. Which SD-WAN Manager monitoring dashboard sequence best delivers device, tunnel and application views?
- A university with 60 helpdesk staff needs role-based Manager access, seamless login for faculty using campus identity, and full command accounting for network changes with existing Cisco ISE. Auditors require centralized credentials, MFA-capable SSO, and per-command logs. Which external authentication combination on SD-WAN Manager satisfies these monitoring and access needs?
- A network operations team must upgrade 80 WAN Edges to 20.12.1 during a weekend window using SD-WAN Manager with minimal downtime and easy rollback. Images are ready but not yet staged, and policy requires setting the new version as default only after verified boot. Which software image management sequence from the Manager meets this upgrade requirement?
- An MSP manages 500 WAN Edge routers and needs nightly inventory, tunnel statistics and alarm history exported to its dashboard without manual clicks in SD-WAN Manager. Scripts must scale and reuse authentication efficiently. Which REST API monitoring approach should the engineer implement to satisfy bulk automation needs?
- A NOC developer automates SD-WAN Manager alarms retrieval, must authenticate programmatically, maintain session state across calls, and include forgery protection headers on writes. Which Manager REST API authentication sequence best satisfies this API monitoring requirement?
- A NOC team using SD-WAN Manager must triage a regional voice issue affecting three sites, needing to check device health, then tunnel loss and jitter, then confirm which applications consume bandwidth. The lead wants the fastest native workflow. Which monitoring dashboard sequence from the Manager answers this operational triage need?
- A managed service provider with 400 WAN Edge devices needs nightly inventory, tunnel health, and alarm summaries for customer reports without manual clicks in the GUI. Which REST API monitoring approach should you use for device inventory, statistics and bulk monitoring?
- A healthcare network with 120 WAN Edge routers must forward critical SD-WAN alarms to a central syslog server and SNMP manager, with email alerts for severity-critical events and no flood of minor alarms. Operators use SD-WAN Manager for visibility. Which alarm and notification configuration meets the forwarding requirement?
- An enterprise must upgrade a fabric with clustered SD-WAN Manager, two Validators, two Controllers, and 80 WAN Edges, requiring minimal downtime and rollback safety with image distribution verified first. Which software upgrade sequence should the operations lead approve for safe image management from the Manager?
- A power utility with 80 WAN Edges must centralize logins for audits: network admins need role-based GUI access to the management platform with an external server, and field techs need external logins to routers with local fallback during WAN outages. Which AAA design covers external AAA for the Manager and for WAN Edges?
- A university network team stages five new WAN Edges for dormitory buildings and must standardize them on a tested release. Images must be held centrally, pushed only to those devices, applied without an unplanned reboot, and retained as the boot version. Which software image management sequence should the administrator follow in SD-WAN Manager?
These questions are original practice material and are NOT actual exam questions or brain-dump content. Cisco Systems, Inc. and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by Cisco Systems, Inc..