Architecture (20%)

ENSDWI · 60 questions

• A global fabric with 800 WAN Edges uses two SD-WAN Controllers in the US and one in EMEA with controller groups per region. The design must survive a controller loss without control-plane churn and keep regional affinity. Which control-plane scale and redundancy approach preserves stability with regional affinity?
• A service provider will grow to 2,000 WAN Edges across three regions and must survive loss of any single SD-WAN Controller without mass re-convergence, while keeping regional control traffic local where possible. Which control-plane scale and redundancy design with multiple controllers and groups meets regional resilience?
• A new manufacturing fabric has Manager and Controllers online, but two WAN Edges behind NAT cannot find peers and show no DTLS sessions. Staging confirmed certificates and organization name are correct. Which Validator orchestration and NAT discovery behavior should the engineer verify to allow initial authentication?
• A global logistics firm with 800 sites needs the control plane to survive a controller failure and to scale OMP load, considering three SD-WAN Controllers with affinity for regional edges. Connections must reconverge without full outage. Which control-plane scale and redundancy design using multiple controllers and controller groups meets the need?
• A manufacturing overlay sees new WAN Edge routers stuck with private addresses behind branch NAT that cannot establish DTLS to the Controller. The design relies on a reachable orchestrator to authenticate devices and help peers discover public mappings. Which SD-WAN Validator behavior provides initial authentication, orchestration, and NAT discovery?
• A new manufacturing site powers on its WAN Edge behind NAT with only the controller DNS name configured. It must authenticate its identity, learn the SD-WAN Controller and Manager addresses, and report its public IP and port. Which SD-WAN Validator role explains that bootstrap sequence?
• A retail chain needs rugged in-store routers, a virtual form for its private data center, and a cloud-hosted presence in AWS for SaaS breakout. Architects must justify placement by platform strengths and limits. Which statement correctly differentiates hardware, virtual, and cloud-hosted WAN Edge options for the rollout?
• A company needs ten rugged branches, fifty retail sites with local compute, and bursting cloud workloads in AWS. The architect must balance ruggedization, virtualization and cloud integration while keeping centralized management. Which WAN Edge platform mix best matches hardware, virtual and cloud-hosted capabilities?
• A global enterprise with 300 sites needs a single pane for provisioning templates, software upgrades, certificate management, and historical performance graphs plus programmatic access for its NetOps tools. No data-plane forwarding can depend on this element. Which SD-WAN Manager capability satisfies the centralized management requirement?
• A healthcare network needs a single pane to onboard gateways, push Day-0 configs, monitor tunnel health, retain alarms, and expose automation for its ticketing system. Which SD-WAN Manager capability set meets those management-plane needs?
• A distributed retailer with 120 stores needs one portal for zero-touch onboarding, configuration templates, software operations, and fabric-wide monitoring with API access. Regional admins require role-based access and audit logs. Which SD-WAN Manager management-plane capability should the architect designate for these tasks?
• A retailer needs hardware routers for 80 stores, virtual appliances on VMware in its data center, and auto-scaling gateways inside AWS to terminate SD-WAN tunnels. Which WAN Edge platform mix matches hardware, virtual and cloud-hosted needs?
• A regional hub aggregates 40 branches with dual transport and needs high aggregate throughput, redundant power and diverse WAN interface capacity, while small stores need only a compact branch router. Which edge selection best satisfies the hub throughput and resiliency needs for this design?
• A bank is troubleshooting why a new branch prefix is missing at remote sites while data-plane tunnels are up, and the design review must confirm control-plane responsibilities. Controllers show OMP peering established and policies unchanged. Which description correctly states the SD-WAN Controller role for control plane, route and policy distribution over OMP?
• A bank adds 60 new branches to its SD-WAN fabric with hubs in two data centers. Branch routes flap during maintenance and hub policies change weekly. Operations asks how routes and policy stay consistent without full mesh peering. Which description of the SD-WAN Controller role correctly explains control-plane distribution over OMP?
• A 60-user branch needs 500 Mbps encrypted throughput with PoE switching and Wi-Fi, a regional hub needs 5 Gbps aggregation for 30 branches with deep crypto scale, and a data center needs 20 Gbps core with redundancy. Budget is tight and only SD-WAN Edge models may be proposed. Which platform mapping best aligns throughput and feature needs to site roles?
• A company has 25 small shops needing basic routing, two regional hubs aggregating 500 Mbps of encrypted traffic with services, and a data center needing multi-gigabit throughput and redundancy. Budget limits overprovisioning. Which edge platform selection aligns throughput and feature needs to each site role?
• An enterprise with vEdge and cEdge sites reports inconsistent routing and missing centralized policies after adding a second Controller. All edges show control connections, but OMP routes differ between sites. Which Controller control-plane function should the engineer verify first to explain consistent route and policy distribution over OMP?
• A new site WAN Edge router has just received its certificate and organization name. Connectivity to the fabric controllers over the Internet must be authenticated before OMP can start. Which WAN Edge control-connection behavior correctly establishes its secure channels to each controller type?
• A campus team has IOS XE routers running classic EIGRP today and wants to migrate one pilot site to SD-WAN with centralized policy while keeping another router autonomous for local testing, using the same hardware family. Reboot flexibility and license needs matter. Which mode choice best fits centralized versus autonomous operation on this hardware?
• A campus has IOS XE routers running traditional routing that must join the SD-WAN overlay, while one router must stay on classic CLI routing for a legacy lab. Which operating mode distinction allows fabric membership versus standalone routing on these platforms?
• A manufacturing firm deploys 80 WAN Edges with dual transports to redundant Managers, Controllers, and Validators. Operations requires encrypted control and expects each edge to keep persistent control connections to its Manager and Controllers. Which WAN Edge data-plane and connection behavior should the engineer verify to meet the design?
• A new engineer diagrams steady-state connectivity for a single-homed branch WAN Edge and must label control versus data connections to each controller type. Tunnels to other branches are already shown. Which description correctly states the WAN Edge role in the data plane and which DTLS/TLS connections it forms to each controller?
• A distributor owns IOS XE routers capable of SD-WAN that currently run traditional routing with EIGRP and ZBFW, and IT wants to migrate selected sites to SD-WAN without replacing hardware. Some sites must stay traditional. Which mode distinction guides migration of IOS XE SD-WAN-capable routers?
• A retailer connects 40 stores to two data centers over MPLS and internet. Stores must learn LAN prefixes with their VPN IDs, edge routers must learn which WAN next-hops are reachable, and two hubs must advertise firewall service insertion. Which OMP route type should the engineer check for the firewall advertisement?
• A retail company is refreshing 80 branches that each carry about 300 Mbps of mixed MPLS and Internet traffic, need on-box intrusion prevention with TLS inspection, and must run application-aware routing with active SLA probes while keeping headroom for bursts. Which platform sizing principle ensures the WAN Edge sustains security and app-QoE services?
• A new engineer sees SD-WAN Controller advertising three tables and confuses customer prefixes with tunnel endpoints and firewall services. The fabric uses MPLS and internet TLOCs with a firewall service at HQ. Which description correctly maps OMP routes, TLOC routes and service routes to what each carries?
• A 300-user headquarters needs integrated threat defense, SSL proxy, and application-aware QoE with analytics on its WAN Edge while keeping throughput headroom for growth. Budget requires right-sizing hardware and entitlements upfront. Which sizing decision best aligns platform and licensing to those security and QoE needs?
• A multinational reports that branch prefixes appear in SD-WAN Manager but internet exits and firewall services are not advertised correctly, and engineers debate which OMP advertisements carry what. The fabric uses SD-WAN Controller for route reflection with service-side and transport attachments. Which OMP route type mapping correctly describes OMP routes, TLOC routes, and service routes and what each carries?
• A healthcare group is sizing 25 new clinics where each WAN Edge must run on-box firewall, IPS, URL filtering and continuous application QoE monitoring for telehealth, with room for throughput growth. Procurement wants the lowest cost that still meets services. Which sizing consideration should the architect prioritize to support security and app-QoE services?
• A branch uses Cloud OnRamp for SaaS for Microsoft 365 with dual Internet transports and a gateway site offering a cleaner path. Probes show the local Internet path degrading while the gateway path stays excellent. Which Cloud OnRamp for SaaS behavior selects the best exit for the application?
• An energy utility has dual-transport routers where internet and MPLS links flap and tunnels form unpredictably. The engineer must explain why a private 10.1.1.1 MPLS link and a public 203.0.113.5 internet link build separate tunnels. Which TLOC description should the engineer use to explain deterministic tunnel formation?
• A logistics company adds LTE and MPLS at 50 branches and sees tunnels forming unpredictably, with some branches preferring the wrong transport despite policy. The architect must explain how endpoint identity steers IPsec tunnel formation. Which TLOC structure description correctly links system IP, color, and encapsulation to how TLOCs drive tunnel formation?
• A head office uses Cloud OnRamp for SaaS for Microsoft 365 with DIA at three branches and a gateway site. Users complain about Teams quality when a branch Internet path degrades. Which Cloud OnRamp for SaaS behavior best selects the best exit for the SaaS application?
• Two branches each have dual transports but only one IPsec tunnel forms instead of four. Both use the same system IP scheme and colors look mismatched in SD-WAN Manager. Which TLOC-structure insight explains how system IP, color and encapsulation drive tunnel formation?
• A media company with 60 branches uses Cloud OnRamp for SaaS for Microsoft 365, with dual transports at each site and both regional and local internet exits available. Users report variable Teams quality while direct internet is underutilized. Which Cloud OnRamp for SaaS path selection behavior should the engineer verify to choose the best exit for the SaaS application?
• A national retailer with 90 stores uses SD-WAN Manager to monitor Microsoft 365. Stores have uneven ISP quality and IT wants cloud probing from two hub sites to pick the best egress for SaaS. Local DIA alone lacks visibility. Which Cloud OnRamp for SaaS model should the engineer select to meet centralized probing requirements?
• A 200-store retailer uses Microsoft 365 and Salesforce from every branch with dual internet transports and no regional hub. Stores need the lowest latency path with continuous performance probing and automatic best-path selection, while IT wants no extra tunnel hops. Which Cloud OnRamp for SaaS path selection model meets these SaaS performance requirements?
• A manufacturer connects plants with private MPLS and public internet. Compliance requires encrypted transport over internet, but operations wants lightweight overhead for native MPLS with no encryption. The WAN Edge routers support both encapsulations per tunnel. Which data plane encapsulation choice should the engineer apply to satisfy both transport requirements?
• A 300-user SaaS-heavy firm sees variable Microsoft 365 performance across branches, has no regional gateways, and wants automated best-path SaaS selection without deploying new data-center hubs. Which Cloud OnRamp for SaaS model best fits this SaaS performance requirement?
• A logistics firm runs encrypted SD-WAN over DIA and private MPLS where voice needs confidentiality on Internet but legacy probes on MPLS need unencrypted encapsulation for inspection. The design must preserve overlay routing while matching per-transport security needs. Which data plane encapsulation choice correctly applies IPsec versus GRE for this traffic?
• A logistics firm encrypts all inter-site traffic over the Internet but needs unencrypted transport for a private MPLS leg to support non-IPsec inspection, while keeping overlay routing intact. Which data-plane encapsulation choice correctly distinguishes IPsec versus GRE usage?
• An enterprise runs voice and video over dual Internet links, needs sub-second failure detection, and wants SD-WAN to steer traffic using live loss, latency and jitter per tunnel. Which BFD design on tunnels best provides purpose, timers and path-quality measurement?
• A multinational needs predictable, private-like connectivity from 40 branches to workloads in AWS and Azure VPCs/VNets without backhauling through its data centers. Security requires auto-provisioned IPsec to cloud gateways with OMP routing end to end. Which Cloud OnRamp for IaaS connectivity design meets this multicloud transit requirement?
• A manufacturer extends its fabric to AWS and Azure, hosts workloads in multiple VPCs and VNets, and needs scalable private transit without per-branch IPsec sprawl to each VPC. Which Cloud OnRamp for IaaS connectivity design best meets this cloud transit requirement?
• An e-commerce firm needs subsecond failover for payment traffic and historical loss, latency and jitter per tunnel to guide SLA policies. Links show intermittent brownouts that routing protocols miss, so continuous liveness and quality measurement on every tunnel is required. Which BFD role with timers and path-quality reporting meets this need?
• A financial firm runs voice over dual internet and MPLS tunnels and needs sub-second detection of brownouts plus continuous measurement of loss, latency and jitter for SLA steering. Probes must run on every tunnel without user traffic. Which BFD on tunnels design should the engineer configure to feed path-quality measurement?
• A logistics company is extending its SD-WAN fabric to AWS and Azure with VPCs and VNets in three regions. It needs scalable private connectivity from branches without per-branch IPsec sprawl and with centralized routing control. Which Cloud OnRamp for IaaS design should the engineer describe to provide transit cloud access?
• A service provider is building a Cloud OnRamp for Colocation cluster in a downtown colo with two compute hosts, needing firewall plus WAN optimization in a chain and shared DNS for tenants. Which design statement should the architect present to describe Cloud OnRamp for Colocation service chaining and shared services?
• A regional hub uses a public transport address while a new remote office sits behind a firewall doing port address translation. The branch must build control connections and direct IPsec tunnels to the hub without a public address on its transport. Which statement correctly describes NAT effects and the Validator role in NAT discovery?
• A retail chain places WAN Edge routers behind broadband NAT at 200 stores, with a SD-WAN Validator and SD-WAN Controller reachable on public IPs in the cloud. Stores must form control connections and then direct IPsec tunnels between sites. Which statement describes NAT handling and the Validator role in NAT discovery?
• A retailer wants firewall and IDS inspection for branch Internet traffic at two colocation sites, sharing the same security stack across tenants and steering selected branches through it without backhauling to the data center. Which Cloud OnRamp for Colocation design meets this service chaining requirement?
• Two branches sit behind carrier NAT with only private addresses, while the data center has public IPs. Edges can reach the Validator and Controller but peer IPsec fails until NAT addresses are learned. Which statement correctly describes NAT impact and the Validator role in NAT discovery for control and data connections?
• A healthcare group needs firewall, IDS and load-balancer functions hosted in two colocation facilities to serve 120 clinics with shared inspection before cloud access. Which Cloud OnRamp for Colocation design should you deploy for service chaining and shared services in a colo cluster?
• A global enterprise is expanding to a Multi-Region Fabric with North America and Europe as separate regions connected through a core, requiring inter-region traffic to transit border routers and preferred hierarchical paths. The design team asks how regions and roles enforce this hierarchy. Which Multi-Region Fabric description answers how access, core, and path selection interact for this requirement?
• A manufacturer uses AWS and Azure plus a private cloud exchange to reach SaaS, with branches needing automated optimal paths and consistent segmentation across clouds. New VPCs appear weekly. Which multicloud and interconnect integration best extends the SD-WAN fabric to these clouds?
• A global enterprise adopts Multi-Region Fabric with 12 access regions in Americas, EMEA and APAC plus a high-capacity core backbone. Intercontinental spokes suffer suboptimal paths and excessive peering. Which hierarchical design correctly uses regions, border routers, and path selection for scalable inter-region routing?
• A global enterprise with 500 sites across Americas, EMEA and APAC suffers suboptimal tromboning when all traffic transits one hub, and needs hierarchical routing with regional isolation. Planners propose Multi-Region Fabric with access and core roles. Which hierarchical path selection design meets the isolation requirement?
• A retailer runs workloads in AWS and Azure, needs consistent segmentation from branches to VPCs/VNets, and wants automated connectivity without manual IPSec to each cloud. Which integration approach should the architect propose for multicloud and cloud interconnect with the SD-WAN fabric?
• A retailer expanding to AWS and Azure needs branch inventory traffic to reach cloud workloads securely, needs consistent segmentation, and must avoid manual IPsec tunnels per VPC. Which multicloud and cloud interconnect integration should you deploy with the SD-WAN fabric?