Controller Deployment (15%)

ENSDWI · 45 questions

• A bank must deploy SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator in a closed network with no internet access, using its internal PKI to issue all controller identities and requiring manual vetting of each device. Which certificate authorization option supports closed-network controller identity with enterprise PKI?
• A midsize bank wants cloud-delivered controllers to avoid data-center hardware but must retain ownership of overlay design, security policy, and daily operations for audit compliance. The architect must explain the shared responsibility boundary before signing. Which division between Cisco-hosted and customer-managed duties describes cloud-delivered controller deployment?
• A manufacturer is bringing up a new fabric with an enterprise CA, and controllers plus 40 WAN Edges fail authentication because the root chain is missing. Installations must trust the same enterprise root on all devices before certificates validate. Which installation of the root certificate chain on controllers and WAN Edges establishes trust correctly?
• A retail chain with 120 stores has no spare data-center capacity and orders Cisco-hosted controllers to speed rollout. Internal IT must retain device onboarding, configuration templates, and routing and security policy design for compliance. Which shared-responsibility split correctly describes Cisco-hosted controller cloud deployment?
• A new deployment has SD-WAN Manager, two controllers and fifty WAN Edges that show certificate errors and fail to establish DTLS/TLS sessions despite reachability to the Validator. The root CA chain was recently renewed. Which certificate-chain installation step restores trusted control connections for controllers and edges?
• A 30-site retailer wants cloud-delivered controllers to avoid managing Linux, hypervisors, and controller upgrades, but must retain control of policies, device configs, and WAN Edge routers. Which shared-responsibility split describes that cloud deployment?
• A retail chain approved cloud-hosted controllers and must gather everything Cisco needs to instantiate its overlay before cutover. The team owns its Smart Account, WAN Edge serials, and WAN bandwidth details. Which information and prerequisites package enables onboarding of the cloud-hosted controller overlay?
• A startup ordered 15 WAN Edge routers and purchased cloud-hosted controllers for a new overlay with company domain cisco-start.example. The deployment must pass authentication and allow zero-touch onboarding. Which prerequisite set must the engineer gather before onboarding the cloud overlay?
• An enterprise using private PKI sees DTLS failures after replacing controllers because WAN Edges do not trust the new controller certificates. The chain was never pushed beyond the CA server. Which root-certificate installation restores trust on controllers and WAN Edges?
• An enterprise onboards 200 WAN Edges through SD-WAN Manager, where the procurement list must authorize devices and operators must track which routers are approved, testing, or rejected before control connections form. Sync failures currently block onboarding. Which upload of the WAN Edge authorized serial number list and handling of device validation states resolves onboarding?
• A regional retailer with 40 stores approved hosted SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator in AWS. Branches have internet only, the overlay must use valid certificates, and all controllers must share the same organization name. Which prerequisite set must the engineer confirm first to onboard the cloud-hosted controller overlay?
• A retailer is staging 25 new WAN Edge routers for stores. The engineer syncs the Smart Account and uploads the authorized serial file in SD-WAN Manager, but five routers show Invalid while the rest show Valid. Which validation check determines that an Invalid device cannot establish control connections?
• An enterprise received 80 new WAN Edge serial numbers and chassis numbers from logistics, and SD-WAN Manager shows some devices as staging while new routers cannot join the fabric. The validator is reachable and certificates are valid. Which certificate and device-list action authorizes the routers and clarifies validation states?
• A manufacturer plans redundant controllers in two company data centers for control-plane resilience. One site runs VMware ESXi and the other runs KVM, and leadership may later extend controllers into AWS or Azure without changing deployment model. Which controller hosting statement correctly describes supported on-premises deployment platforms?
• A logistics firm replaced its PKI and several WAN Edge routers show control connections flapping after a root CA rollover, with one branch certificate past expiry and another listed on the CRL. Controllers remain reachable and clocks are correct. Which action addresses the certificate states that keep these two edges from holding control connections?
• A government agency requires all SD-WAN controllers to run in its own data centers and approved public cloud accounts for sovereignty, with no Cisco-hosted option. The architect must list viable placements for the Manager, Controller, and Validator. Which set identifies supported hosting platforms for customer-hosted controllers?
• A branch edge with a valid certificate suddenly loses all control connections after an administrator revokes its certificate, and another edge warns of impending expiry. Which certificate lifecycle effect explains the revoked device losing fabric access immediately?
• A bank requires all SD-WAN controllers to run in its own data centers or its approved public cloud for data sovereignty. It uses VMware ESXi on premises and hosts workloads in AWS and Azure, with no bare-metal provisioning team. Which hosting approach satisfies the on-premises and cloud controller requirement?
• A regional retailer has 40 WAN Edge routers with enterprise CA certificates, and overnight three stores lost OMP routes while DTLS to the SD-WAN Controller stays down after a certificate renewal window. Valid serials still appear in SD-WAN Manager but one device shows an expired validity date. Which certificate lifecycle condition should the engineer validate first to explain the failed control connections?
• A regional bank is installing Cisco SD-WAN controllers on-premises in its own data center with an isolated management network, three static public IPs for VPN 0 reachability, and a single registered enterprise name to bind all devices. The engineer must bring up SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator consistently. Which initial installation sequence correctly applies system IP, VPN 0, and organization name for controller on-premises deployment?
• A logistics firm installs three on-premises controllers in its data center for a new overlay with organization name LogiCorp. Edge routers fail to authenticate and form no control connections despite reachable IPs. Which initial installation setting should the engineer verify first to restore controller adjacency?
• A new WAN Edge at a warehouse shows no OMP routes and users report no SD-WAN reachability. SD-WAN Manager shows the Edge flapping between connect and challenge, then tear-down toward the SD-WAN Controller. Which interpretation of these control-connection states guides troubleshooting?
• A partner must stage SD-WAN Manager, SD-WAN Controller and SD-WAN Validator for a new customer isolated lab with no prior controllers. They have IPs, certificates and WAN links ready but devices cannot join. Which initial installation sequence with system IP, VPN 0 and organization name allows controllers to form the fabric?
• After a certificate renewal, a branch WAN Edge shows no OMP routes and users report intermittent reachability. SD-WAN Manager shows one controller connection stuck in challenge and another in tear-down. Which interpretation of the control connection states best guides troubleshooting?
• A new branch WAN Edge shows no OMP routes, and the operations team reports the control connection to the SD-WAN Controller flaps between challenge and tear-down even though the Validator is reachable. Authentication was recently changed. Which interpretation of the control connection states should guide the next troubleshooting step for control plane connectivity?
• A service provider outgrows a single SD-WAN Manager handling 800 devices, with statistics lagging and configuration commits queuing. The plan adds two nodes for scale and resiliency without splitting the overlay. Which cluster design should the architect deploy to distribute Manager load?
• A service provider manages 2,000 WAN Edges from a single SD-WAN Manager that now suffers slow upgrades, search timeouts, and statistics gaps during peak polling. The team plans a three-node cluster while preserving services. Which Manager cluster scaling description correctly states the role of each node service for this growth?
• A bank is deploying controllers on premises across two data centers to survive loss of a full site and a single node, with 400 WAN Edges needing deterministic rehoming without manual reconfiguration. WAN Edges receive multiple addresses and must maintain control during failures. Which redundancy design ensures WAN Edges use multiple Validators and Controllers correctly?
• A new WAN Edge at a warehouse never reaches the controllers. It reaches the SD-WAN Validator on UDP 12346, but its DTLS handshake is repeatedly rejected, and the serial is already whitelisted. Which control-connection failure cause best explains this symptom set for control-plane troubleshooting?
• A new WAN Edge at a warehouse shows DTLS down to the SD-WAN Controller and SD-WAN Validator, its system clock is 18 minutes behind, its certificates were issued 10 minutes ago and the organization name matches. Underlay ping to controllers succeeds. Which control-plane connectivity issue should the engineer fix first to restore secure peering?
• A bank plans an on-premises SD-WAN Manager cluster for 800 WAN Edge routers with high availability and separate statistics collection. The design must keep configuration, control messaging and analytics available during a single server loss. Which Manager cluster scaling approach should the architect describe to satisfy resilience and service separation?
• Four new WAN Edges at a warehouse fail to establish control connections after a template push. SD-WAN Validator is reachable, certificates show valid, organization name matches, but logs show TLS errors and the devices are five minutes behind NTP. Which control-plane connectivity failure reason explains this onboarding symptom?
• A financial customer deploys controllers on-premises across two data centers, requires survival of a full site loss, and needs deterministic WAN Edge behavior when controllers become unreachable. Which redundancy design correctly uses multiple Validators and Controllers and WAN Edge connectivity?
• A healthcare network deploys two Validators and two Controllers on premises across data centers for 300 branches. A single controller-site failure must not block new branch onboarding or policy updates. How should the engineer describe WAN Edge use of redundant Validators and Controllers to ensure control-plane resilience?
• A district store router shows no control connections after staging, the template push failed, and the operations lead needs the fastest isolation of certificate versus reachability causes. Which show-command and Manager GUI workflow best diagnoses this join failure?
• A service provider plans an on-premises deployment for 1800 WAN Edges, dual transports per site, and 120k OMP routes with headroom for 30% growth and controller failover. The design must account for control load, tunnel scale and route capacity together. Which sizing approach correctly factors devices, tunnels and OMP routes for controllers?
• A new branch WAN Edge at a retail store shows no control connections, the site has Internet reachability, the serial is in Plug-and-Play, and the admin suspects certificate or Validator reachability. Which diagnostic approach should the engineer use to determine why the WAN Edge fails to join the control plane?
• A regional bank plans an on-premises SD-WAN Controller deployment for 1,200 WAN Edges, each with dual transports and full routing tables pushing 180,000 OMP routes fabric-wide. The server team asks what drives vCPU, RAM and scale limits. Which sizing factor should the engineer assess first to size the on-premises controller deployment?
• A new WAN Edge at a retail store will not join the fabric. It has DHCP Internet access, correct system clock, and reaches the Validator, but the Manager GUI shows the device as invalid and no control connection is established. Which troubleshooting check best identifies why this WAN Edge does not join the fabric?
• A defense supplier must deploy SD-WAN Controllers on-premises with no Internet access to Cisco cloud services, using its internal PKI to issue all identities with short-lived certificates. Which certificate authorization approach should the engineer select for controller identity and onboarding?
• A bank places WAN Edges behind a stateful firewall with NAT to reach hosted Controllers over the Internet. Control connections intermittently fail during initial bring-up, while user data sessions work after establishment. Which firewall and NAT handling allows DTLS/TLS control connections to form reliably?
• A healthcare company must onboard SD-WAN Controllers and 80 WAN Edges with strict audit rules: production controllers need automated scalable trust, while a isolated lab needs temporary bring-up without external PKI. Security approved Cisco cloud PKI for production and manual install for lab. Which certificate authorization plan satisfies both environments for this deployment?
• A bank WAN Edge behind a branch firewall must build DTLS control to a cloud-hosted Controller and Validator, outbound HTTPS is open, but control never forms while data traffic works. Which firewall and NAT port requirement should the engineer verify to restore DTLS/TLS control connections?
• A hospital behind a strict firewall is onboarding new branches where control connections stall during DTLS handshake, NAT hides private addresses, and only HTTPS is currently allowed outbound. Which firewall and NAT ports should you open for DTLS/TLS control connections?
• A service provider plans an on-premises controller cluster for 800 WAN Edge routers with dual transports and a full internet routing table redistributed at data centers, expecting 150,000 OMP routes. Architects must choose server resources and clustering. Which sizing factor for on-premises controllers addresses the scale requirement?