Policies (20%)

ENSDWI · 60 questions

• A regional retailer runs dual SD-WAN Controllers for two VPNs and must stop Site 20 prefixes from being advertised to Site 30 while keeping both sites reachable from headquarters. The engineer will use a centralized policy that filters OMP route advertisements. Which control policy direction on the SD-WAN Controller achieves the route-filtering requirement?
• A retailer with 40 branches runs guest Internet in VPN 10 and a firewall service at DC site 100 advertising a service TLOC. The design requires guest prefixes to be reachable only through that firewall TLOC, with failover if it is withdrawn. Which control policy set action for service chaining should the engineer configure to steer traffic through the firewall TLOC?
• A national retailer uses VPN 10 for stores that must send all traffic through regional hubs and VPN 20 for distribution centers that need direct site-to-site exchange. Both VPNs run across the same SD-WAN fabric with two SD-WAN Controllers. Which control-policy topology configuration delivers segmentation using different topologies per VPN?
• A bank runs voice over two transports, preferring low-delay MPLS color gold but tolerating broadband color blue, and requires loss under 2%, latency under 150ms, and jitter under 30ms before moving calls. The policy must measure performance and steer per tunnel. Which app-route policy with SLA class criteria and preferred colors meets the voice need?
• A retailer with 60 stores must force all inter-store traffic through two data-center hubs for inspection, while hubs still exchange routes directly. Spokes must not learn each other's TLOCs via OMP. Which control policy construction creates that hub-and-spoke topology?
• A retailer runs POS in VPN 30 and staff devices in VPN 40 on the same WAN Edge and needs POS to reach a shared printer in VPN 40 without merging routing tables. Shared services must stay controlled and leak only specific prefixes. Which route-leaking design provides selective end-to-end segmentation with controlled sharing?
• A school district with one hub and 25 spokes needs spokes to reach each other only through the hub for inspection, while the hub reaches all spokes directly. Spokes currently learn each other's TLOCs and form direct tunnels. Which control policy construction creates the hub-and-spoke topology requirement?
• An insurer must limit partner routes from site 200 to data-center prefixes 10.0.0.0/8, allow only Internet transport TLOCs, and drop the rest. The policy must use reusable lists and explicit actions. Which control policy match and set construction should the engineer build?
• A hospital runs clinical VPN 20 and guest VPN 30 on the same WAN Edges but guest kiosks need controlled access to a scheduling server in VPN 20, while all other guest routes must stay isolated. Which route-leaking policy between VPNs grants selective access to the shared service?
• A pharmaceutical maker runs 25 spokes and a headquarters hosting an IPS appliance behind a service-side attachment in a service VPN. Regulated research subnets must pass through the IPS, guest traffic must go direct, and routing must stay centralized. Which control-policy action inserts service chaining for the research prefixes through the IPS service?
• A trading firm steers market-data over app-route policy with strict loss and latency limits, preferring fiber color gold, but during congestion no tunnel of any color meets the SLA class for 30 seconds. Sessions must continue on the tunnel closest to meeting the SLA rather than drop until quality recovers. Which fallback behavior when no tunnel meets the SLA class keeps market-data flowing?
• A healthcare network runs voice over MPLS and broadband with requirements of under 150 ms latency, under 30 ms jitter and under 1% loss, preferring MPLS but failing over to broadband on violation. Which app-route policy design enforces SLA-class criteria with preferred colors for voice traffic?
• A healthcare network runs voice and EHR over MPLS and broadband, and clinicians report choppy calls when broadband degrades while EHR must stay stable. The design needs voice to prefer low loss, latency and jitter paths and move if SLA fails. Which app-aware routing configuration enforces voice SLA criteria and preferred colors?
• A bank has two data centers advertising 10.0.0.0/8 to 60 branches over OMP. Operations requires the hub routes to be filtered before they enter the Controller topology, but branch prefixes must still reach the hubs unchanged. Which control-policy design should the engineer apply to change only the intended routes?
• A hospital runs voice over two transports with an application-aware routing policy requiring low loss and latency, but during a fiber brownout both tunnels violate the SLA class. Which fallback behavior keeps critical voice flowing when no tunnel meets the SLA class?
• A manufacturer chains branch Internet traffic through a firewall service hosted at hub Site 20 before breakout. The firewall advertises a service TLOC, but default OMP best-path sends branches directly to the NAT TLOC at Site 20. Which control-policy action enforces the required service chaining through the firewall?
• A logistics firm must keep regulated warehouse prefixes off the internet transport by matching site lists, specific prefixes, and TLOC characteristics in a centralized control policy. The architect must choose match criteria and resulting set actions. Which control-policy match-and-set combination correctly uses site lists, prefix lists and TLOCs?
• A hospital runs app-aware routing for telehealth over two transports with BFD at 500 ms and app-route poll at 5 minutes, but failover to the better path takes minutes after brownout and clinicians complain. Loss starts suddenly while BFD stays up briefly. Which tuning of BFD and app-route polling best speeds application-aware convergence for this brownout case?
• A trading firm needs voice to fail over in seconds when WAN quality degrades, but the default application-aware routing feels slow to react. Which BFD and app-route polling adjustment accelerates SLA detection and convergence for this requirement?
• A university wants Zoom and Workday to take the low-latency path while YouTube and bulk downloads take broadband, but port-based rules keep misclassifying traffic because apps use dynamic ports and CDNs. Policy must match applications reliably before app-aware routing acts. Which classification approach correctly feeds application-aware routing for these dynamic apps?
• A hospital prioritizes Epic traffic from 10.10.0.0/16 to its data center 172.16.5.0/24. The centralized application-aware routing policy must match the source prefix, destination prefix, approved application, and voice DSCP before setting the SLA path. Which sequence match set should the engineer configure to enforce that precise classification?
• An enterprise merges two regions and must stop one data-center prefix from spreading to a partner site while still advertising all other routes, with minimal side effects. The control policy is applied on the Controller. Which description correctly states control-policy direction and which routes the policy actually changes?
• A logistics firm uses app-aware routing for barcode scanners over LTE and broadband with strict loss and latency limits, but remote sites occasionally lose both preferred paths during storms. Operations requires scanners to keep working on the single best available path. Which fallback behavior applies when no tunnel meets the SLA class?
• A retailer needs a control policy where Site 10 advertises 10.10.0.0/16 to Sites 20-30, but Hub Site 5 must filter TLOCs with lossy MPLS color and prefer broadband TLOCs for that prefix. Which match-and-set combination implements the site, prefix, and TLOC requirement?
• A 40-user branch has one MPLS transport and one Internet transport with NAT enabled on its interface in VPN 0. Users in service VPN 10 need direct Internet access for all traffic while MPLS stays preferred for corporate prefixes. Which branch DIA design provides full local Internet breakout?
• A seaport logistics hub runs voice dispatch, a warehouse management system, and nightly database replication over MPLS and broadband. Dispatch voice marked EF freezes when replication bursts, and managers need voice protected without blocking replication. Which centralized data-policy sequence match uses source, destination, application, and DSCP?
• A bank has two data centers advertising 10.0.0.0/8 to SD-WAN Controller from different regions. Engineers must ensure branches prefer DC-West for those prefixes without changing TLOC reachability or underlay tunnels. The policy is built in SD-WAN Manager. Which control-policy direction and effect achieves this route preference change?
• A manufacturer runs dual transports with MPLS for voice and internet for bulk data. Voice from VPN 10 must stay on MPLS TLOCs with EF marking, guest traffic must be forced to VPN 20, and malware flows must be blocked. Which data policy action set should the engineer configure to meet all three needs?
• A retailer needs Zoom to use MPLS only while loss stays under 2% while Office 365 can use Internet, with automatic classification even when ports change. The WAN Edge runs IOS XE with DPI enabled. Which application-aware routing classification meets the dynamic-app requirement?
• A logistics firm runs voice over two transports and wants app-aware routing to shift traffic within seconds when loss rises, but BFD flaps on a brownout link cause excessive reroutes. SLA targets require fast detection without instability. Which timer adjustment should the engineer evaluate first to tune application-aware routing convergence behavior?
• A university wants lecture video over MPLS and dorm Netflix over broadband, matching by source subnet, destination prefix, application and DSCP. A centralized data policy is planned in SD-WAN Manager. Which sequence match design selects this traffic correctly for forwarding action?
• A branch in VPN 20 needs selective DIA so only guest web traffic breaks out locally while corporate traffic stays on OMP overlays. Both transports have NAT, and blanket local default routing is prohibited. Which DIA approach provides app-selective local breakout?
• A financial firm wants its trading application to prefer low-jitter MPLS unless loss exceeds threshold, but port-based rules keep misclassifying the app when it moves to cloud ports. Classification must stay accurate without manual ACL updates. Which classification approach should the engineer choose to support application-aware routing for the trading traffic?
• An insurer must divert guest traffic to a scrubbing firewall, preserve voice markings end to end, and drop known malicious prefixes at the edge branches with dual transports. The policy team must encode forwarding and marking in one centralized data policy. Which data policy action set correctly uses set local TLOC, next hop, VPN, DSCP, and drop or accept for this control?
• A university applies a data policy to Site 10 that must filter user traffic entering the fabric toward the data center and also filter DC return traffic leaving the fabric toward users. The first draft applies only one direction and misses return flows. Which direction semantics should the engineer use to cover both paths?
• A small branch has one Internet transport on GigabitEthernet1 with DHCP, needing local web breakout for VPN 10 users while corporate traffic stays on the overlay. Which DIA configuration best enables direct Internet access at the branch?
• A 40-site retailer needs direct Internet access for guest Wi-Fi and Microsoft 365, must keep PCI card data on the VPN overlay, and has small branches with no local security staff. Which DIA security enforcement design best balances these DIA trade-off requirements?
• A single-router branch with one MPLS and one internet transport must send guest VPN 20 traffic directly to the internet while corporate VPN 10 stays on the overlay. The internet interface needs NAT and the service VPN needs a local default route without leaking to OMP. Which direct Internet access configuration satisfies this branch isolation requirement?
• A hospital has 40 clinics needing identical hub preference for telehealth centrally, but each clinic must translate its overlapping 10.1.0.0/16 LAN and enable local Internet breakout on site. Compliance requires central intent with per-site exceptions handled locally. Which statement correctly separates localized policy scope from centralized data policy enforcement scope?
• A hospital has dual hubs with separate TLOCs and needs MRI traffic from Clinic Site 20 to prefer the low-latency hub, remark voice to expedited forwarding, and drop guest traffic to the data center. The policy is centralized from the Controller. Which data policy action set should the engineer configure to enforce preferred path and QoS handling?
• A bank has LAN printers and servers behind a branch router and must filter traffic leaving the LAN toward the SD-WAN overlay differently from traffic arriving from the overlay to the LAN across all sites in one site list. Which data-policy direction design correctly applies from-service versus from-tunnel semantics?
• A healthcare group with 25 clinics wants only Salesforce and Workday to break out locally with NAT, while all other traffic stays on MPLS to headquarters. Engineers need per-application path and NAT control on WAN Edge routers. Which DIA control for selective application breakout should the engineer configure to meet NAT requirements?
• A national retailer with 180 small stores plans DIA for point-of-sale cloud access and guest browsing. All Internet traffic must receive URL filtering and malware inspection. Store WAN Edges run high CPU, sites have no local security staff, and MPLS bandwidth is limited. Which DIA security enforcement design should the engineer choose?
• An enterprise has Guest VPN 10 at branches and MPLS VPN 20 toward the data center. A centralized data policy must handle internet-bound traffic leaving the Edge and tunnel-bound traffic arriving from the fabric differently, applied only to Site 30 and Site 40. Which direction and site-list application should the engineer configure to enforce correct data policy semantics?
• A network team must block a specific site prefix from being advertised to partners, keep all other OMP routes flowing, and enforce the filter consistently across the overlay. Which centralized control-policy application best achieves this OMP filtering requirement?
• An international retailer operates 35 stores with dual transports and requires voice traffic to prefer MPLS with failover to broadband at every site, while each store also needs local OSPF redistribution and service-VPN route maps unique to its LAN. The design must apply the common steering once and keep site-specific routing on the routers. Which policy scope and enforcement design correctly separates localized policy from centralized policy?
• A branch must allow only marketing VLAN 30 in VPN 10 to break out locally to the internet for HubSpot, while finance VLAN 40 in the same VPN must stay on the overlay to the data center. Both VLANs share one internet transport and need source NAT only for breakout traffic. Which selective DIA forwarding approach meets this per-application isolation requirement?
• A manufacturer must isolate guest, IoT and ERP traffic end to end, keep Internet transport separate from LAN, and preserve out-of-band management even if the overlay fails. Templates must map each use case to the correct VPN identifier consistently. Which VPN assignment correctly uses service VPNs, VPN 0 and VPN 512 for segmentation?
• A manufacturing branch has one MPLS and one Internet circuit, four user VLANs, plus a need for out-of-band management if the overlay fails. The engineer drafts templates with VPN 0, VPN 10 and VPN 512. Which VPN assignment correctly maps transport, service, and management roles for end-to-end segmentation?
• A bank with 60 branches must prevent direct branch-to-branch routes for audit isolation, must allow all branches to reach two data-center hubs, and must keep OMP peering scalable. Which control policy design should you build to enforce hub-and-spoke topology?
• A manufacturer uses a centralized security policy for internet breakout at headquarters while each plant needs unique OSPF costs and VLAN mappings on its own Edge routers. Engineers debate where to enforce each requirement efficiently. Which distinction between localized policy versus centralized policy guides enforcement placement?
• An enterprise runs dual data centers with regional hubs and needs to prevent specific branch TLOCs from being advertised to a partner site, while allowing all other overlay routes. Central changes must apply fabric-wide without touching branch CLIs. Which centralized control policy application achieves this routing control?
• A 40-site retailer wants guest and Microsoft 365 traffic offloaded locally at each branch, PCI traffic must stay on MPLS to the data center, and IT has no staff for branch firewalls. Which design trade-off should the engineer recommend for direct Internet access with security enforcement?
• A bank needs VPN 20 for teller traffic restricted to hub-and-spoke through the data center and VPN 30 for voice engineers requiring full mesh between campuses, both running over the same SD-WAN fabric. The architect must enforce different topologies per VPN centrally. Which end-to-end segmentation approach with control policy meets this dual-topology requirement?
• A logistics company has one headquarters hub and forty spokes that must communicate only through the hub for inspection, but spokes must still establish data tunnels directly to the hub. Underlay connectivity is full mesh capable. Which control policy construction creates this hub-and-spoke behavior?
• A manufacturer runs a centralized firewall service at its headquarters and needs Cambridge plant traffic to detour through that firewall before reaching the partner VPN, with failover to a second firewall. Which centralized policy design should you use to provide this service chaining?
• A hospital deploys SD-WAN with isolated traffic for clinical devices, guest Wi-Fi, transport underlay, and router management, requiring separation even if overlays fail. Engineers must assign VPNs correctly on WAN Edge routers. Which assignment of service VPNs, VPN 0 and VPN 512 reflects their roles?
• A logistics firm must block a merger-acquired site from learning data-center prefixes, allow all other sites full routes, and enforce this centrally without touching WAN Edges. Which centralized control policy action should the engineer configure to meet this routing requirement?
• A university runs staff in VPN 10 and research instruments in VPN 20 on the same fabric, and a shared printer subnet in VPN 20 must be reachable from VPN 10 without merging the full tables. Security requires explicit controlled leaking only for that subnet. Which route-leaking approach between VPNs with policy enforces this selective shared-service requirement?
• A logistics firm needs VPN 30 as hub-and-spoke via Chicago and VPN 40 as full mesh between warehouses, both over the same physical overlay. Application teams demand no cross-VPN leakage. Which segmentation approach correctly delivers different topologies per VPN with control policy?