I85PREP
⌘ K
Arista ACE Specialist - WAN Routing study materials
Arista ACE Specialist - WAN Routing study resources

Arista ACE Specialist - WAN Routing practice questions

One question at a time. Build your Arista ACE Specialist - WAN Routing understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1WAN and SD-WAN Architecture

In a hub-and-spoke WAN topology, what is the primary traffic-forwarding characteristic between two spoke sites?

  1. Spokes forward traffic only to the internet gateway
  2. Spokes are connected in a full mesh by design
  3. Spoke-to-spoke traffic is typically forwarded through the hub site Correct answer.
  4. Spokes communicate directly over a dedicated spoke-to-spoke circuit

Explanation

A hub-and-spoke topology centralizes connectivity at the hub, so inter-spoke traffic normally traverses the hub. This simplifies policy and reduces circuit count but adds latency and hub load. Full-mesh designs instead provide direct spoke-to-spoke paths.

Question 2WAN and SD-WAN Architecture

Which WAN technology provides a connectionless, packet-switched service where the provider forwards based on a customer-assigned label?

  1. MPLS VPN Correct answer.
  2. Dark fiber
  3. Frame Relay
  4. Leased line

Explanation

MPLS VPNs are packet-switched services where the provider forwards traffic using labels assigned within the provider network. Leased lines are dedicated point-to-point circuits, and dark fiber provides unlit physical strands. Frame Relay is also packet-switched but uses DLCIs rather than MPLS labels.

Question 3WAN and SD-WAN Architecture

What is the main purpose of a DMVPN Phase 1 design compared with a full mesh of tunnels?

  1. To encrypt all traffic with IPsec by default
  2. To provide direct spoke-to-spoke tunnels
  3. To reduce configuration by using hub-terminated tunnels Correct answer.
  4. To eliminate the need for a hub router

Explanation

DMVPN Phase 1 uses a hub-and-spoke tunnel model where spokes build tunnels only to the hub, reducing configuration and tunnel count. Direct spoke-to-spoke tunnels are a Phase 2/3 capability. Phase 1 does not inherently encrypt traffic.

Question 4WAN and SD-WAN Architecture

In SD-WAN architecture, what is the role of the controller plane?

  1. It provides DNS resolution for the overlay
  2. It terminates all IPsec tunnels at the branch
  3. It forwards user data packets between branch sites
  4. It computes and distributes policy and topology information to network devices Correct answer.

Explanation

The controller plane centralizes policy computation and distributes topology and policy information to the data plane devices. Actual packet forwarding occurs in the data plane. This separation of control and forwarding is a defining SD-WAN principle.

Question 5WAN and SD-WAN Architecture

Which characteristic distinguishes a private WAN circuit from an internet-based WAN transport?

  1. Private circuits always cost less than internet transport
  2. Private circuits require no routing protocol
  3. Private circuits use encryption by default
  4. Private circuits offer deterministic paths with provider SLAs Correct answer.

Explanation

Private WAN circuits provide deterministic paths and contractual SLAs for latency, jitter, and availability. Internet transport is best-effort and typically requires encryption to protect data. Private circuits are not inherently encrypted and are often more expensive.

Question 6WAN and SD-WAN Architecture

What does a WAN edge router use to select among multiple paths when a routing protocol advertises equal-cost routes?

  1. Only the lowest interface index
  2. Equal-cost multipath load balancing Correct answer.
  3. The oldest route in the table
  4. The highest administrative distance

Explanation

When multiple routes have equal cost and equal preference, the router can install them and load-balance traffic across them using equal-cost multipath. Administrative distance is used to compare routes from different sources, not to break equal-cost ties.

Question 7WAN and SD-WAN Architecture

Which statement best describes an overlay network in SD-WAN?

  1. It is a logical topology built over one or more underlays Correct answer.
  2. It is the physical underlay of provider circuits
  3. It replaces the need for any physical transport
  4. It is limited to a single transport type

Explanation

An overlay is a logical topology (such as tunnels) constructed on top of one or more physical underlays. It enables policy and path control independent of the underlying transport. The underlay remains the physical transport.

Question 8WAN and SD-WAN Architecture

What is the primary function of a WAN edge device at a branch site?

  1. To host the provider's core label-switching routers
  2. To connect the branch LAN to WAN transports and apply policy Correct answer.
  3. To serve as the authoritative DNS server for the provider
  4. To provide only physical layer media conversion

Explanation

A WAN edge device connects the branch LAN to one or more WAN transports and applies routing, policy, and often security functions. It does not perform provider core switching or act as a provider DNS authority.

Question 9WAN and SD-WAN Architecture

An enterprise wants direct spoke-to-spoke communication in a DMVPN design without routing all inter-spoke traffic through the hub. Which DMVPN phase provides this capability with spoke-to-spoke tunnels?

  1. Phase 3
  2. Phase 4
  3. Phase 2 Correct answer.
  4. Phase 1

Explanation

DMVPN Phase 2 enables direct spoke-to-spoke tunnels by allowing spokes to learn each other's routes and build on-demand tunnels. Phase 1 restricts traffic to hub paths, and Phase 3 adds hierarchical scalability with NHRP shortcuts. There is no Phase 4 in the standard DMVPN progression.

Question 10WAN and SD-WAN Architecture

A network engineer needs a WAN transport that guarantees a committed rate and provides an SLA for latency and jitter between two data centers. Which transport best fits this requirement?

  1. MPLS VPN with a provider SLA Correct answer.
  2. Best-effort broadband internet
  3. A single unencrypted IPsec tunnel over the internet
  4. A public Wi-Fi backhaul

Explanation

MPLS VPNs from a provider can include contractual SLAs covering committed rates, latency, and jitter, making them suitable for latency-sensitive inter-DC traffic. Internet and Wi-Fi transports are best-effort and cannot guarantee these metrics.

Question 11WAN and SD-WAN Architecture

In an SD-WAN solution, application-aware routing steers traffic based on which combination of factors?

  1. Application identity plus real-time path quality metrics Correct answer.
  2. Only the routing protocol administrative distance
  3. Only the destination IP address
  4. Only the source MAC address

Explanation

Application-aware routing identifies applications (for example by DPI or flow classification) and steers them according to live path metrics such as latency, jitter, and loss. This allows per-application policy across multiple transports. Traditional destination-based routing does not consider path quality.

Question 12WAN and SD-WAN Architecture

A company uses a hub-and-spoke WAN and wants to add a second hub for redundancy. What is the main benefit of this design?

  1. It eliminates the need for WAN encryption
  2. It guarantees spoke-to-spoke direct tunnels
  3. It provides an alternate path if the primary hub fails Correct answer.
  4. It removes the need for routing protocols

Explanation

Adding a second hub provides an alternate forwarding path so spokes can remain reachable if the primary hub fails. Routing protocols are still needed to select paths, and encryption requirements are unchanged. Spoke-to-spoke direct tunnels are a separate design choice.

Question 13WAN and SD-WAN Architecture

What does a provider edge (PE) router do in an MPLS VPN architecture?

  1. It connects customer sites to the provider MPLS network and maintains per-customer VRFs Correct answer.
  2. It forwards traffic only within the customer LAN
  3. It assigns public IP addresses to customer hosts
  4. It terminates all customer IPsec tunnels

Explanation

The PE router sits at the provider edge, connecting customer sites to the MPLS core and maintaining separate VRFs per customer to keep routing tables isolated. Customer LAN forwarding is handled by customer edge devices, not the PE.

Question 14WAN and SD-WAN Architecture

An engineer configures a WAN edge to prefer a primary MPLS path and use internet as backup. Which mechanism most directly enforces this preference?

  1. Disabling the routing protocol on the MPLS path
  2. Increasing the MTU on the internet path
  3. A routing preference or administrative distance favoring the MPLS route Correct answer.
  4. Equal-cost multipath across both paths

Explanation

Route preference (such as administrative distance or protocol preference) makes the MPLS route preferred and the internet route a backup. Equal-cost multipath would load-balance rather than prefer one path. MTU changes do not affect path preference.

Question 15WAN and SD-WAN Architecture

Why do SD-WAN designs commonly encrypt overlay tunnels even when using private underlays?

  1. To reduce the number of routing adjacencies
  2. To increase the MTU of the underlay
  3. To eliminate the need for path selection
  4. To protect traffic confidentiality and integrity across the WAN Correct answer.

Explanation

Encrypting overlay tunnels protects confidentiality and integrity of traffic traversing the WAN, regardless of whether the underlay is private or public. Encryption does not change MTU, adjacency counts, or path-selection requirements.

Question 16WAN and SD-WAN Architecture

A branch has two internet links of different bandwidth. Which SD-WAN capability best ensures voice traffic uses the link with the lowest measured latency?

  1. Per-flow quality measurement with policy-based path selection Correct answer.
  2. Increasing the routing metric on both links
  3. Round-robin load balancing across both links
  4. Static default routing on both links

Explanation

Continuous per-flow quality measurement feeds policy-based path selection so latency-sensitive traffic such as voice can be steered to the best-performing link. Static or round-robin methods ignore live quality, and raising metrics on both links does not differentiate them.

Question 17WAN and SD-WAN Architecture

What is the purpose of NHRP in a DMVPN deployment?

  1. To encrypt the tunnel payload
  2. To provide QoS marking for voice
  3. To distribute public IP mappings for tunnel endpoints Correct answer.
  4. To replace the routing protocol entirely

Explanation

NHRP lets spokes register their public tunnel addresses with the hub and resolve other spokes' addresses, enabling on-demand spoke-to-spoke tunnels. It does not provide encryption, QoS, or replace routing protocols.

Question 18WAN and SD-WAN Architecture

Which design consideration most affects the scalability of a full-mesh WAN topology?

  1. The number of tunnels grows linearly with the number of sites
  2. The number of tunnels grows roughly with the square of the number of sites Correct answer.
  3. Full mesh eliminates the need for encryption
  4. Full mesh requires no routing protocol

Explanation

In a full mesh, each site needs a path to every other site, so the number of tunnels (or adjacencies) grows roughly with the square of the site count. This makes large full-mesh designs costly to manage. Routing and encryption are still required.

Question 19WAN and SD-WAN Architecture

An SD-WAN controller pushes a policy that sends SaaS traffic directly to the internet from branches while sending internal traffic over MPLS. What is this design called?

  1. Backhauling
  2. Local internet breakout Correct answer.
  3. Full-mesh tunneling
  4. Hub-and-spoke hairpinning

Explanation

Local internet breakout sends SaaS and internet-bound traffic directly from the branch to the internet, reducing latency and backhaul load. Backhauling instead sends such traffic to a central site. Internal traffic still follows the MPLS path.

Question 20WAN and SD-WAN Architecture

Which statement correctly describes the relationship between administrative distance and prefix length in route selection on a router?

  1. Longer prefix length is always preferred before administrative distance is considered within the same source Correct answer.
  2. Administrative distance only applies to directly connected routes
  3. Administrative distance is compared first across all sources regardless of prefix length
  4. Prefix length is ignored when multiple routes exist

Explanation

For routes from the same routing source, the longest matching prefix wins. Administrative distance is used to compare routes learned from different sources before protocol-specific metrics are evaluated. It is not limited to directly connected routes.

Question 21WAN and SD-WAN Architecture

A network architect is comparing MPLS VPN with internet-based SD-WAN. Which pair of trade-offs is most accurate?

  1. MPLS requires no routing; internet SD-WAN requires no encryption
  2. MPLS offers provider SLAs but higher cost; internet SD-WAN offers flexibility and lower cost but requires encryption Correct answer.
  3. MPLS is always encrypted; internet SD-WAN is never encrypted
  4. MPLS offers lower cost and best-effort delivery; internet SD-WAN offers guaranteed SLAs

Explanation

MPLS VPNs typically provide SLA-backed deterministic paths at higher cost, while internet-based SD-WAN offers transport flexibility and lower cost but relies on encryption and overlay intelligence for security and quality. The other pairings invert these characteristics.

Question 22WAN and SD-WAN Architecture

In a DMVPN Phase 3 design, what does the hub use to influence which spoke-to-spoke path a spoke selects?

  1. IPsec rekey timers
  2. QoS trust boundaries
  3. BGP community values only
  4. NHRP redirect messages that prompt spokes to resolve a direct tunnel Correct answer.

Explanation

Phase 3 uses NHRP redirects so the hub can signal a spoke to resolve a direct spoke-to-spoke tunnel when traffic would otherwise transit the hub. Rekey timers and QoS do not control path selection. BGP communities alone do not trigger NHRP resolution.

Question 23WAN and SD-WAN Architecture

An SD-WAN edge measures 150 ms latency on link A and 40 ms on link B, but link A has a committed SLA while link B is best-effort. Voice policy requires latency under 100 ms but prefers SLA-backed transport when quality is acceptable. Which action best satisfies the policy?

  1. Send voice over link B because it meets the latency threshold Correct answer.
  2. Send voice over neither link
  3. Send voice over link A because it has an SLA
  4. Load-balance voice equally across both links

Explanation

The policy's hard requirement is latency under 100 ms; link B at 40 ms satisfies it, while link A at 150 ms does not, despite its SLA. SLA preference applies only when quality is acceptable, so the latency threshold takes precedence. Load-balancing would send some voice over the non-compliant link.

Question 24WAN and SD-WAN Architecture

A provider offers an MPLS VPN where the customer manages routing between its own sites across the provider cloud. Which model does this describe?

  1. Layer 3 VPN with customer-managed routing Correct answer.
  2. A public internet VPN
  3. Layer 2 point-to-point service
  4. Layer 1 leased line

Explanation

A Layer 3 MPLS VPN carries customer IP routing across the provider cloud, and the customer can manage routing between its own sites through the provider's VRFs. Layer 2 and Layer 1 services do not provide provider-based Layer 3 forwarding. Public internet VPNs are not provider MPLS VPNs.

Question 25WAN and SD-WAN Architecture

A company wants to ensure that if a primary WAN path degrades in quality but does not fail, traffic still moves to a secondary path. Which mechanism is required beyond traditional routing protocol convergence?

  1. Continuous path-quality probing with policy-based failover Correct answer.
  2. Disabling the primary interface manually
  3. Faster routing hello timers only
  4. Increasing the administrative distance of the secondary path

Explanation

Traditional routing protocols react to link or neighbor failures, not gradual quality degradation. Continuous probing with policy-based failover detects latency, jitter, or loss changes and moves traffic before a hard failure. Faster hellos and distance tweaks do not measure quality.

Question 26WAN and SD-WAN Architecture

Which WAN connectivity model provides a dedicated, point-to-point circuit between two customer sites with a fixed bandwidth guarantee?

  1. A Layer 3 MPLS VPN with a committed rate
  2. An internet broadband connection
  3. A GRE tunnel over the public internet
  4. A dedicated leased line Correct answer.

Explanation

A leased line is a dedicated circuit that connects exactly two endpoints and delivers a fixed, guaranteed bandwidth with no shared provider switching. MPLS VPNs are logical and shared, broadband is best-effort, and GRE tunnels inherit the underlying transport's characteristics.

Question 27WAN and SD-WAN Architecture

In SD-WAN terminology, what distinguishes the underlay from the overlay?

  1. The underlay is encrypted while the overlay is cleartext
  2. The underlay carries only control traffic while the overlay carries only data traffic
  3. The underlay is the physical transport network; the overlay is the logical tunnel topology built on top of it Correct answer.
  4. The underlay is managed by the provider while the overlay is always unmanaged

Explanation

The underlay consists of the actual transport links (MPLS, internet, LTE) and their routing, while the overlay is the logical mesh of tunnels formed across those links. Encryption and management responsibility are independent of the underlay/overlay distinction.

Question 28WAN and SD-WAN Architecture

Which WAN topology connects every site directly to every other site?

  1. Hub-and-spoke
  2. Ring
  3. Partial mesh
  4. Full mesh Correct answer.

Explanation

A full mesh provides a direct path between every pair of sites, maximizing path diversity at the cost of many tunnels or circuits. Hub-and-spoke and partial mesh reduce connectivity to save cost, and a ring only connects neighbors.

Question 29WAN and SD-WAN Architecture

What is the role of a customer edge (CE) router in an MPLS VPN architecture?

  1. It connects the customer site to the provider edge and exchanges routes with it Correct answer.
  2. It provides the global routing table for the provider backbone
  3. It assigns MPLS labels between provider routers
  4. It terminates all customer VPNs at the provider core

Explanation

The CE router sits at the customer premises and peers with the provider edge, handing off customer routes and forwarding traffic into the provider cloud. Label switching and VPN termination are provider functions performed by P and PE routers.

Question 30WAN and SD-WAN Architecture

Which characteristic is typical of a broadband internet WAN link compared with an MPLS link?

  1. Lower cost with variable, best-effort performance Correct answer.
  2. Deterministic bandwidth with no oversubscription
  3. Guaranteed latency and jitter via an SLA
  4. Native any-to-any Layer 3 VPN separation

Explanation

Broadband internet service is inexpensive but best-effort, so latency, jitter, and loss vary with congestion. MPLS services are the ones that typically provide SLAs, VPN separation, and more predictable performance.

Question 31WAN and SD-WAN Architecture

What does the term 'brownfield' mean when describing an SD-WAN migration?

  1. Adding SD-WAN incrementally alongside existing routers and transports Correct answer.
  2. Running SD-WAN exclusively over a new MPLS contract
  3. Replacing all existing WAN equipment with SD-WAN appliances in one cutover
  4. Deploying SD-WAN only in the data center

Explanation

A brownfield migration introduces SD-WAN devices and policies gradually while existing WAN infrastructure continues to operate, allowing coexistence during transition. A full replacement is a greenfield approach.

Question 32WAN and SD-WAN Architecture

Which protocol is commonly used to build encrypted SD-WAN overlay tunnels between edges?

  1. LDP
  2. IPsec Correct answer.
  3. BFD
  4. NHRP

Explanation

IPsec provides confidentiality and integrity for overlay tunnels between SD-WAN edges. NHRP is a mapping protocol, LDP distributes MPLS labels, and BFD is a fast failure-detection mechanism.

Question 33WAN and SD-WAN Architecture

Which statement describes a virtual routing and forwarding (VRF) instance in a WAN design?

  1. It creates a separate routing table so overlapping address spaces can coexist Correct answer.
  2. It encrypts all traffic leaving a WAN interface
  3. It aggregates multiple physical links into one logical link
  4. It assigns QoS markings to inbound frames

Explanation

A VRF maintains an independent routing and forwarding table, allowing multiple customers or segments with overlapping prefixes to share a device. Encryption, link aggregation, and marking are handled by other features.

Question 34WAN and SD-WAN Architecture

A branch has an MPLS link and an internet link. The design requires that traffic fail over to the internet when the MPLS link loses connectivity, and that the internet link is preferred only in that case. Which capability implements this requirement?

  1. Policy-based routing that sends all traffic to the internet
  2. A floating static route with a higher administrative distance pointing to the internet Correct answer.
  3. Per-packet load balancing across both links
  4. Equal-cost multipath across both links

Explanation

A floating static route is installed but remains inactive while a route with a lower administrative distance (learned over MPLS) exists, becoming active only when that path is lost. Equal-cost multipath and per-packet balancing would use both links simultaneously rather than as standby.

Question 35WAN and SD-WAN Architecture

An SD-WAN edge must forward business-critical traffic over the MPLS link while sending bulk backup traffic over broadband, regardless of destination. Which mechanism accomplishes this?

  1. Centralized policy that classifies traffic and maps it to a preferred path Correct answer.
  2. Configuring a longer tunnel keepalive on the broadband link
  3. Enabling jumbo frames on the MPLS interface
  4. Increasing the MTU on the broadband interface

Explanation

SD-WAN path selection relies on centralized policies that match traffic (by application, DSCP, or prefix) and steer it to a chosen transport. MTU, jumbo frames, and keepalive timers affect delivery characteristics but do not direct traffic to a specific link.

Question 36WAN and SD-WAN Architecture

A network architect must design a WAN where a single regional site aggregates traffic from many small branches to reduce per-site tunnel counts. Which topology matches this requirement?

  1. Ring
  2. Hub-and-spoke with the regional site as hub Correct answer.
  3. Point-to-point leased lines between every branch
  4. Full mesh

Explanation

A hub-and-spoke design funnels branch traffic through a central hub, keeping the number of tunnels per branch low and simplifying policy enforcement. Full mesh and point-to-point designs multiply connections per site.

Question 37WAN and SD-WAN Architecture

Which benefit does dynamic multipoint VPN primarily provide over a classic hub-and-spoke VPN?

  1. Automatic encryption key rotation without any configuration
  2. Guaranteed bandwidth reservations per spoke
  3. Native multicast replication across the provider core
  4. Direct spoke-to-spoke tunnels established on demand Correct answer.

Explanation

DMVPN allows spokes to build direct tunnels to one another dynamically, avoiding the hub as a transit point for spoke-to-spoke flows. It does not provide bandwidth reservations or automatic key rotation by itself.

Question 38WAN and SD-WAN Architecture

An engineer needs the underlay to detect link degradation within sub-second intervals so the SD-WAN controller can reroute traffic. Which mechanism is designed for this?

  1. SNMP polling every five minutes
  2. BFD Correct answer.
  3. NTP
  4. Syslog forwarding

Explanation

BFD sends rapid, lightweight probes that detect failures and degradation in sub-second timeframes, feeding fast reroute decisions. NTP, periodic SNMP polling, and syslog are not fast failure-detection mechanisms.

Question 39WAN and SD-WAN Architecture

Which statement best describes the function of a route reflector in a large iBGP WAN deployment?

  1. It redistributes routes between OSPF and BGP
  2. It encrypts BGP sessions between autonomous systems
  3. It assigns MPLS labels to BGP prefixes
  4. It reflects routes between iBGP peers so a full iBGP mesh is not required Correct answer.

Explanation

A route reflector receives iBGP routes and reflects them to other iBGP clients, removing the need for every router to peer with every other router. It does not perform redistribution, encryption, or label allocation.

Question 40WAN and SD-WAN Architecture

A provider offers a Layer 3 VPN service in which the customer runs BGP with the provider edge and the provider carries only customer routes. Which model is this?

  1. Layer 3 VPN with provider-managed routing
  2. Dark fiber lease
  3. Layer 3 VPN with customer-managed routing Correct answer.
  4. Layer 2 point-to-point pseudowire

Explanation

When the CE peers with the PE using BGP and the customer controls its own routing policy across the VPN, the service is a Layer 3 VPN with customer-managed routing. Provider-managed routing would place routing control with the provider.

Question 41WAN and SD-WAN Architecture

Which design consideration most directly limits how many IPsec tunnels a single SD-WAN edge can support?

  1. The length of the pre-shared key
  2. The number of QoS queues configured
  3. The device's memory, CPU, and encryption throughput Correct answer.
  4. The number of syslog servers configured

Explanation

Each tunnel consumes memory for state and requires CPU and encryption capacity for its traffic, so platform resources bound tunnel scale. QoS queues, key length, and logging targets do not determine tunnel count.

Question 42WAN and SD-WAN Architecture

An SD-WAN deployment must keep voice traffic within a latency budget of 100 ms. The controller continuously measures per-link latency, jitter, and loss. Which capability uses these measurements to choose a path?

  1. Application-aware path selection with SLA thresholds Correct answer.
  2. Port mirroring
  3. Static route redistribution
  4. Spanning Tree recalculation

Explanation

SLA-based application-aware routing compares live per-link quality metrics against configured thresholds and steers traffic to a link that satisfies them. Static redistribution, STP, and port mirroring do not evaluate link quality.

Question 43WAN and SD-WAN Architecture

A company wants to interconnect three data centers over a provider network with any-to-any reachability, using a single routing domain managed by the company. Which WAN service best fits?

  1. Three point-to-point leased lines in a triangle with no provider routing
  2. A single GRE tunnel between two of the sites
  3. An MPLS Layer 3 VPN with a single customer VRF Correct answer.
  4. Three separate internet broadband links with static routes

Explanation

An MPLS Layer 3 VPN provides any-to-any connectivity within one customer routing domain across all provider-attached sites. Separate broadband links, unmanaged leased lines, and a single tunnel do not deliver a unified any-to-any domain.

Question 44WAN and SD-WAN Architecture

Which statement correctly describes how a hub-and-spoke WAN affects traffic engineering compared with a full mesh?

  1. Hub-and-spoke concentrates policy enforcement and traffic at the hub Correct answer.
  2. Hub-and-spoke provides more direct paths between spokes
  3. Hub-and-spoke eliminates the need for routing at branch sites
  4. Hub-and-spoke guarantees lower latency between any two spokes

Explanation

In hub-and-spoke, inter-spoke traffic transits the hub, which centralizes policy enforcement and traffic inspection but adds latency and hub load. It does not eliminate branch routing or guarantee lower latency.

Question 45WAN and SD-WAN Architecture

An architect is designing a WAN with strict regulatory requirements that all inter-site traffic remain on a private provider network and never traverse the public internet. Which transport choice satisfies this?

  1. Internet broadband with IPsec tunnels
  2. An MPLS VPN service from a provider Correct answer.
  3. A public cloud VPN gateway
  4. A 5G cellular connection with encryption

Explanation

An MPLS VPN carries traffic only across the provider's private backbone, keeping it off the public internet. Broadband, public cloud gateways, and cellular connections all rely on public infrastructure.

Question 46WAN and SD-WAN Architecture

A WAN design uses a single MPLS provider with one physical link per site. Which single change most improves resilience against a provider link failure?

  1. Increasing the MPLS committed rate
  2. Enabling jumbo frames on the MPLS interface
  3. Reducing the OSPF hello interval on the MPLS link
  4. Adding a diverse secondary transport such as internet or LTE Correct answer.

Explanation

Resilience against a failed transport requires an alternate path, typically a diverse second transport with failover policy. More bandwidth, larger frames, or faster hellos do not help when the only link is down.

Question 47WAN and SD-WAN Architecture

In an SD-WAN controller-based architecture, which plane is responsible for computing and distributing forwarding policy to the edges?

  1. The data plane
  2. The management plane
  3. The control plane Correct answer.
  4. The forwarding plane

Explanation

The control plane computes topology and policy and distributes it to edges, while the data plane forwards packets and the management plane handles configuration and monitoring. The forwarding plane is another name for the data plane.

Question 48WAN and SD-WAN Architecture

A design requires that inter-spoke traffic in a DMVPN network not be hairpinned through the hub once direct spoke tunnels exist. Which DMVPN phase accomplishes this with hub-controlled next-hop resolution?

  1. Phase 2
  2. A static point-to-point tunnel mesh
  3. Phase 3 Correct answer.
  4. Phase 1

Explanation

DMVPN Phase 3 uses NHRP shortcut switching, where the hub informs the spoke of the correct next hop so a direct spoke-to-spoke tunnel can be built without hub transit. Phase 1 forces all inter-spoke traffic through the hub, and Phase 2 relies on spoke-learned routes rather than hub-controlled next-hop resolution.

Question 49WAN and SD-WAN Architecture

An enterprise runs OSPF inside each site and BGP between sites over a provider VPN. Which design principle does this arrangement follow?

  1. IGP at the edge, BGP in the core
  2. A single IGP spanning all sites with no BGP
  3. IGP for intra-site reachability and BGP for inter-site policy and scale Correct answer.
  4. BGP for intra-site reachability and OSPF for inter-site policy

Explanation

A common WAN design uses an IGP such as OSPF within each site for fast convergence and BGP between sites to apply policy and scale across the provider domain. Using BGP intra-site or a single flat IGP across all sites sacrifices policy control and scale.

Question 50WAN and SD-WAN Architecture

A company operates two SD-WAN overlays: one for corporate traffic and one for guest traffic, each with separate VRFs and policies. Which statement best explains why separate overlays are used instead of one shared overlay?

  1. A shared overlay cannot encrypt traffic
  2. A shared overlay cannot carry more than one DSCP value
  3. Separate overlays provide isolation of routing, policy, and failure domains Correct answer.
  4. Separate overlays are required to use BFD

Explanation

Distinct overlays bound each traffic class to its own routing table, policy set, and failure domain, so a change or fault in one does not affect the other. Encryption, BFD, and DSCP marking are all available within a single overlay.