I85PREP
⌘ K
Cisco ENSDWI 300-415 study materials
Cisco ENSDWI 300-415 study resources

Cisco ENSDWI 300-415 practice questions

One question at a time. Build your Cisco ENSDWI 300-415 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1SD-WAN Architecture and Controller Deployment

In a Cisco SD-WAN deployment, which component is responsible for distributing the control-plane overlay routes (OMP routes) and policies to the WAN Edge devices?

  1. The vManage NMS
  2. The vSmart controller Correct answer.
  3. The WAN Edge router itself
  4. The vBond orchestrator

Explanation

The vSmart controller runs the Overlay Management Protocol and is the control-plane brain of the fabric, exchanging OMP routes and policies with WAN Edge devices. vBond handles initial authentication and orchestration, while vManage is the management plane.

Question 2SD-WAN Architecture and Controller Deployment

Which controller plane is responsible for validating and authenticating a WAN Edge device when it first joins the SD-WAN fabric?

  1. vBond Correct answer.
  2. vSmart
  3. vAnalytics
  4. vManage

Explanation

vBond acts as the orchestration and authentication entry point: a new WAN Edge authenticates against vBond, which then redirects it to the appropriate vManage and vSmart controllers. This makes vBond the first controller a device contacts.

Question 3SD-WAN Architecture and Controller Deployment

A network architect wants a single SD-WAN controller cluster to serve two geographically separate regions while avoiding a single point of failure. Which deployment model provides controller redundancy across sites?

  1. Single controller per plane in one data center
  2. Redundant controllers distributed across multiple sites Correct answer.
  3. Two vSmart controllers on the same host
  4. A single vBond with no vSmart redundancy

Explanation

Cisco recommends distributing redundant controllers across multiple sites or data centers so that a site failure does not remove control-plane services. Hosting controllers on the same host or in one location leaves the fabric vulnerable to a single failure domain.

Question 4SD-WAN Architecture and Controller Deployment

Which protocol and port does a WAN Edge use by default to establish the DTLS control connection to a vSmart controller?

  1. TCP 443
  2. UDP 12346 Correct answer.
  3. UDP 12366
  4. TCP 22

Explanation

The WAN Edge opens a DTLS control connection to vSmart over UDP port 12346, while the data-plane BFD/IPsec tunnels use UDP 12346 as well but with different session types. vManage uses TCP 443 for its management connection.

Question 5SD-WAN Architecture and Controller Deployment

What is the primary function of the vBond orchestrator in the controller bring-up sequence?

  1. It stores device configuration templates and pushes them to WAN Edges
  2. It authenticates devices and provides the list of vSmart and vManage controllers Correct answer.
  3. It computes the best path for each application flow
  4. It terminates IPsec tunnels between WAN Edge devices

Explanation

vBond authenticates the WAN Edge and returns the addresses of the vSmart and vManage controllers the device should use. It does not store templates, compute paths, or terminate data-plane tunnels.

Question 6SD-WAN Architecture and Controller Deployment

An engineer is planning a controller deployment where WAN Edges are behind NAT and cannot be reached directly. Which controller must have a publicly reachable IP address for the initial bring-up?

  1. vAnalytics
  2. vBond Correct answer.
  3. vSmart
  4. vManage

Explanation

Because vBond is the first controller contacted during bring-up, it must be reachable at a public address when devices sit behind NAT. After authentication, vBond redirects the device to the internal vManage and vSmart addresses.

Question 7SD-WAN Architecture and Controller Deployment

Which statement accurately describes the relationship between the management plane and the control plane in a Cisco SD-WAN fabric?

  1. vManage configures devices, and vSmart distributes routing and policy information Correct answer.
  2. vBond distributes policies, and vManage authenticates devices
  3. vManage distributes OMP routes, and vSmart stores templates
  4. vSmart stores configuration templates, and vBond monitors device health

Explanation

The management plane (vManage) handles configuration, templates, and monitoring, while the control plane (vSmart) exchanges OMP routes and distributes policies. Keeping these roles separate is fundamental to the SD-WAN architecture.

Question 8SD-WAN Architecture and Controller Deployment

A design requires that the SD-WAN controllers be deployed as a cluster with high availability of the management plane. Which approach best supports this requirement?

  1. Two vBond nodes without any vManage redundancy
  2. One vSmart and one vManage on the same host
  3. Three vManage nodes in a cluster with a shared database Correct answer.
  4. A single vManage with a local backup file

Explanation

vManage high availability is achieved by running a cluster of nodes (commonly three) that share a replicated database, so the management plane survives a node failure. A backup file or colocating roles does not provide live failover.

Question 9SD-WAN Architecture and Controller Deployment

Which component maintains the OMP route table that is advertised to all WAN Edge devices in the overlay?

  1. The WAN Edge local route table
  2. The vSmart controller Correct answer.
  3. The vBond orchestrator
  4. The vManage database

Explanation

vSmart maintains the overlay routing table built from OMP updates received from WAN Edges and redistributes the best routes and policies to all devices. The local route table on each WAN Edge is separate from the controller's overlay view.

Question 10SD-WAN Architecture and Controller Deployment

An administrator needs the vSmart controllers to be reachable even if one controller site fails. Which configuration principle supports this?

  1. Configure all WAN Edges with only one vSmart address
  2. Use a DNS name or anycast address that resolves to multiple vSmart controllers Correct answer.
  3. Point all devices to the vBond address only
  4. Disable the control connection to vSmart on backup devices

Explanation

Using a DNS name or anycast address that resolves to multiple vSmart controllers lets WAN Edges fail over to a surviving controller if one site is lost. Configuring only one address or pointing devices solely at vBond removes that resilience.

Question 11SD-WAN Architecture and Controller Deployment

Which protocol does the WAN Edge use to establish a secure control connection to vSmart?

  1. DTLS over UDP Correct answer.
  2. TLS over TCP
  3. IPsec ESP
  4. GRE

Explanation

Control connections between WAN Edges and controllers use DTLS, which runs over UDP and provides encryption and authentication. IPsec ESP and GRE are used for data-plane tunnels or transport, not the control connection itself.

Question 12SD-WAN Architecture and Controller Deployment

What role does the vManage NMS play when a WAN Edge device is onboarded?

  1. It authenticates the device against the certificate authority
  2. It computes the best path for each application
  3. It distributes OMP routes to peers
  4. It pushes configuration templates and monitors device state Correct answer.

Explanation

vManage is the management plane: it stores and pushes configuration templates and collects operational state from devices. Authentication is handled by vBond, path selection by OMP, and route distribution by vSmart.

Question 13SD-WAN Architecture and Controller Deployment

A design must ensure that a WAN Edge can still establish control connections if the primary vBond is unreachable. What should be configured?

  1. Only the vManage address on the device
  2. Multiple vBond addresses or a DNS name resolving to multiple vBonds Correct answer.
  3. A single vBond address with no fallback
  4. A static route to the vSmart controller

Explanation

Providing multiple vBond addresses or a DNS name that resolves to several vBond nodes lets the WAN Edge try alternate orchestrators during bring-up. A single address or omitting vBond entirely prevents failover.

Question 14SD-WAN Architecture and Controller Deployment

Which statement best describes how OMP differs from a traditional routing protocol such as OSPF in the SD-WAN overlay?

  1. OMP is a link-state protocol that floods LSAs within each site
  2. OMP distributes overlay routes and policies between WAN Edges and vSmart Correct answer.
  3. OMP runs only between WAN Edges and does not involve vSmart
  4. OMP replaces IPsec and provides data-plane encryption

Explanation

OMP is the overlay routing protocol that carries routes and policies between WAN Edges and the vSmart controllers. It is not a link-state IGP, does not flood LSAs, and does not provide encryption.

Question 15SD-WAN Architecture and Controller Deployment

Which controller plane is optional in the sense that the fabric can forward data traffic even if it becomes temporarily unavailable?

  1. The vManage management plane Correct answer.
  2. The data plane
  3. The vSmart control plane
  4. The vBond orchestration plane

Explanation

vManage is the management plane; if it is temporarily unavailable, existing data forwarding and control-plane operation continue. vSmart and vBond are required for route distribution and bring-up respectively, and the data plane is what actually forwards traffic.

Question 16SD-WAN Architecture and Controller Deployment

An engineer is deploying controllers in a private cloud and must ensure controllers can communicate with each other and with WAN Edges across a firewall. Which set of ports should be permitted for control and management traffic?

  1. UDP 12346 for control connections and TCP 443 for management Correct answer.
  2. TCP 80 and UDP 53 only
  3. TCP 22 only
  4. UDP 500 and UDP 4500 only

Explanation

Controller and WAN Edge control connections use UDP 12346, and management access to vManage uses TCP 443. Opening only SSH, IPsec NAT-T ports, or HTTP/DNS would not permit the required control and management sessions.

Question 17SD-WAN Architecture and Controller Deployment

Which statement about the vSmart controller's policy role is correct?

  1. vSmart forwards user data traffic between sites
  2. vSmart stores device certificates and signs them
  3. vSmart applies centralized policies that control route advertisement and path selection Correct answer.
  4. vSmart applies only local ACLs on each WAN Edge

Explanation

vSmart is where centralized control policies are defined and applied, influencing which routes are advertised and how traffic is steered. It does not forward user data, apply only local ACLs, or act as a certificate authority.

Question 18SD-WAN Architecture and Controller Deployment

What is the purpose of the controller certificate and the root CA in a Cisco SD-WAN deployment?

  1. To assign IP addresses to WAN Edges
  2. To encrypt user data between WAN Edges
  3. To authenticate controllers and WAN Edges during control connection establishment Correct answer.
  4. To compress OMP updates

Explanation

Controllers and WAN Edges use certificates signed by a trusted root CA to authenticate each other when establishing control connections. Data encryption is handled by IPsec, and certificates do not compress updates or assign addresses.

Question 19SD-WAN Architecture and Controller Deployment

A customer wants to deploy Cisco SD-WAN controllers on-premises rather than in the cloud. Which consideration is most relevant to this decision?

  1. On-premises controllers require no certificates
  2. On-premises controllers give the customer control over the hosting environment and network reachability Correct answer.
  3. On-premises controllers eliminate the need for vSmart
  4. On-premises controllers remove the need for vBond

Explanation

On-premises controller deployment gives the organization control over hosting, addressing, and reachability of the controller VMs. Certificates, vSmart, and vBond are still required regardless of where the controllers are hosted.

Question 20SD-WAN Architecture and Controller Deployment

Which statement accurately describes the data plane in a Cisco SD-WAN fabric?

  1. It runs OMP between WAN Edges and vSmart
  2. It consists of IPsec tunnels between WAN Edges that carry user traffic Correct answer.
  3. It is managed entirely by vManage templates
  4. It is provided by the vBond orchestrator

Explanation

The data plane is formed by encrypted IPsec tunnels between WAN Edge devices that carry user traffic across the underlay. OMP runs in the control plane, and vManage and vBond do not forward user data.

Question 21SD-WAN Architecture and Controller Deployment

An architect is comparing a controller deployment where all controllers run as VMs in a single data center versus one where controllers are split across two data centers. What is the main advantage of the split design?

  1. It allows WAN Edges to skip vBond authentication
  2. It tolerates the loss of one data center without losing control-plane services Correct answer.
  3. It removes the need for vSmart redundancy
  4. It reduces the number of certificates required

Explanation

Splitting controllers across two data centers ensures that losing one site does not take down the control or management plane. It does not reduce certificate requirements, remove the need for redundancy, or bypass authentication.

Question 22SD-WAN Architecture and Controller Deployment

Which controller is responsible for maintaining the authoritative list of devices that are permitted to join the overlay?

  1. vSmart, through its OMP route table
  2. The WAN Edge, through its local configuration
  3. vBond, through its authentication and orchestration function Correct answer.
  4. vManage, through its device inventory and whitelist

Explanation

vBond validates devices during bring-up and controls which devices are allowed to join the overlay, working with the device inventory and whitelist. vSmart handles routes, and vManage handles configuration and monitoring.

Question 23SD-WAN Architecture and Controller Deployment

Which of the following best describes the role of the underlay network in a Cisco SD-WAN deployment?

  1. It provides the transport connectivity over which overlay tunnels are built Correct answer.
  2. It authenticates controllers during bring-up
  3. It stores configuration templates for WAN Edges
  4. It runs OMP to distribute overlay routes

Explanation

The underlay is the existing transport network (MPLS, internet, LTE, and so on) that provides reachability between sites; overlay tunnels such as IPsec are built on top of it. OMP, templates, and authentication belong to the controller planes.

Question 24SD-WAN Architecture and Controller Deployment

A WAN Edge is configured with two vSmart controllers. How does the device behave if the control connection to one vSmart fails?

  1. It maintains the connection to the remaining vSmart and continues receiving overlay routes Correct answer.
  2. It drops all OMP routes and stops forwarding traffic
  3. It falls back to OSPF for overlay routing
  4. It re-authenticates through vManage before forwarding resumes

Explanation

A WAN Edge can maintain control connections to multiple vSmart controllers, so losing one leaves the other to continue providing overlay routes and policy. Data forwarding is not dependent on a single vSmart connection.

Question 25SD-WAN Architecture and Controller Deployment

Which statement about vManage clustering is accurate?

  1. Clustering disables the vManage API
  2. A cluster requires exactly two nodes to function
  3. All nodes in the cluster must be in the same subnet and share a single database
  4. Cluster nodes replicate the database and provide management-plane redundancy Correct answer.

Explanation

vManage cluster nodes replicate their database so that management-plane services remain available if a node fails. Nodes can be distributed across sites, more than two nodes are supported, and the API remains available.

Question 26SD-WAN Architecture and Controller Deployment

In a Cisco SD-WAN fabric, which controller is responsible for authenticating WAN Edge devices when they first come online and for providing them with the current list of vSmart controllers?

  1. vSmart controller
  2. vEdge Cloud router
  3. vBond orchestrator Correct answer.
  4. vManage

Explanation

The vBond orchestrator acts as the initial point of contact for WAN Edge devices; it validates the device certificate and returns the authoritative list of vSmart controllers (and optionally vManage) that the device should connect to. vSmart distributes routing and policy, and vManage provides management and provisioning, but neither performs the initial orchestration handshake.

Question 27SD-WAN Architecture and Controller Deployment

Which statement accurately describes the default behavior of control connections between a WAN Edge device and the vSmart controllers when the device has multiple WAN interfaces?

  1. The WAN Edge establishes control connections only over the interface that is configured as the primary tunnel source.
  2. The WAN Edge establishes a control connection to each vSmart controller from every WAN interface that is up and has a valid route to the controller. Correct answer.
  3. The WAN Edge establishes a control connection only on the interface with the lowest administrative distance.
  4. The WAN Edge establishes one control connection per vSmart controller, using the first interface that completes the DTLS handshake.

Explanation

By default, a WAN Edge device forms a DTLS control connection to each vSmart controller from every WAN interface that has reachability to that controller. This provides redundancy and allows OMP to track the state of each connection independently. The device does not restrict control connections to a single interface unless policy or configuration explicitly does so.

Question 28SD-WAN Architecture and Controller Deployment

An engineer is designing a Cisco SD-WAN deployment where the vManage controllers will be deployed as a cluster. Which component must be configured to ensure that the cluster nodes can communicate securely and maintain a consistent view of the network?

  1. A shared NFS or object storage repository for configuration and statistics
  2. A separate OMP domain for each vManage node
  3. A cluster service using a quorum-based mechanism and a shared database Correct answer.
  4. A dedicated vBond orchestrator per vManage node

Explanation

vManage clustering relies on a quorum-based cluster service and a shared database so that all nodes maintain consistent configuration and statistics. The cluster uses internal communication for replication and leader election. External storage or per-node vBond instances are not required for cluster consistency.

Question 29SD-WAN Architecture and Controller Deployment

Which protocol and port are used by WAN Edge devices to establish the secure control connection to vSmart controllers by default?

  1. TLS over TCP port 443
  2. SSH over TCP port 22
  3. DTLS over UDP port 12346 Correct answer.
  4. IPsec over UDP port 500

Explanation

Control connections between WAN Edge devices and vSmart controllers use DTLS over UDP, with the default port 12346. This secure channel carries OMP routing updates and control-plane traffic. Other ports and protocols are used for different purposes such as management or IPsec data plane.

Question 30SD-WAN Architecture and Controller Deployment

A network architect is evaluating the placement of vSmart controllers in a multi-region Cisco SD-WAN fabric. Which design consideration most directly affects the resilience of the control plane if a regional data center fails?

  1. Deploying at least one vSmart controller in each region and ensuring that WAN Edge devices can reach controllers in another region. Correct answer.
  2. Relying on vBond to take over vSmart functions during a failure.
  3. Deploying all vSmart controllers in a single centralized data center with redundant power.
  4. Using a single vSmart controller per region with no cross-region connectivity.

Explanation

To maintain control-plane resilience, vSmart controllers should be distributed across regions and WAN Edge devices must have reachability to controllers outside their own region. This ensures that a regional failure does not isolate devices from policy and routing updates. Centralizing all controllers or using single controllers per region without cross-connectivity creates single points of failure.

Question 31SD-WAN Architecture and Controller Deployment

Which statement correctly describes the role of the root certificate authority (CA) in a Cisco SD-WAN controller deployment?

  1. It acts as a backup vBond orchestrator during a failure.
  2. It provides the initial configuration template for vManage.
  3. It encrypts all data plane traffic between WAN Edge devices.
  4. It signs the device certificates that are installed on controllers and WAN Edge devices to establish trust. Correct answer.

Explanation

The root CA signs the device certificates used by controllers and WAN Edge devices, forming the chain of trust that authenticates devices during control connection establishment. It does not provide configuration, act as a controller, or encrypt data traffic. Data plane encryption is handled by IPsec or other mechanisms.

Question 32SD-WAN Architecture and Controller Deployment

An administrator is deploying Cisco SD-WAN controllers on-premises and needs to ensure that the controllers can communicate with each other and with WAN Edge devices that are behind NAT. Which configuration is required on the vBond orchestrator?

  1. Configure vBond with a private IP address and disable NAT traversal.
  2. Configure a public IP address on vBond and enable NAT traversal. Correct answer.
  3. Configure vBond to use only IPv6 addresses.
  4. Configure vBond to act as a DHCP server for WAN Edge devices.

Explanation

When WAN Edge devices are behind NAT, the vBond orchestrator must be reachable via a public IP address and NAT traversal must be enabled so that devices can establish control connections. vBond does not provide DHCP services and does not require IPv6-only addressing. Private addressing without NAT traversal would prevent reachability.

Question 33SD-WAN Architecture and Controller Deployment

Which component of the Cisco SD-WAN architecture is responsible for distributing policy and routing information to all WAN Edge devices in the overlay?

  1. vBond
  2. vSmart Correct answer.
  3. vEdge Cloud
  4. vManage

Explanation

vSmart controllers are the control plane components that run OMP and distribute routing and policy information to WAN Edge devices. vManage is the management plane, vBond handles orchestration, and vEdge Cloud is a WAN Edge device. Only vSmart provides overlay policy and routing distribution.

Question 34SD-WAN Architecture and Controller Deployment

A network engineer is planning a Cisco SD-WAN deployment and must decide whether to use a single vSmart controller or a vSmart cluster. Which statement best describes the benefit of deploying multiple vSmart controllers in a cluster?

  1. It eliminates the need for vBond orchestrator.
  2. It increases the number of OMP routes that can be advertised.
  3. It allows WAN Edge devices to bypass IPsec encryption.
  4. It provides redundancy and load sharing for control plane processing. Correct answer.

Explanation

Deploying multiple vSmart controllers in a cluster provides redundancy and load sharing for control plane functions, ensuring that if one controller fails, others continue to distribute policy and routing. It does not change the number of OMP routes, eliminate vBond, or affect data plane encryption. The cluster works together to maintain a consistent control plane view.

Question 35SD-WAN Architecture and Controller Deployment

Which statement accurately describes how a WAN Edge device establishes a control connection to a vSmart controller when the device is behind a NAT device?

  1. The WAN Edge sends a DTLS connection request to the vSmart controller's public IP address and port, and NAT traversal is used to maintain the connection. Correct answer.
  2. The WAN Edge initiates a DTLS connection to vBond, which relays the connection to vSmart.
  3. The WAN Edge uses IPsec to connect to vSmart and then establishes OMP over IPsec.
  4. The WAN Edge must have a public IP address to connect to vSmart.

Explanation

A WAN Edge behind NAT initiates a DTLS connection to the vSmart controller's public address and port, and NAT traversal mechanisms maintain the connection through the NAT device. vBond is used for initial discovery but does not relay the control connection. A public IP address on the WAN Edge is not required.

Question 36SD-WAN Architecture and Controller Deployment

Which of the following best describes the function of the vManage NMS in a Cisco SD-WAN deployment?

  1. It forwards data traffic between WAN Edge devices.
  2. It provides a centralized management plane for configuration, monitoring, and troubleshooting. Correct answer.
  3. It distributes OMP routes to WAN Edge devices.
  4. It authenticates WAN Edge devices during onboarding.

Explanation

vManage is the centralized management plane, offering GUI, API, and CLI for configuration, monitoring, and troubleshooting of the SD-WAN fabric. It does not distribute OMP routes (vSmart does), authenticate devices (vBond does), or forward data traffic (WAN Edge devices do).

Question 37SD-WAN Architecture and Controller Deployment

An engineer is designing a Cisco SD-WAN fabric that must support high availability of the vBond orchestrator. Which deployment approach provides redundancy for vBond?

  1. Deploy vBond on the same server as vManage.
  2. Deploy a single vBond with a backup power supply.
  3. Use a DNS round-robin record for vBond.
  4. Deploy multiple vBond instances and configure WAN Edge devices with a list of vBond addresses. Correct answer.

Explanation

vBond redundancy is achieved by deploying multiple vBond orchestrators and configuring WAN Edge devices with a list of vBond addresses (or using DNS with multiple records). This allows devices to try another vBond if the first is unreachable. A single vBond with backup power does not provide network-level redundancy, and co-locating with vManage does not provide independent redundancy.

Question 38SD-WAN Architecture and Controller Deployment

In a Cisco SD-WAN architecture, which plane is responsible for forwarding user traffic between sites?

  1. Control plane
  2. Orchestration plane
  3. Data plane Correct answer.
  4. Management plane

Explanation

The data plane is responsible for forwarding user traffic between sites, typically using IPsec tunnels between WAN Edge devices. The management plane handles configuration and monitoring, the control plane distributes routing and policy, and the orchestration plane handles initial device authentication and controller discovery.

Question 39SD-WAN Architecture and Controller Deployment

A network architect is comparing a Cisco SD-WAN deployment where all controllers are in a single data center versus one where controllers are distributed across multiple sites. Which statement best describes the impact on control plane resiliency?

  1. A distributed deployment is more resilient because it avoids a single point of failure for the control plane. Correct answer.
  2. A single data center deployment is more resilient because it reduces latency between controllers.
  3. Both deployments provide equal resiliency as long as vManage is clustered.
  4. A distributed deployment requires fewer vSmart controllers.

Explanation

Distributing controllers across multiple sites increases control plane resiliency by eliminating a single point of failure; if one site fails, controllers in other sites can continue to serve WAN Edge devices. A single data center deployment, even with low latency, is vulnerable to site-level failures. vManage clustering alone does not address vSmart or vBond resiliency.

Question 40SD-WAN Architecture and Controller Deployment

Which statement accurately describes the relationship between OMP and the underlay routing protocol in a Cisco SD-WAN fabric?

  1. OMP replaces the underlay routing protocol entirely.
  2. OMP and the underlay routing protocol must be the same protocol.
  3. OMP operates over the underlay to distribute overlay routes and policies, while the underlay provides reachability between devices. Correct answer.
  4. OMP is used only for management traffic, not for data forwarding.

Explanation

OMP is an overlay routing protocol that runs over the underlay to distribute overlay routes and policies; the underlay provides the underlying reachability (e.g., via OSPF, BGP, or static routes) needed for OMP and data tunnels. OMP does not replace the underlay, nor must it match the underlay protocol. It is used for control plane overlay routing, not management traffic.

Question 41SD-WAN Router and Template Configuration

In a Cisco SD-WAN deployment, which component is responsible for distributing route and policy information to the WAN Edge routers over the overlay?

  1. The vManage server
  2. The colocated DHCP server
  3. The vBond orchestrator
  4. The vSmart controller Correct answer.

Explanation

The vSmart controller is the SD-WAN control plane component. It receives routes from WAN Edge devices through OMP and distributes policy and routing information across the overlay. vManage handles management and vBond handles authentication and orchestration.

Question 42SD-WAN Router and Template Configuration

A device template in vManage is being created for a WAN Edge router. Which feature must be configured on the device for vManage to push the template and manage it?

  1. The device must be in vManage mode and onboarded to the overlay Correct answer.
  2. The device must run in autonomous mode with SNMPv2c
  3. The device must have a static default route only
  4. The device must be in CLI mode with no configuration database

Explanation

Device templates are applied to WAN Edge devices that are onboarded and operating in vManage mode, which enables the configuration database and NETCONF-based template push. A device left in CLI mode is not template-managed until it is converted.

Question 43SD-WAN Router and Template Configuration

Which template type in vManage is used to define a common set of configuration that can be shared across many devices, such as system settings and logging?

  1. Device template
  2. CLI template
  3. Policy template
  4. Feature template Correct answer.

Explanation

Feature templates define reusable configuration blocks for a specific feature, such as system, logging, or VPN settings. Device templates then combine multiple feature templates and map them to variables for a specific device.

Question 44SD-WAN Router and Template Configuration

When creating a device template, what is the purpose of defining variables?

  1. They encrypt the configuration payload sent to the device
  2. They allow per-device values to be substituted into a shared template Correct answer.
  3. They automatically generate the overlay topology
  4. They determine which controller the device registers with

Explanation

Variables let a single device template serve many devices by substituting device-specific values such as system IP, hostname, or site ID at attach time. This avoids maintaining a separate template for every router.

Question 45SD-WAN Router and Template Configuration

Which VPN is reserved on a Cisco SD-WAN WAN Edge for the transport underlay that carries the control connections to the controllers?

  1. VPN 1
  2. VPN 512
  3. VPN 0 Correct answer.
  4. VPN 65530

Explanation

VPN 0 is the transport VPN that holds the physical WAN interfaces and the tunnels to the controllers. It carries the control and management traffic used for overlay establishment.

Question 46SD-WAN Router and Template Configuration

A network engineer wants to add a new WAN interface to an existing WAN Edge router that is managed by a device template. What is the correct workflow?

  1. Delete the device template and rebuild the router from scratch
  2. Change only the device variable values without touching the templates
  3. Edit the CLI directly on the router and let vManage detect the change
  4. Modify the feature template for the transport VPN, update the device template, and push it Correct answer.

Explanation

Template-managed devices should be changed through the template workflow so the intended configuration stays consistent. The engineer updates the relevant feature template, re-attaches or updates the device template, and pushes the change from vManage.

Question 47SD-WAN Router and Template Configuration

Which OMP setting in a feature template controls how often hello packets are sent between OMP peers?

  1. The OMP hello interval Correct answer.
  2. The OMP graceful-restart timer
  3. The OMP hold time
  4. The OMP path limit

Explanation

The OMP hello interval sets how frequently hello messages are sent to maintain OMP peering. The hold time determines how long a peer waits before declaring the session down if hellos stop.

Question 48SD-WAN Router and Template Configuration

Which feature template would an engineer modify to change the BFD timers used for overlay tunnel health detection?

  1. The OMP feature template
  2. The VPN interface feature template
  3. The system feature template
  4. The BFD feature template Correct answer.

Explanation

BFD timers for tunnel health are configured in the BFD feature template, which is then included in the device template. This controls how quickly the overlay detects path failures.

Question 49SD-WAN Router and Template Configuration

An engineer needs to configure an application-aware routing policy that prefers a specific path for voice traffic. Which template category is used to define this?

  1. A localized access control policy
  2. A device template variable
  3. A centralized data policy
  4. A centralized application-aware routing policy Correct answer.

Explanation

Application-aware routing policies are centralized policies that use SLA classes and application definitions to steer traffic across paths. They are configured in vManage policy templates and pushed to the overlay.

Question 50SD-WAN Router and Template Configuration

Which configuration item must be unique for every WAN Edge device in the overlay and is typically set through a device template variable?

  1. The vBond IP address
  2. The OMP hold time
  3. The system IP address Correct answer.
  4. The organization name

Explanation

The system IP is the persistent identity of a WAN Edge in the overlay and must be unique per device. It is commonly supplied as a device template variable so each router receives its own value.