I85PREP
⌘ K
ExtremeCloud SD-WAN study materials
ExtremeCloud SD-WAN study resources

ExtremeCloud SD-WAN practice questions

One question at a time. Build your ExtremeCloud SD-WAN understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1SD-WAN Fundamentals and Solution Architecture

In an SD-WAN architecture, what is the primary function of the control plane as separated from the data plane?

  1. It encrypts payload traffic between branch sites using IPsec.
  2. It computes and distributes path selection and policy decisions to the forwarding elements. Correct answer.
  3. It forwards each customer packet hop by hop across the underlay transport.
  4. It performs per-packet QoS marking on the WAN edge interface.

Explanation

SD-WAN decouples the control plane from the data plane so that centralized logic computes topology, policy, and path decisions and pushes them to the forwarding devices. The data plane then handles actual packet forwarding and encryption locally. This separation is the defining architectural principle of SD-WAN.

Question 2SD-WAN Fundamentals and Solution Architecture

Which statement best describes an underlay transport in an SD-WAN deployment?

  1. It is the overlay tunnel mesh built between SD-WAN edges.
  2. It is the centralized policy engine that distributes routes.
  3. It is the physical or provider network (MPLS, broadband, LTE) that carries overlay traffic. Correct answer.
  4. It is the virtual routing instance used for segmentation.

Explanation

The underlay is the underlying transport network - MPLS, internet broadband, LTE/5G - that provides connectivity. The SD-WAN overlay is built on top of it using tunnels. Keeping the two layers distinct is fundamental to SD-WAN design.

Question 3SD-WAN Fundamentals and Solution Architecture

A company wants branch traffic to reach the internet directly from the branch instead of backhauling to a central data center. Which SD-WAN capability enables this?

  1. Overlay route summarization at the hub
  2. Centralized firewall chaining at the data center
  3. Full-mesh IPsec between all branches
  4. Local internet breakout at the branch edge Correct answer.

Explanation

Local internet breakout lets the branch edge send internet-bound traffic directly to a local ISP, avoiding the hairpin to a central site. This reduces latency and backhaul cost. It is a core SD-WAN traffic-steering policy.

Question 4SD-WAN Fundamentals and Solution Architecture

Which component in a typical SD-WAN solution is responsible for centralized configuration, policy definition, and orchestration?

  1. The underlay ISP router
  2. The branch WAN edge device
  3. The branch LAN access switch
  4. The SD-WAN controller or orchestrator Correct answer.

Explanation

The controller/orchestrator is the centralized management and policy brain of the SD-WAN solution. It stores configuration, defines policies, and pushes them to the edges. Edge devices consume that policy but do not author it centrally.

Question 5SD-WAN Fundamentals and Solution Architecture

What is the purpose of application-aware routing in SD-WAN?

  1. To compress all traffic uniformly regardless of application type.
  2. To assign static routes to each application manually.
  3. To classify traffic by application and steer it over the best path based on measured conditions. Correct answer.
  4. To disable encryption for latency-sensitive applications.

Explanation

Application-aware routing identifies traffic by application and continuously measures path quality, then steers each flow over the path that best meets its requirements. This is dynamic and per-application. It differs from static routing because decisions adapt to live conditions.

Question 6SD-WAN Fundamentals and Solution Architecture

Which benefit is most directly associated with using a zero-touch provisioning workflow for SD-WAN edge devices?

  1. Eliminating the need for any underlay connectivity at the branch.
  2. Reducing manual on-site configuration by automatically downloading configuration from the controller. Correct answer.
  3. Removing the requirement for encryption keys on the overlay.
  4. Guaranteeing line-rate throughput on every transport.

Explanation

Zero-touch provisioning lets a new edge device authenticate to the controller and pull its configuration automatically, so field staff do not configure it manually. This speeds deployment and reduces errors. It does not change transport or encryption requirements.

Question 7SD-WAN Fundamentals and Solution Architecture

In SD-WAN terminology, what does a 'service chain' describe?

  1. The ordered sequence of network functions (such as firewall and inspection) that traffic traverses. Correct answer.
  2. The list of DNS servers assigned to a branch.
  3. The sequence of BGP autonomous systems along a path.
  4. The physical cabling order between branch switches.

Explanation

Service chaining defines an ordered set of network functions - firewall, IPS, optimization - that traffic must pass through. SD-WAN policy can steer flows into a chain at the branch or in a hub. Order matters because each function processes traffic in sequence.

Question 8SD-WAN Fundamentals and Solution Architecture

Which statement correctly distinguishes an SD-WAN overlay tunnel from the underlying transport link?

  1. The tunnel is provider-assigned and the transport is customer-configured.
  2. The tunnel provides a logical encrypted path, while the transport provides the physical or provider connectivity. Correct answer.
  3. The tunnel is unencrypted, while the transport is always encrypted.
  4. The tunnel carries only management traffic, while the transport carries user data.

Explanation

Overlay tunnels are logical, encrypted paths built between SD-WAN edges. The transport (underlay) supplies the actual connectivity those tunnels ride over. Confusing the two leads to errors in design and troubleshooting.

Question 9SD-WAN Fundamentals and Solution Architecture

A branch has an MPLS circuit and a broadband circuit. Policy requires voice traffic to prefer MPLS but fail over to broadband if MPLS latency exceeds a threshold. Which SD-WAN mechanism implements this?

  1. NAT overload on the broadband interface
  2. SLA-based path selection with per-application policy and failover Correct answer.
  3. Spanning Tree reconvergence
  4. Static default routing with administrative distance

Explanation

SLA-based path selection continuously measures each path against thresholds like latency, jitter, and loss, and steers applications per policy. When MPLS breaches the voice SLA, traffic fails over to broadband. Static routing cannot react to live quality changes.

Question 10SD-WAN Fundamentals and Solution Architecture

Why does SD-WAN typically use IPsec tunnels over internet transports even when application traffic is already encrypted with TLS?

  1. To provide site-to-site confidentiality and integrity for all traffic, including non-TLS flows and routing updates. Correct answer.
  2. To replace the need for any routing protocol in the overlay.
  3. To reduce the CPU load on the branch edge device.
  4. To increase available bandwidth on the internet circuit.

Explanation

IPsec overlay tunnels protect all traffic between sites, including non-TLS applications and control traffic such as routing updates. TLS only protects individual application sessions. The overlay therefore provides consistent site-to-site security.

Question 11SD-WAN Fundamentals and Solution Architecture

Which describes the role of a hub site in a hub-and-spoke SD-WAN topology?

  1. It aggregates branch traffic and often hosts shared services such as data center access and security inspection. Correct answer.
  2. It provides only local internet breakout for its own users.
  3. It acts solely as a backup controller for the orchestrator.
  4. It is a branch device with no overlay tunnels.

Explanation

In hub-and-spoke, hub sites concentrate branch connectivity and typically host shared services like data center access and centralized security. Spokes reach each other through the hub unless a direct path is added. This centralization simplifies policy but can add hairpin latency.

Question 12SD-WAN Fundamentals and Solution Architecture

What is the main advantage of a partial-mesh overlay over a strict hub-and-spoke overlay for branch-to-branch traffic?

  1. It removes the need for any encryption between branches.
  2. It eliminates the need for a controller.
  3. It guarantees unlimited bandwidth on all links.
  4. It allows selected branch pairs to communicate directly, reducing hairpin latency through the hub. Correct answer.

Explanation

A partial mesh adds direct tunnels between selected branch pairs so their traffic does not traverse the hub. This lowers latency and conserves hub capacity. It is a targeted compromise between full-mesh cost and hub-only hairpinning.

Question 13SD-WAN Fundamentals and Solution Architecture

An administrator wants traffic for a SaaS application to go directly to the internet from each branch while all other traffic goes to the data center. Which policy construct accomplishes this?

  1. A QoS shaper applied to all interfaces
  2. An overlay route summarization policy
  3. A per-application traffic steering rule with breakout for the SaaS application Correct answer.
  4. A global default route pointing to the data center

Explanation

Per-application steering rules let the SD-WAN edge match specific applications and direct them to a chosen egress, here local internet breakout. Other traffic continues to follow the default path to the data center. This granularity is a core SD-WAN policy capability.

Question 14SD-WAN Fundamentals and Solution Architecture

Which statement about segmentation in SD-WAN is accurate?

  1. Segments must share a single routing table to function.
  2. Segmentation disables overlay encryption for guest traffic.
  3. Virtual routing and forwarding instances keep segment traffic isolated while sharing physical transports. Correct answer.
  4. Segmentation requires separate physical circuits per department.

Explanation

SD-WAN segmentation commonly uses VRFs or equivalent constructs to keep traffic from different groups isolated while sharing the same underlay and overlay. This provides security and policy separation without dedicated physical links. Encryption remains in force per segment.

Question 15SD-WAN Fundamentals and Solution Architecture

How does forward error correction (FEC) improve application experience over a lossy SD-WAN transport?

  1. By increasing the transmit power of the WAN interface.
  2. By sending redundant parity data so the receiver can reconstruct lost packets without retransmission. Correct answer.
  3. By retransmitting every lost packet immediately from the sender.
  4. By compressing packets so fewer are lost.

Explanation

FEC adds redundant parity information to the stream so the receiver can rebuild lost packets locally, avoiding a round-trip retransmission. This helps latency-sensitive traffic on lossy links. It trades some bandwidth overhead for improved delivery.

Question 16SD-WAN Fundamentals and Solution Architecture

A designer is comparing overlay tunnel modes. Which characteristic is typical of a tunnel that carries only selected traffic rather than all traffic between sites?

  1. It cannot coexist with a full-traffic tunnel.
  2. It encrypts every packet regardless of policy.
  3. It is a policy-based or on-demand tunnel matched to specific flows. Correct answer.
  4. It requires a dedicated physical circuit.

Explanation

Policy-based or on-demand tunnels are established for traffic that matches defined criteria, such as a specific application or segment. This contrasts with tunnels that carry all traffic between sites. Both modes can coexist in the same overlay.

Question 17SD-WAN Fundamentals and Solution Architecture

What role does a route reflector or dynamic routing protocol play in a large SD-WAN overlay?

  1. It encrypts the overlay tunnels between edges.
  2. It assigns IP addresses to branch endpoints.
  3. It distributes overlay reachability information so edges can learn remote prefixes without full peering. Correct answer.
  4. It enforces QoS markings on the underlay.

Explanation

Dynamic routing within the overlay distributes reachability so edges learn remote prefixes automatically. A route reflector can scale this by reducing the number of peerings required. Encryption, addressing, and QoS are handled by other mechanisms.

Question 18SD-WAN Fundamentals and Solution Architecture

Which scenario best justifies deploying SD-WAN instead of traditional branch routers with static routes?

  1. A lab environment testing a single routing protocol.
  2. A single small office with one ISP and no growth plans.
  3. A multi-site enterprise needing dynamic path selection, centralized policy, and mixed transports. Correct answer.
  4. A data center needing only Layer 2 switching.

Explanation

SD-WAN's value appears when many sites must combine multiple transports with centralized policy and dynamic path selection. A single-site static-routed office gains little from the added complexity. The architecture targets distributed, multi-transport environments.

Question 19SD-WAN Fundamentals and Solution Architecture

What does a 'last-mile' transport refer to in SD-WAN design?

  1. The connection between the controller and the orchestrator.
  2. The connection from the branch edge to the nearest provider network. Correct answer.
  3. The final overlay tunnel between two data centers.
  4. The internal LAN segment behind the branch switch.

Explanation

The last mile is the link connecting a site to its service provider's network, often the most variable and costly part of WAN connectivity. SD-WAN designs frequently mix last-mile types (broadband, LTE, MPLS) to improve resilience and cost. It is distinct from the overlay tunnel itself.

Question 20SD-WAN Fundamentals and Solution Architecture

An engineer observes that voice quality degrades only when the broadband circuit is used, while the MPLS circuit performs well. Which SD-WAN design element most directly addresses this?

  1. Adding more static routes to the broadband next hop
  2. Configuring per-application SLA thresholds with a preferred path and failover order Correct answer.
  3. Disabling application-aware routing globally
  4. Increasing the overlay MTU on all tunnels

Explanation

Per-application SLA thresholds let voice prefer MPLS and only use broadband when MPLS fails the SLA, or avoid broadband when its quality is poor. This directly targets quality-sensitive flows. Static routes and MTU changes do not adapt to measured quality.

Question 21SD-WAN Fundamentals and Solution Architecture

A customer requires that guest traffic never traverse the same overlay tunnel as corporate traffic, even though both use the same physical circuits. Which SD-WAN design satisfies this?

  1. Enable FEC on the guest segment.
  2. Apply QoS shaping to guest traffic only.
  3. Use a single VRF and rely on IPsec for isolation.
  4. Assign each segment to a distinct VRF with separate overlay topology and policy. Correct answer.

Explanation

Segment isolation is achieved by placing each group in its own VRF with separate overlay topology and policy, so guest flows use different tunnels than corporate flows. QoS, FEC, and shared VRFs do not provide this separation. This is a segmentation design decision.

Question 22SD-WAN Fundamentals and Solution Architecture

Which factor most limits the effectiveness of local internet breakout for a latency-sensitive SaaS application?

  1. The quality and peering of the local ISP path to the SaaS provider Correct answer.
  2. The size of the branch LAN subnet
  3. The administrative distance of the default route
  4. The number of overlay tunnels configured at the branch

Explanation

Local breakout only helps if the local ISP path to the SaaS provider is well-peered and low-latency. A poor local path can perform worse than backhauling. Designers must validate ISP peering and measure path quality before choosing breakout.

Question 23SD-WAN Fundamentals and Solution Architecture

In a design where branches must reach each other directly but the number of sites is large, which approach best balances tunnel scale and latency?

  1. A full mesh of tunnels between every pair of branches
  2. A dynamic partial mesh that builds direct tunnels only for pairs with heavy or latency-sensitive traffic Correct answer.
  3. A strict hub-and-spoke with all inter-branch traffic hairpinned
  4. A single shared tunnel between all branches

Explanation

A dynamic partial mesh creates direct tunnels only where traffic patterns justify them, avoiding the n-squared growth of a full mesh while reducing hairpin latency. It adapts to actual demand. Full mesh and strict hub-and-spoke represent the extremes.

Question 24SD-WAN Fundamentals and Solution Architecture

A security team wants all branch-to-internet traffic inspected by a cloud security service without backhauling to a data center. Which SD-WAN architecture supports this?

  1. Steering breakout traffic through a service chain to a cloud security point of presence Correct answer.
  2. Disabling local breakout entirely
  3. Encrypting only the overlay tunnels
  4. Increasing the underlay MTU on broadband circuits

Explanation

SD-WAN can chain breakout traffic through a cloud security point of presence so inspection happens in the cloud rather than at a central data center. This preserves the latency benefit of local breakout while enforcing security policy. It relies on service chaining and traffic steering.

Question 25SD-WAN Fundamentals and Solution Architecture

Which statement best explains why SD-WAN separates the management plane from the control plane?

  1. So that encryption keys can be shared in plaintext across the overlay.
  2. So that configuration and monitoring can be handled independently of real-time path computation and forwarding decisions. Correct answer.
  3. So that underlay circuits no longer need IP addressing.
  4. So that the data plane can forward packets without any routing information.

Explanation

The management plane handles configuration, monitoring, and orchestration, while the control plane computes topology and path decisions. Separating them lets operators manage the fabric without interfering with real-time forwarding logic. The data plane still depends on routing information from the control plane.

Question 26SD-WAN Fundamentals and Solution Architecture

In an SD-WAN architecture, which plane is responsible for computing and distributing overlay forwarding decisions such as path selection and tunnel endpoint reachability?

  1. The data plane, implemented by the forwarding ASIC on each edge device
  2. The licensing plane, implemented by the subscription server
  3. The management plane, implemented by the element management system
  4. The control plane, typically implemented by a centralized controller or orchestrator Correct answer.

Explanation

SD-WAN architectures separate functions into management, control, and data planes. The control plane computes topology and policy decisions and distributes them to edges, while the data plane forwards packets and the management plane handles configuration and monitoring.

Question 27SD-WAN Fundamentals and Solution Architecture

Which component in a typical SD-WAN solution is responsible for defining application-aware policies and pushing them to edge devices?

  1. The branch LAN switch
  2. The ISP's BGP route reflector
  3. The centralized orchestrator or controller Correct answer.
  4. The WAN optimizer appliance

Explanation

The orchestrator/controller is the centralized policy authority in SD-WAN; administrators define application policies there and they are distributed to edges. Edge devices then enforce those policies on traffic.

Question 28SD-WAN Fundamentals and Solution Architecture

What is the primary purpose of a underlay transport in an SD-WAN deployment?

  1. To perform deep packet inspection of SaaS traffic
  2. To provide the physical or virtual network connectivity over which overlay tunnels run Correct answer.
  3. To encrypt application flows between branches
  4. To enforce application-aware firewall rules

Explanation

The underlay is the underlying transport network (MPLS, internet, LTE, etc.) that carries overlay tunnels. SD-WAN overlays are built on top of these transports.

Question 29SD-WAN Fundamentals and Solution Architecture

Which statement best describes an SD-WAN edge device?

  1. A device that only provides wireless LAN coverage
  2. A device that sits at a site, terminates overlay tunnels, and applies policy to steer traffic Correct answer.
  3. A device that exclusively performs DNS resolution for branch clients
  4. A device that only terminates MPLS circuits at the provider edge

Explanation

The SD-WAN edge terminates overlay tunnels, applies application-aware policy, and forwards traffic across available transports. It is the enforcement point for SD-WAN intelligence at a site.

Question 30SD-WAN Fundamentals and Solution Architecture

Which transport type is most commonly used as a low-cost, high-bandwidth underlay for SD-WAN local internet breakout?

  1. Leased line with fixed CIR
  2. Dedicated MPLS LSP
  3. Satellite backhaul
  4. Business broadband internet Correct answer.

Explanation

Broadband internet is the typical low-cost, high-bandwidth transport used for local internet breakout in SD-WAN designs. It complements private transports such as MPLS for policy-based steering.

Question 31SD-WAN Fundamentals and Solution Architecture

What does 'application-aware routing' mean in an SD-WAN solution?

  1. Routing decisions ignore link quality metrics
  2. Routing decisions are made only by the ISP's core routers
  3. Routing decisions consider the identified application and its required SLA when choosing a path Correct answer.
  4. Routing decisions are made solely on destination IP prefix length

Explanation

Application-aware routing identifies flows by application and steers them over the path that best meets that application's SLA (latency, loss, jitter). It goes beyond destination-based forwarding.

Question 32SD-WAN Fundamentals and Solution Architecture

Which term describes the SD-WAN capability that lets an edge use multiple heterogeneous transports simultaneously and select among them per flow?

  1. Port-channel load balancing
  2. Single-homed static routing
  3. Hybrid WAN with dynamic path selection Correct answer.
  4. Spanning Tree convergence

Explanation

Hybrid WAN with dynamic path selection allows an edge to use multiple transports at once and choose a path per flow based on policy and measured quality. This is a core SD-WAN value proposition.

Question 33SD-WAN Fundamentals and Solution Architecture

Which of the following best describes a 'virtual overlay' network in SD-WAN?

  1. A VLAN used only inside a data center
  2. A dedicated physical fiber ring between sites
  3. A wireless mesh using only 802.11 radios
  4. A logical tunnel topology built over one or more physical transports Correct answer.

Explanation

The overlay is a logical network of tunnels built on top of physical or virtual transports. It provides connectivity independent of the specific underlay used.

Question 34SD-WAN Fundamentals and Solution Architecture

A retail chain wants each store to use its broadband link for point-of-sale traffic to a cloud payment provider while sending inventory updates to the data center over MPLS. Which SD-WAN capability primarily enables this?

  1. Spanning Tree root guard
  2. Application-aware policy with per-flow path selection Correct answer.
  3. Static default routing
  4. QoS marking only

Explanation

Per-application policy combined with per-flow path selection lets different applications take different transports. QoS marking alone classifies traffic but does not choose the path.

Question 35SD-WAN Fundamentals and Solution Architecture

A design uses a single hub site with many branches, and branch-to-branch traffic must traverse the hub. Which topology does this describe?

  1. Ring
  2. Hub-and-spoke Correct answer.
  3. Full mesh
  4. Partial mesh

Explanation

In hub-and-spoke, branches connect to a central hub and inter-branch traffic passes through it. This is simpler and cheaper but adds latency and hub load for branch-to-branch flows.

Question 36SD-WAN Fundamentals and Solution Architecture

An administrator must ensure that voice traffic is never sent over a link whose measured loss exceeds a threshold, and that it fails over automatically. Which SD-WAN mechanism provides this?

  1. BGP route dampening
  2. Port mirroring
  3. SLA-based path monitoring with policy-driven failover Correct answer.
  4. Static route redistribution

Explanation

SLA-based monitoring measures loss, latency, and jitter per path and triggers policy-driven failover when thresholds are breached. This keeps voice on a compliant path automatically.

Question 37SD-WAN Fundamentals and Solution Architecture

Which SD-WAN design element primarily determines how traffic is classified into an application for policy enforcement?

  1. The transport's MTU setting
  2. The DHCP lease duration
  3. The BGP community attached to the route
  4. Application signatures and flow classification at the edge Correct answer.

Explanation

Edges classify traffic into applications using signatures and flow inspection, and policy is then applied to that classification. MTU, BGP communities, and DHCP do not classify applications.

Question 38SD-WAN Fundamentals and Solution Architecture

A company wants to add a second internet provider at a branch so that business-critical traffic survives a single-provider outage. Which SD-WAN design principle does this illustrate?

  1. Route summarization for scale
  2. Transport diversity for resiliency Correct answer.
  3. Overlay segmentation for security
  4. QoS shaping for fairness

Explanation

Using multiple independent transports provides diversity so a single provider failure does not take down critical traffic. SD-WAN can then fail over per policy.

Question 39SD-WAN Fundamentals and Solution Architecture

Which SD-WAN feature allows an edge to use a cellular LTE link as a backup that activates only when primary transports fail SLA checks?

  1. Proxy ARP
  2. Policy-based conditional standby with SLA probes Correct answer.
  3. Static floating route with administrative distance
  4. Always-on active/active forwarding across all links

Explanation

Conditional standby keeps a link ready but only forwards traffic when policy and SLA probes indicate primary paths are unsuitable. This conserves metered cellular bandwidth.

Question 40SD-WAN Fundamentals and Solution Architecture

In SD-WAN architecture, what is the function of a 'gateway' or 'concentrator' node in a regional hub design?

  1. It only encrypts traffic between two branch sites
  2. It assigns IP addresses to branch endpoints
  3. It terminates branch overlays and provides shared services such as security inspection or connectivity to legacy sites Correct answer.
  4. It replaces the need for any routing protocol in the underlay

Explanation

A gateway/concentrator aggregates branch overlays and provides shared services like security inspection, legacy connectivity, or cloud on-ramp. It centralizes functions that are uneconomical to place at every branch.

Question 41SD-WAN Fundamentals and Solution Architecture

A customer's security policy requires that traffic from IoT devices and from employee laptops use separate logical networks with distinct policies, even when they share the same physical transport. Which SD-WAN capability addresses this?

  1. Overlay segmentation with per-segment policy Correct answer.
  2. Jitter buffering
  3. Route redistribution
  4. Forward error correction

Explanation

Overlay segmentation creates separate logical networks (segments/VRFs) with independent policies over shared transports. This isolates IoT from employee traffic without separate physical links.

Question 42SD-WAN Fundamentals and Solution Architecture

Which statement best explains how SD-WAN supports a cloud on-ramp to a major public cloud provider?

  1. By using only MPLS to reach the cloud
  2. By establishing overlay tunnels from branch edges or gateways to a cloud point of presence Correct answer.
  3. By requiring all cloud traffic to backhaul through the data center
  4. By disabling encryption for cloud-bound traffic

Explanation

Cloud on-ramp uses overlay tunnels from branches or regional gateways to a provider point of presence, avoiding data center backhaul. This reduces latency and improves cloud application experience.

Question 43SD-WAN Fundamentals and Solution Architecture

An engineer must choose between an active/active and an active/standby transport configuration for a site with two links of equal quality. Which outcome is most associated with active/active?

  1. Guaranteed lower latency on every flow
  2. Elimination of the need for SLA monitoring
  3. Automatic removal of one link from service
  4. Higher aggregate throughput and per-flow load distribution Correct answer.

Explanation

Active/active uses both transports concurrently, increasing aggregate capacity and distributing flows per policy. It does not guarantee lower latency on every flow and still requires monitoring.

Question 44SD-WAN Fundamentals and Solution Architecture

A branch edge reports that a business application is being classified as generic HTTPS, so the intended priority policy is not applied. Which action most directly addresses the root cause?

  1. Increase the tunnel MTU
  2. Disable SLA probes
  3. Change the BGP local preference
  4. Update application signatures or use custom application definitions Correct answer.

Explanation

Misclassification usually stems from outdated or missing application signatures, or from encrypted traffic that needs a custom definition. Updating signatures or defining the application restores correct policy matching.

Question 45SD-WAN Fundamentals and Solution Architecture

Which design consideration most affects the scale of the control plane in a large SD-WAN overlay with hundreds of edges?

  1. The brand of power supply in the branch
  2. The number of overlay tunnels and routing adjacencies the controller must manage Correct answer.
  3. The color of the management interface
  4. The length of the console cable

Explanation

Control-plane scale is driven by the number of tunnels, endpoints, and routing adjacencies the controller must track and distribute. Physical attributes of hardware do not affect control-plane scale.

Question 46SD-WAN Fundamentals and Solution Architecture

A network architect is asked to justify SD-WAN over a traditional WAN with static routes for a company opening many small branches with diverse internet providers. Which justification is strongest?

  1. SD-WAN guarantees zero packet loss on all internet links
  2. SD-WAN provides centralized policy, transport independence, and automated path selection across diverse providers Correct answer.
  3. SD-WAN removes the need for any IP addressing plan
  4. SD-WAN eliminates the need for security controls at branches

Explanation

SD-WAN's value in this scenario is centralized policy, independence from any single transport, and automated path selection across diverse providers. It does not guarantee lossless internet or remove addressing or security needs.

Question 47SD-WAN Fundamentals and Solution Architecture

An enterprise requires that branch-to-branch traffic use direct tunnels where available but fall back through a regional gateway when direct paths fail SLA checks. Which SD-WAN design pattern describes this?

  1. Single-transport static routing
  2. Dynamic partial mesh with gateway fallback Correct answer.
  3. Full mesh with no policy
  4. Strict hub-and-spoke with no direct tunnels

Explanation

A dynamic partial mesh establishes direct tunnels where feasible and uses a gateway as fallback when direct paths degrade. This balances latency benefits against resiliency and scale.

Question 48SD-WAN Fundamentals and Solution Architecture

A designer must place a security inspection service so that branch-to-internet traffic is inspected without tromboning through the data center. Which architectural choice best meets this?

  1. Route all traffic over MPLS only
  2. Disable internet breakout at all branches
  3. Backhaul all internet traffic to the data center firewall
  4. Redirect internet-bound traffic through a regional cloud security gateway via overlay tunnels Correct answer.

Explanation

A regional cloud security gateway reached by overlay tunnels inspects breakout traffic near the branch, avoiding data center tromboning. This preserves security while reducing latency.

Question 49SD-WAN Fundamentals and Solution Architecture

An SD-WAN controller distributes overlay reachability information to edges using a scalable routing design. Which approach best avoids a full mesh of routing adjacencies among all edges?

  1. Edges peer with a route reflector or controller that reflects overlay routes Correct answer.
  2. Each edge peers directly with every other edge
  3. Each edge uses only static default routes to the hub
  4. Each edge runs an isolated routing process with no peering

Explanation

Peering edges to a route reflector or controller that reflects routes avoids the n-squared adjacency problem of a full mesh. It scales overlay routing while preserving reachability.

Question 50SD-WAN Fundamentals and Solution Architecture

A company wants SD-WAN edges to prefer a private MPLS path for latency-sensitive traffic but use broadband for bulk transfers, while preserving automatic failover if MPLS degrades. Which combination of SD-WAN features is required?

  1. Application classification, per-path SLA monitoring, and policy-based steering with failover Correct answer.
  2. Static routes and NAT only
  3. DNS forwarding and DHCP relay
  4. VLAN pruning and Spanning Tree

Explanation

This requires classifying applications, continuously monitoring each path's SLA, and steering per policy with automatic failover. Together these deliver preference plus resiliency.