300-415 Implementing Cisco Catalyst SD-WAN Solutions (ENSDWI) Practice Questions
Prepare for 300-415 with more than an answer.
- 1
An engineer is troubleshooting a control connection issue for a newly deployed vEdge router. The router fails to join the fabric. The engineer runs the command
show control local-propertiesand observes that the Certificate Status is 'Not-Installed'. What is the most likely reason for this status?Show answer details
Correct answer: A
For a device to be considered valid and allowed to join the overlay, its chassis and serial number must be uploaded to vManage and associated with a certificate serial number. When the device attempts to join, vManage checks this list. If the device is not on the list, vManage will not authorize it, and the certificate will not be successfully installed, resulting in the 'Not-Installed' status.
- 2
A hospital is deploying a Cisco SD-WAN solution to connect its main campus with several remote clinics. Due to HIPAA compliance requirements, all traffic related to Electronic Health Records (EHR) must be logically isolated from guest Wi-Fi and facilities management traffic. All traffic types will share the same physical WAN links.
Company Background: The hospital has a central data center at the main campus where the EHR systems are hosted. Remote clinics need reliable access to these systems. Each clinic also provides a guest Wi-Fi network for patients.
Current Situation: The hospital uses a flat network architecture over MPLS, which provides no segmentation. They are migrating to a dual-transport (MPLS and Internet) SD-WAN fabric.
Requirements:
- EHR traffic must be in a separate routing domain and completely isolated from other traffic types.
- Guest Wi-Fi traffic from all clinics must be backhauled to the main campus and egress to the internet through a centralized firewall.
- The solution must be scalable and managed centrally from vManage.
Which design approach best satisfies all requirements?
Show answer details
Correct answer: B
This is the ideal solution. Using separate service VPNs (e.g., VPN 10 for EHR, VPN 20 for Guest) provides complete logical isolation with separate routing tables. A centralized control policy can then be applied to the Guest Wi-Fi VPN (VPN 20) to enforce a hub-and-spoke topology, ensuring all its traffic is routed to the main campus for security inspection before egressing to the internet. This meets all stated requirements for segmentation, traffic flow, and compliance.
- 3
A network engineer wants to verify the Bidirectional Forwarding Detection (BFD) sessions and their status on all active WAN tunnels of a cEdge router. Which CLI command should the engineer use to display this information?
Show answer details
Correct answer: C
The
show sdwan bfd sessionscommand on a cEdge (IOS XE SD-WAN) router provides a detailed list of all BFD sessions. The output includes the source and destination TLOCs, the state of the session (Up/Down), uptime, and detection time, which is essential for troubleshooting data plane connectivity issues. - 4
True or False: A centralized control policy in Cisco SD-WAN is used to directly manipulate the path of data packets for specific applications as they traverse the fabric.
Show answer details
Correct answer: B
This statement is false. A centralized control policy operates on the control plane. It influences routing decisions by manipulating OMP route advertisements (vRoutes and TLOC routes), which in turn determines the overall network topology. A centralized data policy is used to directly manipulate the path of data packets based on criteria like source/destination IP, port, or DSCP value.
- 5
An organization is deploying an application-aware routing policy to steer real-time voice traffic over the link with the lowest latency. The policy is configured with an SLA class that has a maximum latency threshold of 150 ms. The MPLS link is currently measured at 100 ms latency, and the Internet link is at 160 ms. How will the SD-WAN fabric handle the voice traffic?
Show answer details
Correct answer: B
Application-aware routing policies first identify all paths that meet the defined SLA criteria. In this case, only the MPLS link (100 ms) is within the 150 ms latency threshold. The Internet link (160 ms) violates the SLA. Therefore, all voice traffic will be sent exclusively over the MPLS link as it is the only compliant path.
- 6
A network administrator is configuring a vEdge router for a new branch. The configuration requires a subinterface on a physical port to handle tagged VLAN traffic for a specific service VPN. Which configuration snippet correctly creates a VLAN-tagged subinterface and assigns it to VPN 10?
# The physical interface is ge0/1 # The VLAN ID is 100 # The service VPN is 10Show answer details
Correct answer: C
On a vEdge router (Viptela OS), a subinterface is created by appending a dot and the subinterface number (which is conventionally the VLAN ID) to the physical interface name (e.g., ge0/1.100). The VLAN tag is implicitly defined by this syntax when the subinterface is configured under a service VPN. This subinterface is then configured with an IP address and brought up like a regular interface.
- 7
What are two primary functions of the Overlay Management Protocol (OMP) in a Cisco SD-WAN fabric? (Select TWO)
Show answer details
Correct answer: B, E
OMP is responsible for the distribution of IPsec encryption keys between WAN Edge routers, which is essential for establishing the data plane tunnels.
This is the core function of OMP. It acts as the routing protocol for the overlay, advertising service-side prefixes (vRoutes), data plane tunnel endpoints (TLOCs), and policies between the vSmart controllers and WAN Edge routers.
- 8
A financial services company is deploying a Cisco SD-WAN fabric and requires that all traffic destined for its PCI-compliant datacenter traverses a specific high-security MPLS circuit. However, all other traffic, including general internet access, should use a commodity broadband circuit for cost savings. Which policy configuration is the most direct and efficient way to achieve this segmentation and traffic steering?
Show answer details
Correct answer: A
A centralized data policy using an 'app-route' action is the correct method for influencing the path of specific traffic flows based on destination prefixes and directing them to a preferred TLOC (in this case, the MPLS circuit). This allows granular control over traffic steering within the SD-WAN fabric. A control policy manipulates routing updates, not data traffic paths directly. Localized policies apply only to a single device and are less scalable for fabric-wide rules. A VPN membership policy controls which sites can communicate within a VPN, but not the path they take.
- 9
During a vSmart controller software upgrade, an administrator needs to ensure that WAN Edge routers retain their OMP routing information and that the data plane remains fully operational without interruption. Which OMP feature must be enabled on the WAN Edge routers to support this requirement?
Show answer details
Correct answer: C
OMP Graceful Restart is a mechanism that allows a WAN Edge router to continue forwarding traffic using its last known OMP routing information when its control plane connection to the vSmart controller is lost. This prevents traffic black-holing during controller reboots or upgrades. The hold-down timer is for route stability, BFD detects path failures, and route polling is not a standard OMP feature.
- 10
A network engineer is configuring a QoS map policy to prioritize VoIP traffic (marked with DSCP EF) and ensure it receives preferential treatment across the SD-WAN fabric. The policy needs to allocate bandwidth and schedule traffic appropriately. Which set of actions within a centralized data policy is required to achieve this? (Select TWO)
Show answer details
Correct answer: C, E
Setting the forwarding class maps the matched traffic (e.g., DSCP EF) to a specific hardware queue on the WAN Edge router. This is the first critical step in applying QoS treatment.
After mapping traffic to a forwarding class, you assign that class to a specific queue defined in the QoS map. This queue will have properties like bandwidth percentage and scheduling priority (e.g., Low Latency Queuing).
