Cisco 300-415: Implementing Cisco Catalyst SD-WAN Solutions (ENSDWI) v1.2

Last checked November 10, 2026 against the official Cisco exam page.

1. Question 1Architecture

   A new WAN Edge router is installed at a remote branch and must first contact a controller so it can be authenticated and learn how to join the overlay. Which component should it reach first?

   1. AvSmart, which reflects OMP routes and applies centralized control policy
   2. BvBond, which authenticates new devices and helps them traverse NAT
   3. CvManage, which hosts the GUI, the REST API and the monitoring dashboards
   4. DThe hub WAN Edge router, which forwards user data through IPsec tunnels
   Show answer and explanationHide answer

   Correct answer: B

   vBond is the orchestrator and the first point of contact for new WAN Edge devices, where authentication and NAT traversal assistance happen. vSmart distributes routes and policy, vManage provides management and monitoring, and the hub WAN Edge forwards user traffic, so none of them is the first onboarding contact.

2. Question 2Router Deployment

   A WAN Edge router will be shipped to a remote office with no site-specific configuration. Once it is cabled to the internet, the operator wants it to contact the controllers and join the overlay automatically. Which onboarding approach matches this?

   1. ALog in over SSH at the site and type the interface, transport and control settings by hand
   2. BLet vSmart push a CLI template to unknown devices over a DTLS session before onboarding
   3. CCopy a complete running configuration to the router with TFTP before it is shipped out
   4. DZero-touch provisioning with Plug and Play, after the device is in the authorized list
   Show answer and explanationHide answer

   Correct answer: D

   Zero-touch provisioning uses Plug and Play: once the device is registered and authorized, it discovers the controllers and receives its configuration without staff on site. Manual configuration, file copies and template pushes to unauthenticated devices all contradict the zero-touch model.

3. Question 3Policies

   A team wants one branch's prefixes withheld from every other site so that no remote router learns them, enforced centrally. Where should this be configured?

   1. AA centralized control policy that filters OMP routes on the vSmart controller
   2. BA localized data policy applied on the branch WAN Edge transport interface
   3. CAn access control list on the branch LAN switch that blocks the prefixes
   4. DA QoS map applied to the transport interface and scheduler on the branch edge
   Show answer and explanationHide answer

   Correct answer: A

   A centralized control policy on the vSmart filters which OMP routes are advertised to other sites, so the prefixes never reach remote routers. A localized policy, a LAN access list or a QoS map acts only on the local device and does not stop the advertisement across the fabric.

4. Question 4Controller Deployment

   An engineer installs a new WAN Edge router. The device is powered on and reachable on its transport network, but it never forms control connections with the controllers. Which cause is most likely?

   1. AThe BFD sessions have not yet come up across the transport tunnels
   2. BThe router hostname does not match the name of the vManage server
   3. CThe router serial number was never added to the authorized device list
   4. DThe vSmart has not yet learned the router's service VPN routes over OMP
   Show answer and explanationHide answer

   Correct answer: C

   A WAN Edge can only authenticate with the controllers if its serial identifier is in the authorized device list. BFD sessions and OMP routes depend on control connections that have not formed yet, and a hostname mismatch with vManage does not block onboarding.

5. Question 5Security and Quality of Service

   A branch must send its internet and internal traffic through a firewall that sits in the data center. Which SD-WAN capability advertises that firewall as a service over the overlay so traffic can be steered to it?

   1. AService insertion, which advertises the firewall as a service route through OMP
   2. BCloud OnRamp for colocation, which connects the branch to a colocation facility with cloud routing
   3. CApplication-aware firewall, which enforces rules based on the identity of the application
   4. DDNS security, which filters domain lookups before the connection is opened
   Show answer and explanationHide answer

   Correct answer: A

   Service insertion lets a firewall or other service node in the data center be advertised as a service through OMP, so branch traffic can be steered to it. Colocation cloud routing, the application-aware firewall and DNS security do not advertise a data center service node for steering.