Free 300-415 practice test: 30 questions with answers

vBond is the orchestrator and the first point of contact for new WAN Edge devices, where authentication and NAT traversal assistance happen. vSmart distributes routes and policy, vManage provides management and monitoring, and the hub WAN Edge forwards user traffic, so none of them is the first onboarding contact.

vSmart is the control plane component: it receives OMP routes and TLOC information from WAN Edge routers, redistributes them, and applies centralized policy. User traffic flows over the WAN Edge data plane tunnels, vManage hosts the GUI and configuration, and vBond performs the first onboarding authentication.

Cloud OnRamp for SaaS probes SaaS application performance from the WAN Edge routers and chooses the best exit path, which is what the scenario needs. Cloud OnRamp for IaaS connects workloads in public clouds, Direct Internet Access gives local breakout without performance-based path selection, and service insertion steers traffic to a service node.

A TLOC is identified by the system IP address of the WAN Edge, its transport color and its encapsulation type. The hostname, VPN identifier, NAT port and BFD timers are not part of that identity, so the other options are wrong.

WAN Edge routers build IPsec tunnels between one another for the data plane by default. GRE can be configured as an alternative encapsulation on a TLOC but is not the default, and VXLAN and MPLS label switched paths are not the overlay data plane encapsulations used here.

Zero-touch provisioning uses Plug and Play: once the device is registered and authorized, it discovers the controllers and receives its configuration without staff on site. Manual configuration, file copies and template pushes to unauthenticated devices all contradict the zero-touch model.

Device templates built from feature templates are attached to many routers at once, so one change in vManage propagates to all of them. Per-router CLI, local edits and OMP do not provide that central, repeatable configuration, because OMP carries routes and TLOCs rather than device configuration.

BFD runs over the IPsec data plane tunnels, and its probes provide the loss, latency and jitter values used for path decisions. OMP carries routing information, control connections carry control traffic, and SNMP interface counters do not measure per-tunnel path quality.

OMP is the overlay routing protocol that runs over the control connections and carries routes, TLOCs and service information to vSmart. BGP and OSPF are routing protocols used in service or underlay networks rather than for overlay advertisements, and LDP is not used in the SD-WAN control plane.

OMP advertises TLOCs to the controllers and onward to other WAN Edge routers, and each TLOC carries a color that names its transport. A TLOC is not identified by hostname, it is not limited to VPN 512, and TLOC preference does influence path selection.

A centralized control policy on the vSmart filters which OMP routes are advertised to other sites, so the prefixes never reach remote routers. A localized policy, a LAN access list or a QoS map acts only on the local device and does not stop the advertisement across the fabric.

Centralized control policies act on routing and TLOC information held by vSmart, whereas data policies classify and steer user traffic on WAN Edge routers. The other options swap the two roles or wrongly tie each policy type to vBond or to localized configuration.

Application-aware routing uses SLA classes with loss, latency and jitter thresholds, measured with BFD over the tunnels, to move traffic to a better path. A QoS policy only prioritizes traffic, a LAN access list does not measure link quality, and Cloud OnRamp for IaaS builds cloud gateways.

Direct Internet Access lets internet-bound traffic leave the branch locally rather than traveling the overlay to the hub. Service insertion and an application-aware firewall do not change where traffic exits, and withdrawing the default route would cut off internet access rather than provide local breakout.

Service VPNs isolate routing tables across the overlay, and VPN 0 is the transport VPN for WAN interfaces and control connections. VPN 512 is the management VPN rather than a data VPN, TLOC colors name transports and do not create segments, and LAN VLAN tags are not what SD-WAN segmentation relies on.

A WAN Edge can only authenticate with the controllers if its serial identifier is in the authorized device list. BFD sessions and OMP routes depend on control connections that have not formed yet, and a hostname mismatch with vManage does not block onboarding.

The organization name must match across vManage, vSmart, vBond and every WAN Edge, otherwise control connections are rejected. Hostname prefixes, loopback addresses in service VPN 1 and local administrator passwords do not need to match for the control plane to form.

The fix is to allow the controller traffic through the firewall and NAT path to the vBond so the WAN Edge can reach it. Moving the router to VPN 512 does not change the transport path, raising BFD timers does not affect control connection setup, and a vSmart cannot take over the vBond orchestrator role.

Controllers authenticate with certificates, so an expired certificate breaks the control connections until a valid one is installed and confirmed. Rebooting edges, changing TLOC colors and disabling control policy do not repair an expired certificate.

Certificate validity is checked against the current time, so a clock far in the past makes valid certificates look not yet valid. Correcting the clock, typically with NTP, fixes the root cause, while self-signed certificates and disabled validation weaken trust and BFD timers do not affect certificate checks.

Service insertion lets a firewall or other service node in the data center be advertised as a service through OMP, so branch traffic can be steered to it. Colocation cloud routing, the application-aware firewall and DNS security do not advertise a data center service node for steering.

The application-aware firewall recognizes applications and enforces rules per application, not only per address and port. Port-based access lists filter on address and port, static NAT translates addresses, and a TLOC color names a transport rather than classifying applications.

A DNS security policy sends DNS lookups to a cloud security service that can block known malicious domains before a connection is made. The control policy manages routes, App-QoE improves application performance, and a LAN access list on port 443 would block legitimate HTTPS rather than filter domains.

Low-latency queuing gives voice a strict priority queue, so it is served ahead of bulk traffic during congestion. Random early detection only drops packets early, static routing does not prioritize within a link, and packet duplication adds copies rather than priority.

TCP optimization is an App-QoE feature that improves TCP performance across the WAN. DNS security, centralized data policy and application-aware routing belong to other feature areas and do not optimize TCP sessions.

A user with a read-only role can view monitoring data without the ability to change configuration or policy, which meets the requirement. Full administrator access and a shared account violate least privilege and accountability, and SSH access to each edge with the enable password would expose device configuration.

The vManage REST API requires an authenticated session or token before protected endpoints return data. SSH to each edge, SNMP with a public community string to vSmart, and registering a script host as a device all fall outside how the API is used.

vManage can delegate user authentication to an external AAA server such as RADIUS or TACACS+, so administrators use the central directory and their logins are audited centrally. Shared local logins, SNMPv3 and MAC-address device-list entries do not provide per-user central authentication.

The image is first loaded into the vManage software repository and verified, then the upgrade is scheduled to the routers in planned groups. Rebooting all routers at once, copying images by hand and installing through the vSmart are not the controlled upgrade path.

REST API sessions and tokens expire, so a long-running script has to re-authenticate and use a fresh one. The vBond device list, BFD timers and vSmart reboots do not affect the API session the script holds.