Implementing Cisco SD-WAN Solutions (ENSDWI) practice questions

1. Question 1 of 25

   

   Refer to the exhibit. Which command allows traffic through the IPsec tunnel configured in VPN 0?

   • Aservice netsvc1 vpn1
   • Bservice netsvc1 address 1.1.1.1
   • Cservice FW address 1.1.1.1
   • Dservice local

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Half the battle is understanding the layout of this question. The question they are asking is "what is the next line in the config after the VPN1 configuration command at the bottom of the snippet" "From-vSmart" means configure this on vSmart. Service insertion requires configs on several devices. A service config needs to go on the edge router to advertise the service. The second config is done on the vSmart controller. Baio's doc is a good reference to learn the order of operation.

   Adapted from community discussion by she_ccie · 2023-03-06 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

   1. S

      she_ccie

      2023-03-06

      9 upvotes

      Half the battle is understanding the layout of this question. The question they are asking is "what is the next line in the config after the VPN1 configuration command at the bottom of the snippet" "From-vSmart" means configure this on vSmart. Service insertion requires configs on several devices. A service config needs to go on the edge router to advertise the service. The second config is done on the vSmart controller. Baio's doc is a good reference to learn the order of operation.

   2. B

      Baio

      2023-02-28

      Selected B5 upvotes

      https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/SD-WAN_Release_16.3/07Policy_Applications/02Service_Chaining/Service_Chaining_Configuration_Examples

   3. S

      Speirsington

      2023-01-03

      3 upvotes

      Just to add service netsvc1 VPN1 isn't valid vEdge1(config-vpn-1)# service netsvc1 vpn1 --------------------------------------^ syntax error: expecting address - IPv4 address interface - Interface tracker - Enable tracker for this Service

   4. S

      Speirsington

      2023-01-03

      3 upvotes

      Agreed I go for B - https://www.cisco.com/c/dam/en/us/td/docs/routers/sdwan/configuration/config-18-4.pdf#page=476 vpn 10 service netsvc1 address 2.2.2.2

2. Question 2 of 25

   Select 2

   Which two mechanisms are used to guarantee the integrity of data packets in the Cisco SD-WAN architecture data plane? (Choose two.)

   • Acertificates
   • Btransport locations
   • Cauthentication headers
   • Dencapsulation security payload
   • ETPM chip

   Show answer

   Correct answer: C, D

   How others answered

   • CD100%

   Explanation

   A number of components contribute to the integrity of data packets in the Viptela data plane: • ESP, which is the standard IPsec encryption protocol, protects (via encryption and authentication) the inner header, data packet payload, and ESP trailer in all data packets. • AH, which is the standard IPsec authentication protocol, protects (via authentication) the entire data packet, including the inner and outer headers, data packet payload, and ESP trailer

   Adapted from community discussion by vicopo · 2022-07-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

   1. A

      Adedayo

      2022-01-05

      27 upvotes

      Should be Authentication headers and encapsulation security payload (CD) https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/Release_18.4/Security/01Security_Overview/Data_Plane_Security_Overview

   2. V

      vicopo

      2022-07-08

      2 upvotes

      A number of components contribute to the integrity of data packets in the Viptela data plane: • ESP, which is the standard IPsec encryption protocol, protects (via encryption and authentication) the inner header, data packet payload, and ESP trailer in all data packets. • AH, which is the standard IPsec authentication protocol, protects (via authentication) the entire data packet, including the inner and outer headers, data packet payload, and ESP trailer

   3. [

      [Removed]

      2023-01-17

      1 upvote

      ntegrity—To guarantee that data traffic is transmitted across the network without being tampered with, the data plane implements several mechanisms from the IPsec security protocol suite: A modified version of the ESP protocol encapsulates the payload of data packets. The modified version of ESP uses an AH-like mechanism to check the integrity of the outer IP and UDP headers. You can configure the integrity methods supported on each router, and this information is exchanged in the router's TLOC properties. If two peers advertise different authentication types, they negotiate the type to use, choosing the strongest method. i would take the answer as correct

   4. T

      tester2478

      2022-09-09

      2 upvotes

      i think C and D are correct https://www.cisco.com/c/dam/en/us/td/docs/routers/sdwan/configuration/config-18-4.pdf#page=242 beside TLOC (transport location) in son related with integrity

3. Question 3 of 25

   Select 2

   A Cisco SD-WAN customer has a requirement to calculate the SHA value for files as they pass through the device to see the returned disposition and determine if the file is good, unknown, or malicious. The customer also wants to perform real-time traffic analysis and generate alerts when threats are detected. Which two Cisco SD-WAN solutions meet the requirements? (Choose two.)

   • ACisco Threat Grid
   • BCisco Trust Anchor Module
   • CCisco AMP
   • DCisco Secure Endpoint
   • ECisco Snort IPS

   Show answer

   Correct answer: C, E

   How others answered

   • CE50%
   • AC25%
   • AD25%

   Only 50% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Cisco Threat Grid (Option A): Cisco Threat Grid is a cloud-based malware analysis and threat intelligence platform. It allows the customer to calculate the SHA value for files as they pass through the SD-WAN devices. The files are then submitted to Threat Grid for analysis. The platform analyzes files using various sandboxing techniques to determine if the files are good, unknown, or malicious. This provides real-time threat detection and enables the customer to take appropriate actions when threats are detected. Cisco AMP (Advanced Malware Protection) (Option C): Cisco AMP is a comprehensive security solution that provides advanced malware detection, prevention, and response capabilities. It offers file reputation services, file analysis, and sandboxing to identify and block advanced malware and threats. In a Cisco SD-WAN deployment, AMP can be integrated with the SD-WAN devices to perform real-time traffic analysis. This helps in detecting and blocking threats in real-time and generating alerts when malicious activities are identified.

   Adapted from community discussion by colipto · 2023-07-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

   1. C

      colipto

      2023-07-28

      2 upvotes

      Cisco Threat Grid (Option A): Cisco Threat Grid is a cloud-based malware analysis and threat intelligence platform. It allows the customer to calculate the SHA value for files as they pass through the SD-WAN devices. The files are then submitted to Threat Grid for analysis. The platform analyzes files using various sandboxing techniques to determine if the files are good, unknown, or malicious. This provides real-time threat detection and enables the customer to take appropriate actions when threats are detected. Cisco AMP (Advanced Malware Protection) (Option C): Cisco AMP is a comprehensive security solution that provides advanced malware detection, prevention, and response capabilities. It offers file reputation services, file analysis, and sandboxing to identify and block advanced malware and threats. In a Cisco SD-WAN deployment, AMP can be integrated with the SD-WAN devices to perform real-time traffic analysis. This helps in detecting and blocking threats in real-time and generating alerts when malicious activities are identified.

   2. N

      nilkanthy

      2022-12-05

      4 upvotes

      C for Calculate SHA value for files. E for real time traffic analysis and generate alerts.

   3. M

      M_Ryu

      2023-09-12

      1 upvote

      I think it's C and E Cisco Amp: "File Reputation: The process of using a 256-bit Secure Hash Algorithm (SHA256) signature to compare the file against the Advanced Malware Protection (AMP) cloud server and access its threat intelligence information. The response can be Clean, Unknown, or Malicious." Source: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/ios-xe-17/security-book-xe/malware-protection.html Cisco Snort IPS: "Snort is an open source network IPS that performs real-time traffic analysis and generates alerts when threats are detected on IP networks." Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_utd/configuration/xe-16-12/sec-data-utd-xe-16-12-book/snort-ips.pdf

   4. A

      aafonya

      2022-11-08

      Selected C, E2 upvotes

      https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_utd/configuration/xe-16-12/sec-data-utd-xe-16-12-book/snort-ips.pdf "Snort is an open source network IPS that performs real-time traffic analysis and generates alerts when threats are detected on IP networks. "

4. Question 4 of 25

   Which combination of platforms is managed by vManage?

   • AISR4351, ASR1002HX, vEdge2000, vEdge Cloud
   • BISR4321, ASR1001, Nexus, ENCS
   • CISR4321, ASR1001, ENCS, ISRv
   • DISR4351, ASR1009, vEdge2000, CSR1000v

   Show answer

   Correct answer: A

   How others answered

   • A88%

   Explanation

   So all models in A & C are supported in SD-WAN, however the ISRv is managed from DNA-center. A is correct. "Cisco vEdge Cloud is deployed by Cisco DNA Center and then controlled, provisioned, and managed by Cisco vManage, whereas Cisco ISRv is deployed, provisioned, and managed by Cisco DNA Center." https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/sd-wan/white_paper-c11-741071.html

   Adapted from community discussion by serieus · 2021-08-16 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

   1. C

      Cert_freak

      2021-03-01

      12 upvotes

      C is wrong only 1001-X is supported - A is the right answer https://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-series-aggregation-services-routers/datasheet-c78-731632.html

   2. T

      TamerRouby

      2021-04-24

      5 upvotes

      Answer is A https://www.cisco.com/c/en/us/products/routers/router-selector.html?oid=caten020272&sd_wan=sd_wan_support

   3. A

      Adedayo

      2021-01-05

      5 upvotes

      ISRv is integrated services virtual router which can be used in the SDWAN fabric. Answer is valid

   4. S

      serieus

      2021-08-16

      3 upvotes

      So all models in A & C are supported in SD-WAN, however the ISRv is managed from DNA-center. A is correct. "Cisco vEdge Cloud is deployed by Cisco DNA Center and then controlled, provisioned, and managed by Cisco vManage, whereas Cisco ISRv is deployed, provisioned, and managed by Cisco DNA Center." https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/sd-wan/white_paper-c11-741071.html

5. Question 5 of 25

   A bank is looking for improved customer experience for applications and reduce overhead related to compliance and security. Which key feature or features of the Cisco SD-WAN solution will help the bank to achieve their goals?

   • AIntegration with PaaS providers to offer the best possible application experience
   • BQoS including application prioritization and meeting critical applications SLA for selecting optimal path
   • CImplementation of BGP across the enterprise routing for selecting optimal path
   • DImplementation of a modern age core banking system

   Show answer

   Correct answer: B

   How others answered

   • B92%

   Explanation

   While you can improve app experience with A & B, B doesn't reduce overhead related to compliance & security. Integration via PaaS does, since the Cloud providers take care of the regulatory needs. so this should be A I think

   Adapted from community discussion by serieus · 2021-08-19 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

   1. F

      FlipCCNP

      2021-06-06

      18 upvotes

      This should be B. Ref below page 51 and 52 https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/sd-wan/nb-06-cisco-sd-wan-ebook-cte-en.pdf

   2. R

      RREVECO

      2024-09-26

      Selected B1 upvote

      CORRECT ANSWER "B" very textual and 90% similar to the case study of the link: https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/sd-wan/nb-06-cisco-sd-wan-ebook-cte-en.pdf page 51 and 52 and there is a change in: ""The Cisco SD-WAN solution is able to provide: • Quality of Service, including application prioritization and choosing the optimized path based on required SLAs for critical applications. • Circuit remediation for critical traffic, so as to improve the end-user experience for traffic traversing poor quality circuits. • Integration into cloud "SaaS and IaaS" (DOES NOT INDICATE PaaS) providers to offer the best possible application experience""

   3. R

      Roger95

      2024-09-26

      Selected B1 upvote

      - Improve customer experience for applications -Reduce overhead related to compliance and security. -->The chosen solution was a managed service built with Cisco SD-WAN which dramatically improved service delivery and quality of experience. -->Application performance improved due to dynamic SLA-based traffic routing over MPLS, internet, and LTE circuits. https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/sd-wan/nb-06-cisco-sd-wan-ebook-cte-en.pdf (P51,52,53)

   4. S

      serieus

      2021-08-19

      2 upvotes

      While you can improve app experience with A & B, B doesn't reduce overhead related to compliance & security. Integration via PaaS does, since the Cloud providers take care of the regulatory needs. so this should be A I think

6. Question 6 of 25

   Select 2

   Which two algorithms authenticate a user when configuring SNMPv3 monitoring on a WAN Edge router? (Choose two.)

   • AAES-256
   • BMD5
   • CSHA-2
   • DAES-128
   • ESHA-1

   Show answer

   Correct answer: A, E

   How others answered

   • AE43%
   • BC43%

   Only 43% agreed on this answer — treat it as contested rather than settled.

   Explanation

   https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/snmp/snmp-book/snmp-book_2.html Choose the authentication mechanism for the user: MD5 digest. SHA-1 message digest. SHA-256 message digest. SHA-256 - introduced in 20.5.1 MD5 - depracated 20.3.2 Official Cisco SD-WAN course: https://www.cisco.com/c/en/us/training-events/training-certifications/training/training-services/courses/implementing-cisco-sd-wan-solutions-ensdwi.html The course lab environment is built using Cisco vEdge Cloud routers and Cisco SD-WAN 20.3 code. They use 20.3, so SHA-256 has not been there yet, I would go with MD5 and SHA-1, but IMO every combination SHA1/SHA2/MD5 is correct, it depends on the software version that you choose, so this question is really dumb and very Cisco-way of making exams.

   Adapted from community discussion by Chefff · 2023-05-02 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

   1. C

      CCNPWILL

      2021-04-26

      9 upvotes

      Authentication Protocol Select the authentication mechanism for the user: SHA-1 message digest. SHA-256 message digest. Note Starting from Cisco SD-WAN Release 20.5.1, SHA-256 authentication protocol was introduced. When you choose SHA-256 as the authentication protocol, you must set the security level as authPriv.

   2. C

      Chefff

      2023-05-02

      2 upvotes

      https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/snmp/snmp-book/snmp-book_2.html Choose the authentication mechanism for the user: MD5 digest. SHA-1 message digest. SHA-256 message digest. SHA-256 - introduced in 20.5.1 MD5 - depracated 20.3.2 Official Cisco SD-WAN course: https://www.cisco.com/c/en/us/training-events/training-certifications/training/training-services/courses/implementing-cisco-sd-wan-solutions-ensdwi.html The course lab environment is built using Cisco vEdge Cloud routers and Cisco SD-WAN 20.3 code. They use 20.3, so SHA-256 has not been there yet, I would go with MD5 and SHA-1, but IMO every combination SHA1/SHA2/MD5 is correct, it depends on the software version that you choose, so this question is really dumb and very Cisco-way of making exams.

   3. P

      pimp85

      2021-10-06

      4 upvotes

      A&E ,check here https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/snmp/snmp-book/snmp-book_2.html "Support introduced for AES-256 bit Authentication Protocol called SHA-256." "Select the authentication mechanism for the user: SHA-1 message digest. SHA-256 message digest."

   4. S

      Speirsington

      2021-12-30

      2 upvotes

      It depends on the release version. MD5 authentication protocol is deprecated for Cisco SD-WAN Release 20.3.2 and later releases. Select the authentication mechanism for the user: SHA-1 message digest. SHA-256 message digest. Note Starting from Cisco SD-WAN Release 20.5.1, SHA-256 authentication protocol was introduced. When you choose SHA-256 as the authentication protocol, you must set the security level as authPriv. Note MD5 authentication protocol is deprecated for Cisco SD-WAN Release 20.3.2 and later releases.

7. Question 7 of 25

   What is a description of vManage NMS?

   • AA cluster consists of a minimum of two vManage NMSs.
   • BIt is a software process on a dedicated WAN Edge router in the network.
   • CA cluster requires device templates to be created on an attached to the same server.
   • DIt is accessible only from VPN 512 (the management VPN).

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   C is correct. From the link above: "Note that you must configure each Cisco vManage in the cluster individually, from that vManage server itself. You cannot create a vManage configuration template on one vManage server and attach other Cisco vManage to that device template."

   Adapted from community discussion by CCNPCollab1297 · 2022-07-18 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation
   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

   1. R

      RexChen

      2022-05-26

      14 upvotes

      I think it's C https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/cisco-sd-wan-overlay-network-bringup.html#c_Step_2__Deploy_the_vManage_NMS_7856.xml

   2. C

      CCNPCollab1297

      2022-07-18

      12 upvotes

      C is correct. From the link above: "Note that you must configure each Cisco vManage in the cluster individually, from that vManage server itself. You cannot create a vManage configuration template on one vManage server and attach other Cisco vManage to that device template."

   3. N

      NetArch_Teck

      2024-07-16

      2 upvotes

      A Cluster requires device templates to be created on at least 3 instances for Redundancy | HA | Uptime Talking from experience, VManage NMS heavily relies on templates to be attached to server instances within a cluster, otherwise the instances would not be able to form said cluster. The other three are invalid:- A minimum of 3 instances are needed for a cluster VManage NMS does not operate on a WAN Edge Router VPN 0 and VPN 512 can access the VManage NMS Option C is the only valid choice here!

   4. E

      Eliasmiranda

      2023-09-08

      2 upvotes

      D is correct. Nowhere in the documentation does it state that a device template associated with vManage is required to create a cluster. https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/sd-wan/white-paper-c11-741440.html https://sdwan-docs.cisco.com/Product_Documentation/vManage_Help/Release_18.1/Administration/Cluster_Management

8. Question 8 of 25

   An administrator is configuring the severity level on the vManage NMS for events that indicate that an action must be taken immediately. Which severity level must be configured?

   • Aerror
   • Bcritical
   • Cwarning
   • Dalert

   Show answer

   Correct answer: B

   How others answered

   • B81%

   Explanation

   I'm going with B as well "In the Severity drop-down, select the event severity level. Events generated by Cisco SD-WAN devices are collected by vManage NMS and classified as: Critical—indicates that action needs to be taken immediately. Major—indicates that the problem needs to be looked into but is not critical enough to bring down the network. Minor—is informational only." source(search 'Set Event Filters'): https://www.cisco.com/c/en/us/td/docs/routers/sdwan/vManage-Help/xe-17-vedge-20/b-vmanage-help/m-help-monitor.html#c_Events_12335.xml

   Adapted from community discussion by M_Ryu · 2023-09-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

   1. W

      wcorrea

      2022-11-04

      Selected B8 upvotes

      B - Critical Critical—indicates that action needs to be taken immediately. https://sdwan-docs.cisco.com/Product_Documentation/vManage_Help/Release_18.4/Monitor/Events

   2. C

      colipto

      2023-07-23

      1 upvote

      Answer is D alert Select the severity of the syslog message to save. The severity indicates the seriousness of the event that generated the message. priority can be one of the following: • Emergency—System is unusable (corresponds to syslog severity 0). • Alert— Action must be taken immediately (corresponds to syslog severity 1). • Critical—Critical: A serious condition (corresponds to syslog severity 2). • Error—An error condition that does not fully impair system usability (corresponds to syslog severity 3). • Warning—A minor error condition (corresponds to syslog severity 4). • Notice—A normal, but significant condition (corresponds to syslog severity 5). • Informational—Routine condition (the default) (corresponds to syslog severity 6). https://www.cisco.com/c/dam/en/us/td/docs/routers/sdwan/vManage-Help/vmanage-help-18-4.pdf

   3. M

      M_Ryu

      2023-09-12

      2 upvotes

      I'm going with B as well "In the Severity drop-down, select the event severity level. Events generated by Cisco SD-WAN devices are collected by vManage NMS and classified as: Critical—indicates that action needs to be taken immediately. Major—indicates that the problem needs to be looked into but is not critical enough to bring down the network. Minor—is informational only." source(search 'Set Event Filters'): https://www.cisco.com/c/en/us/td/docs/routers/sdwan/vManage-Help/xe-17-vedge-20/b-vmanage-help/m-help-monitor.html#c_Events_12335.xml

   4. R

      RafaJohnston76

      2024-01-30

      Selected B1 upvote

      Question states Severity Level for events, under Events filter, severity there are only 3 options, hence Critical - B is the correct answer a.Critical—indicates that action needs to be taken immediately. b.Major—indicates that the problem needs immediate attention from you but, is not critical enough to bring down the network. c.Minor—is informational only. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/Monitor-And-Maintain/monitor-maintain-book/m-alarms-events-logs.html

9. Question 9 of 25

   

   Refer to the exhibit. An engineer configured OMP with an overlay-as of 10666. What is the AS-PATH for prefix 104.104.104.104/32 on R100?

   • A100 10666
   • B100 20 104
   • C100 10666 20 104
   • D100 10666 104

   Show answer

   Correct answer: D

   How others answered

   • D67%
   • A33%

   Only 67% agreed on this answer — treat it as contested rather than settled.

   Explanation

   is D: https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/214147-vedge-does-not-advertise-its-own-as-when.html "This document describes why vEdge router does not advertise its own Autonomous System (AS) number when you advertise Border Gateway Protocol (BGP) routes into Overlay Management Protocol (OMP)."

   Adapted from community discussion by Zdrobici · 2023-07-29 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

   1. Z

      Zdrobici

      2023-07-29

      5 upvotes

      is D: https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/214147-vedge-does-not-advertise-its-own-as-when.html "This document describes why vEdge router does not advertise its own Autonomous System (AS) number when you advertise Border Gateway Protocol (BGP) routes into Overlay Management Protocol (OMP)."

   2. K

      Knowledge33

      2024-07-22

      Selected D3 upvotes

      https://community.cisco.com/t5/networking-knowledge-base/sd-wan-techtip-vedge-does-not-advertise-its-own-as-when-bgp/ta-p/3807923

   3. A

      AJMD

      2024-02-23

      Selected D2 upvotes

      Correct https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/214147-vedge-does-not-advertise-its-own-as-when.html

   4. G

      GlobalK

      2024-05-03

      1 upvote

      Typo. Correct is D. In Overlay AS, the router that announces a route changes its own AS to the one specified in the configuration. The other ASs that appear in the AS_PATH attribute remain unchanged.

10. Question 10 of 25

    

    Refer to the exhibit. Which configuration configures IPsec tunnels in active and standby?

    • Avpn 1 service netsvc1 interface ipsec1 ipsec2 from-vsmart lists vpn-list 1 vpn 1
    • Bvpn 0 service netsvc1 interface ipsec1 ipsec2 from-vsmart lists vpn-list 0 vpn 0
    • Cvpn 1 service netsvc1 interface ipsec1 ipsec2 vpn-list 1 count ServicePSec1_275676046 from-vsmart lists vpn-list 1 vpn 1
    • Dvpn 0 service netsvc1 interface ipsec1 ipsec2 vpn-list 1 count ServicePSec1_275676046 from-vsmart lists vpn-list 0 vpn 0

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A looks much better, why would we use a counter under vpn-list definition? A with a little bit of formating: vpn 1 service netsvc1 interface ipsec1 ipsec2 from-vsmart lists vpn-list 1 vpn 1

    Adapted from community discussion by DBla · 2023-04-09 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. D

       DBla

       2023-04-09

       12 upvotes

       A looks much better, why would we use a counter under vpn-list definition? A with a little bit of formating: vpn 1 service netsvc1 interface ipsec1 ipsec2 from-vsmart lists vpn-list 1 vpn 1

    2. S

       she_ccie

       2023-08-27

       1 upvote

       If the action you are configuring is a service, configure the required services on the Cisco SD-WAN devices so that the Cisco vSmart Controller knows how to reach the services: Device(config)# vpn vpn-id service service-name address ip-address Specify the VPN is which the service is located and one to four IP addresses to reach the service device or devices. If multiple devices provide the same service, the device load-balances the traffic among them. Note that the Cisco SD-WAN device keeps track of the services, advertising them to the Cisco vSmart Controller only if the address (or one of the addresses) can be resolved locally, that is, at the device's local site, and not learned through OMP. If a previously advertised service becomes unavailable, the Cisco SD-WAN device withdraws the service advertisement. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/vedge/policies-book/control-policies.html#id_112053

    3. S

       she_ccie

       2023-08-28

       1 upvote

       Location of Service IP address of the the service device, or GRE interface through which the service is reachable. You can specify up to four IP address. The service is advertised to the vSmart controller only if the address (or one of the addresses) can be resolved locally, at the local site, and not via routes learned through OMP. When configuring a GRE tunnel, specify the names of one or two GRE interfaces. If you configure two, the first interface is the primary GRE tunnel, and the second is the backup tunnel. All packets are sent only to the primary tunnel. If that tunnel fails, all packets are then sent to the secondary tunnel. If the primary tunnel comes back up, all traffic is moved back to the primary GRE tunnel. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/command/sdwan-cr-book/config-cmd.html#wp5008346010

    4. J

       JP4CCNP

       2024-10-12

       Selected A2 upvotes

       Right Answer is A. Because the Counter in Policys are limited to 20 Signs. In the Example there are 22 Signs.

11. Question 11 of 25

    An organization wants to use the Cisco SD-WAN regionalized service-chaining feature to optimize cost and user experience with applications in the network, which allows branch routers to analyze and steer traffic toward the required network function. Which feature meets this requirement?

    • ACloud onRamp for Colocation
    • BCloud onRamp for IaaS
    • CCloud Services Platform
    • DVNF Service Chaining

    Show answer

    Correct answer: A

    How others answered

    • A60%
    • D40%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A: ? "With the Cisco SD-WAN Cloud onRamp for Colocation solution built specifically for colocation facilities, the solution routes the traffic to the best-permissible path from branches and remote workers to where all applications are hosted" https://www.cisco.com/c/en/us/td/docs/routers/sdwan-cloud-onramp-for-colocation/solution-user-guide/cisco-sdwan-cloud-onramp-colocation-solution-guide-19_1/about-cisco-sd-wan-Cloud-OnRamp-for-Colocation-solution.html

    Adapted from community discussion by EGD · 2021-12-19 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. E

       EGD

       2021-12-19

       3 upvotes

       A: ? "With the Cisco SD-WAN Cloud onRamp for Colocation solution built specifically for colocation facilities, the solution routes the traffic to the best-permissible path from branches and remote workers to where all applications are hosted" https://www.cisco.com/c/en/us/td/docs/routers/sdwan-cloud-onramp-for-colocation/solution-user-guide/cisco-sdwan-cloud-onramp-colocation-solution-guide-19_1/about-cisco-sd-wan-Cloud-OnRamp-for-Colocation-solution.html

    2. R

       RafaJohnston76

       2024-01-26

       Selected A2 upvotes

       A is correct. Page 96 and 112 you can see the difference between Service-chaining and VNF ser ice chaining https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/sd-wan/nb-06-cisco-sd-wan-ebook-cte-en.pdf

    3. [

       [Removed]

       2022-01-16

       2 upvotes

       cloud on ramp for colocation is used when you have a colocation datacenter and you want to forward traffic there. for example you have a firewall there and from the firewall you want to redirect traffic to a second service in the same colocation building.( service chaining)

    4. S

       sus_007

       2023-10-01

       Selected A1 upvote

       Cloud on-ramps are solutions designed to help organizations quickly and securely obtain cloud connectivity solutions.

12. Question 12 of 25

    What is a restriction when configuring a tunnel interface?

    • AUp to six tunnel interfaces are configurable on a vSmart.
    • BIt is manually assigned when using vManage feature templates.
    • CIt must be configured for the interface under all VPNs.
    • DUp to six tunnel interfaces are configurable on a WAN Edge.

    Show answer

    Correct answer: B

    How others answered

    • B75%
    • D25%

    Explanation

    this is sentence from the link mentioned by Roger95 "On a Cisco vSmart Controller or Cisco vSmart Controller NMS, you can configure one tunnel interface. On a Cisco IOS XE SD-WAN device, you can configure up to eight tunnel interfaces." so A - vSmart supports only 1 tunnel not 6 and D - vEdge supports up to 8 tunnels not 6 I would go for B in this case

    Adapted from community discussion by PepaZdepa33 · 2023-12-28 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. P

       PepaZdepa33

       2023-12-28

       Selected B4 upvotes

       this is sentence from the link mentioned by Roger95 "On a Cisco vSmart Controller or Cisco vSmart Controller NMS, you can configure one tunnel interface. On a Cisco IOS XE SD-WAN device, you can configure up to eight tunnel interfaces." so A - vSmart supports only 1 tunnel not 6 and D - vEdge supports up to 8 tunnels not 6 I would go for B in this case

    2. R

       Roger95

       2023-11-15

       Selected B2 upvotes

       I go for B. Maximum tunnels is 8. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/system-interface/vedge-20-x/systems-interfaces-book/configure-interfaces.html

    3. Z

       Zamochit

       2024-07-22

       1 upvote

       for me is B, tunel 0 is not the tunnel interface. is the tunnel mode sdwan that's call physical interfaces related to tunnel interface. Do in a cedge this command: show sdwan running-config sdwan you will not see tunel0 on that part of the config for your example. if you use show run: interface Tunnel2 ip unnumbered GigabitEthernet0/0/0 tunnel source GigabitEthernet0/0/0 tunnel mode sdwan ! interface Tunnel4 ip unnumbered GigabitEthernet0/0/1 tunnel source GigabitEthernet0/0/1 tunnel mode sdwan I hope it helps.

    4. S

       soltani

       2024-07-22

       1 upvote

       A & D are not correct answer * You can configure up to 512 interfaces on a Cisco IOS XE Catalyst SD-WAN device. This number includes physical interfaces, loopback interfaces, and subinterfaces. * On a Cisco Catalyst SD-WAN Controller or Cisco Catalyst SD-WAN Controller NMS, you can configure one tunnel interface. * On a Cisco IOS XE Catalyst SD-WAN device, you can configure up to eight tunnel interfaces.

13. Question 13 of 25

    Which OMP route is selected if it was learned from the same Cisco SD-WAN device at location S4406T9E02F15?

    • Aroute with the lower origin metric
    • Broute with the higher OMP route preference value
    • Croute with the higher router ID
    • Droute with the lower administrative distance

    Show answer

    Correct answer: D

    How others answered

    • D53%
    • B40%

    Only 53% agreed on this answer — treat it as contested rather than settled.

    Explanation

    1) Prefer ACTIVE routes over STALE routes. 2) Select routes that are Valid. 3) Prefer routes with lower administrative distance (AD) (on vEdge only). AD is a locally-significant value on each router and depends on the OS. 4) Prefer routes with a higher route preference value. By default, all omp routes have 0 preference. 5) Prefer routes with a higher TLOC preference value (on vEdge only). TLOC preference is a parameter in TLOC routes. 6) Compare the origin type 7) Compare the origin metric - prefer lower metric so I would go with D

    Adapted from community discussion by PepaZdepa33 · 2023-06-28 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. P

       PepaZdepa33

       2023-06-28

       Selected D3 upvotes

       1) Prefer ACTIVE routes over STALE routes. 2) Select routes that are Valid. 3) Prefer routes with lower administrative distance (AD) (on vEdge only). AD is a locally-significant value on each router and depends on the OS. 4) Prefer routes with a higher route preference value. By default, all omp routes have 0 preference. 5) Prefer routes with a higher TLOC preference value (on vEdge only). TLOC preference is a parameter in TLOC routes. 6) Compare the origin type 7) Compare the origin metric - prefer lower metric so I would go with D

    2. S

       sdwanlove

       2023-04-14

       3 upvotes

       Please disregards my previous post. I found this: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/routing/ios-xe-17/routing-book-xe/m-unicast-routing.html "If the OMP route is valid and if it has been learned from the same Cisco SD-WAN device, select the OMP route with the lower administrative distance." So it should be D.

    3. S

       Shahansa

       2024-02-18

       3 upvotes

       It is D https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/bridging-routing-segmentation-qos/vedge/bridging-routing-segmentation-qos-book/unicast-overlay-routing.html#:~:text=If%20the%20OMP%20route%20is,higher%20OMP%20route%20preference%20value.

    4. N

       Neil_Neo234

       2023-04-08

       1 upvote

       https://www.networkacademy.io/ccie-enterprise/sdwan/omp-best-path-selection Prefer routes with lower administrative distance (AD) (on vEdge only). AD is a locally-significant value on each router and depends on the OS. Different platforms may have different AD values for different protocols. For example, OMP has AD of 250 on vEdges and 251 on cEdges. Additionally, network admins can define floating static routes with various ADs for the same prefix. AD is only compared when the same WAN edge router receives the same site-local prefix from multiple routing protocols. AD is not a parameter in OMP, is not advertised, and does not influence vSmart.

14. Question 14 of 25

    What is the behavior of vBond orchestrator?

    • AIt builds permanent connections with vSmart controllers.
    • BIt builds permanent connections with WAN Edge routers.
    • CIt updates vSmart of WAN Edge routers behind NAT devices using OMP.
    • DIt maintains vSmart and WAN Edge routers secure connectivity state.

    Show answer

    Correct answer: A

    How others answered

    • A82%

    Explanation

    A. Is correct. The major components of the Cisco vBond Orchestrator are: Control plane connection: Each Cisco vBond Orchestrator has a persistent control plane connection in the form of a DTLS tunnel with each Cisco vSmart Controller in its domain. In addition, the Cisco vBond Orchestrator uses DTLS connections to communicate with edge routers when they come online, to authenticate the router, and to facilitate the router's ability to join the network. Basic authentication of an edge router is done using certificates and RSA cryptography. NAT traversal: The Cisco vBond Orchestrator facilitates the initial orchestration between edge routers and Cisco vSmart Controllers when one or both of them are behind NAT devices. Standard peer-to-peer techniques are used to facilitate this orchestration. Load balancing: In a domain with multiple Cisco vSmart Controllers, the Cisco vBond Orchestrator automatically performs load balancing of edge routers across the Cisco vSmart Controllers when routers come online. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/system-overview.html#c_Components_of_the_Viptela_SEN_9290.xml

    Adapted from community discussion by Eliasmiranda · 2022-09-09 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. E

       Eliasmiranda

       2022-09-09

       2 upvotes

       A. Is correct. The major components of the Cisco vBond Orchestrator are: Control plane connection: Each Cisco vBond Orchestrator has a persistent control plane connection in the form of a DTLS tunnel with each Cisco vSmart Controller in its domain. In addition, the Cisco vBond Orchestrator uses DTLS connections to communicate with edge routers when they come online, to authenticate the router, and to facilitate the router's ability to join the network. Basic authentication of an edge router is done using certificates and RSA cryptography. NAT traversal: The Cisco vBond Orchestrator facilitates the initial orchestration between edge routers and Cisco vSmart Controllers when one or both of them are behind NAT devices. Standard peer-to-peer techniques are used to facilitate this orchestration. Load balancing: In a domain with multiple Cisco vSmart Controllers, the Cisco vBond Orchestrator automatically performs load balancing of edge routers across the Cisco vSmart Controllers when routers come online. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/system-overview.html#c_Components_of_the_Viptela_SEN_9290.xml

    2. R

       Roier

       2023-03-02

       Selected A3 upvotes

       A is correct The DTLS connections with Cisco vSmart Controllers are permanent so that the vBond controller can inform the Cisco vSmart Controllers as edge routers join the network. The DTLS connections with edge routers are temporary; once the Cisco vBond Orchestrator has matched a edge router with a Cisco vSmart Controller, there is no need for the Cisco vBond Orchestrator and the edge router to communicate with each other. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/system-overview.html

    3. A

       A_Wolf

       2022-01-29

       4 upvotes

       A is correct. The connection between the vSMART controller(s) and the vBOND via DTLS is the only persistent connection (always there) OMP runs between the edge router and the Cisco vSmart Controller and carries only control information (routing) vBond does not use OMP!

    4. I

       InjaYeGame

       2023-04-20

       2 upvotes

       I support A as correct. see below: "The DTLS connections with edge routers are temporary; once the Cisco vBond Orchestrator has matched a edge router with a Cisco vSmart Controller, there is no need for the Cisco vBond Orchestrator and the edge router to communicate with each other. The Cisco vBond Orchestrator shares only the information that is required for control plane connectivity, and it instructs the proper edge routers and Cisco vSmart Controllers to initiate secure connectivity with each other. The Cisco vBond Orchestrator maintains no state."

15. Question 15 of 25

    How is the software managed in Cisco SD-WAN?

    • ASoftware upgrade operation in the group must include vManage, vBond, and vSmart.
    • BSoftware downgrades are unsupported for vManage.
    • CSoftware images must be uploaded to vManage through HTTP or FTP.
    • DSoftware images must be transferred through VPN 512 or VPN 0 of vManage.

    Show answer

    Correct answer: B

    How others answered

    • B71%
    • C29%

    Only 71% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Tech tip: Once upgraded, It is not possible to downgrade vManage to a lower major release. For example, if you are running an 18.3.x release, you cannot downgrade to an 18.2,x or lower release. While you can install a lower code version onto the vManage server, you will not be able to activate it. https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/SDWAN/SD-WAN-End-to-End-Deployment-Guide.pdf

    Adapted from community discussion by Roger95 · 2023-11-17 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. N

       nbvolz

       2024-04-19

       3 upvotes

       Answer: C Manage Remote Server From the Cisco vManage menu, choose Maintenance > Software Repository. For the desired remote server, click … To view the remote server settings, click View Details. To edit the remote server settings, click Edit. Edit any of the following settings as necessary and click Save. Note You cannot edit the remote server settings if you have added locations of any software images on the remote server to the Cisco vManage software repository. If you wish to edit the remote server settings, remove the software image entries from the software repository and then edit the settings. Server Info Server Name: Enter a name for the server. Server IP or DNS Name: Enter the IP address or the DNS name of the server. Protocol: Choose HTTP or FTP.

    2. N

       NetArch_Teck

       2024-01-20

       4 upvotes

       Option [C] is the answer! A is wrong software upgrades does not have to included VManage B is wrong, downgrades are supported in VManage D is wrong Service VPN are permitted to transfer software images Cisco link reference:- https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/Monitor-And-Maintain/monitor-maintain-book/maintain.html

    3. R

       Roger95

       2023-11-17

       Selected B3 upvotes

       Tech tip: Once upgraded, It is not possible to downgrade vManage to a lower major release. For example, if you are running an 18.3.x release, you cannot downgrade to an 18.2,x or lower release. While you can install a lower code version onto the vManage server, you will not be able to activate it. https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/SDWAN/SD-WAN-End-to-End-Deployment-Guide.pdf

    4. S

       soltani

       2024-07-14

       1 upvote

       B is correct A version downgrade from a major release to an older one, it is not supported in vManage. https://www.cisco.com/c/en/us/support/docs/wan/dpt/220424-upgrade-sd-wan-controllers-with-the-use.html

16. Question 16 of 25

    How must the application-aware enterprise firewall policies be applied within the same WAN Edge router?

    • Awithin zone pair
    • Bwithin and between zones
    • Cbetween two VPN tunnels
    • Dbetween two VRFs

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Answer [B] Within and between the two zones. In Summary Traffic flows that originate in a given zones are allowed to proceed to another zone based on the policy between the two zones. Grouping VPNs into zones allows you to establish security boundaries in your overlay network so that you can control all data traffic that passes between zones. White Paper Link:- https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/SDWAN/sdwan-firewall-compliance-deploy-guide-2020sep.pdf

    Adapted from community discussion by NetArch_Teck · 2023-07-20 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. N

       NetArch_Teck

       2023-07-20

       3 upvotes

       Answer [B] Within and between the two zones. In Summary Traffic flows that originate in a given zones are allowed to proceed to another zone based on the policy between the two zones. Grouping VPNs into zones allows you to establish security boundaries in your overlay network so that you can control all data traffic that passes between zones. White Paper Link:- https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/SDWAN/sdwan-firewall-compliance-deploy-guide-2020sep.pdf

    2. R

       RafaJohnston76

       2024-02-04

       Selected A3 upvotes

       Zone pair—A container that associates a source zone with a destination zone and that applies a firewall policy to the traffic that flows between the two zones.

    3. B

       brutusmail

       2023-07-14

       Selected A3 upvotes

       I believe it is ans A. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/ios-xe-16/security-book-xe/enterprise-firewall.html#id_121727

    4. S

       soltani

       2024-01-14

       3 upvotes

       B is correct Cisco's Enterprise Application-Aware Firewall can perform intra-zone-based firewalling and inter-zone-based firewalling based on zone pair association and traffic flow between zones.

17. Question 17 of 25

    What is a requirement for a WAN Edge to reach vManage, vBond, and vSmart controllers in a data center?

    • AOMP
    • BIGP
    • CQoS
    • DTLS

    Show answer

    Correct answer: D

    How others answered

    • D46%
    • B42%

    Only 46% agreed on this answer — treat it as contested rather than settled.

    Explanation

    attention to the question: What is a requirement for a WAN Edge to reach "vManage, vBond, and vSmart" controllers in a data center? IGP or static routing is needed to get from WANEDGE to VBOND, but then DTLS/TLS tunnels need to be established for wan edge to reach VSMART, VMANAGE note 1: I replace the IGP with static routing to reach the vbond , but I need DTLS/TLS for the wan edge to reach the other controllers NOTE 2 vbond needs DTLS/TLS to authenticate the wANEDGE if that will never reach the controllers link: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/vedge/security-book/security-overview.html shows that the vBond can use TLS to connect to the wanEdge

    Adapted from community discussion by RREVECO · 2022-06-01 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. A

       Almanac

       2022-01-17

       9 upvotes

       OMP is between vSmart to vEdge , and vSmart to vSmart only. I think tha answes is D: TLS. any comment?

    2. R

       RREVECO

       2022-06-01

       Selected D2 upvotes

       attention to the question: What is a requirement for a WAN Edge to reach "vManage, vBond, and vSmart" controllers in a data center? IGP or static routing is needed to get from WANEDGE to VBOND, but then DTLS/TLS tunnels need to be established for wan edge to reach VSMART, VMANAGE note 1: I replace the IGP with static routing to reach the vbond , but I need DTLS/TLS for the wan edge to reach the other controllers NOTE 2 vbond needs DTLS/TLS to authenticate the wANEDGE if that will never reach the controllers link: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/vedge/security-book/security-overview.html shows that the vBond can use TLS to connect to the wanEdge

    3. H

       heavncong

       2022-12-07

       Selected D3 upvotes

       No OMP between wan edge and vManage or vBond D - TLS should be the correct answer

    4. H

       Han2022

       2022-06-03

       3 upvotes

       D. TLS pg 180: https://www.cisco.com/c/dam/en/us/td/docs/routers/sdwan/configuration/config-18-4.pdf#page=186

18. Question 18 of 25

    An engineer is applying QoS policy for the transport-side tunnel interfaces to enable scheduling and shaping for a WAN Edge cloud router. Which command accomplishes the task?

    • Acloud-qos-service-side
    • Bqos-scheduler QOS_0
    • Crewrite-rule QOS-REQWRITE
    • Dqos-map QOS

    Show answer

    Correct answer: D

    How others answered

    • D67%
    • A33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    transport side command: cloud-qos service side command: cloud-qos-service-side The question says transport side, so the service-side command is not correct.

    Adapted from community discussion by timtgh · 2023-09-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. T

       timtgh

       2023-09-10

       2 upvotes

       transport side command: cloud-qos service side command: cloud-qos-service-side The question says transport side, so the service-side command is not correct.

    2. S

       soltani

       2024-01-15

       1 upvote

       vEdge-3# conf t Entering configuration mode terminal vEdge-3(config)# vpn 0 interface ge0/0 vEdge-3(config-interface-ge0/0)# qos-map 3-QUEUES-QOS-MAP vEdge-3(config)# vpn 0 interface ge0/1 vEdge-3(config-interface-ge0/1)# qos-map 3-QUEUES-QOS-MAP vEdge-3(config-interface-ge0/1)# commit and-quit Commit complete.

    3. S

       soltani

       2024-01-15

       1 upvote

       D is correct In the Policy Overview page, select the Cloud QoS checkbox to enable QoS on the transport side, and select the Cloud QoS Service side checkbox to enable QoS on the service side but question said apply a qos policy on tunnel interface that qos-map apply it

    4. N

       NetArch_Teck

       2023-07-20

       1 upvote

       Answer [A] Cloud-qos-service-side is the command for cloud WAN Edge Devices. Confirmed Link:- https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/qos/vEdge-20-x/qos-book/forwarding-qos.html

19. Question 19 of 25

    What is the BFD multiplier in application-aware routing?

    • A6
    • B7
    • C8
    • D9

    Show answer

    Correct answer: A

    How others answered

    • A70%
    • B30%

    Only 70% agreed on this answer — treat it as contested rather than settled.

    Explanation

    To determine the SLA classification of a tunnel, application-aware routing uses the loss, latency, and jitter information from the latest poll intervals. The number of poll intervals used is determined by a multiplier. By default, the multiplier is 6, so the information from all the poll intervals (specifically, from the last six poll intervals) is used to determine the classification. Reference: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/application-aware-routing.html

    Adapted from community discussion by [Removed] · 2024-05-15 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. I

       iking

       2024-03-25

       Selected A3 upvotes

       A. 6 The BFD multiplier in application-aware routing is a user-configurable parameter that determines the time to calculate mean loss, mean latency, and mean jitter. This value multiplies the polling interval to specify the time for these calculations. The default value for the BFD multiplier in application-aware routing is 6.

    2. [

       [Removed]

       2024-05-15

       Selected A2 upvotes

       To determine the SLA classification of a tunnel, application-aware routing uses the loss, latency, and jitter information from the latest poll intervals. The number of poll intervals used is determined by a multiplier. By default, the multiplier is 6, so the information from all the poll intervals (specifically, from the last six poll intervals) is used to determine the classification. Reference: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/application-aware-routing.html

    3. R

       Raynecore

       2024-05-20

       Selected A2 upvotes

       https://www.cisco.com/c/en/us/td/docs/routers/sdwan/command/iosxe/qualified-cli-command-reference-guide/m-bfd-commands.html

    4. K

       KKK_9999

       2024-08-02

       2 upvotes

       This is not for AAR policy. It's standard BFD configuration setting multiplier. For app-route monitoring BFD multiplier value is 6. So option is A.

20. Question 20 of 25

    Select 2

    

    Refer to the exhibit. An engineer is troubleshooting tear down of control connections even though a valid CertificateSerialNumber is entered. Which two actions resolve the issue? (Choose two.)

    • AEnter a valid product ID (model) on the PNP portal
    • BMatch the serial number file between the controllers
    • CRemove the duplicate IP in the network
    • DRestore network reachability for the controller
    • EEnter a valid serial number on the controllers for a given device

    Show answer

    Correct answer: A, E

    How others answered

    • AE88%

    Explanation

    I reckon it's A & E. The correct serial number and device model must be configured and provisioned on PnP portal (software.cisco.com) and vManage.

    Adapted from community discussion by Mr_Cipher · 2021-12-29 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. M

       Mr_Cipher

       2021-12-29

       15 upvotes

       I reckon it's A & E. The correct serial number and device model must be configured and provisioned on PnP portal (software.cisco.com) and vManage.

    2. A

       AiltonDoria

       2023-08-17

       3 upvotes

       if you have a look with the properly attention to this question we will be able to understand that's question is not about what meaning CRTREJSER, BIDNTVRFD. The question is: Focus in solve the issue, ***Which two actions resolve that behavior?*** based on it, the right options are: A: Enter a valid product ID (model) on the PNP portal E: Enter a valid serial number on the controllers for a given device Explanation and reference link: https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/214509-troubleshoot-control-connections.html#anc11 When you troubleshoot such a problem, ensure that the correct serial number and device model was configured and provisioned on the PnP portal (software.cisco.com) and vManage. In order to check the chassis number and the certificate serial number, this command can be used on vEdge routers: CRTREJSER - Challenge response rejected by peer. (peer reject because the serial number is not valid, that's why it generates this message.

    3. S

       serieus

       2022-02-13

       5 upvotes

       So for the state to reach tear_down, IP connectivity is there. That makes C & D wrong (or at least unlikely). Serials are configured in the customer portal or manually on 1 vManager so getting a mismatch is not possible i think? That rules out B. Leaving A & E. That's the best I can do coming up with a substantiated answer anyway..

    4. T

       TheNetworkStudent

       2022-02-10

       4 upvotes

       You can't really get any conclusion from any of the given reference links, because they all specify a local error and this question doesn't. Peer private and public IP can be the same so following @ramjam's conclusion. Its not C. Because of the lack of a better answer I'm inclined to agree on A & E, but the exhibit really doesn't match any documentation I've found. Either on the 'DSIS' part or the lack of local error/remote error... They've messed with the exhibit in a weird way... please also notice the "29th hour" in the timestamp...

21. Question 21 of 25

    Which protocol is used for the vManage to connect to the vSmart Controller hosted in Cloud?

    • APnP Server
    • BZTP
    • CHTTP
    • DNETCONF

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Netconf and CLI: Netconf is a standards-based protocol used by Cisco vManage to provision a Cisco vSmart Controller. In addition, each Cisco vSmart Controller provides local CLI access and AAA.

    Adapted from community discussion by BGP65000 · 2023-12-17 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. B

       BGP65000

       2023-12-17

       Selected D2 upvotes

       Netconf and CLI: Netconf is a standards-based protocol used by Cisco vManage to provision a Cisco vSmart Controller. In addition, each Cisco vSmart Controller provides local CLI access and AAA.

    2. N

       nbvolz

       2024-01-25

       3 upvotes

       On a test, would you go with the voted answer or the one they have as correct on here?

    3. J

       jcms700

       2024-01-03

       Selected D2 upvotes

       https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html

    4. A

       A_Wolf

       2022-07-31

       1 upvote

       D. NETCONF https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html "When any controller (vManage, vBond, or vSmart) is added to vManage, a vManage instance uses NETCONF to retrieve information from them and allows them to be added as devices into the GUI" "If any controller reloads or crashes, then that controller uses NETCONF to communicate back to vManage before encrypted DTLS/TLS sessions are re-formed"

22. Question 22 of 25

    Which configuration step is taken on vManage after WAN Edge list is uploaded to support the on-boarding process before the device comes online?

    • AVerify the device certificate
    • BEnable the ZTP process
    • CSet the device as valid
    • DSend the list to controllers

    Show answer

    Correct answer: C

    How others answered

    • C67%
    • D33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Reference: https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/SDWAN/sd-wan-wan-edge-onboarding-deploy-guide-2020jan.pdf

    Adapted from community discussion by mac_tire · 2022-04-14 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. M

       mac_tire

       2022-04-14

       8 upvotes

       Correct answer is C, https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/system-interface/vedge-20-x/systems-interfaces-book/configure-devices.html in this document it states in section Upload WAN Edge Router Authorized Serial Number File To upload the WAN edge router authorized serial number file to Cisco vManage and then download it to controllers in the network: From the Cisco vManage menu, choose Configuration > Devices. Click WAN Edge List, and click Upload WAN Edge List. Under Upload WAN Edge List screen: Click Choose File and select the WAN edge router authorized serial number file you received from Cisco PnP. To automatically validate the routers and send their chassis and serial numbers to the controllers, ensure that the Validate the uploaded vEdge List and send to controllers check box is selected. If you do not select this option, you must individually validate each router in Configuration > Certificates > WAN Edge List. Click Upload. A list of routers in the network is displayed in the router table, with details about each router.

    2. T

       TheNetworkStudent

       2021-08-10

       3 upvotes

       This question is, again, one of those horrible Cisco questions. In the same document that's referenced by almost everyone here, it's once mentioned that you might have to change the state of a machine to valid manually, in the appendix it's said that it will do this automatically (but it won't work if it's not valid). How I see it: You MIGHT HAVE to manually set one or machines to valid state. You WILL HAVE to send it to the controllers. Which makes C the less correct answer in my opinion and D the more correct answer because you might have to do C but always will have to do D... But again, this question is just horrible and also very much subject to change over multiple updates/releases...

    3. A

       alphatag

       2021-05-14

       4 upvotes

       On the 19.2 version, you don't need to "set the device as valid", you should verify the state as "valid", and after that click on "Send the list ton controllers" The correct answer for me is "D"

    4. M

       MiraGod

       2022-09-03

       3 upvotes

       Yes you are right, but they need to be validated before, you can use the checkbox when uploading the list into the vManage, or you go to devices and validate them one by one and then you will share the valid list to the controllers. That is why when you do a show valid-vedges on the vSmart you will only see the ones that are valid and no the whole list.

23. Question 23 of 25

    Which type of route advertisement of OMP can be verified?

    • AOrigin, TLOC, and VPN
    • BOrigin, TLOC, and service
    • COMP, VPN, and origin
    • DOMP, TLOC, and service

    Show answer

    Correct answer: D

    How others answered

    • D60%
    • A40%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I think would be the letter A, as per the 'sh omp routes' output: vEdge120# show omp routes --------------------------------------------------- omp route entries for vpn 1 route 10.110.1.0/30 --------------------------------------------------- RECEIVED FROM: peer 1.1.1.30 path-id 1 label 1005 status C,I,R loss-reason not set lost-to-peer not set lost-to-path-id not set Attributes: originator 1.1.1.110 type installed tloc 1.1.1.110, mpls, ipsec ultimate-tloc not set domain-id not set overlay-id 1 site-id 110 region-id None region-path 65534 preference not set tag not set origin-proto connected origin-metric 0 as-path not set community not set unknown-attr-len not set

    Adapted from community discussion by williancm19 · 2023-05-26 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. C

       CCNPWILL

       2021-04-25

       10 upvotes

       Correct answer is D. Read the link and it is plainly put. OMP routes ( vRoute, TLOC, and service)

    2. W

       williancm19

       2023-05-26

       2 upvotes

       I think would be the letter A, as per the 'sh omp routes' output: vEdge120# show omp routes --------------------------------------------------- omp route entries for vpn 1 route 10.110.1.0/30 --------------------------------------------------- RECEIVED FROM: peer 1.1.1.30 path-id 1 label 1005 status C,I,R loss-reason not set lost-to-peer not set lost-to-path-id not set Attributes: originator 1.1.1.110 type installed tloc 1.1.1.110, mpls, ipsec ultimate-tloc not set domain-id not set overlay-id 1 site-id 110 region-id None region-path 65534 preference not set tag not set origin-proto connected origin-metric 0 as-path not set community not set unknown-attr-len not set

    3. K

       kup_rjds

       2023-05-27

       3 upvotes

       D https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/bridging-routing-segmentation-qos/vedge/bridging-routing-segmentation-qos-book/unicast-overlay-routing.html

    4. I

       Idro

       2022-11-03

       2 upvotes

       D - https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/SD-WAN_Release_16.2/03Routing/01Unicast_Overlay_Routing_Overview

24. Question 24 of 25

    A network administrator is configuring a tunnel interface on a branch Cisco IOS XE router to run TLOC extensions. Which configuration will extend a TLOC over a GRE tunnel to another router in the branch? A.

    

    B.

    

    C.

    

    D.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/command/sdwan-cr-book/sdwan-cr-book_chapter_010.html#wp2314758100

    Adapted from community discussion by Speirsington · 2021-12-29 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. A

       Almanac

       2021-03-24

       27 upvotes

       yes B is the right answer sdwan nterface interface-name tunnel-interface tloc-extension-gre-to extended-interface-ip-address

    2. S

       Speirsington

       2021-12-29

       12 upvotes

       B is correct - the rest aren't valid commands: vedge(config-vpn-0)# int g0/0 vedge(config-interface-g0/0)# gre-interface ------------------------------^ syntax error: unknown command vedge(config-interface-g0/0)# extended-interface ------------------------------^ syntax error: unknown command vedge(config-interface-g0/0)# tloc-interface ------------------------------^ syntax error: unknown command vedge(config-interface-g0/0)# tunnel-interface vedge(config-tunnel-interface)#

    3. R

       ramjam

       2021-06-12

       3 upvotes

       B. Correct Link: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/command/sdwan-cr-book/sdwan-cr-book_chapter_010.html#wp2314758100 sdwan interface tloc-extension-gre-to—Configure a tunnel interface over which to run TLOC extensions (on IOS XE routers only). TLOC extensions allow you to extend a TLOC, over a GRE tunnel, to another router in the branch. sdwan interface tloc-extension-gre-from —Configure an interface as an extended interface, to channel TLOC traffic from a source branch router to the local WAN interface (on IOS XE routers only).

    4. M

       motokal

       2021-03-15

       3 upvotes

       After reading the reference URL, I think the correction answer should be B? Thoughts?

25. Question 25 of 25

    A network administrator is bringing up one WAN Edge router for branch connectivity. Which types of tunnels form when the WAN edge router connects to the Cisco SD-WAN fabric?

    • ADTLS or TLS tunnel with vSmart controller and IPsec tunnel with vBond controller
    • BDTLS or TLS tunnel with vBond controller and IPsec tunnel with vManage controller
    • CDTLS or TLS tunnel with vBond controller and IPsec tunnel with other WAN Edge routers
    • DDTLS or TLS tunnel with vSmart controller and IPsec tunnel with other WAN Edge routers

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    D is the correct answer. 1. VBOND will make only DTLS connection, TLS connection will not happen between vBond and vEdge. 2. vBond connection is temporary 3. vEdges will make IPSec tunnels over data plane

    Adapted from community discussion by HAMPI · 2022-09-16 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-415 or CertExamHQ.

    1. H

       HAMPI

       2022-09-16

       6 upvotes

       D is the correct answer. 1. VBOND will make only DTLS connection, TLS connection will not happen between vBond and vEdge. 2. vBond connection is temporary 3. vEdges will make IPSec tunnels over data plane

    2. R

       ramjam

       2021-12-11

       2 upvotes

       Correct. https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/SD-WAN_Release_16.3/05Security/01Security_Overview

    3. S

       serieus

       2022-02-13

       2 upvotes

       Have to correct myself. The vBond is locked to DTLS only so C is NOT correct.

    4. K

       khanda

       2022-08-24

       1 upvote

       C is the correct answer, the minimal config on the Edge device contains the vBond IP or DNS name, so first comms would be to the vBond through TLS/DTLS tunnel connection. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/cisco-sd-wan-overlay-network-bringup.html

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-415 practice, question 1 of 25