Friday, 14 August 2026

Top 10 Cisco SD-WAN Multiple Choice Questions (MCQs) with Answers and Explanations

 Cisco SD-WAN's (Viptela-based) architecture separates control, management, orchestration, and data planes in a way that's genuinely different from traditional WAN routing. The following ten questions cover the concepts that come up most often in interviews, certification prep, and real production troubleshooting — controller roles, OMP, TLOCs, BFD, and centralized policy.

Question 1

What is the PRIMARY function of the vBond orchestrator in a Cisco SD-WAN deployment?

Options

A. It distributes centralized data policy to all edge devices

B. It authenticates and orchestrates initial connectivity between edge devices, vSmart, and vManage

C. It stores the full routing table for the entire overlay

D. It performs deep packet inspection on branch traffic

Correct Answer

✅ B. It authenticates and orchestrates initial connectivity between edge devices, vSmart, and vManage

Explanation

vBond is the first point of contact for any device joining the SD-WAN fabric — it validates certificates/identity and tells a new edge device how to reach the vSmart controllers and vManage. It doesn't carry ongoing control-plane routing information or policy itself; that's vSmart's job.

Question 2

Which controller is responsible for distributing routing and policy information to edge routers via OMP?

Options

A. vBond

B. vManage

C. vSmart

D. vAnalytics

Correct Answer

✅ C. vSmart

Explanation

vSmart acts as the centralized control-plane controller, similar in concept to a route reflector. It receives OMP routes from every edge device, applies centralized policy, and distributes the resulting routing/policy information back out to relevant edges — edges never need a full mesh of direct control-plane sessions with each other.

Question 3

What does a TLOC (Transport Locator) represent in Cisco SD-WAN?

Options

A. A logical grouping of branches in the same region

B. The combination of a WAN edge's IP address, link color, and encapsulation that identifies a specific transport path

C. The tunnel used exclusively for control-plane traffic to vSmart

D. A backup route used only during failover

Correct Answer

✅ B. The combination of a WAN edge's IP address, link color, and encapsulation that identifies a specific transport path

Explanation

A TLOC uniquely identifies one transport connection on an edge device — for example, the MPLS circuit versus the Internet circuit on the same router are two separate TLOCs. OMP advertises routes with their associated TLOC(s), which is how the overlay knows which underlay path(s) can reach a given prefix.

Question 4

What is the role of OMP (Overlay Management Protocol) in Cisco SD-WAN?

Options

A. It replaces BFD for path liveness detection

B. It is the control-plane protocol that distributes routes, TLOC information, and policy between vSmart and edge devices

C. It is used only for zero-touch provisioning

D. It handles QoS marking on the underlay

Correct Answer

✅ B. It is the control-plane protocol that distributes routes, TLOC information, and policy between vSmart and edge devices

Explanation

OMP is purpose-built for SD-WAN — edge devices advertise their local routes and TLOCs to vSmart via OMP, vSmart applies centralized policy, and then re-advertises the resulting routes back to the appropriate edges. It's conceptually similar to BGP but designed specifically for the overlay/underlay separation SD-WAN relies on.

Question 5

A branch's MPLS and Internet tunnels are both administratively up, but application-aware routing isn't failing traffic over during a brief MPLS degradation. What should be checked FIRST?

Options

A. Whether NAT is enabled on the Internet transport

B. The SLA class thresholds configured for that traffic's data policy — they may be too loose to trigger failover for the degradation observed

C. Whether OMP is enabled on the Internet TLOC

D. The device's software version

Correct Answer

✅ B. The SLA class thresholds configured for that traffic's data policy — they may be too loose to trigger failover for the degradation observed

Explanation

Application-aware routing only reroutes traffic when measured loss/latency/jitter breaches the specific SLA class thresholds tied to that traffic's policy. If the degradation is real but stays under those thresholds, failover simply won't trigger — this is one of the most common causes of "why didn't it fail over" tickets.

Question 6

What is the purpose of BFD (Bidirectional Forwarding Detection) in Cisco SD-WAN?

Options

A. To encrypt tunnel traffic between edge devices

B. To rapidly detect loss of connectivity on a transport/tunnel so the overlay can react quickly

C. To assign VLANs to LAN-side interfaces

D. To perform zero-touch certificate rotation

Correct Answer

✅ B. To rapidly detect loss of connectivity on a transport/tunnel so the overlay can react quickly

Explanation

BFD runs continuously across each SD-WAN tunnel and detects failures far faster than routing protocol hello/dead timers alone would. A BFD session going down is typically the first, fastest signal that a specific transport path has a problem — before application-aware routing metrics even catch up.

Question 7

What is the KEY difference between centralized and localized policy in Cisco SD-WAN?

Options

A. Centralized policy only affects the LAN side; localized policy only affects the WAN side

B. Centralized policy is built and pushed from vManage/vSmart and applies overlay-wide routing/security decisions; localized policy is device-specific and configured directly on an edge (e.g., ACLs, QoS on local interfaces)

C. Localized policy requires a separate vSmart cluster

D. Centralized policy cannot affect application-aware routing

Correct Answer

✅ B. Centralized policy is built and pushed from vManage/vSmart and applies overlay-wide routing/security decisions; localized policy is device-specific and configured directly on an edge (e.g., ACLs, QoS on local interfaces)

Explanation

Centralized policy (built in vManage, distributed via vSmart) controls things like which sites can reach each other, application-aware routing behavior, and traffic engineering across the whole fabric. Localized policy is scoped to a single device — things like an interface ACL or QoS scheduler that only makes sense configured per-router.

Question 8

During Zero Touch Provisioning (ZTP), what does a new edge device contact FIRST?

Options

A. vManage directly, to download its configuration template

B. vSmart directly, to establish OMP peering

C. vBond, to authenticate and be redirected to the correct vSmart/vManage

D. A DNS server to resolve the nearest data center

Correct Answer

✅ C. vBond, to authenticate and be redirected to the correct vSmart/vManage

Explanation

ZTP always starts with the device reaching vBond — using a pre-provisioned vBond address, often resolved via a well-known DNS name. vBond validates the device's identity and redirects it to the appropriate vSmart controllers and vManage, at which point the device downloads its template and establishes full control-plane connectivity.

Question 9

What does enabling Direct Internet Access (DIA) at a branch allow?

Options

A. The branch can break out to the Internet locally instead of backhauling all Internet-bound traffic through a central hub

B. The branch bypasses vSmart entirely for all traffic

C. DIA disables BFD monitoring on that transport

D. DIA is only available on branches with a single transport

Correct Answer

✅ A. The branch can break out to the Internet locally instead of backhauling all Internet-bound traffic through a central hub

Explanation

DIA lets a branch send Internet/SaaS-bound traffic directly out its local Internet transport rather than routing it back through a regional or central hub first. This reduces latency for cloud/SaaS applications significantly, but shifts more security responsibility to the branch itself, since traffic no longer passes through centralized inspection by default.

Question 10

What is the fundamental distinction between the "underlay" and the "overlay" in SD-WAN?

Options

A. The underlay is the physical/logical transport network (MPLS, Internet, LTE) carrying packets; the overlay is the logical tunnel mesh (IPsec/GRE) built on top of it that the SD-WAN policy and routing operate within

B. The underlay only exists at the data center; branches only participate in the overlay

C. The overlay refers exclusively to the vManage management network

D. There is no meaningful difference — the terms are interchangeable in Cisco SD-WAN

Correct Answer

✅ A. The underlay is the physical/logical transport network (MPLS, Internet, LTE) carrying packets; the overlay is the logical tunnel mesh (IPsec/GRE) built on top of it that the SD-WAN policy and routing operate within

Explanation

The underlay is whatever WAN transport actually exists between sites — SD-WAN doesn't need to control or even fully trust it. The overlay is the encrypted tunnel fabric SD-WAN builds on top, which is where OMP routing, application-aware routing, and centralized policy actually operate — abstracting the messy reality of the underlay away from the routing decisions.

Key Takeaways

Controller Roles

  • vBond = authentication and orchestration entry point (first contact during ZTP)
  • vSmart = centralized control plane, OMP route/policy distribution
  • vManage = configuration, monitoring, and centralized policy authoring

Core Concepts

  • TLOC = a specific transport path's identity (IP + color + encapsulation)
  • OMP = the control-plane protocol tying it all together
  • BFD = fast failure detection underneath application-aware routing decisions

Policy and Design

  • Centralized policy = overlay-wide decisions from vManage/vSmart
  • Localized policy = per-device configuration (ACLs, QoS)
  • DIA trades centralized inspection for lower-latency local breakout

Architecture

  • Underlay = the physical/carrier transport; Overlay = the encrypted tunnel fabric SD-WAN actually routes within

Conclusion

These ten questions cover the concepts that separate engineers who can click through vManage from engineers who genuinely understand why the overlay behaves the way it does — controller roles, OMP, TLOCs, and SLA-class-driven failover all come up constantly in real troubleshooting. Use these as a quick self-check before an interview, a certification study session, or your next production change window.

Related Reading on Networklearner:

Need help with SD-WAN, Cisco ACI, Nexus, data center networking, or network automation?

I am a CCIE Data Center engineer with 18+ years of enterprise networking experience, working hands-on with production SD-WAN and ACI environments.

Contact me for consulting, troubleshooting, design reviews, and project support: rockingoa@gmail.com

Posted by at
Labels: , , , , , , ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)