Showing posts with label Networking Quiz. Show all posts

Friday, 14 August 2026

Question 1

What is the PRIMARY function of the vBond orchestrator in a Cisco SD-WAN deployment?

Options

A. It distributes centralized data policy to all edge devices

B. It authenticates and orchestrates initial connectivity between edge devices, vSmart, and vManage

C. It stores the full routing table for the entire overlay

D. It performs deep packet inspection on branch traffic

Correct Answer

✅ B. It authenticates and orchestrates initial connectivity between edge devices, vSmart, and vManage

Explanation

vBond is the first point of contact for any device joining the SD-WAN fabric — it validates certificates/identity and tells a new edge device how to reach the vSmart controllers and vManage. It doesn't carry ongoing control-plane routing information or policy itself; that's vSmart's job.

Question 2

Which controller is responsible for distributing routing and policy information to edge routers via OMP?

Options

A. vBond

B. vManage

C. vSmart

D. vAnalytics

Correct Answer

✅ C. vSmart

Explanation

vSmart acts as the centralized control-plane controller, similar in concept to a route reflector. It receives OMP routes from every edge device, applies centralized policy, and distributes the resulting routing/policy information back out to relevant edges — edges never need a full mesh of direct control-plane sessions with each other.

Question 3

What does a TLOC (Transport Locator) represent in Cisco SD-WAN?

Options

A. A logical grouping of branches in the same region

B. The combination of a WAN edge's IP address, link color, and encapsulation that identifies a specific transport path

C. The tunnel used exclusively for control-plane traffic to vSmart

D. A backup route used only during failover

Correct Answer

✅ B. The combination of a WAN edge's IP address, link color, and encapsulation that identifies a specific transport path

Explanation

A TLOC uniquely identifies one transport connection on an edge device — for example, the MPLS circuit versus the Internet circuit on the same router are two separate TLOCs. OMP advertises routes with their associated TLOC(s), which is how the overlay knows which underlay path(s) can reach a given prefix.

Question 4

What is the role of OMP (Overlay Management Protocol) in Cisco SD-WAN?

Options

A. It replaces BFD for path liveness detection

B. It is the control-plane protocol that distributes routes, TLOC information, and policy between vSmart and edge devices

C. It is used only for zero-touch provisioning

D. It handles QoS marking on the underlay

Correct Answer

✅ B. It is the control-plane protocol that distributes routes, TLOC information, and policy between vSmart and edge devices

Explanation

OMP is purpose-built for SD-WAN — edge devices advertise their local routes and TLOCs to vSmart via OMP, vSmart applies centralized policy, and then re-advertises the resulting routes back to the appropriate edges. It's conceptually similar to BGP but designed specifically for the overlay/underlay separation SD-WAN relies on.

Question 5

A branch's MPLS and Internet tunnels are both administratively up, but application-aware routing isn't failing traffic over during a brief MPLS degradation. What should be checked FIRST?

Options

A. Whether NAT is enabled on the Internet transport

B. The SLA class thresholds configured for that traffic's data policy — they may be too loose to trigger failover for the degradation observed

C. Whether OMP is enabled on the Internet TLOC

D. The device's software version

Correct Answer

✅ B. The SLA class thresholds configured for that traffic's data policy — they may be too loose to trigger failover for the degradation observed

Explanation

Application-aware routing only reroutes traffic when measured loss/latency/jitter breaches the specific SLA class thresholds tied to that traffic's policy. If the degradation is real but stays under those thresholds, failover simply won't trigger — this is one of the most common causes of "why didn't it fail over" tickets.

Question 6

What is the purpose of BFD (Bidirectional Forwarding Detection) in Cisco SD-WAN?

Options

A. To encrypt tunnel traffic between edge devices

B. To rapidly detect loss of connectivity on a transport/tunnel so the overlay can react quickly

C. To assign VLANs to LAN-side interfaces

D. To perform zero-touch certificate rotation

Correct Answer

✅ B. To rapidly detect loss of connectivity on a transport/tunnel so the overlay can react quickly

Explanation

BFD runs continuously across each SD-WAN tunnel and detects failures far faster than routing protocol hello/dead timers alone would. A BFD session going down is typically the first, fastest signal that a specific transport path has a problem — before application-aware routing metrics even catch up.

Question 7

What is the KEY difference between centralized and localized policy in Cisco SD-WAN?

Options

A. Centralized policy only affects the LAN side; localized policy only affects the WAN side

B. Centralized policy is built and pushed from vManage/vSmart and applies overlay-wide routing/security decisions; localized policy is device-specific and configured directly on an edge (e.g., ACLs, QoS on local interfaces)

C. Localized policy requires a separate vSmart cluster

D. Centralized policy cannot affect application-aware routing

Correct Answer

✅ B. Centralized policy is built and pushed from vManage/vSmart and applies overlay-wide routing/security decisions; localized policy is device-specific and configured directly on an edge (e.g., ACLs, QoS on local interfaces)

Explanation

Centralized policy (built in vManage, distributed via vSmart) controls things like which sites can reach each other, application-aware routing behavior, and traffic engineering across the whole fabric. Localized policy is scoped to a single device — things like an interface ACL or QoS scheduler that only makes sense configured per-router.

Question 8

During Zero Touch Provisioning (ZTP), what does a new edge device contact FIRST?

Options

A. vManage directly, to download its configuration template

B. vSmart directly, to establish OMP peering

C. vBond, to authenticate and be redirected to the correct vSmart/vManage

D. A DNS server to resolve the nearest data center

Correct Answer

✅ C. vBond, to authenticate and be redirected to the correct vSmart/vManage

Explanation

ZTP always starts with the device reaching vBond — using a pre-provisioned vBond address, often resolved via a well-known DNS name. vBond validates the device's identity and redirects it to the appropriate vSmart controllers and vManage, at which point the device downloads its template and establishes full control-plane connectivity.

Question 9

What does enabling Direct Internet Access (DIA) at a branch allow?

Options

A. The branch can break out to the Internet locally instead of backhauling all Internet-bound traffic through a central hub

B. The branch bypasses vSmart entirely for all traffic

C. DIA disables BFD monitoring on that transport

D. DIA is only available on branches with a single transport

Correct Answer

✅ A. The branch can break out to the Internet locally instead of backhauling all Internet-bound traffic through a central hub

Explanation

DIA lets a branch send Internet/SaaS-bound traffic directly out its local Internet transport rather than routing it back through a regional or central hub first. This reduces latency for cloud/SaaS applications significantly, but shifts more security responsibility to the branch itself, since traffic no longer passes through centralized inspection by default.

Question 10

What is the fundamental distinction between the "underlay" and the "overlay" in SD-WAN?

Options

A. The underlay is the physical/logical transport network (MPLS, Internet, LTE) carrying packets; the overlay is the logical tunnel mesh (IPsec/GRE) built on top of it that the SD-WAN policy and routing operate within

B. The underlay only exists at the data center; branches only participate in the overlay

C. The overlay refers exclusively to the vManage management network

D. There is no meaningful difference — the terms are interchangeable in Cisco SD-WAN

Correct Answer

✅ A. The underlay is the physical/logical transport network (MPLS, Internet, LTE) carrying packets; the overlay is the logical tunnel mesh (IPsec/GRE) built on top of it that the SD-WAN policy and routing operate within

Explanation

The underlay is whatever WAN transport actually exists between sites — SD-WAN doesn't need to control or even fully trust it. The overlay is the encrypted tunnel fabric SD-WAN builds on top, which is where OMP routing, application-aware routing, and centralized policy actually operate — abstracting the messy reality of the underlay away from the routing decisions.

Key Takeaways

Controller Roles

vBond = authentication and orchestration entry point (first contact during ZTP)
vSmart = centralized control plane, OMP route/policy distribution
vManage = configuration, monitoring, and centralized policy authoring

Core Concepts

TLOC = a specific transport path's identity (IP + color + encapsulation)
OMP = the control-plane protocol tying it all together
BFD = fast failure detection underneath application-aware routing decisions

Policy and Design

Centralized policy = overlay-wide decisions from vManage/vSmart
Localized policy = per-device configuration (ACLs, QoS)
DIA trades centralized inspection for lower-latency local breakout

Architecture

Underlay = the physical/carrier transport; Overlay = the encrypted tunnel fabric SD-WAN actually routes within

Conclusion

These ten questions cover the concepts that separate engineers who can click through vManage from engineers who genuinely understand why the overlay behaves the way it does — controller roles, OMP, TLOCs, and SLA-class-driven failover all come up constantly in real troubleshooting. Use these as a quick self-check before an interview, a certification study session, or your next production change window.

Related Reading on Networklearner:

Need help with SD-WAN, Cisco ACI, Nexus, data center networking, or network automation?

I am a CCIE Data Center engineer with 18+ years of enterprise networking experience, working hands-on with production SD-WAN and ACI environments.

Contact me for consulting, troubleshooting, design reviews, and project support: rockingoa@gmail.com

Question 1

A contract subject is configured with scope "VRF" instead of "Tenant." What does this actually control?

Options

A. Whether the contract can be reused by other tenants

B. Which EPGs within the fabric the contract's filter rules are allowed to apply between

C. The QoS priority assigned to matched traffic

D. Whether the contract requires stateful firewall inspection

Correct Answer

✅ B. Which EPGs within the fabric the contract's filter rules are allowed to apply between

Explanation

Contract scope controls the boundary within which a contract's consumer/provider relationship is valid — VRF scope restricts it to EPGs within the same VRF, Tenant scope extends it to any VRF within the same tenant, and Global scope allows it across tenants. Getting this wrong is a common cause of contracts silently failing to apply between EPGs that appear correctly configured otherwise.

Question 2

Which ACI construct is responsible for propagating endpoint reachability information (which leaf owns which endpoint) across the fabric?

Options

A. Zoning-rules

B. COOP (Council of Oracle Protocol)

C. LLDP

D. OSPF between leaf and spine

Correct Answer

✅ B. COOP (Council of Oracle Protocol)

Explanation

COOP runs between leaf switches and spine switches to synchronize the fabric-wide endpoint database, so any leaf can look up where an endpoint currently lives. This is distinct from zoning-rules, which enforce policy (what's allowed to talk to what) rather than reachability (where something physically is).

Question 3

What is the KEY architectural difference between ACI Multi-Pod and ACI Multi-Site?

Options

A. Multi-Pod supports more leaf switches per Pod than Multi-Site

B. Multi-Pod uses a single APIC cluster and fabric-wide policy domain; Multi-Site uses independent APIC clusters per site orchestrated centrally

C. Multi-Site does not support Layer 3 connectivity between sites

D. Multi-Pod requires Nexus Dashboard Orchestrator; Multi-Site does not

Correct Answer

✅ B. Multi-Pod uses a single APIC cluster and fabric-wide policy domain; Multi-Site uses independent APIC clusters per site orchestrated centrally

Explanation

Multi-Pod extends one fabric (single APIC cluster, single policy domain) across pods connected by an IPN. Multi-Site keeps each site as its own independent fabric with its own APIC cluster, and coordinates policy between them via Nexus Dashboard Orchestrator — giving genuine fault-domain isolation that Multi-Pod doesn't provide.

Question 4

An engineer configures EPG-WEB as the consumer and EPG-DB as the provider of a contract, but traffic from DB to WEB is unexpectedly blocked while WEB to DB works fine. What is the MOST likely cause?

Options

A. The Bridge Domain is set to flood mode

B. The contract's filter is unidirectional and "Apply Both Directions" was not enabled (or a reverse filter wasn't added)

C. The VRF is in unenforced mode

D. The two EPGs are in different tenants

Correct Answer

✅ B. The contract's filter is unidirectional and "Apply Both Directions" was not enabled (or a reverse filter wasn't added)

Explanation

By default, ACI contracts can be configured to apply filters in both directions automatically, but if that option is disabled, the consumer-to-provider direction is permitted while the reverse (provider-to-consumer) traffic needs its own explicit filter entry. This is one of the most common real-world contract misconfigurations.

Question 5

What is the purpose of `vzAny` in an ACI tenant?

Options

A. It disables all contract enforcement within a VRF

B. It represents all EPGs in a VRF as a single group, allowing one contract to apply to every EPG in that VRF at once

C. It is the default deny rule applied to unmatched traffic

D. It defines the L3Out external EPG

Correct Answer

✅ B. It represents all EPGs in a VRF as a single group, allowing one contract to apply to every EPG in that VRF at once

Explanation

vzAny is a shortcut object representing every EPG within a VRF. Associating a contract to vzAny (as provider or consumer) avoids configuring the same contract relationship individually for dozens of EPGs — commonly used for shared services like DNS or NTP that every EPG needs to reach.

Question 6

An APIC cluster is running with a target size of 3, but only 2 controllers are currently healthy. What is the operational impact?

Options

A. The fabric immediately goes into a full outage

B. The fabric continues to run on existing policy, but the cluster is out of quorum for making and validating new configuration changes reliably

C. Only Tenant-level changes are blocked; Fabric Access Policy changes still work normally

D. APIC automatically demotes itself to a single-controller cluster with no impact

Correct Answer

✅ B. The fabric continues to run on existing policy, but the cluster is out of quorum for making and validating new configuration changes reliably

Explanation

Data plane forwarding on the leaf/spine switches is independent of APIC availability — it keeps running on already-programmed policy. But losing quorum in the APIC cluster means new configuration changes may not be reliably validated or replicated, which is why restoring cluster health quickly matters even though traffic isn't immediately affected.

Question 7

Which ACI feature allows two endpoints within the SAME EPG to be prevented from communicating with each other?

Options

A. Intra-EPG Isolation

B. Preferred Group Member

C. Taboo Contract

D. Unenforced VRF mode

Correct Answer

✅ A. Intra-EPG Isolation

Explanation

By default, endpoints in the same EPG can freely communicate with each other since they share the same policy. Intra-EPG Isolation overrides this, blocking east-west traffic between endpoints in the same EPG — useful for scenarios like a shared VDI or DMZ EPG where individual endpoints shouldn't reach each other directly.

Question 8

What is the primary function of an L3Out in Cisco ACI?

Options

A. To create a Layer 2 extension between two Bridge Domains

B. To provide Layer 3 connectivity between the ACI fabric and external networks, and control which external routes are imported/exported

C. To define QoS policy for external traffic only

D. To replace the need for a Bridge Domain in a tenant

Correct Answer

✅ B. To provide Layer 3 connectivity between the ACI fabric and external networks, and control which external routes are imported/exported

Explanation

An L3Out defines the routing protocol (BGP, OSPF, EIGRP, or static) used to exchange routes with an external network, along with route-map-based import/export control over which external subnets are learned into the fabric and which internal subnets are advertised out.

Question 9

What does a VMM (Virtual Machine Manager) domain in ACI primarily enable?

Options

A. Automatic firmware upgrades for ESXi hosts

B. Direct integration between APIC and a hypervisor manager (like vCenter) so EPGs can be dynamically mapped to VM port groups

C. A dedicated management VRF for hypervisor traffic

D. Automatic contract creation between all VMs in a cluster

Correct Answer

✅ B. Direct integration between APIC and a hypervisor manager (like vCenter) so EPGs can be dynamically mapped to VM port groups

Explanation

A VMM domain lets APIC push EPGs directly into the hypervisor as port groups (e.g., in vCenter), so VM placement automatically inherits the correct network policy without a network admin manually configuring VLANs or trunk ports for every new VM.

Question 10

A leaf switch shows a health score of 45 with no active critical faults listed. What does this indicate?

Options

A. The health score is unrelated to faults and only reflects hardware temperature

B. The health score is a weighted aggregate that can be pulled down by multiple minor/major faults even without any single critical fault present

C. A health score below 50 always means the leaf is about to fail

D. The health score only reflects the previous 24 hours and resets automatically

Correct Answer

✅ B. The health score is a weighted aggregate that can be pulled down by multiple minor/major faults even without any single critical fault present

Explanation

ACI health scores are calculated as a weighted aggregate across all faults affecting an object, including minor and major severities — not just critical ones. A moderate score with no critical faults often means several smaller issues are compounding, which is why it's worth reviewing the full fault list rather than only filtering for critical severity.

Key Takeaways

Policy Model

Contracts define what's allowed to communicate — scope defines the boundary they operate within
vzAny simplifies shared-services contracts across an entire VRF
Intra-EPG Isolation blocks communication within a single EPG when needed

Fabric Architecture

COOP synchronizes endpoint location, independent of policy enforcement
Multi-Pod = one fabric, one APIC cluster; Multi-Site = independent fabrics, centrally orchestrated
APIC cluster health affects config changes, not existing data-plane forwarding

Connectivity and Integration

L3Out controls both routing protocol adjacency and route import/export to external networks
VMM domains connect APIC directly to hypervisor managers for automatic policy-to-VM mapping

Operations

Health scores are weighted aggregates — always check the full fault list, not just the score

Conclusion

These ten questions cover the concepts that separate engineers who can navigate the APIC GUI from engineers who genuinely understand why ACI behaves the way it does — contract scope, zoning-rule enforcement, fabric architecture, and health-score interpretation all come up constantly in real troubleshooting. Use these as a quick self-check before an interview, a CCIE Data Center study session, or your next production change window.

Related Reading on Networklearner:

Need help with Cisco ACI, Nexus, data center networking, or network automation?

I am a CCIE Data Center engineer with 18+ years of enterprise networking experience, working hands-on with production ACI fabrics.

Contact me for consulting, troubleshooting, design reviews, and project support: rockingoa@gmail.com

Friday, 14 August 2026

Top 10 Cisco SD-WAN Multiple Choice Questions (MCQs) with Answers and Explanations

Question 1

What is the PRIMARY function of the vBond orchestrator in a Cisco SD-WAN deployment?

Options

Correct Answer

Explanation

Question 2

Which controller is responsible for distributing routing and policy information to edge routers via OMP?

Options

Correct Answer

Explanation

Question 3

What does a TLOC (Transport Locator) represent in Cisco SD-WAN?

Options

Correct Answer

Explanation

Question 4

What is the role of OMP (Overlay Management Protocol) in Cisco SD-WAN?

Options

Correct Answer

Explanation

Question 5

A branch's MPLS and Internet tunnels are both administratively up, but application-aware routing isn't failing traffic over during a brief MPLS degradation. What should be checked FIRST?

Options

Correct Answer

Explanation

Question 6

What is the purpose of BFD (Bidirectional Forwarding Detection) in Cisco SD-WAN?

Options

Correct Answer

Explanation

Question 7

What is the KEY difference between centralized and localized policy in Cisco SD-WAN?

Options

Correct Answer

Explanation

Question 8

During Zero Touch Provisioning (ZTP), what does a new edge device contact FIRST?

Options

Correct Answer

Explanation

Question 9

What does enabling Direct Internet Access (DIA) at a branch allow?

Options

Correct Answer

Explanation

Question 10

What is the fundamental distinction between the "underlay" and the "overlay" in SD-WAN?

Options

Correct Answer

Explanation

Key Takeaways

Controller Roles

Core Concepts

Policy and Design

Architecture

Conclusion

Top 10 Cisco ACI Multiple Choice Questions (MCQs) with Answers and Explanations

Question 1

A contract subject is configured with scope "VRF" instead of "Tenant." What does this actually control?

Options

Correct Answer

Explanation

Question 2

Which ACI construct is responsible for propagating endpoint reachability information (which leaf owns which endpoint) across the fabric?

Options

Correct Answer

Explanation

Question 3

What is the KEY architectural difference between ACI Multi-Pod and ACI Multi-Site?

Options

Correct Answer

Explanation

Question 4

An engineer configures EPG-WEB as the consumer and EPG-DB as the provider of a contract, but traffic from DB to WEB is unexpectedly blocked while WEB to DB works fine. What is the MOST likely cause?

Options

Correct Answer

Explanation

Question 5

What is the purpose of `vzAny` in an ACI tenant?