01. By default WAN Edges build a full mesh of data tunnels. A retail organization instead wants all branch-to-branch traffic to transit a central data center hub.
How is this topology change achieved?
a) A localized data policy in each branch template drops every tunnel except the hub tunnel.
b) The full mesh is disabled by removing branch TLOCs from the vBond allow-list.
c) A QoS forwarding class on the hub reprioritizes traffic so direct tunnels are never selected.
d) A centralized control policy on vSmart rewrites the branch advertisements so traffic transits the hub.
02. A multi-region fabric streams multicast from a source at the region-A hub. Most receivers are concentrated across many region-B branches, with a few receivers also in region A. Today a single replicator sits at the region-A hub, so every region-B receiver's copy is fanned out at region A and each copy crosses the inter-region link separately.
Which design change best improves multicast scalability for this topology?
a) Designate an additional replicator in region B so one copy crosses the inter-region link before local fan-out.
b) Move the only replicator to region B so region-A receivers pull copies back across the inter-region link.
c) Convert the multicast to unicast at the source so App-Aware Routing can load-balance every receiver copy separately.
d) Configure the region-B receivers to peer OMP directly with the region-A source bypassing the replicator entirely.
03. Users at a branch complain of choppy voice. Monitoring shows both available tunnels currently meet the voice SLA class, and App-Aware Routing is keeping voice on the primary tunnel. That primary transport, however, is congested at the branch egress during business hours.
What is the correct interpretation and remedy?
a) Tighten the SLA class loss thresholds so AAR moves voice onto the other tunnel
b) AAR chose a compliant path so localized LLQ must solve the egress congestion
c) Add a centralized vSmart data policy dropping the bulk traffic competing with voice
d) AAR is misconfigured because a tuned SLA class should queue voice ahead of traffic
04. A service provider runs a single multi-tenant Catalyst SD-WAN Manager deployment that hosts several customer overlays on shared controllers.
Which two statements correctly describe how tenant separation and administration work in this model?
(Choose two.)
a) Multi-tenancy replaces role-based access control so defining roles within a tenant becomes entirely unnecessary.
b) A tenant administrator can manage only the devices events and health data belonging to that tenant.
c) A provider-level administrator manages the shared controller infrastructure that underpins all of the tenants.
d) Each tenant is separated by deploying a dedicated vBond orchestrator for every branch that it owns.
e) Each tenant administrator can review the alarms and health of every other tenant on the shared deployment.
05. In a cEdge ZBFW deployment, three service VPNs are mapped to three security zones. Traffic within any single zone flows freely, but traffic the engineer intended to permit between two specific zones is being dropped.
What is the most likely cause?
a) Intra-zone traffic is blocked by default until an operator explicitly permits it
b) No permit zone-pair has been defined for that intended traffic direction
c) The UTD container silently overrides every configured zone-pair firewall policy
d) A vSmart control policy is filtering the inter-zone TLOC routes
06. At a voice-heavy branch, an engineer wants voice both to receive priority queuing on the local egress interface and to ride the overlay path currently meeting a strict loss/latency/jitter target.
Which combination correctly delivers both outcomes?
a) A centralized data policy alone which queues and steers voice by SLA
b) A control policy alone which sets both the queue and SLA path
c) Localized QoS for the priority queue plus App-Aware Routing for SLA steering
d) Localized QoS alone which also selects the SLA-compliant overlay voice path
07. During staging of a multi-region fabric, an engineer finds a WAN Edge with an up control connection to vManage but none to vSmart, and OMP is down. They run show control connections to investigate.
What is this command primarily used to diagnose here?
a) The per-VPN routing table this device advertises outward through OMP
b) The state and peer of each control connection to the controllers
c) The DSCP marking applied to each data-plane overlay tunnel outbound
d) The exact OMP hello and hold timers negotiated with each vSmart
08. A regional hub hosts a shared firewall that spoke sites must traverse before reaching the Internet. The design relies on OMP service routes together with a control policy for service insertion.
Which statements about this service-chaining design are correct?
(Choose two.)
a) A centralized control policy on vSmart steers matching traffic through the hub service first.
b) The hub WAN Edge advertises the firewall as an OMP service route so vSmart locates it.
c) Each spoke must run a local UTD firewall because service routes cannot reach a remote one.
d) A localized data policy in the spoke template inserts the service instead of vSmart.
e) The vBond controller advertises the service route after validating the hub certificate during onboarding.
09. On a WAN Edge, OMP advertises the service-side VPN routing into the overlay so remote sites can reach locally attached prefixes.
Which route sources can be redistributed into OMP from the WAN Edge's service VPN?
(Choose three.)
a) Static routes configured manually within the service VPN routing table
b) The DTLS control sessions maintained with the vBond or vSmart controllers
c) Routes learned by a service-side protocol like OSPF BGP or EIGRP
d) The TLOC color assignments applied on the transport-side WAN interfaces
e) Connected interface routes for the service VPN on the WAN Edge
10. Malware is increasingly delivered over HTTPS, and the security team needs a branch cEdge to inspect the contents of encrypted web sessions with its IPS and AMP engines.
Which UTD capability makes that inspection possible?
a) URL filtering that acts only on the web category
b) Anti-replay protection applied to the IPsec overlay tunnels
c) DNS-layer security enforced through a cloud SIG tunnel
d) A TLS/SSL proxy that decrypts the web sessions