Versa Networks Versa Certified SD-WAN Specialist VNX301 Exam Questions

Answer : A, B

The correct answers are A and B. In the exhibit, the LAN interface shows a fixed VLAN ID value of 100. Because this value is directly configured in the template rather than represented as a per-device variable, every branch that uses this template will receive the same LAN VLAN ID. This supports option A. Versa configuration examples show that VLAN-tagged interfaces are created by defining logical units with a vlan-id, and organizations then use those tagged interfaces for traffic identification and routing services.

For the MPLS WAN network, the VLAN ID field is shown as a variable or bind-data style value rather than a fixed number. This allows each branch device to receive a different MPLS VLAN ID during onboarding, depending on the branch-specific values supplied in the workflow or device bind data. Therefore, branches can have separate VLAN IDs on the MPLS WAN transport, which supports option B. Versa SD-WAN troubleshooting output also shows WAN interfaces as logical VNI subinterfaces, such as vni-0/1.0 and vni-0/2.0, mapped to SD-WAN transport networks like INET and MPLS.

Option C is incorrect because an INET interface can be untagged, commonly represented with VLAN ID 0. Option D is incorrect because the MPLS VLAN field is intentionally parameterized, not incorrectly configured.

Answer : A

The correct answer is A. Versa link-bandwidth troubleshooting documentation explains that a VOS device can be configured as a Versa speed-test client, a Versa speed-test server, or both simultaneously. After the server is configured, the client starts the test by initiating a TCP-based connection toward the speed-test server. The server listens on port 5201. The documentation includes an explicit note that if the VOS device is behind a firewall, port 5201 must be open.

This is different from the SD-WAN overlay data path, which commonly uses UDP-based transport encapsulation, and different from internet speed-test traffic, which uses other ports depending on the specific test type. In this scenario, the question states that a Versa speed-test server was configured, so the relevant requirement is TCP 5201 reachability from the client to the server.

TCP 443 may be used for management or web access, UDP 4790 is associated with SD-WAN transport encapsulation, and UDP 53 is DNS. None of those replace TCP 5201 for Versa speed-test server operation.

Answer : A

Symmetric Forwarding is the correct Versa SD-WAN feature for ensuring that return traffic between SD-WAN branches follows the same SD-WAN path on which the forward traffic was received. Versa documentation for SD-WAN traffic steering describes Symmetric forwarding as the option that specifies the path for reverse-direction traffic, meaning whether traffic returning from the destination branch to the originating branch should be sent on the same path on which it arrived. It further states that enabling symmetric traffic forwarding determines the reverse path for traffic returning from the destination branch to the originating branch.

This is different from Symmetric Routing, which is a routing design goal or behavior, not the Versa SD-WAN forwarding-profile feature named in the product documentation. Equal-Cost Multipath can distribute flows across equal-cost routes, but it does not specifically guarantee that both directions of the same SD-WAN session use the same path. Packet Striping is used to split or distribute packets across multiple links for performance, not to enforce bidirectional path symmetry. Therefore, the verified Versa feature to enable is Symmetric Forwarding.

Answer : A

The correct answer is A. Versa CGNAT troubleshooting documentation states that, after connecting to the vsmd daemon, administrators can view CGNAT access lists used for traffic matching with the command show cgnat acl info <tenant-id>. The sample output shows ACL handle, rule ID, category, precedence, VRF, source IP, destination IP, tenant ID, and total filters.

This is the correct command when NAT configuration appears present but translations do not occur, because it verifies whether the runtime dataplane has the correct traffic-match rules. If the source prefix, destination prefix, VRF, or precedence is wrong, the session may never match the NAT rule, and no translation will be applied.

show system status checks system services. show device clients shows active and failed sessions, CPU usage per session, and memory load for processes. show system storage shows disk usage. These commands are useful in other troubleshooting workflows, but they do not validate CGNAT ACL matching criteria for tenant traffic.

Answer : B

The correct answer is B. The DoS profile in the exhibit is a Classified Profile using Source IP Only as the classification key. For TCP flood protection, the profile is enabled and shows an Alarm Rate of 5000 packets per second, an Activate Rate of 7000 packets per second, a Maximum Rate of 100000 packets per second, a Drop Period of 300 seconds, and an action of Random. This means the first threshold, 5000 pps, is used to trigger alarm behavior, while the second threshold, 7000 pps, activates the configured mitigation action. Since the selected action is Random, packets are randomly dropped when the TCP rate reaches the activate threshold.

Versa documentation shows that DoS policies can match traffic using source, destination, service, application, schedule, IP version, DSCP, and other conditions, and that a DoS policy can set either an aggregate or classified DoS profile. It also documents that DoS policies support enforcement actions and logging through LEF profiles for DoS events. Therefore, 7000 pps does not merely generate an alarm, and it does not mean complete dropping. Complete dropping is not selected in the exhibit.

Answer : C

The correct answer is C. In Versa Secure SD-WAN, Direct Internet Access, or DIA, provides local internet breakout from the branch rather than backhauling internet-bound traffic through a hub. Versa design documentation explains that the DIA architecture creates an internal connection between the tenant VRF and the WAN transport VR and uses CGNAT to translate internet-bound LAN traffic to the public IP address associated with the WAN transport interface. It specifically states that the main DIA components include the CGNAT function for translating internet-bound traffic and that DIA is configured using Director Workflows when configuring tunnels.

When the workflow template is used and the DIA option is selected for the internet breakout tunnel, Director automatically builds the required DIA infrastructure, including the NAPT/CGNAT configuration associated with the internet-facing transport network. This is why manual creation of the CGNAT pool and rule is not required in the workflow-based method. Option A describes a manual configuration approach, not the workflow-generated behavior. Option B is incorrect because NAT must be associated with the internet-facing breakout path, not simply the LAN interface. Option D is incorrect because DIA normally requires address translation for LAN users accessing the public internet.

Answer : B

The correct answer is B. In Versa SD-WAN onboarding, the branch progresses through three staging phases. In Stage 1, the branch uses its factory-default configuration to start an IKE session with the staging server. After the IKE session comes up, the staging server assigns an IP address to the branch and notifies the branch of the Versa Director IP address. Versa Director is also notified that the branch has come up.

In Stage 2, Versa Director pushes the stage-two configuration to the branch through the staging server. This stage changes the IPsec profile so that the Controller IP address becomes the remote IP. The branch reboots and then attempts to establish the IKE session with the Controller. If the device successfully completed Stage 1 but never forms the Controller IKE session, the failure point is Stage 2.

Stage 3 is later, when the device receives stage-three configuration, becomes operational, and creates Controller IPsec plus branch-to-branch VXLAN/ESP sessions. Therefore, the described issue is a Stage 2 staging failure.