4.5 Demonstrate Understanding of Path and Security Policy Implementation Based on User / Group ID SD-WAN-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An SD-WAN administrator is configuring path policies for a company with two links: MPLS and broadband. The 'VIP' group must use MPLS for all traffic. The 'Standard' group can use either link. The 'Guest' group should only use broadband. The administrator creates a path policy for the 'VIP' group to prefer MPLS and a path policy for the 'Guest' group to prefer broadband. What will happen to the 'Standard' group's traffic?

   • AIt will be blocked because no path policy is defined for the 'Standard' group.
   • BIt will use the default path selection, which may be either MPLS or broadband based on the configured metrics.
   • CIt will be forced to use broadband because the 'Guest' group's policy is more specific.
   • DIt will be forced to use MPLS because the 'VIP' group's policy is more specific.
   Reveal Solution Discussion Select an answer first
2. 7foundation · medium

   What is a key architectural benefit of integrating User/Group ID into SD-WAN policy enforcement?

   • AIt allows the same user/group-based policies to be applied across all paths and locations
   • BIt eliminates the need for any IP-based policies
   • CIt requires all users to authenticate to the SD-WAN controller
   • DIt only works when the user is on the corporate network
   Reveal Solution Discussion Select an answer first
4. 8foundation · medium

   How does User/Group ID enhance security policy enforcement in SD-WAN?

   • ABy allowing policies to be written for specific users or groups, improving granularity and reducing reliance on IP addresses
   • BBy replacing the need for application-based policies
   • CBy providing encryption for all user traffic
   • DBy automatically blocking all traffic from unknown users
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has a security policy that allows the 'Contractors' group to access the internet but denies them access to the internal file server. The policy order is: 1) Allow 'Contractors' to internet, 2) Deny 'Contractors' to file server, 3) Allow all to internet. A contractor is able to access the file server. What is the most likely reason?

   • AThe deny policy for the file server is placed below the allow-all policy.
   • BThe file server traffic is being routed over a path that bypasses the firewall.
   • CThe contractor is not correctly identified as a member of the 'Contractors' group in the User/Group ID mapping.
   • DThe file server is in the internet URL category, so the allow policy matches it.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company has a hybrid SD-WAN architecture with some sites using a local firewall and others using a centralized firewall. The 'Finance' group needs a specific security policy enforced at all sites. The administrator has configured the policy on the centralized firewall but not on the local firewalls. What is the most likely outcome?

   • AThe policy will only be enforced at sites using the centralized firewall, not at sites with local firewalls.
   • BThe policy will be automatically pushed to all local firewalls from the centralized firewall.
   • CThe policy will be enforced at all sites because the centralized firewall handles all security decisions.
   • DThe policy will be enforced at all sites because the 'Finance' group is defined in the centralized User/Group ID.
   Reveal Solution Discussion Select an answer first