4.5 Demonstrate Understanding of Path and Security Policy Implementation Based on User / Group ID SD-WAN-ENGINEER Practice Questions (Page 3)

Questions 11–14

1. 11application · medium

   A company has two sites connected via SD-WAN. The finance team at the main site needs their traffic to the remote site's ERP server to always use the MPLS link, while other users can use either MPLS or broadband. The finance users are in an Active Directory group called 'FINANCE'. What should the administrator configure to meet this requirement?

   • ACreate a path policy that matches source user group 'FINANCE' and destination IP of the ERP server, setting the preferred path to MPLS.
   • BCreate a static route on the firewall for the ERP server's IP pointing to the MPLS next hop, affecting all users.
   • CCreate a QoS policy that prioritizes traffic from the 'FINANCE' group, which will force it over the MPLS link.
   • DCreate a security policy for the 'FINANCE' group allowing access to the ERP server, and the SD-WAN will automatically route it over MPLS.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   In a security policy rule, what does specifying a user or group as the source accomplish?

   • AIt encrypts traffic from that user or group
   • BIt authenticates the user or group before allowing traffic
   • CIt overrides all other security rules for that user
   • DIt restricts the rule to traffic from that user or group, regardless of source IP
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational company uses SD-WAN with centralized policy management. The 'Sales' group needs low latency for their CRM application, so a path policy routes them over MPLS. The 'Sales' group also needs access to a partner portal, which is only reachable via the broadband link. The administrator has created a security policy allowing the 'Sales' group to access the partner portal. However, the traffic is still being routed over MPLS and failing. What is the most likely cause?

   • AThe User/Group ID mapping for the 'Sales' group is incorrect.
   • BThe security policy for the partner portal is placed below a deny-all policy.
   • CThe partner portal is not reachable over any path, so the traffic fails regardless of the path policy.
   • DThe path policy for the 'Sales' group is matching all traffic to the partner portal and forcing it over MPLS, which cannot reach the portal.
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   What is the primary purpose of User/Group ID in an SD-WAN environment?

   • ATo provide encryption for user traffic
   • BTo authenticate users before they access the network
   • CTo optimize routing based on network latency
   • DTo map IP addresses to user and group identities for policy enforcement
   Reveal Solution Discussion Select an answer first