2.5 Explain VRF Implementation for Network Segmentation SD-WAN-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A financial services firm uses VRFs to separate trading (VRF-TRADE) and corporate (VRF-CORP) traffic across its SD-WAN. The SD-WAN policy must ensure that trading traffic always uses the lowest-latency path, while corporate traffic can use any available path. How should the firm enforce this?

   • AApply SD-WAN policies per VRF, with a path-selection rule for VRF-TRADE that prioritizes the lowest-latency link and a general rule for VRF-CORP.
   • BUse a single VRF and rely on application-based QoS to prioritize trading traffic.
   • CConfigure the routing table of VRF-TRADE to only contain the lowest-latency path.
   • DApply a single SD-WAN policy to all traffic that prioritizes the lowest-latency path.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A logistics company runs its SD-WAN with two VRFs: one for operational telemetry (VRF-OPS) and one for general internet access (VRF-INT). The company wants to ensure that telemetry traffic is never sent over a low-quality satellite link, while internet traffic can use any link. How should the SD-WAN policies be configured?

   • ACreate a policy for VRF-OPS that excludes the satellite link from path selection, and a separate policy for VRF-INT that allows all links.
   • BCreate a single policy for all traffic that excludes the satellite link.
   • CConfigure the satellite link as a backup only in the VRF-OPS routing table.
   • DUse a single VRF and apply QoS to prioritize telemetry on other links.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A bank uses VRFs to isolate cardholder data (VRF-CARD) from general corporate traffic (VRF-CORP). A new reporting application in VRF-CORP must read from a database in VRF-CARD. The security team requires that the database is not reachable from any other system in VRF-CORP, and that the reporting application cannot reach any other resource in VRF-CARD. The network team wants to minimize configuration overhead. What should they do?

   • ALeak only the database route from VRF-CARD into VRF-CORP, and leak only the reporting application's route from VRF-CORP into VRF-CARD, then apply security policies to restrict traffic to the specific application and database.
   • BPlace the reporting application in VRF-CARD and the database in VRF-CORP, then configure route leaking for the database.
   • CLeak all routes between the two VRFs and rely on security policies to block unwanted traffic.
   • DMerge the two VRFs into a single VRF and use application-level access controls.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A government agency is required to keep classified and unclassified traffic on separate networks. They are deploying a new SD-WAN site with a single appliance. The agency wants to avoid deploying a second appliance but must ensure that the two traffic types are isolated at Layer 3. What should the agency do?

   • ACreate two VLANs on the LAN switch and map each to a different SD-WAN tunnel.
   • BConfigure two VRFs on the appliance, assign the classified and unclassified interfaces to separate VRFs, and apply SD-WAN policies per VRF.
   • CUse a single VRF and rely on firewall rules to block traffic between the two networks.
   • DDeploy a second SD-WAN appliance for classified traffic.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company uses VRFs to separate production (VRF-PROD) and development (VRF-DEV) traffic. A new application in VRF-DEV must access a database in VRF-PROD, but the database is also used by other production applications. The company wants to ensure that the development application can only access the database, not other production resources. What is the most secure configuration?

   • AMerge the two VRFs into a single VRF and use application-level access controls.
   • BPlace the database in VRF-DEV and move the development application to VRF-PROD.
   • CLeak all routes from VRF-PROD into VRF-DEV and rely on the firewall to block unwanted traffic.
   • DLeak only the database route from VRF-PROD into VRF-DEV, and apply a security policy that restricts the development application to the database's IP address and port.
   Reveal Solution Discussion Select an answer first