VNX-100 Practice Questions

The Versa Stateful Firewall is a foundational security component that operates on a zone-based architecture. This architecture provides macro-segmentation by controlling traffic flow between different security zones (e.g., trust, untrust, DMZ). A key capability of this firewall is Zone Protection, which uses profiles to protect the zones themselves from reconnaissance scans and various types of flooding attacks. These protections are a primary mechanism for mitigating Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, which are explicitly listed as a capability of the Versa security stack, starting with the stateful firewall.

A. Unified Threat Management (UTM) is a broader security suite that includes the stateful firewall along with other services like IPS and AV, not a capability of the firewall itself.

D. Dynamic User Protection (DUP) is not a standard term for a Versa Stateful Firewall feature. User-based policies are an NGFW function, which is an extension beyond the base stateful firewall.

1. Versa Networks

"Next-Generation Firewall" Solution Brief

Page 2

"Key Capabilities" section. The document states

"The Versa Networks solution starts with a zone-based stateful firewall providing context-aware security policy enforcement..." This confirms the zone-based nature.

2. Versa Networks

"Secure SD-WAN At-a-Glance" Document

Page 1

"Full Stack of Security" section. This document explicitly lists the components of the security stack: "Versa Secure SD-WAN includes a full-stack of security with a next-generation firewall

including stateful firewall

DoS and DDoS protection..." This directly links the stateful firewall with DDoS protection.

3. Versa Networks

"VOS™ 21.2.3 Security Configuration Guide"

Chapter: "Configuring Zone Protection and DoS Protection"

Section: "Zone Protection Profile". This official configuration guide details the use of Zone Protection Profiles to configure thresholds for various flood attacks (SYN

UDP

ICMP) and reconnaissance protection

which are the core mechanisms for DoS and DDoS defense at the zone level.

In the Versa Networks CoS framework, Queuing and Scheduling are critical functions for managing traffic during periods of congestion. Queuing involves assigning classified traffic to specific queues, each configured with properties like priority (for strict-priority handling) and weights (for bandwidth distribution using algorithms like Weighted Round Robin). Scheduling is the mechanism that then determines the precise order in which packets are dequeued and transmitted from these queues onto the physical interface. Together, they ensure that high-priority traffic is serviced appropriately according to defined policies.

A. This statement describes Classification. Remarking is the process of altering the CoS fields (e.g., DSCP) in a packet, not separating traffic.

B. This statement describes Remarking. Classification is the process of identifying and categorizing traffic based on its characteristics without altering the packet.

1. Versa Networks

"Configuring Quality of Service

" VOS™ Configuration Guide

Release 22.1

2022-07-15.

Section: QoS Overview

Page 7: "Queuing—Holds packets in a queue when the network is congested. You can configure queue properties such as priority and weight." This directly supports option C.

Section: QoS Overview

Page 7: "Scheduling—Determines the order in which queued packets are transmitted." This directly supports option D.

Section: QoS Overview

Page 7: "Classification—Categorizes packets into different traffic classes." and "Marking and Remarking—Sets a value in the packet to indicate its class." This confirms that options A and B incorrectly define their respective terms.

URL-based Zero Touch Provisioning (ZTP), also known as One-Time Link (OTL) ZTP, is a method designed for simplicity and security. An administrator generates a unique, single-use URL from Versa Director for a specific branch appliance. This URL is then securely communicated to the on-site installer, commonly via email. The installer connects a laptop to the device's management port, accesses a local web UI, and pastes the provided URL. The appliance uses this link to securely contact the Versa Director, authenticate, and download its full configuration, completing the provisioning process without manual CLI commands or pre-staging.

A. ZTP is initiated by pasting the URL into the appliance's local web interface, not by using a console connection.

B. ZTP is a feature for provisioning remote branch appliances (CPEs), not for the centrally located Versa Gateways.

C. The URL-based ZTP workflow allows the on-site installer to configure the WAN link using either DHCP or a static IP address.

1. Versa Networks

"Zero Touch Provisioning Deployment Guide

VOS™ Release 22.1

" Chapter 1: ZTP Overview

Section: One-Time Link Based ZTP. This section details the workflow where an administrator generates a URL in Versa Director and sends it to a field engineer. The guide states

"The field engineer receives the one-time link (for example

in an email)..." This confirms that the link is designed to be sent via methods like email.

2. Versa Networks

"Zero Touch Provisioning Deployment Guide

VOS™ Release 22.1

" Chapter 3: On-Premises ZTP

Section: Stage a Device Using One-Time Link. This chapter provides the step-by-step process

which includes the installer accessing the device's GUI and having the option to configure the WAN interface. The guide explicitly shows options for both "DHCP" and "Static" IP address assignment

invalidating the claim that only DHCP is supported.

3. Versa Networks

"SD-WAN Configuration and Administration Guide

VOS™ Release 22.1

" Part 3: Device Onboarding. This guide clarifies that ZTP is a mechanism for onboarding branch devices (CPEs) into the network fabric

distinguishing their provisioning process from that of core components like Controllers and Gateways.

The Versa Networks Quality of Service (QoS) framework on its CPEs is fundamentally built upon three core functions. First, Classification identifies and categorizes traffic based on various criteria like application, IP address, or DSCP markings. Second, Ingress Policing is applied to rate-limit traffic entering an interface, ensuring it conforms to a specified bandwidth profile by dropping excess packets. Third, Hierarchical Queuing, a key feature of Versa's Hierarchical QoS (H-QoS), manages network congestion at egress by scheduling packets through a multi-level queue structure. This provides granular control over bandwidth allocation and prioritization for different traffic classes, ensuring service level agreements (SLAs) are met.

A. admission control: This is a more specific mechanism, like Call Admission Control (CAC) for VoIP, not a foundational QoS function in the general Versa framework.

C. egress policing: Versa's architecture predominantly uses egress shaping and hierarchical scheduling to manage outbound traffic, while policing is the primary mechanism for rate-limiting at ingress.

1. Versa Networks VOS™ Quality of Service (QoS) Configuration Guide (Release 22.1):

Section: QoS Overview

Page 7: This section outlines the basic QoS workflow

stating

"The basic QoS process is to classify incoming packets and then apply a QoS policy to them... The actions include policing the traffic... and queuing the traffic for transmission." This confirms Classification

Policing

and Queuing as core components.

Section: Hierarchical QoS

Page 10: This section details the H-QoS model

explaining

"Versa VOS supports hierarchical QoS (H-QoS)

which allows you to apply queuing and shaping at multiple levels of a hierarchy." This directly supports Hierarchical Queuing (B).

Section: Configuring Policers

Page 45: This chapter describes the function and configuration of policers

specifying their use for rate-limiting. The examples and context consistently apply policers to input/ingress traffic

supporting Ingress Policing (E).

Section: Configuring Classifiers

Page 29: This chapter details the process of identifying traffic flows based on various fields

which is the definition of Classification (D).

A Versa Workflow is an automated, multi-step process within Versa Director designed to orchestrate operational tasks. These workflows execute a sequence of predefined actions to create, modify, or delete configuration objects managed by the Director. Common use cases include automating the onboarding of a new branch device (CPE), deploying a new service across multiple sites, or executing complex configuration changes in a controlled and repeatable manner. This automation simplifies administration, reduces manual errors, and ensures consistency in network operations.

A. A template defines a set of configuration parameters, whereas a workflow is a process that applies configurations or performs actions, often using a template as an input.

B. Versa Workflows are designed to manage objects and configurations within the Versa Networks ecosystem; they do not have the native capability to configure routing policies on third-party devices.

D. Ordering services from Versa Networks is a commercial or sales process. A Versa Workflow is a technical feature within the management platform for network and service orchestration.

1. Versa Networks Documentation

Versa Director Administrator Guide: The guide describes workflows as a feature for automating operational procedures. It states

"A workflow is a sequence of tasks that are executed to create or modify objects in the system." This directly supports the definition of a workflow as a process for object creation and modification. (Reference typically found in chapters on Automation or Workflows).

2. Versa Networks Documentation

Versa Director Workflows: This document details the creation and execution of workflows. It explains that workflows consist of tasks that perform API calls to Versa Director to manage objects like devices

templates

and policies

reinforcing that their function is to manipulate objects within the system. (Reference found in sections explaining workflow tasks and execution).

The Versa Networks SD-WAN control plane is fundamentally built on Multi-Protocol BGP (MP-BGP). The Versa Controllers act as route reflectors, and the branch appliances (FlexVNFs/CSGs) establish internal BGP (iBGP) peerings with them. This MP-iBGP framework is used to discover and maintain the SD-WAN topology.

To transport SD-WAN-specific overlay information—such as Transport Locators (TLOCs), encryption keys, and site IDs—Versa utilizes a proprietary BGP address family. This allows the standard BGP protocol to carry the necessary custom information required to build the SD-WAN fabric, effectively using a "Private Address Family" for topology advertisement.

A. SD-WAN topology is discovered using eBGP.

The relationship between branch appliances and controllers is within a single autonomous system, mandating the use of internal BGP (iBGP), not external BGP (eBGP).

D. NETCONF advertises topology changes.

NETCONF is a management plane protocol used by Versa Director to push configuration to devices. It does not dynamically advertise topology changes; that is the role of the control plane protocol, MP-BGP.

1. Versa Networks

"Versa Operating System (VOS™) 21.2.2 SD-WAN and SASE Configuration Guide

" Chapter: BGP for SD-WAN

Section: "BGP for SD-WAN Overview." This section states

"The Versa solution uses Multi-Protocol BGP (MP-BGP) as the control plane protocol to exchange reachability information between the branch CPEs and the controllers... The peering between the CPEs and the controllers is an iBGP peering." This supports option B and refutes option A.

2. Versa Networks

"Versa Operating System (VOS™) 21.2.2 SD-WAN and SASE Configuration Guide

" Chapter: BGP for SD-WAN

Section: "SD-WAN Routes." This section details the use of a specific address family for SD-WAN routes: "Versa Networks uses a proprietary BGP address family to exchange SD-WAN-specific information... The address family is SD-WAN (AFI 16396

SAFI 254)." This directly supports option C.

3. Versa Networks

"Versa Director Configuration and Administration Guide 21.2.2

" Chapter: Versa Director Overview

Section: "Versa Director Architecture." This document clarifies the role of NETCONF: "Versa Director uses the NETCONF protocol to configure and manage the Versa devices (Controllers

Analytics

and FlexVNFs)." This confirms NETCONF is for management

refuting its role in advertising topology changes as suggested in option D.

In the Versa Secure SD-WAN architecture, the Versa Controller acts as the centralized control plane. It functions as a Multi-Protocol BGP (MP-BGP) route reflector. When a new branch site (CPE) is provisioned and comes online, it establishes a secure control plane connection and an MP-BGP peering session with the Controller. The Controller then reflects the new site's reachability information, specifically its Transport Locators (TLOCs), to all other existing sites that are also peered with it. This MP-BGP route reflection mechanism enables existing sites to automatically learn about the new site and its WAN transport endpoints, facilitating dynamic, on-demand tunnel creation without manual intervention on existing devices.

A. This describes a static, manual process that is contrary to the automated and scalable nature of a software-defined WAN solution.

B. Versa Director is the management and orchestration plane, responsible for configuration and monitoring, not for real-time control plane notifications between sites.

C. The Controller does not "reconfigure" existing sites. It facilitates the dynamic exchange of routing and topology information via MP-BGP, which updates forwarding tables, not the device's base configuration.

1. Versa Networks

"Secure SD-WAN Configuration Guide": In the sections describing the control plane

it is detailed that the Versa Controller operates as a route reflector for MP-BGP. It states

"The controller advertises the TLOCs of a branch to other branches so that the branches can form IPsec tunnels between them." This process of advertising TLOCs via MP-BGP is the mechanism for auto-discovery. (Reference: Chapter on "Control Plane

" Section on "Overlay Service and Transport VPN (O-ST-VPN)").

2. Versa Networks

"Controller Deployment Guide": This guide specifies the role of the Controller in the architecture. It explains

"The Versa Controller is the control plane of the SD-WAN network... It uses MP-BGP to communicate with the CPE devices... The Controller acts as a BGP route reflector

reflecting routes learned from one branch to all other branches." This confirms that MP-BGP is the protocol used for disseminating site information for auto-discovery. (Reference: Section "Controller Architecture Overview").

A Captive Portal is a feature that intercepts a user's web traffic and redirects them to a specific web page for an action before access is granted. In a Versa Networks environment, a Captive Portal can be integrated with a URL Filtering policy. When a user attempts to access a site in a specified category (e.g., social media), the policy can trigger the Captive Portal, which presents a page requiring the user to enter a justification. This is the only mechanism among the options that provides the necessary user interaction to fulfill the requirement.

A. IP filtering: This feature operates at Layer 3, blocking or allowing traffic based on IP addresses. It lacks the capability to interact with the user to request a justification.

B. SSL Inspection: This is a method used to decrypt and inspect encrypted traffic. While it is often a prerequisite for advanced URL filtering, it is not the feature that prompts users for input.

C. DNS filtering: This feature blocks access to websites by preventing the resolution of their domain names. It is a simple block/allow mechanism and cannot prompt for user justification.

1. Versa Networks VOS™ Next Generation Firewall Configuration and Administration Guide: In the chapter on "Security Policies

" the guide details the actions available for URL Filtering rules. One of the configurable actions is captive-portal. This action redirects the user's browser to a portal page for authentication or interaction before allowing the session to proceed. The section on "Configuring Captive Portal" further explains its use for user identification and presenting custom pages

which can be used to solicit justification.

2. Versa Networks Secure SD-WAN Configuration Guide: The section on "Unified Security Policy" describes how to create rules based on applications and URL categories. It specifies that a rule's action can be set to trigger a Captive Portal

enforcing user interaction for specific types of traffic

such as social media access. This directly supports using the portal for justification purposes.

In Versa Networks SD-WAN, traffic steering policies are used to direct traffic over specific paths based on defined criteria. Applications are a primary match criterion, allowing administrators to identify business-critical or recreational traffic (e.g., Office 365, YouTube) and steer it accordingly. Schedules are another key criterion, enabling time-based policies. For example, a rule can be active only during business hours to prioritize corporate traffic or after hours to steer backup traffic over a lower-cost link. Both are used in the "match" condition of a policy rule to determine which traffic the rule applies to before the steering action is taken.

A. Logging: Logging is an action performed on traffic that matches a rule; it records events but does not determine the traffic path.

D. Anti-virus: Anti-virus is a security service or profile applied as an action to matched traffic, not a criterion for steering it over a specific WAN link.

1. Versa Networks VOS™ Administrator Guide: In the "Forwarding Policies" chapter

the configuration of SD-WAN rules is detailed. The "Match Conditions" section explicitly lists Application and Schedule as criteria for identifying traffic to which a steering policy will be applied. (Specific section: Forwarding Policies > Rules > Match Conditions).

2. Versa Networks

"Configuring Basic SD-WAN" Technical Note (TN-SGW-101): This document outlines the fundamental steps for creating SD-WAN policies. It demonstrates that rules are constructed by defining match criteria

such as Application definitions (e.g.

application groups)

and applying them within a specific Schedule to enforce time-of-day-based traffic steering. The action taken upon a match is to apply a Forwarding Profile

which dictates the path.

Versa Workflows, managed through Versa Director, are designed to simplify and automate the configuration of branch devices. When creating a device template or workflow, the routing configuration section provides options for the most commonly used protocols in enterprise SD-WAN deployments. These explicitly include BGP (typically for underlay and overlay routing), OSPF (for dynamic routing on the LAN side), and Static routes for simple and predictable pathing. These three protocols are available as standard, selectable options within the workflow's graphical user interface.

B. EIGRP: This is a Cisco-proprietary protocol and is not offered as a standard, configurable option within the simplified Versa Workflows for branch deployment.

C. IS-IS: This protocol is primarily used in large-scale service provider networks, not typical enterprise branch scenarios, and is therefore not an available option in Versa Workflows.

1. Versa Networks

VOS™ Configuration Guide for Release 22.1.1

Document Version 1.0

July 2022.

Section: Configuring Routing Protocols (Chapter 10): This chapter details the configuration of supported routing protocols. The guide's examples and primary sections focus on BGP (Section 10.4)

OSPF (Section 10.5)

and Static Routes (Section 10.2)

confirming their central role. The absence of dedicated sections for EIGRP or IS-IS in the context of standard branch configuration implies they are not primary

workflow-driven protocols.

2. Versa Networks

Versa Director Configuration Guide for Release 22.1.1

Document Version 1.0

July 2022.

Section: Device Templates (Chapter 6)

Subsection: Configuring Routing in a Template: This section describes the process of adding routing instances to a device template

which is a core component of a workflow. The graphical interface options presented in the guide for the "Protocol" field consistently show BGP

OSPF

and Static as the available choices for automated provisioning.