Versa Networks VNX301 - Versa Certified SD-WAN Specialist (VNX300)

The correct answers are A and D . Versa stateful firewall service includes classic firewall functions that track sessions and enforce traffic policy, and it can work with DoS policy enforcement. Versa’s CLI guide includes Configuring DoS policies under the security configuration area, where DoS rules can match on source, destination, services, applications, URL category, IP version, DSCP, TTL, EtherType, and other packet or session attributes, and can then apply aggregate or classified DoS profiles. This validates DoS protection as a stateful firewall/security service capability.

Application-Level Gateways, or ALGs , are also associated with stateful firewall/NAT behavior because they inspect and assist protocol handling for applications that embed addressing or dynamic port information inside the payload or control channel. This is part of traditional stateful firewall service behavior rather than UTM content inspection.

The correct answer is B . Versa documentation for internet speed tests explains that when you run an internet speed test from a Director node, it creates approximately 200 sessions . This is useful for measuring aggregate throughput, but it does not represent the behavior of a single application flow. The same documentation states that you can run a speed test with a single session from the device CLI, and that this is useful for simulating file transfer rates when using SCP or FTP .

Therefore, when the goal is to understand how a single file transfer behaves, the CLI-based single-session test is the best option. A default Director-based test may produce higher aggregate results because multiple sessions can use parallelism and better fill the pipe.

show interfaces brief is useful for interface status and addressing, but it does not measure file-transfer throughput. SLA latency is useful for path-quality monitoring, but latency alone does not show single-session TCP throughput.

The correct answer is A . Versa throughput troubleshooting documentation includes a specific section titled Check that Packets Are not Dropped by CoS . It states that if a CoS shaper or rate limiter is configured on the VOS device, it may drop packets when traffic exceeds the configured shaping rate. To check whether CoS is dropping packets, Versa recommends commands including show class-of-services interfaces brief and show class-of-services interfaces detail interface-name.

The detailed interface output displays traffic statistics such as TX packets, TX packets dropped, TX bytes, TX bytes dropped, and per-traffic-class drops. This is exactly the evidence needed to confirm whether shaping or QoS enforcement is causing the observed loss.

show alarms last-n 10 may reveal major events but will not provide per-interface CoS drop counters. show system uptime only indicates how long the system has been running. show cgnat tenants is relevant for NAT state and tenant CGNAT resources, not QoS drops.

The correct answer is A . Versa CGNAT troubleshooting documentation shows the command show cgnat acl info < tenant-id > for viewing CGNAT access lists used for traffic matching. The example output includes columns such as ACL handle , RuleId , Category , Precedence , VRF , Source IP , and Destination IP . It also shows tenant ID and total filters.

This command is useful when a CGNAT rule exists in configuration but sessions are not being translated. By checking the ACL output, the administrator can confirm whether the correct source prefix, destination prefix, VRF, and rule precedence are actually programmed in the dataplane. If the wrong VRF or subnet is shown, the rule may never match the intended traffic.

System uptime and CPU usage are operational health indicators. SLA metrics are SD-WAN path-quality values. BGP AS path and local preference are routing attributes. None of these directly show CGNAT access-list match programming.

The correct answer is A . Versa monitoring documentation states that when an administrator selects a provider organization in Director and opens the Summary tab, the screen displays several panes. The Asset Inventory pane displays the number of tenants, SD-WAN branches, SD-WAN Controller nodes, vCPEs, SD-WAN hubs, uCPEs, Director nodes, and Analytics nodes in the organization.

This pane is useful for quickly validating the managed estate and confirming whether expected infrastructure objects exist under the provider organization. It also provides a Details button to display asset information in tabular format, which can help during audits or operational checks.

Package Information shows software package details for the selected node, not organization-wide inventory. Uptime shows how long a node and its software have been running. High Availability shows Director HA information. These panes are useful, but they do not provide the organization-level asset count requested in the question.

The correct answer is C . Versa’s bandwidth and throughput troubleshooting documentation specifically instructs administrators to check link speed and half-duplex conditions with the command show interfaces detail interface-name. The example output shows an interface operating at half-duplex / 100 Mbps , and the documentation states that the interface should not be in half-duplex mode and that 100 Mbps was incorrect in that scenario.

A duplex mismatch or incorrect negotiated speed can severely reduce effective throughput, cause collisions or retransmissions, and make SD-WAN overlay performance appear poor even when the overlay itself is functioning. Versa recommends fixing half-duplex and link-speed issues by correcting the configuration on the device to which the VOS device is connected and checking the ISP-side transmission mode, such as auto/auto.

SLA probing, Controller route advertisement, and VXLAN encapsulation may affect SD-WAN path selection or tunnel formation, but the evidence in the question directly points to a physical or underlay Ethernet negotiation problem.

The correct answer is A . Versa CGNAT troubleshooting documentation provides a clear workflow for CGNAT issues. It first describes how to view CGNAT summary information using show orgs org-services < org > cgnat summary. It then shows how to view per-pool statistics using show orgs org-services < org > cgnat pools < pool-name > statistics. The sample output includes counters such as bindings-allocated , bindings-freed , alloc-failures , free-failures , out-of-address-errors , and out-of-ports-errors .

If these counters indicate failures, the next step is to inspect CGNAT state inside the vsmd daemon, including tenant state, ACL matching, pools, bindings, and source-port resources. This helps determine whether the issue is pool exhaustion, rule mismatch, resource allocation failure, or stale runtime state.

OSPF may affect routing but does not explain CGNAT allocation counters. Analytics may store logs but is not the dataplane authority for NAT allocation. Rebooting Analytics would not resolve CGNAT resource programming on the VOS device.

The correct answer is A . Versa template-based provisioning is designed to separate common configuration from site-specific values. A device template can define common interface, service, routing, and SD-WAN behavior, while variables and device bind data provide unique values for each appliance. This allows the same template to be reused across many branches while assigning different WAN IP addresses, gateways, VLAN IDs, circuit names, or other per-site parameters during onboarding.

In this scenario, Branch-A and Branch-B use the same template but receive different WAN VLAN IDs from bind data. That is normal and expected in a scalable SD-WAN deployment. Without variables, administrators would need to create a separate template for every site, which would be operationally inefficient and increase configuration drift.

The Controller does not automatically rewrite VLAN IDs after IPsec comes up; VLAN IDs must be part of the generated device configuration. It is also not required to duplicate the device template for each branch. The correct Versa design is reusable templates plus unique bind-data values.

The exhibit shows the Add CGNAT Pool configuration with the IP Address/Range option selected. The configured address range is named Visitors , with a low address of 192.168.10.100 and a high address of 192.168.10.150 . In CGNAT, this pool defines the translated source address resource used by matching NAT rules; it does not define the original inside source hosts. Therefore, matching sessions will have their source address translated to an address from this configured pool range, which makes option C correct. Versa’s CGNAT configuration examples show that a rule matches original source and destination prefixes, and then attaches a translated source pool to perform NAT.