300-415 Question 202
Select 3An enterprise is deploying Cisco SD-WAN to improve its branch network's security and Quality of Service (QoS). The network administrator wants to ensure that critical business applications are prioritized and that sensitive data is encrypted when traversing the network. Which configuration steps should the administrator take to meet these requirements?
- A
Configure centralized application-aware policies to prioritize business-critical applications.
- B
Enable Transport Layer Security (TLS) encryption on all SD-WAN tunnels.
- C
Apply QoS queuing policies to prioritize traffic based on DSCP markings.
- D
Configure ZBFW (Zone-Based Firewall) policies to block non-business traffic.
- E
Use IPSec encryption for data plane traffic between SD-WAN devices.
- F
Enable local breakout for all traffic at branch sites.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet the requirements, the administrator should configure centralized application-aware policies to prioritize critical business applications, apply QoS queuing policies to ensure traffic prioritization based on DSCP markings, and enable IPSec encryption to secure sensitive data in transit. These configurations work together to enhance both the security and QoS in the Cisco SD-WAN environment.
- A. Correct.
Correct: Centralized application-aware policies allow the administrator to identify and prioritize business-critical applications, ensuring optimal performance.
- B. Incorrect.
Incorrect: TLS is not typically used for SD-WAN tunnel encryption. Instead, IPSec is the standard protocol for securing SD-WAN data plane traffic.
- C. Correct.
Correct: Applying QoS queuing policies ensures that critical traffic is prioritized based on DSCP markings, which is essential to meet QoS requirements.
- D. Incorrect.
Incorrect: While ZBFW can improve security, it does not address the prioritization of business-critical applications or encryption of sensitive data.
- E. Correct.
Correct: IPSec encryption secures data traversing the SD-WAN, ensuring confidentiality and integrity of sensitive business traffic.
- F. Incorrect.
Incorrect: Enabling local breakout for all traffic could expose sensitive data to the internet without encryption and does not prioritize critical applications.