Drag and Drop Question Drag and drop the description from the left onto the corresponding WAN connectivity types and categories on the right. Answer:

Question

Exhibit

Explanation

This drag-and-drop question tests knowledge of the architectural and operational differences between Cisco SD-WAN and MPLS VPNs, specifically regarding data security, network segmentation, and routing exposure.

Approach. The correct approach is to carefully evaluate each description box and associate it with the architectural and operational characteristics of either Cisco SD-WAN or MPLS VPN, then place it into the most fitting sub-category (data security, network segmentation, or routing exposure).

For Cisco SD-WAN:

• data security: Drag 'Application data is encrypted end-to-end.' here. Cisco SD-WAN solutions, like those based on Viptela technology, build secure overlay tunnels (IPsec/DTLS) between network devices, ensuring application data is encrypted from the source SD-WAN edge device to the destination across the WAN.
• network segmentation: Drag 'It supports end-to-end network segmentation.' here. SD-WAN enables the creation of multiple logical networks (VPNs or VRFs) over a shared physical infrastructure, allowing for granular, policy-driven segmentation that extends from the customer's LAN, across the WAN, and into data centers or cloud environments.
• routing exposure: Drag 'Control traffic is fully encrypted and independent from the service provider network.' here. The SD-WAN control plane (e.g., OMP in Viptela) securely exchanges routing and policy information between controllers and edge devices over encrypted channels, operating independently of the underlying service provider's routing protocols.

For MPLS VPN:

• data security: Drag 'It is hard to detect sniffing incidents.' here. While MPLS VPNs provide logical separation (VRFs), they typically do not provide native end-to-end encryption of customer data. If an attacker gains access to the service provider's internal network, data may be intercepted in cleartext, and the customer has limited visibility into the SP's network to detect such incidents.
• network segmentation: Drag 'The WAN is a flat network with no network segmentation.' here. Compared to SD-WAN's agile, policy-driven micro-segmentation, a single MPLS VPN instance for a customer can be considered 'flat' in terms of applying granular, end-to-end security policies directly across the WAN without extensive additional configuration or services. While MPLS offers VRF-based segmentation between customers, and multiple VRFs for one customer, the agility and end-to-end control are less than SD-WAN.
• routing exposure: Drag 'CE to PE routing is controlled by the service provider.' here. In an MPLS Layer 3 VPN, the Customer Edge (CE) router peers directly with the Provider Edge (PE) router. The service provider's PE routers manage the distribution of customer routes within their MPLS network, meaning the SP has direct control and exposure to the customer's routing information.

Common mistakes.

• common_mistake. A common mistake is to confuse the logical separation provided by MPLS VPNs (via VRFs) with the end-to-end encryption or policy-driven micro-segmentation capabilities of SD-WAN. For example, incorrectly placing 'Application data is encrypted end-to-end' under MPLS VPN data security would be wrong because MPLS itself does not inherently encrypt customer data; it only isolates it logically. Another mistake would be placing 'It supports end-to-end network segmentation' under MPLS VPN network segmentation, overlooking that SD-WAN offers a much more flexible and customer-controlled approach to extending segmentation across the entire network, including the customer's LAN and cloud, unlike the SP-dependent VRF segmentation in MPLS. Similarly, misunderstanding the independence of the SD-WAN control plane from the underlying network could lead to misplacing the 'Control traffic is fully encrypted and independent from the service provider network' description.

Concept tested. The core concept being tested is the comparative understanding of Wide Area Network (WAN) technologies, specifically the architectural and operational differences between traditional MPLS VPNs and modern Software-Defined WAN (SD-WAN) solutions, focusing on their respective capabilities in data security, network segmentation, and routing control/exposure.

No community discussion yet for this question.