4A0-N02 Sample Questions Answers

Automation of the enterprise WAN

Virtualization of the branch office CPE

Orchestration of cloud networks

Providing unified policy across the data center and enterprise WAN

VSD (Virtualized Services Directory)

VSC (Virtualized Services Controller)

VRS (Virtual Routing and Switching)

NSG (Network Services Gateway)

CA (Certificate Authority) runs as a service on the utility host.

CA (Certificate Authority) only generates a certificate for the VSC.

With the certificate, the communication between the VSD and VSC can be encrypted in IPsec.

With the certificate, the communication between the VSC and NSG can be encrypted in TLS.

The VSD in the data center and the VSD for the branch office are running XMPP to synchronize with each other.

The VSC in the data center and the VSC for the NSG branch office are running BGP to update each other’s forwarding table.

With integration, the virtual machines in the data center and the devices in the branch office can belong to the same overlay network.

Traffic between the virtual machines in the data center and the devices in the branch office are forwarded in VXLAN tunnels.

A DHCP pool can be configured on a subnet connected to an NSG bridge vPort, the NSG then becomes the DHCP server.

VSD is in charge of the IP address assignment to the devices behind the NSG vPort.

There must be more than one device behind the bridge vPort.

The static IP to MAC mapping configuration is not on the bridge vPort.

NSG vPorts are associated with access ports.

There are four types of vPorts: VM, container, host and bridge.

The NSG’s vPorts are typically host vPorts.

One vPort can only belong to one subnet or L2 domain.

It encrypts and encapsulates the VXLAN traffic.

The key for IPsec needs be manually configured on NSGs and must match each other.

The IPsec tunnel can be directly terminated by VRS in a data center.

To have IPsec VPN, an encryption function needs to be enabled at each individual NSG.

The network egress and access egress QoS policies are created at different places.

Rate limiters need to be created in advance to the egress QoS policy.

It supports hierarchical policing per port/VLAN.

It supports one parent scheduler at port level and up to eight children queues.

These two NSGs exchange OpenFlow-TLS with their controller to establish the tunnel for overlay traffic.

These two NSGs must be managed by the same VSD/VSD HA cluster.

The overlay tunnels established between the NSGs must be VXLAN encapsulation.

The overlay tunnels are established during bootstrapping.