Authentic Versa Networks Certification Exam VNX301 Questions Answers

The correct answer is LOCAL_PREF . In BGP, the Local Preference attribute is used inside an autonomous system to influence which exit path is preferred for outbound traffic. In this scenario, the Versa Secure SD-WAN CPE receives routes from two upstream service providers, SP1 and SP2. To prefer routes learned from AS 64515 over routes learned from AS 64519, you would apply a BGP import or route policy that assigns a higher local preference to routes received from SP1. Versa SD-WAN design guidance shows this exact routing concept: an import policy can manipulate the Local-Pref attribute to prefer one advertised route path over another. The Versa output examples also display “Local Preference” as a BGP route attribute used in route selection.

MULTI_EXIT_DISC, or MED, is generally used to influence how a neighboring AS enters your AS, not how your CPE prefers routes learned from different upstreams. ORIGIN is part of BGP best-path selection but is not normally the administrative tool used to prefer one provider. NEXT_HOP identifies the next-hop address and does not directly define route preference.

The correct answer is D . In a Versa HA active-active branch deployment, the cross-connect link between the two CPE devices is used to extend WAN transport reachability between the peers. Versa SD-WAN design documentation explains that, in an HA active-active design, a cross-connect cable between the two devices extends one device’s transport VR to the other device and vice versa. For example, the documentation describes the cross-connect as extending the MPLS-Transport-VR to one device and the Internet-Transport-VR to the peer device.

In the question, there are four total WAN networks across the HA pair: INET-1 , MPLS-1 , INET-2 , and MPLS-2 . The HA active-active workflow must create separate logical subinterfaces on the cross-connect link for each WAN network so that each transport segment can be extended and kept logically separated across the two appliances. Therefore, the number of subinterfaces created on the cross-connect link equals the total number of WAN networks across the HA pair, which is four .

Options A, B, and C are incorrect because they undercount the number of required transport extensions. Two subinterfaces would only account for two WAN networks, but this design has four separate WAN transport networks.

The correct answer is B . The requirement is to stop branch devices from sourcing traffic using IP addresses that do not belong to the branch. This is a source-address enforcement problem, so the correct control is a stateful firewall policy that permits only traffic whose source IP address matches the valid branch LAN prefix or branch-assigned address range. Versa’s stateful firewall configuration documentation explains that firewall policy rules include source matching, where the administrator selects the source zone and one or more source addresses to which the rule applies.

By creating an allow rule for the legitimate branch source prefixes and placing a deny rule for all other sources from the branch LAN zone, the VOS device prevents spoofed or unauthorized source addresses from leaving the branch. This is consistent with Versa security policy behavior, where firewall rules evaluate traffic based on zones, addresses, services, applications, and other match criteria. Captive portal verifies user identity but does not directly prevent IP spoofing. An IP filter profile based on applications does not ensure the source address belongs to the branch. Option D is incorrect because allowing traffic to the assigned LAN range controls destination traffic, while this requirement is about validating the source IP address of outbound branch traffic.