VMware 5V0-42.21 Practice Test Questions, Exam Dumps

Practice Exams:

View All

5V0-42.21 VMware Practice Test Questions and Exam Dumps

Question 1

A customer is using VMware SD-WAN. The security team has noticed an excessive amount of traffic coming from all Android devices from within the corporate network. Which match option of the Business Policy should the administrator configure to block all of these devices from going to the internet?

A. IP Address
B. Protocol
C. Operating System
D. VLAN

Answer: C

Explanation:

When dealing with excessive traffic from Android devices, the goal is to block these devices based on their unique characteristics rather than their IP addresses or protocols, since multiple Android devices might be assigned the same IP address or use similar protocols for communication. The most effective way to target Android devices in this scenario is by their operating system.

Why "Operating System" is the Correct Match Option:

VMware SD-WAN allows administrators to create business policies that can match various traffic characteristics, including:

IP Address: This matches traffic based on IP addresses, which is typically useful when blocking specific devices by their IP address. However, multiple devices (in this case, Android devices) could share the same IP range or even have dynamic IP addresses.
Protocol: This matches traffic based on the network protocol being used (e.g., HTTP, HTTPS, FTP). While protocols can help block certain types of traffic, they are not specific to devices such as Android.
Operating System (OS): This match option allows you to filter traffic based on the device's operating system, which is ideal when you want to block all devices running a particular OS, such as Android. This is the most effective option for blocking traffic from Android devices specifically.
VLAN: This matches traffic based on VLAN IDs, which could be useful if Android devices are on a specific VLAN. However, the question does not provide information indicating that Android devices are isolated in their own VLAN, so this is less likely to be the best match option.

Why the Other Options Are Less Effective:

A. IP Address: Blocking based on IP address would require knowing the specific IPs used by Android devices. This is inefficient and could be unreliable if the devices have dynamic IPs or share IPs.
B. Protocol: Blocking by protocol targets the type of traffic rather than the device. While you could block web traffic (HTTP/HTTPS), it wouldn't necessarily block all types of traffic generated by Android devices.
D. VLAN: While VLAN-based matching can be useful if Android devices are segregated into a specific VLAN, the question does not mention VLAN configuration or segmentation, making this option less appropriate.

By using the Operating System match option, the administrator can efficiently block all Android devices from accessing the internet, regardless of their IP address or protocol. This is the most precise and targeted method in this scenario.

Question 2

An administrator is requested to deploy Edges in branch offices of a company. There is no local IT department in each of the branch offices thus the deployment should be as easy as possible to increase the manageability. Reliability of the solution is also an important requirement.

Which VMware SD-WAN Edge deployment option is valid for this scenario?

A. Deploy a pair of pre-installed bare-metal Edges and enable HA.
B. Use a SaaS options offering Edges hosted in VMware cloud.
C. Deploy a cluster of virtual Edges deployed in AWS cloud.
D. Deploy small vSphere cluster in each location and use virtual Edges.

Answer: A

Explanation:

In this scenario, the key considerations are ease of deployment, manageability, and reliability, especially since there is no local IT department at the branch offices. Let's analyze each option to see which fits best.

Option A

Deploy a pair of pre-installed bare-metal Edges and enable HA.
This is a very effective solution for branch offices where minimal IT intervention is available. By deploying pre-installed bare-metal Edges, the deployment becomes simpler because the hardware comes pre-configured and ready to be plugged in. Enabling High Availability (HA) ensures that the network remains reliable even in the case of a failure of one of the devices. This is especially important when there’s no local IT team to handle troubleshooting or repairs.

Advantages:

Easy deployment: The hardware is pre-installed, so there’s less setup required.
Reliability: High Availability (HA) ensures that if one edge device fails, the other takes over, providing continuous uptime.
Minimal IT involvement: The pre-installed nature of the hardware reduces the need for local IT teams at the branch offices.

Option B

Use a SaaS options offering Edges hosted in VMware cloud.
This option may sound convenient, but it involves hosted Edges in the cloud, which would not address the requirement for branch office deployments. The cloud-hosted option is better suited for centralized deployments where the edge devices would not be located in the branch offices. Additionally, it may not provide the reliability and control that an on-prem solution (like bare-metal Edges) offers.

Disadvantages:

Does not specifically address the deployment of Edges in branch offices.
Reliability may be impacted if the cloud service experiences an issue, and it does not provide local failover capabilities for the branch offices.

Option C

Deploy a cluster of virtual Edges deployed in AWS cloud.
While virtual Edges in the cloud (such as AWS) can be useful for larger or centralized deployments, this is not a practical solution for branch offices. Branch offices typically have limited internet connectivity and may not have the infrastructure required to support virtual edge devices in the cloud effectively.

Disadvantages:

The option doesn't provide the locality of the Edge devices in the branch offices.
It requires cloud infrastructure and may not align with the company's goals of simplicity and reliability for branch deployments without local IT staff.

Option D

Deploy small vSphere cluster in each location and use virtual Edges.
While deploying virtual Edges on a vSphere cluster could offer flexibility, it introduces more complexity. A vSphere cluster requires more setup and ongoing management compared to a pre-installed bare-metal Edge, and maintaining this without a local IT team in each branch would add unnecessary complexity. The question emphasizes the need for simplicity and manageability, which virtualized environments (especially in branch offices) often fail to provide.

Disadvantages:

Requires local infrastructure management, which is not ideal in branch offices without IT personnel.
More complex than deploying pre-configured hardware.

The best solution for this scenario is to deploy pre-installed bare-metal Edges with High Availability to ensure both simplicity and reliability. This option requires minimal local involvement and provides a reliable solution with automatic failover if one Edge fails.

Question 3

Which Software Defined Networks (SDN) characteristic is also true for VMware SD-WAN?

A. Managing and operating a VMware SD-WAN network requires advanced knowledge of software programming by network administrators.
B. Openflow is a key component of the VMware SD-WAN architecture.
C. VMware SD-WAN provides segregated failure domains for the control-plane and data-plane.
D. VMware SD-WAN management plane must be always reachable to provide proper packet forwarding at the VMware SD-WAN Edges.

Answer: C

Explanation:

VMware SD-WAN is a software-defined wide-area network solution that abstracts network management from hardware, offering more flexibility, scalability, and manageability. Let’s go through the options to understand which characteristic matches with VMware SD-WAN.

Option A

Managing and operating a VMware SD-WAN network requires advanced knowledge of software programming by network administrators.
This statement is not true for VMware SD-WAN. One of the main advantages of SD-WAN solutions like VMware SD-WAN is that they are designed to be easier to manage compared to traditional networking. The configuration and operation of VMware SD-WAN can be done via a centralized, web-based management interface, and advanced software programming skills are not required. VMware SD-WAN is designed with simplicity in mind for network administrators.

Option B

Openflow is a key component of the VMware SD-WAN architecture.
This is incorrect. OpenFlow is a protocol often associated with certain types of SDN, particularly in traditional networking environments where OpenFlow is used to control traffic flows between switches. However, VMware SD-WAN does not rely on OpenFlow as a key component. Instead, VMware SD-WAN uses its own proprietary methods to control traffic between sites, leveraging SASE (Secure Access Service Edge) principles for security and optimization.

Option C

VMware SD-WAN provides segregated failure domains for the control-plane and data-plane.
This statement is true. VMware SD-WAN has a segregated architecture where the control plane (responsible for configuration, policies, and network management) is separated from the data plane (responsible for the actual data traffic forwarding). This separation enhances reliability and scalability since failure in one plane (e.g., the control plane) does not directly affect the other (e.g., the data plane). It allows VMware SD-WAN to continue forwarding data traffic even if there is a temporary issue in the control plane, ensuring business continuity.

Option D

VMware SD-WAN management plane must be always reachable to provide proper packet forwarding at the VMware SD-WAN Edges.
This is false. VMware SD-WAN architecture is designed in such a way that packet forwarding at the VMware SD-WAN Edges does not depend on constant connectivity to the management plane. Once the SD-WAN Edges are configured, they can continue to forward traffic locally, even if the management plane is temporarily unreachable. This is one of the key features of SD-WAN: the control plane can be unreachable without disrupting data traffic.

The correct option is C because VMware SD-WAN does provide segregated failure domains for the control plane and data plane, which enhances the overall reliability of the network. Other options either misrepresent the capabilities of VMware SD-WAN or confuse it with different SDN technologies.

Question 4

An engineer would like to use the Zscaler SWG service in a VMware SD-WAN design. Which design option accomplishes this goal?

A. IPSec or GRE tunnel from up to 2 VMware SD-WAN Gateways to Zscaler
B. IPSec tunnel from up to 16 VMware SD-WAN Gateways to Zscaler
C. IPSec tunnel from up to 2 VMware SD-WAN Gateways to Zscaler
D. IPSec or GRE tunnel from up to 16 VMware SD-WAN Gateways to Zscaler

Answer: D

Explanation:

The Zscaler Secure Web Gateway (SWG) service is a cloud-based security solution that provides secure internet access by inspecting and filtering traffic, ensuring that data is protected as it travels to and from the internet. When integrating Zscaler with VMware SD-WAN, the goal is to establish a secure connection between the VMware SD-WAN Gateways and Zscaler, enabling secure, optimized internet access for remote and branch users.

Overview of the Options:

Option A

IPSec or GRE tunnel from up to 2 VMware SD-WAN Gateways to Zscaler
This option suggests limiting the number of VMware SD-WAN Gateways to two for the IPSec or GRE tunnels. While IPSec or GRE tunnels are valid ways to connect SD-WAN Gateways to Zscaler, restricting the number of Gateways to only two may be insufficient for larger or more distributed deployments, which is why it’s not the best choice.

Option B

IPSec tunnel from up to 16 VMware SD-WAN Gateways to Zscaler
This option suggests IPSec tunnels specifically, limiting the number of Gateways to 16. While IPSec is commonly used for securing communication between networks, this option restricts the connection to only IPSec tunnels and may not support all design requirements, such as the use of GRE tunnels, which are more flexible for certain deployment models.

Option C

IPSec tunnel from up to 2 VMware SD-WAN Gateways to Zscaler
Like option A, this one also limits the connection to two VMware SD-WAN Gateways, but it restricts the connection type to only IPSec tunnels. This limitation might not be ideal for larger-scale deployments where more than two Gateways are required for redundancy and high availability.

Option D

IPSec or GRE tunnel from up to 16 VMware SD-WAN Gateways to Zscaler
This is the best option. It allows both IPSec and GRE tunnels, providing flexibility for the engineer to choose the most suitable tunnel type based on specific needs such as performance, security, and ease of configuration. Additionally, this design supports up to 16 Gateways, offering greater scalability and redundancy for larger deployments.

Why Option D is Correct:

IPSec or GRE tunnels: Both tunnel types are supported, allowing the engineer to choose based on the requirements of the specific environment.
Up to 16 Gateways: This allows for larger, more distributed deployments, ensuring that multiple VMware SD-WAN Gateways can connect to Zscaler for redundancy, load balancing, and failover.

The correct option is D, as it provides the most flexibility and scalability for integrating VMware SD-WAN with Zscaler’s SWG service.

Question 5

During a meeting, a VMware SD-WAN pilot is being requested, and the customer is interested in Virtual Edges. Which two factors about the Virtual Edge should be highlighted in terms of scalability and performance? (Choose two.)

A. Is not a latency sensitive application
B. Requires a Microsoft Hyper-V Virtual Host
C. Has a maximum performance of 10Gbps
D. Has a maximum performance of 4Gbps
E. Requires SR-IOV for maximum performance

Answer: C and E

Explanation:

When discussing Virtual Edges in the context of VMware SD-WAN, it's important to focus on both scalability and performance. Virtual Edges offer a flexible, software-based deployment option that can be used for branch offices or remote locations without the need for specialized hardware. However, for optimal performance, there are key aspects to consider:

Option C: Has a maximum performance of 10Gbps

The performance capabilities of Virtual Edges are important, especially when it comes to handling higher traffic volumes in a scalable way. VMware SD-WAN Virtual Edges can handle up to 10Gbps in certain configurations, which is important when discussing scalability and performance for environments with high-throughput requirements. This makes the Virtual Edge a strong candidate for larger branch locations or more demanding environments.

Option E: Requires SR-IOV for maximum performance

SR-IOV (Single Root I/O Virtualization) is a technology that allows for direct access to network interfaces from virtual machines (VMs), bypassing the hypervisor and improving performance. For maximum network performance in VMware SD-WAN, SR-IOV can be required, particularly for environments demanding high throughput. This feature optimizes the network performance by reducing latency and increasing the data throughput of the virtualized edge, making it a key consideration when discussing scalability and performance.

Why Other Options Are Less Relevant:

Option A: Is not a latency sensitive application

This statement is not specifically relevant to the scalability and performance aspects of the Virtual Edge. While VMware SD-WAN is designed to optimize for both latency and throughput, the Virtual Edge itself is intended to support environments that can be latency-sensitive depending on deployment type (e.g., for real-time applications). Hence, latency sensitivity is an important consideration.

Option B: Requires a Microsoft Hyper-V Virtual Host

While Virtual Edges can be deployed on Hyper-V environments, VMware SD-WAN is platform-agnostic, meaning it can also run on VMware vSphere, KVM, and AWS environments. Therefore, requiring Microsoft Hyper-V specifically is not a mandatory factor for Virtual Edge scalability or performance in VMware SD-WAN. The focus should be on the edge’s compatibility with different virtualization environments.

Option D: Has a maximum performance of 4Gbps

This performance number is lower than 10Gbps, making it less favorable compared to the potential of 10Gbps, which is more scalable for large-scale environments. The 10Gbps maximum performance is preferable when discussing scalability for environments that require high throughput.

The two key factors for scalability and performance of the Virtual Edge in VMware SD-WAN are the maximum performance of 10Gbps and the requirement for SR-IOV for optimal performance. These two factors directly impact the virtualized edge’s ability to handle larger amounts of traffic with low latency, making them essential to highlight during the discussion.

Question 6

A customer's network is congested with no degradation of application performance. VMware SD-WAN implements schedulers that control QoS of outbound traffic from the VeloCloud Edge. Which option describes how this mechanism will work?

A. The Link Steering Policy will prevent packet loss by shaping transmit rates to match the local link bandwidth.
B. The Dynamic Bandwidth Measurement prevents packet loss by shaping transmit rates to match the local link bandwidth as well as the bandwidth of individual remote peers.
C. The Network Scheduler implements the QoS hierarchy and is the primary scheduler that influences how bandwidth is shared between edge peers, segments traffic classes, and flows.
D. The WAN Link Scheduler implements the QoS hierarchy and is the primary scheduler that influences how bandwidth is shared between edge peers, segments traffic classes, and flows.

Answer: D

Explanation:

VMware SD-WAN uses sophisticated mechanisms to manage Quality of Service (QoS) and optimize the use of available network bandwidth. Specifically, it implements WAN Link Schedulers to handle outbound traffic from the VeloCloud Edge in ways that improve network performance and efficiency. Let’s break down how each option works in this context:

Option D: The WAN Link Scheduler implements the QoS hierarchy and is the primary scheduler that influences how bandwidth is shared between edge peers, segments traffic classes, and flows.

This is the correct description. The WAN Link Scheduler in VMware SD-WAN is responsible for managing the traffic flow across the network by implementing Quality of Service (QoS) policies. It operates as the primary scheduler for outbound traffic, ensuring that bandwidth is distributed effectively between different edge peers. This includes segmenting traffic classes (for example, prioritizing real-time traffic like VoIP or video) and flows (to avoid congestion) based on the needs of the application or network. In essence, the WAN Link Scheduler is key in preventing congestion and maintaining application performance by appropriately managing available bandwidth.

Option A: The Link Steering Policy will prevent packet loss by shaping transmit rates to match the local link bandwidth.

While the Link Steering Policy is a feature within VMware SD-WAN used to dynamically choose the best available link for sending traffic, it does not directly implement QoS hierarchies or manage traffic flows. Link Steering is about selecting the optimal link for traffic but does not provide the detailed QoS management described in the question, such as shaping traffic or managing bandwidth across multiple peers.

Option B: The Dynamic Bandwidth Measurement prevents packet loss by shaping transmit rates to match the local link bandwidth as well as the bandwidth of individual remote peers.

Dynamic Bandwidth Measurement (DBM) is a mechanism used in VMware SD-WAN to gather real-time bandwidth data from the network. It helps understand how much bandwidth is available across different paths but does not directly influence how traffic is scheduled or segmented between peers. Therefore, while DBM contributes to network management, it doesn't handle the QoS hierarchy or traffic segmentation as described in the question.

Option C: The Network Scheduler implements the QoS hierarchy and is the primary scheduler that influences how bandwidth is shared between edge peers, segments traffic classes, and flows.

While the Network Scheduler is a valid component in managing traffic within VMware SD-WAN, it specifically manages the overall SD-WAN network performance. It’s more focused on high-level network management, rather than directly implementing detailed QoS hierarchy for outbound traffic as the WAN Link Scheduler does. Therefore, the WAN Link Scheduler is more appropriate for controlling QoS for outbound traffic from the VeloCloud Edge.

The WAN Link Scheduler is specifically designed to manage how outbound traffic is scheduled, ensuring that QoS policies are effectively applied to segments traffic classes and flows. This makes Option D the correct answer.

Question 7

Which two system properties configure the behavior of state monitoring, alert generation, and notification with regards to PKI? (Choose two.)

A. session.options.enablePki
B. enable.options.sessionPki
C. enable.default.pkisessions
D. session.options.pkiEnabled
E. session.default.pkiEnabled

Answer: A, D

Explanation:

In systems that deal with Public Key Infrastructure (PKI), monitoring, alert generation, and notification properties are critical to ensure proper security and system behavior. Let’s go over the system properties provided in the options and their relevance to PKI.

Option A: session.options.enablePki

This property is directly related to enabling or disabling the PKI functionality for the session. It’s used to determine whether PKI-based features are active for a given session. When enabled, it will allow the system to monitor the state of PKI certificates, generate relevant alerts, and notify administrators about the status of PKI keys and certificates.

Option B: enable.options.sessionPki

This option does not appear to be a standard or widely recognized system property in relation to PKI configurations. It seems to be incorrect or unrelated to the functionality of monitoring, alerting, and notifications concerning PKI. Therefore, it is not selected as a correct option.

Option C: enable.default.pkisessions

This system property doesn’t directly align with state monitoring or alert generation specifically for PKI behavior. It seems more related to default session configurations rather than directly impacting the alert generation and state monitoring of PKI. It’s therefore not a relevant choice for this question.

Option D: session.options.pkiEnabled

This property enables or disables PKI functionality for the session and is responsible for controlling whether PKI-based monitoring and alerts are active within the session. When enabled, it ensures that PKI certificate states are being monitored, and it generates relevant notifications and alerts based on the state of the PKI session. This is a key property for monitoring PKI states and notifications.

Option E: session.default.pkiEnabled

This option is closely related to the default behavior of PKI within a session. It is used to set the default behavior for PKI sessions, ensuring that any session created by default will have PKI enabled. While it may be involved in configuring the PKI behavior for a session, it is not as specific to state monitoring, alert generation, and notification as the selected options A and D.

The two properties that directly configure the behavior of state monitoring, alert generation, and notification with regards to PKI are session.options.enablePki and session.options.pkiEnabled. These properties control whether PKI functionality is enabled for monitoring, which is directly tied to generating alerts and notifications based on certificate status or expiration.

Question 8

Which statement accurately describes a characteristic of VMware SD-WAN Edge (VCE) clustering?

A. VCE branches will always be evenly distributed between cluster members, even following a Hub cluster member restart.
B. VMware SD-WAN Gateway/Controllers tells branches' VCE to which cluster member the overlay tunnels should be built.
C. An administrator is not able to manually rebalance Spokes in a Cluster via the VMware SD-WAN Orchestrator. This can only be done via the VMware SD-WAN Gateways/Controllers.
D. Branches VCEs will build overlay tunnels to all members of a VCE cluster.

Answer: B

Explanation:

When working with VMware SD-WAN and VCE (Virtual Cloud Edges), clustering is used to provide redundancy, resilience, and better performance by distributing the load across multiple Edge devices. Each cluster typically has a Hub and Spoke model, where the Spokes communicate with the Hub cluster members, and the overall configuration helps optimize traffic routing and load balancing.

Let’s break down each option and analyze its correctness:

Option A: VCE branches will always be evenly distributed between cluster members, even following a Hub cluster member restart.

This statement is incorrect. While VMware SD-WAN aims to optimize traffic and distribute load efficiently, the VCEs (Virtual Cloud Edges) in a cluster are not always evenly distributed between cluster members. This distribution is dynamic and depends on the specific conditions, such as the current load, network policies, and the availability of cluster members. Also, after a Hub cluster member restart, the VCEs may re-establish tunnel connections with different cluster members, but the load balancing isn’t guaranteed to always be even.

Option B: VMware SD-WAN Gateway/Controllers tells branches' VCE to which cluster member the overlay tunnels should be built.

This statement is correct. In VMware SD-WAN, Gateways or Controllers play a critical role in directing traffic and managing the creation of overlay tunnels between branch VCEs and cluster members. The VMware SD-WAN Orchestrator manages the configuration, and the Gateway/Controller ensures that the appropriate overlay tunnels are established between branch devices and cluster members based on network policies, topology, and availability.

Option C: An administrator is not able to manually rebalance Spokes in a Cluster via the VMware SD-WAN Orchestrator. This can only be done via the VMware SD-WAN Gateways/Controllers.

This statement is partially misleading. While it is true that the Gateways/Controllers play a significant role in the automatic load balancing of Spokes in the cluster, administrators can still configure and adjust the cluster settings via the VMware SD-WAN Orchestrator. The Orchestrator provides a management interface that allows for policy adjustments, cluster configurations, and optimization. However, fine-tuning the rebalancing may require interaction with the Gateway/Controller.

Option D: Branches VCEs will build overlay tunnels to all members of a VCE cluster.

This statement is incorrect. In most VCE clustering scenarios, branch VCEs do not need to establish overlay tunnels to all members of the cluster. Typically, the branch VCEs will establish overlay tunnels with primary cluster members or Hub devices, and traffic may be routed through these devices. Establishing tunnels to all cluster members is unnecessary and inefficient, as the cluster's management layer optimizes the traffic flow and connectivity.

The correct option is B because it accurately describes the role of the VMware SD-WAN Gateway/Controllers in managing and directing the establishment of overlay tunnels between branch VCEs and cluster members.

Question 9

A customer with many branches does not have MPLS connections for most branches. The branches need to access services available only at a MPLS service provider. Which type of VMware SD-WAN Gateway can be used to meet the customer’s requirement?

A. Secondary Gateway
B. Cloud Gateway
C. Primary Gateway
D. Partner Gateway

Answer: D

Explanation:

In the VMware SD-WAN architecture, different types of Gateways play specific roles in providing the required connectivity and service access. Given the scenario, where the customer has multiple branches but does not have MPLS connections for most branches and needs access to services that are only available via MPLS, the appropriate choice would be a Partner Gateway.

Let’s break down each option to understand why Partner Gateway is the best choice:

Option A: Secondary Gateway

A Secondary Gateway is typically used to provide additional redundancy for VMware SD-WAN deployments. Secondary Gateways help ensure that there is failover capability in the event that a Primary Gateway experiences issues. However, Secondary Gateways are not designed to facilitate access to external networks like MPLS connections or provide the type of service access required in this scenario. Therefore, this option is not suitable for the customer’s need to access MPLS-based services.

Option B: Cloud Gateway

A Cloud Gateway is a VMware SD-WAN Gateway that is deployed in a public cloud. It helps extend the SD-WAN architecture into the cloud environment and allows for cloud-to-cloud or branch-to-cloud connectivity. However, it is not designed specifically to handle MPLS services that exist outside of the cloud environment. This option does not provide the customer with access to MPLS services available through a service provider, so it doesn't meet the requirement of accessing MPLS services.

Option C: Primary Gateway

A Primary Gateway is the main entry point for the VMware SD-WAN network. It is generally used to connect branch offices to the SD-WAN fabric. However, like the Secondary Gateway, the Primary Gateway does not directly provide access to MPLS networks. The Primary Gateway is typically used for general SD-WAN operations, rather than to bridge external technologies like MPLS to VMware SD-WAN.

Option D: Partner Gateway

A Partner Gateway is designed to bridge VMware SD-WAN with MPLS networks or other third-party networks. It serves as the connection point for branches that do not have direct access to MPLS services but still need to communicate with MPLS-based networks. The Partner Gateway provides the necessary integration to allow branches to access MPLS services offered by the provider. This is the ideal solution for the customer's situation, where branches lack direct MPLS connections but need to access services that are only available over MPLS.

The Partner Gateway (Option D) is specifically designed to enable connectivity between VMware SD-WAN networks and external networks, such as MPLS, and is therefore the correct choice to meet the customer’s requirement of accessing MPLS services.

Question 10

A company that has a VMware SD-WAN Edge device is attempting to connect to a non-VMware infrastructure hosted in AWS. Which VMware SD-WAN Cloud VPN configuration should the customer's administrator configure to create the connection to this company in AWS?

A. Branch to VeloCloud Hubs
B. Branch to Non-VeloCloud Site
C. Branch to Cloud
D. Branch to Branch VPN

Answer: B

Explanation:

In VMware SD-WAN, the Cloud VPN configurations are designed to enable connectivity between VMware SD-WAN branches (or edge devices) and non-VMware infrastructure, such as external cloud environments (like AWS or other third-party services). Let's break down each option to determine which is the best fit for the scenario described.

Option A: Branch to VeloCloud Hubs

This configuration is used to connect VMware SD-WAN branches to VeloCloud Hubs (which are VMware SD-WAN Gateways or central points of communication). This is suitable for connecting VMware SD-WAN branches to the central infrastructure provided by VMware SD-WAN, not to non-VMware infrastructures like AWS. Therefore, this option is not appropriate for connecting to an AWS-hosted infrastructure.

Option B: Branch to Non-VeloCloud Site

This configuration is designed to establish a VPN connection between the VMware SD-WAN Edge device and non-VMware infrastructure, such as AWS, which is hosted outside the VMware SD-WAN fabric. It supports integration with cloud environments and other third-party network infrastructure. In this scenario, where the company needs to connect to AWS (a non-VMware infrastructure), this is the correct choice. The Branch to Non-VeloCloud Site configuration will create a secure connection to the non-VMware infrastructure in AWS.

Option C: Branch to Cloud

The Branch to Cloud configuration typically refers to a connection between a VMware SD-WAN Edge and a cloud service, but it's often used for services like SaaS applications or other cloud-hosted environments where VMware SD-WAN operates natively. It is not meant to connect to third-party infrastructures like AWS unless they are directly supported by VMware SD-WAN. Therefore, this option is not the best choice for connecting to a non-VMware-hosted AWS infrastructure.

Option D: Branch to Branch VPN

The Branch to Branch VPN configuration is used when you want to create a direct VPN tunnel between two VMware SD-WAN branches (or Edge devices). This is useful for connecting remote offices or different branch locations. However, it does not apply to connecting to non-VMware infrastructure like AWS, so it is not the correct solution for the current requirement.

For the scenario described, where a VMware SD-WAN Edge device needs to connect to a non-VMware infrastructure in AWS, the appropriate configuration is Branch to Non-VeloCloud Site (Option B). This will allow the VMware SD-WAN Edge to securely connect to the AWS-hosted infrastructure that is not part of the VMware SD-WAN network.