300-415 Implementing Cisco Catalyst SD-WAN Solutions Exam Topics and Questions

Architecture is where the exam grounds everything else. Before you can configure a policy, troubleshoot a tunnel, or deploy a controller, you need a precise mental model of which plane does what and which component lives where. This topic rewards candidates who know the boundaries between planes, not just the names. Get the relationships wrong here and you will misread scenario questions throughout the rest of the exam.

– Orchestration, management, and control planes

The SD-WAN Validator handles initial device authentication and NAT traversal. Its job is to introduce WAN Edges to the controller layer, and once that handshake is done, it steps out of the data path entirely. Knowing that distinction matters when a question describes a connectivity failure. The SD-WAN Manager is the management plane: it is where configuration templates live, where you push policy, and where monitoring dashboards run. It does not forward traffic and it does not make routing decisions.

The SD-WAN Controller owns the control plane. It runs OMP, the protocol that distributes routes, policies, and TLOC reachability across the fabric. OMP carries three route types that the exam tests separately: OMP routes (vRoutes), TLOC routes, and service routes. A TLOC is the combination of system IP, colour, and encapsulation that uniquely identifies a tunnel endpoint. Misidentifying what a TLOC contains is a common source of lost marks.

– Data plane, tunnels, and health detection

WAN Edge routers form the data plane. They build IPsec or GRE tunnels directly between sites without traffic passing through the controller. IPsec is the default; GRE is available where IPsec is not supported by an intermediate device. BFD runs inside every tunnel and provides sub-second liveness detection. The exam uses BFD state to signal whether a path is up or down in scenario questions, so you need to know what a BFD session failing actually means for traffic forwarding.

Multi-Region Fabric introduces a hierarchy of border and edge routers to scale the fabric across geographic regions. It changes how routes and TLOCs are summarised and advertised, and the exam expects you to know where that hierarchy breaks a standard flat-fabric assumption.

– Edge platforms and Cloud OnRamp variants

WAN Edge platforms range from physical ISR and ASR routers to virtual instances running as CSR or vEdge Cloud. The exam expects you to know capability boundaries, particularly which platforms support which features, rather than hardware specifications.

Cloud OnRamp extends SD-WAN optimisation toward cloud workloads in four distinct modes. For SaaS, the fabric measures per-application quality to each available internet exit and steers traffic to the best one. For IaaS, it automates transit VPC or VNet connectivity into AWS or Azure. Colocation mode places a WAN Edge inside a colo facility to serve as a regional anchor. Multicloud with Cloud and Interconnect adds provider-managed interconnect fabrics to the picture. The exam distinguishes these modes by use case, so knowing which mode applies to which cloud topology is the testable skill.

How Architecture is tested

At 20% of the exam, Architecture produces a significant share of items, and many of them are foundational for interpreting questions in later topics. Items typically present a scenario: a device cannot register, a tunnel is not forming, or a route is not being advertised, and the candidate must identify which plane or component is responsible. The trap is conflating the roles of the Validator, Manager, and Controller. Candidates who treat them as interchangeable lose marks on questions that hinge on exactly one component's function.

OMP is another reliable source of difficulty. Items reward knowing which route type carries which information and what happens when OMP goes down between a WAN Edge and the Controller. Cloud OnRamp questions tend to be scenario-based: a business requirement is described and you select the correct OnRamp mode. Reading the requirement carefully before the options is the discipline that separates right from wrong answers here. TLOC attribute questions are precise and unforgiving: all three attributes must be correct.

Where Architecture defines what the components are, Controller Deployment defines how you get them running and keep them running. This topic shifts from conceptual to procedural: the exam expects you to know the sequence of steps, the certificate trust chain, and the conditions under which the control plane fails to come up. Candidates who have only read about deployment without working through the order of operations tend to drop marks here on scenario-based troubleshooting items.

– Cloud versus on-premises hosting

Cloud-deployed controllers are managed by Cisco and remove most of the infrastructure burden from the operator. The exam does not test deep cloud provisioning steps, but it does expect you to understand what you give up in terms of customisation and what you retain in terms of operational responsibility.

On-premises deployment is where the detail lives. You need to know which hypervisors and public cloud platforms are supported as hosting environments, because the exam presents scenarios where a hosting choice constrains what you can do. Installing controllers on-premises follows a defined sequence: the Validator must be reachable before the Controller can register, and the Manager must be up before you can push configuration. Scalability and redundancy questions focus on cluster sizing for the Manager and the number of Controllers needed to support a given WAN Edge count. Getting the sequencing wrong in a scenario is the most common way candidates lose marks in this area.

– Certificates, device lists, and control plane troubleshooting

The certificate chain is the trust mechanism that lets WAN Edges authenticate to controllers. The exam tests the relationship between the root CA, the controller certificates, and the WAN Edge certificate or serial number entry in the Validator's allowed-list. A device that is not in that list will not form a control connection regardless of whether its certificate is valid. That distinction is a frequent trap.

Troubleshooting control plane connectivity means working through a layered checklist: underlay reachability first, then NAT traversal through the Validator, then OMP session establishment with the Controller. Items in this area reward candidates who apply that sequence rather than jumping to OMP before confirming the Validator session is up. Reading the output of show sdwan control connections and interpreting the state field is the kind of operational knowledge the exam expects here.

How Controller Deployment is tested

Controller Deployment items at 15% lean heavily on scenario and troubleshooting formats. A typical item describes a WAN Edge that cannot establish a control connection and asks you to identify the most likely cause given a set of symptoms. Items reward candidates who eliminate causes in the correct order: underlay, certificate trust, allowed-list entry, then OMP.

Certificate questions are precise. The exam rewards knowing which entity signs what and what happens when a serial number is missing from the Validator's white-list versus when the certificate itself is invalid. These are different failure modes with different fixes.

On-premises deployment questions often involve a constraint: a given platform or hypervisor is in use, and you must decide whether a particular deployment option is supported. Guessing from general networking knowledge tends to fail here because the answer depends on Cisco's specific support matrix. Redundancy questions reward knowing the minimum controller counts for a given scale, not just that redundancy exists.

Router Deployment shares the same 20% weight as Architecture, which tells you Cisco considers hands-on WAN Edge configuration as important as understanding the design. The scope here is broad: onboarding, tunnel configuration, routing protocol integration, and template management all sit under this topic. Candidates who have worked with SD-WAN in a lab will find it familiar territory, but the exam tests configuration logic precisely, and a single wrong parameter in a scenario can flip the answer.

– Onboarding and deployment models

WAN Edge onboarding follows one of two paths. Zero Touch Provisioning relies on the Validator and the Cisco cloud redirect service to point a new device at the right Manager automatically, requiring only that the device serial number is pre-loaded. Bootstrap onboarding uses a local configuration file to provide the Validator address directly, which is the approach used in environments without internet access at bring-up time. The exam distinguishes these by the conditions under which each is appropriate, not just by their names.

Data centre and regional hub deployments introduce topology considerations: a hub WAN Edge typically terminates more tunnels and carries a larger routing table than a branch device. The exam expects you to know how hub-and-spoke and full-mesh topologies affect TLOC advertisement and OMP route preference.

– Data plane configuration and tunnels

Circuit termination defines which physical or logical interfaces carry underlay traffic, and TLOC extension allows a router without a direct internet circuit to borrow another device's TLOC. The exam tests when TLOC extension is needed and what the forwarding implications are.

Dynamic tunnels are built on demand between WAN Edges using TLOC information distributed by the Controller. The exam expects you to understand the conditions that trigger tunnel establishment and what happens when a tunnel cannot be built dynamically, including fallback behaviour through a hub. Underlay-overlay connectivity covers the boundary between the SD-WAN overlay and traditional routed networks attached to the WAN Edge, including the mechanisms used to leak routes between the two domains.

– OMP, TLOCs, and routing protocol integration

OMP configuration on a WAN Edge is minimal by default, but the exam tests the knobs that matter: route redistribution into OMP, graceful restart behaviour, and the number of paths OMP will accept and advertise. TLOC configuration determines which colours are active on which interfaces, and colour selection affects path preference in application-aware routing policies later.

The routing protocol integration sub-topics cover OSPF, BGP, EIGRP, and VRRP as they operate on the service-side (LAN-facing) interfaces of a WAN Edge. The exam expects you to know how each protocol redistributes into and out of OMP and where route metrics are preserved or reset. VRRP is tested in the context of LAN-side redundancy, not WAN-side. Multicast support in SD-WAN is a describe-level topic: know the mechanism and its constraints rather than detailed configuration.

– Templates, configuration groups, and workflows

Feature templates and CLI templates are the two methods for pushing configuration from SD-WAN Manager to WAN Edges at scale. Feature templates abstract individual feature configurations into reusable objects that are assembled into a device template. CLI templates allow direct CLI delivery where a feature template does not exist. The exam tests which method is appropriate for a given scenario and what happens when a template is detached from a device.

Configuration groups, feature profiles, and workflows represent the newer configuration model introduced alongside the classic template approach. The exam expects you to understand the relationship between these constructs and when the newer model applies. Knowing that both models can coexist in a deployment, and what the migration path looks like, is the level of detail the exam rewards.

How Router Deployment is tested

Router Deployment items span the full range from straightforward recall to multi-step scenario analysis. Onboarding questions tend to be scenario-based: given a site's connectivity situation, identify the correct onboarding method and the prerequisite steps. Items reward knowing the ZTP preconditions precisely.

Data plane and tunnel questions often present a topology and ask what happens to traffic when a specific tunnel or circuit fails. Candidates who understand BFD's role in signalling path failure and OMP's role in withdrawing the corresponding TLOC route will find these tractable. Those who blur the two lose marks.

Template questions are a reliable source of difficulty. Items describe a configuration requirement and ask whether a feature template, a CLI template, or a configuration group is the right tool. The trap is assuming the newest model always applies. Routing protocol redistribution items reward knowing the default redistribution behaviour of each protocol into OMP and the attributes that OMP preserves. Reading scenario details about which protocol is in use at the branch before selecting an answer is the discipline that pays off here.

Policies is where the SD-WAN fabric becomes intentional. The architecture and deployment topics set up the infrastructure; this topic determines what traffic does on it. At 20% of the exam, policy questions demand that you understand not just what each policy type does but where it is applied, which plane enforces it, and how control and data policies interact. Candidates who treat policy as a configuration checklist rather than a logical system tend to misread scenario questions significantly.

– Control policies and their reach

Control policies run on the SD-WAN Controller and manipulate the OMP routing table: they can filter, modify, or redirect routes and TLOCs before they are distributed to WAN Edges. The exam tests the direction of policy application (inbound from a WAN Edge to the Controller versus outbound from the Controller to a WAN Edge) and what each direction can affect. A policy applied in the wrong direction in a scenario is a common trap.

Control policies are also the mechanism for shaping topology. A hub-and-spoke topology where branch-to-branch traffic must pass through a hub is enforced by a control policy that withholds branch TLOCs from other branches. The exam expects you to trace that logic from the policy configuration to the resulting traffic path.

– Data policies, segmentation, and DIA

Data policies run on WAN Edge routers and act on individual packets. They can match traffic by application, source, destination, or DSCP and then forward, drop, or redirect it. The exam tests the match-action structure and the order of operations when multiple policies could apply.

End-to-end segmentation uses VPN membership and topology constructs to isolate traffic groups across the fabric. VPN segmentation means a WAN Edge interface belongs to exactly one VPN, and inter-VPN communication requires an explicit service or leaking policy. Topology within a VPN determines whether sites can communicate directly or only through a hub.

Direct Internet Access policy breaks out specific traffic to a local internet circuit rather than backhauling it to a central exit. The exam tests the conditions under which DIA applies and how it interacts with application-aware routing when the preferred path is unavailable.

– Application-aware routing and AI-driven path selection

Application-aware routing (AAR) uses BFD-measured path metrics (loss, latency, jitter) to steer application traffic to the best available path. The exam tests the SLA class configuration: what thresholds trigger a path change, what the fallback behaviour is when no path meets the SLA, and how AAR interacts with standard OMP route preference.

AI-driven Predictive Path Recommendation extends AAR by using historical telemetry to anticipate path degradation before BFD thresholds are breached. The exam treats this as a describe-and-apply topic: know what problem it solves and under what conditions it is enabled, rather than its internal algorithm. Items reward selecting the right steering mechanism for a given application requirement, distinguishing between reactive AAR and predictive recommendation where the scenario gives you enough information to tell them apart.

How Policies is tested

Policy items are among the most scenario-heavy on the exam. A typical item describes a traffic behaviour requirement and asks which policy type, applied where, produces it. The discipline the exam rewards is identifying the enforcement point first: control plane on the Controller, or data plane on the WAN Edge. Candidates who skip that step and go straight to policy syntax tend to select a plausible-sounding option that enforces in the wrong place.

Segmentation questions often describe a topology with multiple VPNs and ask what configuration change would allow or block a specific traffic flow. Items reward understanding that VPN membership is not enough on its own when inter-VPN communication is involved.

AAR questions frequently present a scenario where an application is using a suboptimal path despite an SLA policy being configured. Items reward diagnosing whether the issue is in the SLA threshold, the fallback action, or the absence of BFD data on the relevant path. Predictive path recommendation items are currently at the awareness level: know when to recommend it, not how to tune it internally.

Security and QoS is the broadest topic by sub-topic count on this exam. It combines two distinct disciplines that share a common thread: both are enforced at the WAN Edge and both interact with the traffic classification decisions made in the Policies topic. The width of this topic is its main challenge. Candidates who study security features and QoS mechanics separately without connecting them to the data plane architecture tend to find the scenario questions harder than expected.

– Security features at the WAN Edge

Service insertion places a security appliance in the traffic path by redirecting flows from a WAN Edge to an external device and back. The exam tests the configuration model and the failure behaviour when the inserted service is unreachable.

The integrated security features (application-aware enterprise firewall, IPS, URL filtering, AMP, and SSL/TLS proxy) run as on-box services on supported WAN Edge platforms. The exam expects you to know which features require a separate licence or service node and which run natively. TrustSec integration allows SD-WAN to carry Cisco Security Group Tags in the overlay, enabling policy enforcement based on identity rather than IP address. The exam tests TrustSec at the integration level: how SGTs are propagated across the fabric and where enforcement occurs, not the TrustSec architecture itself.

– Cloud security integration

Cloud security integration offloads inspection to a cloud-delivered security stack rather than performing it on the WAN Edge. DNS security redirects DNS queries to a cloud resolver that blocks malicious domains before a connection is established. The exam tests this as a describe topic: know the traffic flow and the configuration trigger.

Secure Internet Gateway integration tunnels internet-bound traffic from a WAN Edge to a cloud security platform (Cisco Umbrella being the primary example) using GRE or IPsec. The exam expects you to understand when SIG is preferred over on-box inspection and how the SIG tunnel interacts with DIA policy configured in the Policies topic. Questions in this area often connect back to earlier topics, so reading the full scenario before selecting an option pays off.

– QoS on WAN Edge routers

QoS on a WAN Edge follows a standard model: mark traffic at ingress, queue it into forwarding classes, shape or police it at egress. The exam tests each mechanism individually and in combination. Marking sets the DSCP or CoS value used for classification downstream. Queuing assigns packets to forwarding queues with different scheduling behaviours. Scheduling determines the order and proportion in which queues are serviced. Shaping smooths output to a configured rate; policing drops or remarks traffic that exceeds a rate.

Per-tunnel QoS applies the shaping and scheduling configuration per IPsec tunnel rather than per physical interface, which matters when multiple tunnels share a single WAN circuit. Adaptive QoS adjusts the tunnel shaping rate dynamically based on measured available bandwidth. The exam tests the distinction between the two and when adaptive behaviour is appropriate.

– Application Quality of Experience

AppQoE features improve application performance on degraded or constrained WAN paths. TCP optimisation accelerates TCP flows by terminating and re-originating connections at the WAN Edge, removing the impact of WAN latency from the TCP slow-start and retransmission cycle. Data Redundancy Elimination (DRE) caches repeated data patterns and replaces them with short tokens, reducing effective bandwidth consumption for repetitive traffic.

Packet duplication sends copies of a packet across two different paths simultaneously, accepting the bandwidth cost to eliminate the impact of single-path packet loss. Forward Error Correction adds redundant data to a stream so the receiver can reconstruct lost packets without retransmission. AppNav is the service insertion framework that steers flows to AppQoE service nodes. The NGFW capability under AppQoE refers to next-generation firewall inspection integrated into the AppNav chain. The exam tests which AppQoE feature addresses which WAN impairment, making the match between symptom and remedy the core skill.

How Security and Quality of Service is tested

Security and QoS items at 15% cover a lot of ground, and the exam uses that breadth deliberately. A question may describe a traffic problem (high latency, packet loss, or a security compliance requirement) and ask which feature or combination of features resolves it. The trap is selecting a feature that addresses a similar-sounding problem rather than the specific one described.

QoS items reward precise knowledge of the difference between shaping and policing and between per-tunnel and adaptive QoS. Candidates who treat these as interchangeable lose marks on questions where the scenario specifies a dynamic bandwidth environment.

AppQoE questions reward matching the WAN impairment to the correct remedy: packet duplication for loss, FEC for loss with bandwidth to spare, TCP optimisation for latency affecting throughput, DRE for repetitive data. Security feature items tend to test integration points rather than feature internals: how does a feature connect to the rest of the fabric, and what breaks if it is misconfigured or unavailable? That framing is worth keeping in mind when you read the options.

Management and Operations closes the exam at 10%, the lightest weighted topic. Do not treat that as permission to skip it. The items here tend to be direct and reward candidates who know SD-WAN Manager's operational capabilities precisely. After five topics of configuration and policy logic, this topic shifts to monitoring, authentication, and lifecycle management, areas where a working knowledge of the Manager interface pays off more than theoretical understanding.

How Management and Operations is tested

Items in this topic are generally more recall-oriented than the scenario-heavy questions in Architecture or Policies, but precision still matters. Authentication configuration questions test role-based access, RADIUS and TACACS+ integration with the Manager, and what each authentication method affects. Monitoring and reporting questions describe a network condition and ask which Manager view or dashboard surfaces the relevant information.

REST API monitoring items are at the awareness level: know that the Manager exposes a northbound API, what categories of data it can return, and when API-based monitoring is preferable to the GUI. Inventing API endpoint details the exam has not asked about is a trap candidates set for themselves.

Software image management questions cover the workflow for staging, validating, and activating a new WAN Edge image from the Manager. Items reward knowing the sequence of steps and the rollback behaviour if an upgrade fails. The 10% weight means this topic will not make or break your result on its own, but leaving it unprepared converts easy marks into unnecessary losses.