Deck 2: Nuage Networks Virtualized Network Services (VNS) Fundamentals

Question 1

Which of the following statements is NOT true regarding the integration of the data center (VCS solution) and branch office (VNS solution)?

A) The VSD in the data center and the VSD for the branch office are running XMPP to synchronize with each other.
B) The VSC in the data center and the VSC for the NSG branch office are running BGP to update each other's forwarding table.
C) With integration, the virtual machines in the data center and the devices in the branch office can belong to the same overlay network.
D) Traffic between the virtual machines in the data center and the devices in the branch office are forwarded in VXLAN tunnels.

Answer 1

The VSD in the data center and the VSD for the branch office are running XMPP to synchronize with each other.

Question 2

What will happen when a virtual/physical appliance in a subnet with encryption enabled is trying to communicate with a virtual/physical appliance in a subnet with encryption disabled?

A) The communication is not possible and traffic will be dropped.
B) Traffic will be forwarded in an unencrypted VXLAN tunnel.
C) Traffic will be forwarded in an unencrypted VXLAN over IPsec tunnel.
D) The communication between these two subnets is only possible through service chaining.

Answer 2

Traffic will be forwarded in an unencrypted VXLAN over IPsec tunnel.

Question 3

Which of the NAT-T variants creates a NAT table similar to the diagram?

A) Symmetric mapping
B) Port restricted mapping
C) Address restricted mapping
D) Endpoint-independent mapping

Answer 3

Address restricted mapping

Question 4

Which statement is FALSE regarding the vport?

A) NSG vPorts are associated with access ports.
B) There are four types of vPorts: VM, container, host and bridge.
C) The NSG's vPorts are typically host vPorts.
D) One vPort can only belong to one subnet or L2 domain.

Question 5

Which statement about ACL entries is FALSE?

A) They can track both TCP and UDP flows.
B) They can be created in either ingress or egress directions.
C) A packet in the direction of the stateful ACL rules will automatically create a "related" rule in the reverse direction.
D) The automatically created rules will not go away until the ACL is manually deactivated and reactivated.

Question 6

What type of NAT is used so that any external host can send to iAddr: iPort by sending traffic to eAddr: ePort? (i=internal, e=external)

A) Full-cone NAT
B) Address-restricted NAT
C) Port-restricted NAT
D) Symmetric NAT

Question 7

Which component of the VNS solution belongs to the data plane?

A) VSD (Virtualized Services Directory)
B) VSC (Virtualized Services Controller)
C) VRS (Virtual Routing and Switching)
D) NSG (Network Services Gateway)

Question 8

Which of the following connections does not exist during the VNS bootstrapping process?

A) Proxy to NSG
B) Proxy to VSD
C) NSG to VSC OpenFlow-TLS
D) VSC to proxy

Question 9

Which of the following is TRUE about NSG dual uplink?

A) It only provides redundancy for data traffic.
B) Traffic is load balanced between primary and secondary links.
C) One primary VSC is selected on each uplink.
D) Both uplinks can be connected to the same network or to two different networks.

Question 10

Which statement regarding the forwarding policies used in VNS for traffic redirection (also known as service chaining) is FALSE?

A) Forwarding policies can be applied to ingress and egress traffic.
B) Redirection targets should be created in advance and associated with vports.
C) Redirection targets cannot be associated with bridge vports (physical appliances).
D) Traffic between two branch offices or between two devices in the same branch office can be redirected to an appliance located in the data center.

Question 11

Which statement about the security policies implemented by Nuage Networks is FALSE?

A) A security policy is composed of entries defining the conditions to redirect a packet.
B) Ingress policy acts on traffic flow towards the network (or the OVS component).
C) The security policies are defined at the domain level.
D) The security policies deployed on the VSD are distributed ACLs implemented on the VRSs and NSGs.

Question 12

Which one of the following statements is correct regarding bridge vPorts in the VNS solution?

A) A DHCP pool can be configured on a subnet connected to an NSG bridge vPort, the NSG then becomes the DHCP server.
B) VSD is in charge of the IP address assignment to the devices behind the NSG vPort.
C) There must be more than one device behind the bridge vPort.
D) The static IP to MAC mapping configuration is not on the bridge vPort.

Question 13

Please, refer to the diagram. If the two VMs are on the same subnet, what is MAC address X4?

A) X4 = MAC1
B) X4 = MAC4
C) X4 = MAC11
D) X4 = MAC12

Question 14

Which of the following users can create NSG profiles/templates?

A) CSP root group user
B) CSP CMS group user
C) Enterprise designer group user
D) Enterprise admin group user

Question 15

Which of the following is false regarding overlay solutions?

A) An 'overlay network' is a virtual abstraction built on top of an existing physical network.
B) Both VXLAN and TRILL are host-centric overlay solutions.
C) Nuage Networks VNS uses a VXLAN-based overlay solution.
D) Overlay networks are totally transparent to their physical underlay network.

Question 16

Which of the following is FALSE regarding VNS bootstrapping?

A) The bootstrapping configuration templates on VSD ensures NSG configuration conformance.
B) NSG is ready for dispatch without prior configuration.
C) It solves the problem of site CPE activation without having to send a skilled technician on site.
D) NSG exchanges the plain text proprietary bootstrap protocol with VSD.

Question 17

Which of the following statements about the NSG support for NAT-T is TRUE?

A) NAT-T is a network port level attribute.
B) NAT-T NPM probes are disabled by default.
C) Direct Symmetric to Symmetric mapping is supported.
D) Address restricted mapping requires the use of two NPM probes.

Question 18

Which of the following is true regarding the VLAN-based VPN on Nuage Networks NSG?

A) The NSGs use OpenFlow to exchange routing information between each other.
B) The NSGs use VXLAN to exchange routing information between each other.
C) The NSGs forward overlay traffic between each other by using an OpenFlow tunnel.
D) The NSGs forward overlay traffic between each other by using a VXLAN tunnel.

Question 19

Which of the following statements about the NSG vports is TRUE?

A) The NSG responds to DHCP requests on a host vport by default.
B) A host MAC address is dynamically leaned on a host vport.
C) A host vport allows multiple devices to be connected through a switch.
D) IP address assignment is handled by the NSG for a host on a host vport.

Question 20

Which of the following is true regarding the IPsec VPN between the NSGs?

A) It encrypts and encapsulates the VXLAN traffic.
B) The key for IPsec needs be manually configured on NSGs and must match each other.
C) The IPsec tunnel can be directly terminated by VRS in a data center.
D) To have IPsec VPN, an encryption function needs to be enabled at each individual NSG.

Question 21

Which protocol is used between VSAP and the VSC?

A) XMPP
B) OpenFlow
C) BGP and OSPF or ISIS
D) SNMP

Question 22

Which of the following statements about the Nuage Networks SD-WAN portal is TRUE?

A) It runs directly on any Linux-based bare metal server.
B) It is packaged as a docker container.
C) It is deployed as a KVM, Hyper-V or ESXi virtual machine.
D) It must be hosted in a public cloud such as AWS.

Question 23

During VNS automated site activation, the domain design and attributes are configured on which of the following device?

A) VSD (Virtualized Services Directory)
B) VSC (Virtualized Services Controller)
C) NSG (Network Services Gateway)
D) Installer PC

Question 24

Which of the following is a challenge facing enterprise WAN?

A) Manual provisioning slows down the new site turn-up.
B) There is no Internet access at the remote office.
C) OPEX is very high whereas CAPEX is low.
D) MPLS VPN is not supported on CPEs.

Question 25

Which of the following statements about the SD-WAN portal is TRUE?

A) The SD-WAN portal is an optional addition to the Nuage Networks VNS solution.
B) The SD-WAN portal cannot be deployed as a high availability cluster.
C) The SD-WAN portal is configured either by the Graphical User Interface (GUI) or a Command Line Interface (CLI).
D) The SD-WAN portal cannot be used to bootstrap NSGs.

Question 26

Which of the following is NOT a function of Nuage Networks VNS?

A) Automation of the enterprise WAN
B) Virtualization of the branch office CPE
C) Orchestration of cloud networks
D) Providing unified policy across the data center and enterprise WAN

Question 27

Which of the following is true regarding the certificate needed for VNS deployment?

A) CA (Certificate Authority) runs as a service on the utility host.
B) CA (Certificate Authority) only generates a certificate for the VSC.
C) With the certificate, the communication between the VSD and VSC can be encrypted in IPsec.
D) With the certificate, the communication between the VSC and NSG can be encrypted in TLS.

Question 28

Which of the following statements about uplink ingress policing is FALSE?

A) It can be applied to the overlay.
B) It can be applied to the underlay.
C) VSD raises an alarm when the policing threshold is crossed.
D) The policer can be configured by enterprise admin.

Question 29

Which of the following is NOT a VSAP web application?

A) Service Navigator
B) Security Management
C) Inventory Management
D) Fault Management