Enterprise WANs, VPNs, and SD-WAN

Introduction

A wide area network (WAN) connects geographically separated offices, data centres, cloud environments, mobile users, suppliers, and customers. Unlike a local area network, an enterprise WAN crosses facilities and provider domains that the organisation may not own or directly control. Its design therefore involves more than selecting bandwidth. Engineers must balance availability, latency, security, scalability, operational control, regulatory obligations, and cost.

Enterprise WAN technology has evolved from private leased circuits and Frame Relay to MPLS, broadband Internet, cellular access, satellite systems, encrypted Internet VPNs, and software-defined WAN (SD-WAN). These technologies are not mutually exclusive. A modern enterprise commonly combines several of them and selects paths according to application requirements.

The central design challenge is to deliver predictable business outcomes over infrastructure with different performance and trust characteristics. A payment system may require low loss and strong confidentiality; a video application may require high throughput and low jitter; routine software updates may tolerate delay but benefit from inexpensive bandwidth.

Learning Objectives

By the end of this chapter, students should be able to:

1. Compare leased, broadband, cellular, satellite, MPLS, and Internet-based WAN services.
2. Explain encapsulation, tunnelling, encryption, and VPN architectures.
3. Describe SD-WAN overlays, controllers, policies, and path-selection mechanisms.
4. Evaluate WAN designs using performance, security, cost, resilience, and SLA criteria.
5. Analyse an enterprise WAN scenario and recommend an appropriate architecture.
6. Identify governance, operational, and ethical issues associated with enterprise connectivity.

1. WAN Design as a Systems Problem

A WAN is best understood as three related planes:

• Underlay: The physical and provider IP infrastructure, such as fibre, cable, 5G, MPLS, or satellite.
• Overlay: Logical connectivity built over one or more underlays, commonly using IPsec, GRE, VXLAN, or provider VPN mechanisms.
• Control and management: Routing, authentication, policy distribution, monitoring, automation, and troubleshooting.

The underlay determines the possible performance envelope. The overlay determines logical reachability and security. The control system determines how the network reacts to failures and changing application requirements.

Important performance measures include bandwidth, latency, packet loss, jitter, availability, and mean time to repair. Bandwidth is a rate, normally expressed in bit/s. Latency is the time required for a packet to travel between endpoints. Jitter is variation in packet delay. Loss is the proportion of packets that fail to arrive. These metrics interact: a high-capacity link can still be unsuitable for voice if it has excessive delay, loss, or jitter.

For a data transfer of size S bits over a link with capacity C bit/s, the ideal serialization time is:

Here, T_s is serialization time in seconds, S is the data size in bits, and C is link capacity in bit/s. The formula assumes no protocol overhead, queuing, propagation delay, retransmission, or shaping. For example, transmitting 800 Mbit over a 100 Mbit/s link takes 800 ÷ 100 = 8 seconds ideally. Real completion time is normally longer.

For a path containing several sequential links, bottleneck capacity is approximately:

This applies when traffic must traverse all links and no parallel load-sharing changes the result. Increasing a non-bottleneck link does not necessarily increase end-to-end throughput.

A useful availability model for independent sequential components is:

where each A_i is component availability as a fraction between 0 and 1. The independence assumption is often unrealistic because a shared duct, power source, router, or provider can create correlated failures. Consequently, physical diversity and provider diversity are as important as nominal SLA percentages.

2. Enterprise WAN Access Options

2.1 Leased Lines

A leased line is a dedicated, usually symmetric circuit supplied between defined locations. Ethernet private circuits, wavelength services, and synchronous optical services are examples. The customer receives predictable capacity and generally strong service assurance.

Advantages include stable latency, symmetric upload and download, strong provider accountability, and suitability for real-time or critical traffic. Disadvantages include high recurring cost, installation delays, limited availability in remote areas, and potentially expensive upgrades. A leased line is not automatically encrypted; confidentiality must be provided by higher-layer encryption when required.

Leased services are appropriate for data-centre interconnection, high-value branch offices, financial systems, and sites where predictable performance is more important than price.

2.2 Broadband Internet

Cable, fibre-to-the-premises, digital subscriber line, and fixed wireless broadband provide comparatively inexpensive access. They are widely available and often offer high download capacity. However, service may be asymmetric, congestion can vary by time of day, public addressing may be unavailable, and repair commitments may be weaker than for business circuits.

Broadband becomes substantially more useful when combined with IPsec VPNs, traffic measurement, multiple providers, and SD-WAN path selection. Its low price does not remove the need for capacity planning or security controls.

2.3 Cellular WAN

4G and 5G networks provide rapid deployment and mobility. A cellular router can serve as a primary connection for temporary sites or a backup for fixed access. Advantages include geographic flexibility, fast activation, and independence from local wired infrastructure. Limitations include radio coverage, signal quality, variable congestion, data caps, carrier dependence, changing public IP addresses, and possible difficulty obtaining low-latency service guarantees.

Antenna placement, SIM governance, private access point names, carrier diversity, and power protection are important engineering considerations. Cellular should not be treated as a single technology: performance depends on spectrum, radio conditions, backhaul, network slicing arrangements, and local cell loading.

2.4 Satellite WAN

Satellite connectivity can reach ships, rural communities, emergency sites, and locations without terrestrial infrastructure. Traditional geostationary systems have substantial propagation delay because the satellite is far from Earth. Low-Earth-orbit systems can reduce latency but may introduce changing satellite visibility, terminal complexity, weather effects, and service-area constraints.

Satellite is valuable for resilience and coverage, but interactive applications, encrypted tunnels, and TCP performance require careful testing. Applications should use local caching, protocol optimisation, or asynchronous operation where possible.

2.5 MPLS Provider VPNs

Multiprotocol Label Switching (MPLS) forwards packets using labels and provider-defined paths. In an MPLS Layer 3 VPN, the provider maintains separate virtual routing and forwarding instances for customers. The provider network can offer traffic engineering, class-of-service treatment, and strong operational support.

MPLS VPNs provide logical separation and predictable service, but logical separation is not the same as end-to-end encryption. A customer requiring confidentiality against provider or infrastructure compromise should use encryption over the MPLS service. MPLS is also typically more expensive and slower to modify than commodity Internet access.

2.6 Internet-Based WANs

An Internet WAN uses encrypted tunnels over one or more Internet connections. It can scale rapidly and exploit multiple access providers. Its weaknesses are variable routing, dependence on public infrastructure, exposure to denial-of-service threats, and less control over intermediate networks.

Internet-based WANs are highly effective when paired with strong cryptography, resilient access, continuous measurement, and application-aware routing. They are not inherently inferior to private networks; suitability depends on requirements and operational discipline.

Comparison of WAN Options

3. Tunnelling and VPN Concepts

Encapsulation

Encapsulation places one protocol unit inside another. A VPN gateway may encrypt an original IP packet, add an authentication field, and place the result inside a new IP packet addressed to the remote gateway. The intermediate network forwards the outer packet without understanding the protected inner traffic.

A tunnel has two endpoints, a packet format, a forwarding method, and usually a policy defining which traffic enters it. Tunnels may be configured statically or created dynamically through negotiation.

IPsec

IPsec is a family of protocols for protecting IP traffic. Its principal data-plane mechanisms are Authentication Header (AH) and Encapsulating Security Payload (ESP). ESP is widely used because it can provide confidentiality, integrity, authentication, and replay protection. Tunnel mode protects an entire original IP packet and adds a new outer IP header; transport mode protects the payload while retaining the original IP header.

Internet Key Exchange version 2 (IKEv2) negotiates security associations, authenticates peers, establishes cryptographic keys, and supports rekeying. Authentication may use certificates, pre-shared keys, or an external identity system. Strong deployments use modern algorithms, protected credentials, certificate lifecycle management, and carefully limited traffic selectors.

Encryption provides confidentiality, but it does not automatically provide availability, endpoint security, correct authorisation, or protection from traffic analysis. Administrators must also consider key compromise, clock accuracy, certificate revocation, logging, and denial-of-service resistance.

GRE, VXLAN, and Other Tunnels

Generic Routing Encapsulation (GRE) can carry diverse protocols and routing traffic, but GRE alone does not encrypt or authenticate packets. It is commonly combined with IPsec. VXLAN encapsulates Layer 2 frames in UDP and is primarily used for data-centre virtual networks, although similar overlay principles appear in broader network designs. L2TP may provide tunnelling but is not, by itself, a complete confidentiality mechanism.

Remote-Access and Site-to-Site VPNs

A site-to-site VPN connects networks through gateways. A remote-access VPN connects an individual device to an enterprise gateway. Full-tunnel remote access sends all user traffic through the enterprise; split tunnelling sends only selected traffic through it. Split tunnelling can reduce load but may expose enterprise access to untrusted local networks and complicate monitoring.

Zero Trust Network Access (ZTNA) is related but distinct. It grants access to specific applications based on identity, device posture, context, and policy rather than assuming that membership of a VPN implies broad network trust.

4. SD-WAN Architecture and Operation

SD-WAN separates policy and control from packet forwarding. A typical architecture contains:

• Edge devices at branches, campuses, cloud points of presence, or data centres.
• Orchestrators and controllers that distribute configuration, identity, certificates, and policy.
• Secure overlays that use tunnels across broadband, MPLS, cellular, or other underlays.
• Analytics systems that collect measurements and report application and path health.

The term “software-defined” does not mean that hardware is irrelevant. Forwarding devices still perform routing, encryption, quality-of-service processing, and often firewalling. The defining feature is centralised or logically centralised intent and policy, combined with automated overlay management.

A controller may express a policy such as: “Use the lowest-latency path for voice, prefer MPLS for payment transactions when loss is below the threshold, and send ordinary web traffic directly to the Internet.” The edge measures path conditions and selects a compliant path. Some systems duplicate packets over multiple paths for especially sensitive traffic, at the cost of bandwidth.

Path Selection Metrics

Common metrics include one-way delay, round-trip time, loss, jitter, available capacity, cost, and application classification. A simple conceptual path score can be written as:

where D_p, L_p, J_p, and C_p are normalised delay, loss, jitter, and cost measures for path p, and the non-negative weights w_d, w_l, w_j, and w_c express policy priorities. The weights must be calibrated and their sum is commonly set to 1, although this is a modelling convention rather than a networking law. A lower score is preferred. Production systems may use thresholds, priorities, hysteresis, or machine-learning-assisted decisions instead of this simple linear model.

A policy should avoid excessive path switching. If a path alternates around a threshold, packets may reorder, sessions may experience disruption, and troubleshooting becomes difficult. Hysteresis, hold-down timers, and minimum observation periods reduce instability.

Application-Aware Routing

Application identification may use ports, deep packet inspection, domain information, endpoint agents, or cloud integration. Classification must be treated cautiously because encryption, protocol changes, and shared hosting can make identification uncertain. Policies should specify fallback behaviour when classification fails.

Direct Internet breakout can improve cloud and SaaS performance by avoiding unnecessary backhaul through a central data centre. It also moves security enforcement toward branch firewalls, secure web gateways, cloud security services, or Security Service Edge platforms. This is an architectural change, not merely a routing shortcut.

Overlay Topologies

A hub-and-spoke topology is simple and centralises inspection, but it can create bottlenecks and inefficient paths. Full mesh supports direct communication but increases control complexity. SD-WAN can create dynamic partial meshes: direct paths are established for selected applications while other traffic uses hubs or security services.

Consideration must be given to route summarisation, overlapping address spaces, multicast, Quality of Service markings, IPv6, cloud route exchange, and failure behaviour. An overlay that hides underlay problems can simplify operations, but it can also make diagnosis difficult unless both layers are observable.

Figure: SD-WAN edges use several underlays while the controller distributes policy and the encrypted overlay provides logical connectivity.

5. Security, Performance, and Cost Evaluation

Security

A WAN security design should address confidentiality, integrity, authentication, authorisation, segmentation, endpoint security, logging, and incident response. Security controls include IPsec, stateful firewalls, secure management channels, multifactor authentication, certificate-based identity, least privilege, route filtering, DNS security, secure boot, and software patching.

Central orchestration creates operational efficiency but also concentrates risk. A compromised controller or administrator account can affect many sites. Strong role-based access control, approval workflows, backups, offline recovery procedures, configuration versioning, and independent monitoring are essential.

Performance

Performance objectives should be written as measurable service requirements. For example, a voice class might require one-way delay below a specified threshold, low loss, and controlled jitter. The exact thresholds depend on codec, application design, buffering, and business tolerance; generic thresholds should not be copied without testing.

Traffic engineering should consider overhead. If an encrypted tunnel adds H bytes of headers to a packet of P bytes, the payload efficiency is:

where η is dimensionless efficiency. This simplified expression excludes lower-layer framing and assumes one packet with payload P and overhead H. Small packets generally suffer greater proportional overhead. Path MTU discovery, fragmentation, and TCP maximum segment size adjustments should be tested, particularly when multiple encapsulations are nested.

Cost

Total cost of ownership includes installation, recurring access charges, equipment, licences, support, monitoring, cloud security services, staff time, outages, and migration. A low monthly circuit price may be uneconomic if it requires extensive manual operations or causes costly downtime.

A simple annualised cost model is:

where R is monthly recurring cost, I installation and migration cost allocated to the year, L licence cost, O operational cost, and S support and security-service cost. This is an accounting model, not a universal formula; depreciation, risk, taxes, and outage impact may need separate treatment.

Service-Level Agreements

An SLA should define the service boundary, availability measurement, latency and loss objectives, repair time, maintenance notification, escalation, reporting, service credits, exclusions, and measurement method. “99.9% availability” is incomplete without a measurement interval and definition of failure. For a 30-day month of 43,200 minutes, 99.9% availability permits approximately:

This assumes the SLA percentage applies uniformly to the whole month and excludes no special conditions. A provider may measure only its access circuit, while the customer experiences failure from power, LAN, DNS, or a remote service. End-to-end service objectives must therefore supplement provider SLAs.

6. Design and Implementation Method

A disciplined WAN project normally follows these stages:

1. Document business requirements. Identify sites, applications, users, regulatory constraints, recovery objectives, and growth assumptions.
2. Classify traffic. Separate voice, video, transactional, interactive, bulk, management, and recreational traffic.
3. Inventory the current state. Record addressing, routing, circuits, contracts, devices, dependencies, and failure history.
4. Measure the baseline. Collect delay, loss, jitter, utilisation, availability, and application response data at representative times.
5. Select underlays. Use geographic and provider diversity where risk justifies it. Verify IPv4/IPv6, public addressing, handoff, MTU, and support arrangements.
6. Design the overlay. Define tunnel endpoints, encryption, routing, segmentation, topology, and cloud connectivity.
7. Define policy. Specify application classes, path thresholds, fallback paths, security inspection, and administrative roles.
8. Pilot and test. Test failover, brownouts, congestion, controller loss, certificate expiry, MTU issues, routing loops, and recovery procedures.
9. Migrate incrementally. Use rollback plans and maintain an accurate change record.
10. Operate continuously. Monitor user experience, underlay health, overlay state, security events, and SLA performance.

A brownout is a degraded service that remains technically available. SD-WAN designs must detect brownouts, not only complete link failures. Synthetic probes, application telemetry, and end-to-end tests are valuable because interface-up status is not equivalent to useful connectivity.

7. Illustrative Case: Regional Health Network

Background

A fictional regional health network operates a headquarters, six clinics, two small laboratories, and a cloud-hosted electronic health-record service. Clinics currently use expensive MPLS circuits. Internet access is locally available but unmanaged. Cellular service is strong at five clinics and satellite is available at the most remote laboratory.

Problem

The organisation wants to reduce recurring cost while preserving access to clinical systems. It must protect patient information, maintain operation during circuit failure, support voice and video consultation, and provide auditable administrative access. A simple replacement with consumer broadband would reduce cost but would not address security, path variability, or operational visibility.

Analysis

The clinical application is sensitive to delay and interruption but transfers relatively small records. Video consultation requires controlled loss and jitter. Backups and software updates can use inexpensive paths at scheduled times. The remote laboratory cannot depend on terrestrial broadband and needs cellular or satellite resilience.

The network team identifies correlated risks: two clinics receive circuits through the same building entry point, and all sites currently depend on one provider’s monitoring portal. The team therefore evaluates provider and physical-path diversity rather than merely adding a second logical tunnel.

Approach and Solution

The proposed design uses:

• One MPLS or business-fibre circuit at major clinics for predictable primary service.
• Independent broadband at clinics where a separate physical route is available.
• 5G routers as backup at five clinics.
• Satellite backup for the remote laboratory, with local caching and asynchronous transfer where possible.
• IPsec SD-WAN tunnels across all underlays.
• Application-aware policy prioritising clinical transactions and voice, while directing bulk transfers to lower-cost paths.
• Segmentation separating clinical devices, guest access, medical equipment, voice, and management.
• Certificate-based device identity, multifactor administrator authentication, central logging, and restricted controller roles.
• Local Internet security enforcement and cloud security integration for SaaS traffic.

The pilot deliberately disconnects circuits, introduces packet loss, expires test certificates, and verifies that traffic does not bypass required inspection. It also measures the impact of satellite delay on application sessions.

Outcome

The illustrative organisation reduces dependence on a single provider, obtains better visibility into application performance, and lowers recurring access cost. It does not eliminate MPLS everywhere because several sites still benefit from its predictable service and contractual support. The result is a hybrid WAN rather than a technology replacement programme.

Learning Points

The case demonstrates that WAN decisions should be based on application and risk requirements. SD-WAN can combine heterogeneous links, but it cannot create capacity where none exists, remove satellite propagation delay, or compensate for poor identity governance. Resilience depends on physical diversity, tested procedures, and operational capability as much as on software features.

8. Limitations, Governance, and Contemporary Developments

SD-WAN products differ substantially in terminology, controller architecture, interoperability, licensing, and telemetry. Proprietary features can create vendor lock-in. Migration may expose inconsistent addressing, undocumented firewall rules, legacy applications, or incompatible routing assumptions. Organisations should demand exportable configurations, documented APIs, clear support boundaries, and exit plans.

Cloud adoption has shifted WAN boundaries. Users and applications may be distributed across SaaS, public-cloud regions, private data centres, and edge locations. Secure access service edge (SASE) combines networking and security functions delivered partly from cloud points of presence. SASE is an architectural direction rather than a guarantee of performance or security; identity, policy, inspection location, and data residency still require explicit design.

Automation and artificial intelligence can assist anomaly detection, capacity forecasting, configuration generation, and root-cause analysis. Automated recommendations must be governed because inaccurate application classification or a mistaken remediation can affect many sites simultaneously. Human approval, testing, explainable alerts, audit trails, and rollback remain necessary for high-impact changes.

Privacy and regulatory governance are especially important in healthcare, finance, education, and government. Telemetry may contain user identifiers, domain names, device information, or metadata about sensitive activity. Collection should be proportionate, access-controlled, retained only as long as justified, and handled according to applicable law and organisational policy. Encryption key custody, cross-border provider processing, lawful access, and incident notification should be addressed contractually and technically.

Best-Practice Checklist

• Define business and application requirements before choosing a WAN product.
• Separate underlay, overlay, and management-plane failure analysis.
• Use encryption when confidentiality is required; do not confuse MPLS separation with encryption.
• Design physical, provider, power, and geographic diversity.
• Measure delay, loss, jitter, utilisation, and user experience continuously.
• Use application-aware policies with explicit thresholds and fallback behaviour.
• Control MTU and tunnel overhead; test large and small packets.
• Protect controllers with strong identity, least privilege, logging, and recovery plans.
• Include brownout detection and failback stability in testing.
• Negotiate measurable SLAs and verify provider measurements independently.
• Plan licensing, interoperability, configuration export, and exit strategies.
• Review privacy, data residency, telemetry retention, and regulatory requirements.

Chapter Summary

Enterprise WAN design is a multidimensional decision involving access technology, overlay architecture, security, performance, cost, availability, and governance. Leased lines and MPLS offer predictable managed service, while broadband provides economical capacity. Cellular supplies mobility and rapid deployment; satellite extends reach to difficult locations but may impose significant delay. Internet VPNs provide flexible connectivity when protected by strong encryption and operational monitoring.

Tunnelling encapsulates traffic across an intermediate network. IPsec can provide confidentiality, integrity, authentication, and replay protection, but secure connectivity also requires sound identity, routing, segmentation, endpoint, and management controls. SD-WAN builds policy-driven encrypted overlays across heterogeneous underlays. Its value lies in centralised intent, continuous measurement, application-aware routing, and automated failover—not in eliminating the physical limitations of access networks.

A sound evaluation considers total cost of ownership, end-to-end performance, correlated failure, SLA definitions, operational maturity, and regulatory obligations. The most effective enterprise WAN is usually hybrid, measured continuously, tested under failure, and aligned with business risk.

Key Terms

Underlay: The physical or provider network carrying WAN traffic.

Overlay: A logical network constructed over one or more underlays.

Leased line: A dedicated telecommunications circuit supplied between specified endpoints.

MPLS: A forwarding technology using labels and provider-controlled paths.

Provider VPN: A logical customer network implemented within a service provider infrastructure.

Tunnel: A logical path that encapsulates one protocol unit inside another.

IPsec: A suite of protocols that protects IP communications.

ESP: IPsec Encapsulating Security Payload, commonly used for encrypted IP traffic.

IKEv2: A protocol for negotiating IPsec security associations and cryptographic keys.

SD-WAN: Software-defined wide area networking using policy-driven overlays across multiple transports.

Orchestrator: A management system that coordinates configuration, policy, and lifecycle operations.

Path selection: The process of choosing a WAN path using policy and measured conditions.

Jitter: Variation in packet delay.

Brownout: Degraded service that remains technically reachable.

SLA: A contractual statement of measurable service objectives and remedies.

Split tunnelling: Sending only selected traffic through a VPN while other traffic uses a local path.

SASE: An architecture combining network connectivity and cloud-delivered security capabilities.

ZTNA: Identity- and policy-based access to applications without granting broad network trust.

Review Questions

Short Answer Questions

1. Distinguish an underlay from an overlay in an enterprise WAN.
2. Why is MPLS logical separation not equivalent to encryption?
3. State two advantages and two limitations of cellular WAN access.
4. What is the difference between a site-to-site VPN and a remote-access VPN?
5. Why can brownout detection be more useful than link-up status alone?

Long Answer Questions

1. Compare leased lines, broadband, MPLS, cellular, satellite, and Internet VPNs for a multinational enterprise.
2. Explain IPsec tunnel-mode operation, including authentication, encryption, integrity, and key negotiation.
3. Describe SD-WAN architecture and explain how controllers, edge devices, overlays, and analytics interact.
4. Discuss how security, performance, cost, and SLA requirements should be integrated into WAN design.
5. Evaluate the benefits and risks of direct Internet breakout in a cloud-oriented enterprise.

Analytical / Application Questions

1. An organisation has a 200 Mbit/s MPLS circuit and a 500 Mbit/s broadband circuit. Voice requires low jitter, clinical transactions require predictable performance, and backups are delay tolerant. Propose a path-selection policy and explain its fallback behaviour.
2. A 30-day SLA promises 99.95% availability. Calculate the approximate maximum unavailable minutes in the month and identify assumptions that could make the contractual interpretation differ.
3. A remote site has fibre, 5G, and satellite access, but fibre and 5G enter through the same building. Design a resilient WAN arrangement and explain the remaining correlated risks.

Multiple Choice Questions with Answers

Question 1

Which WAN characteristic most directly describes variation in packet delay?

A. Bandwidth

B. Jitter

C. Availability

D. Throughput

Correct Answer: B. Jitter

Question 2

Which statement about MPLS provider VPNs is correct?

A. They always encrypt customer payloads end to end.

B. They provide logical separation but do not inherently guarantee confidentiality from the provider.

C. They can operate only over public wireless networks.

D. They eliminate the need for routing policy.

Correct Answer: B. They provide logical separation but do not inherently guarantee confidentiality from the provider.

Question 3

What is the primary purpose of IPsec tunnel mode?

A. To replace all routing protocols

B. To encrypt only an Ethernet preamble

C. To protect an original IP packet and encapsulate it within a new IP packet

D. To increase the physical capacity of a link

Correct Answer: C. To protect an original IP packet and encapsulate it within a new IP packet

Question 4

Which component commonly distributes policy and configuration in an SD-WAN architecture?

A. A passive optical splitter

B. An orchestrator or controller

C. A cable modem power supply

D. A satellite antenna reflector only

Correct Answer: B. An orchestrator or controller

Question 5

A 100 Mbit/s link must ideally transmit 800 Mbit. Ignoring overhead and propagation delay, how long does serialization take?

A. 0.8 seconds

B. 8 seconds

C. 80 seconds

D. 800 seconds

Correct Answer: B. 8 seconds

Question 6

Which access technology is especially useful for rapid deployment and mobility but is affected by radio coverage and data caps?

A. Cellular WAN

B. Leased wavelength

C. MPLS label switching

D. Fibre cross-connect

Correct Answer: A. Cellular WAN

Question 7

What is a major risk of excessive SD-WAN path switching?

A. It can cause packet reordering and session disruption.

B. It permanently increases fibre propagation speed.

C. It removes the need for encryption.

D. It guarantees lower cost on every path.

Correct Answer: A. It can cause packet reordering and session disruption.

Question 8

For a 30-day month, approximately how much downtime corresponds to 99.9% availability under a simple uniform-month assumption?

A. 4.32 minutes

B. 43.2 minutes

C. 432 minutes

D. 4,320 minutes

Correct Answer: B. 43.2 minutes

Question 9

Which statement best distinguishes a tunnel from encryption?

A. Every tunnel necessarily provides confidentiality.

B. A tunnel encapsulates traffic; confidentiality requires an appropriate encryption mechanism.

C. Encryption is possible only on leased lines.

D. Tunnelling applies only to satellite links.

Correct Answer: B. A tunnel encapsulates traffic; confidentiality requires an appropriate encryption mechanism.

Question 10

Why might an enterprise retain MPLS while adopting SD-WAN?

A. SD-WAN cannot use Internet links.

B. MPLS may still provide predictable service for selected critical applications within a hybrid design.

C. MPLS automatically provides endpoint antivirus.

D. SD-WAN requires every site to use the same access technology.

Correct Answer: B. MPLS may still provide predictable service for selected critical applications within a hybrid design.