VNX301 Exam Dumps : Versa Certified SD-WAN Specialist (VNX300)

The correct answer is A . Versa CGNAT troubleshooting documentation shows the command show cgnat acl info < tenant-id > for viewing CGNAT access lists used for traffic matching. The example output includes columns such as ACL handle , RuleId , Category , Precedence , VRF , Source IP , and Destination IP . It also shows tenant ID and total filters.

This command is useful when a CGNAT rule exists in configuration but sessions are not being translated. By checking the ACL output, the administrator can confirm whether the correct source prefix, destination prefix, VRF, and rule precedence are actually programmed in the dataplane. If the wrong VRF or subnet is shown, the rule may never match the intended traffic.

System uptime and CPU usage are operational health indicators. SLA metrics are SD-WAN path-quality values. BGP AS path and local preference are routing attributes. None of these directly show CGNAT access-list match programming.

The correct answer is A . In Versa SD-WAN application steering, SaaS or cloud-path selection can use monitoring and DNS-based behavior to determine the best path for an application. For real-time applications such as voice, session stability is often more important than aggressively moving active flows after every path-score change. Session pinning to DNS path is the forwarding-profile behavior that keeps a session associated with the path selected when the DNS/application path decision was made.

This matters because voice and collaboration applications can be sensitive to path changes, packet reordering, and jitter. Pinning prevents active sessions from being unnecessarily moved mid-flow as SaaS monitoring scores change, while still allowing new sessions to take advantage of newer path decisions.

Packet striping is used to distribute packets across multiple circuits and can create reordering concerns for some applications. Symmetric forwarding controls reverse-path behavior rather than DNS-based session stability. Random packet drop is a DoS mitigation action, not a SaaS path-selection feature. Therefore, the best answer is Session pinning to DNS path.

The correct answer is A . The exhibit shows that the IPsec VPN is being configured with Tunnel Routing Instance: XIAN-Control-VR . However, the question states that the tunnel is toward a non-SD-WAN site over the INET-Transport-VR . For a site-to-site IPsec tunnel, the tunnel routing instance must match the routing instance used to reach the peer public IP address. In this case, the remote non-SD-WAN peer is 10.1.1.1 , and the intended underlay transport is INET-Transport-VR , not the Control VR.

Versa troubleshooting documentation explains that routing instances are used to define where traffic is sourced and forwarded. For example, configuration examples select routing instances when enabling services or initiating tests, and traffic must use the correct WAN or transport routing instance to reach the remote endpoint. Versa branch troubleshooting also emphasizes that after transport connectivity is available, the branch establishes IKE-based IPsec connectivity; if that connectivity fails, the IPsec-related interface remains down.

Changing the routing instance to global would not be correct because the intended path is specifically INET-Transport-VR. A higher precedence value is not required to establish the tunnel. The policy selector shown already defines local-to-remote interesting traffic, and the key failure is the incorrect tunnel routing instance.