The correct answers are A and C . If the onboarding VPN tunnel from the branch device to the Controller is up, the branch has reached at least the initial staging/control connectivity stage. Versa troubleshooting documentation explains that after a branch establishes IPsec connectivity to the Controller, the Controller sends a branch-connect notification to Versa Director. In response, Director pushes staging configuration and continues the onboarding lifecycle. If the expected later notification is not seen, the branch has not completed staging and further onboarding/debug steps are required.

The Tasks list in Versa Director is useful because device deployment and onboarding actions are executed as Director tasks. If template commit, workflow deployment, device claiming, or configuration push fails, the task output can show the error. The Unknown Devices dashboard is also relevant because a device that reaches the Controller but cannot be matched or fully associated with an expected workflow/appliance record may appear as an unknown device awaiting administrative review. The Monitor dashboard is not the best choice because the device is missing from the Appliances list and has not completed onboarding. Resource Pool is related to connector resources, not branch onboarding completion.

The correct answer is A . In Versa Secure SD-WAN onboarding, the branch moves through three staging phases before becoming fully operational. Versa documentation states that in Stage 3 , Versa Director pushes the stage-three configuration to the branch device over the IKE session and reboots the branch. After this stage, the branch becomes fully operational and is part of the customer SD-WAN network. At this point, IKE and IPsec sessions are created between the branch and Controller , and VXLAN and ESP sessions are created between branch to branch .

This distinction is important because the Controller connection is used for SD-WAN control-plane functions, while branch-to-branch overlay communication uses tunnel encapsulation for data forwarding. The documentation also notes that branch-to-branch ESP is maintained using a lightweight DH key-pair proprietary protocol.

Options B, C, and D are incorrect. HTTPS to Director alone does not represent the complete SD-WAN operational tunnel state. BGP to Analytics is not the required operational tunnel set. GRE-only tunnels without IPsec do not match the Versa Stage 3 SD-WAN tunnel behavior described in the staging documentation.

The correct answer is B . The requirement is to stop branch devices from sourcing traffic using IP addresses that do not belong to the branch. This is a source-address enforcement problem, so the correct control is a stateful firewall policy that permits only traffic whose source IP address matches the valid branch LAN prefix or branch-assigned address range. Versa’s stateful firewall configuration documentation explains that firewall policy rules include source matching, where the administrator selects the source zone and one or more source addresses to which the rule applies.

By creating an allow rule for the legitimate branch source prefixes and placing a deny rule for all other sources from the branch LAN zone, the VOS device prevents spoofed or unauthorized source addresses from leaving the branch. This is consistent with Versa security policy behavior, where firewall rules evaluate traffic based on zones, addresses, services, applications, and other match criteria. Captive portal verifies user identity but does not directly prevent IP spoofing. An IP filter profile based on applications does not ensure the source address belongs to the branch. Option D is incorrect because allowing traffic to the assigned LAN range controls destination traffic, while this requirement is about validating the source IP address of outbound branch traffic.

The correct answer is C . Versa documentation states that for Releases 22.1.3 and later , the speed test factors in network latency to derive results. In these releases, the speed test is performed in three stages : a ping test, an upload test, and a download test. The ping test calculates link latency, and the speed test uses that latency data while performing the upload and download portions.

The same documentation notes that the speed test can measure bandwidth speeds up to 1 Gbps, with actual measurement depending on factors such as in-path shapers and latency. It also states that the test may use up to 45 MB of data per upload or download in the best case and 90 MB for a complete test.

Older releases behave differently. For Releases 21.2 and earlier, the speed test is performed in two stages: upload and download. Therefore, because the question specifically states Release 22.1.3 on both client and server, the correct sequence is ping, upload, and download.

The correct answer is B . Versa branch lifecycle notifications are generated at different stages of onboarding. The first notification indicates that the branch connected using factory-default configuration. After that notification, Versa Director pushes the staging configuration to the branch and requests a reboot. After rebooting with staging configuration, the branch should connect again to the Controller, and a later branch-connect notification should appear.

If this later staged connection notification does not appear, Versa’s troubleshooting guidance says to debug either the data path or IPsec connectivity from the branch to the Controller. This makes sense because the branch must have working transport reachability and IKE/IPsec establishment toward the Controller before it can continue the SD-WAN lifecycle.

Analytics disk usage, LDAP authentication, and URL filtering are not part of the branch staging control path. They may affect monitoring, user identity, or security inspection after the site is operational, but they do not explain why the branch stops after the initial factory-default onboarding notification.

The correct answer is B . In the exhibit, Versa Director shows multiple branch interfaces and a Live Data column. To populate the bandwidth graph with current real-time statistics for all WAN circuits, Live Data must be selected for each WAN circuit that should be monitored. Versa documentation states that from a Director node, administrators can monitor VOS devices, provider organizations, tenants, events, and alarms. It also explains that Versa Director, together with Versa Analytics, can poll VOS devices in real time to provide visibility into what is happening on those devices and to assist with troubleshooting.

Because the requirement is to find the current bandwidth of each WAN circuit, simply refreshing the page is not enough. Refreshing only reloads the dashboard; it does not enable real-time polling for interfaces that are not selected. Selecting Live Data only for MPLS circuits would populate only MPLS-related data and would not satisfy the requirement for all WAN circuits. Unselecting and reselecting only the INET circuit affects only that one circuit. Therefore, the correct operational step is to enable Live Data for all WAN circuits shown in the branch interface dashboard.

The correct answer is B . The exhibit shows the branch interface summary in Versa Director with a Live Data column. To populate real-time bandwidth graphs for WAN circuits, the administrator must select Live Data for the WAN interfaces that need to be monitored. Versa monitoring documentation states that, from a Director node, you can monitor VOS devices and organizations, and that Director, together with Versa Analytics, can poll VOS devices in real time to understand what is happening on the devices. This real-time information can be displayed to assist with troubleshooting.

Because the question asks for the current bandwidth of each WAN circuit, historical analytics alone is not sufficient. The dashboard must poll live statistics from the selected WAN circuits. In the exhibit, not all WAN interfaces appear to have Live Data selected; therefore, the graph is not populated for all circuits. Refreshing the page does not enable polling and will not solve the missing data condition. Selecting only MPLS would populate only the MPLS circuit, not all WAN circuits. Unselecting and reselecting only the INET circuit would affect only that one interface. Therefore, Live Data must be selected for all WAN circuits whose current bandwidth should be displayed.