The correct answers are A and C . Versa supports upgrading deployed VOS branch devices either directly on the VOS appliance or centrally through Versa Director. The Director-based method is performed from the Administration > Appliances area: Versa documentation says to select one or more Controller nodes or VOS devices, click the Upgrade Selected Appliances icon, choose the software image package, and proceed with the appliance upgrade. The same upgrade procedure is referenced for remaining VOS branch devices, including the option to upgrade branches individually or all at once.

A CLI-based upgrade using a software .bin package is also a valid operational method when the image is copied to the device and installed locally, particularly for controlled or recovery-style maintenance. Option B is not the best answer for already deployed branch upgrades because the Preferred Software Version field applies to zero-touch provisioning; Versa states that during ZTP, Director upgrades a branch to the preferred version if applicable. That setting influences onboarding behavior, not the normal upgrade workflow for already deployed branches. Option D is incorrect because System > Director Upgrade is used to upgrade the Versa Director node itself, not VOS branch appliances.

The correct answers are A and C . The route table shown in the Versa SD-WAN design documentation includes a default route, 0.0.0.0/0 , with next hop 169.254.0.2 and exit interface tvi-0/603.0 . A default route is used when no more specific route exists in the routing table, so any unknown IPv4 unicast destination will follow that active default route through the tvi-0/603 interface. This directly supports option C.

The same design context describes local or central internet breakout, where Director workflows create TVI-based connectivity for breakout or gateway-style forwarding. In Versa SD-WAN, TVI interfaces are commonly used as internal virtual tunnel interfaces between routing instances, such as between a tenant LAN VR and a transport or breakout VR. The documentation also describes virtual TVI interface pairs being created by Director workflows between VRs for gateway routing use cases. Therefore, option A is also correct: tvi-0/603 is paired with another interface in another VR to support the default-route forwarding path.

The IP address is not shown as misconfigured; 169.254.x.x addressing is commonly used for point-to-point internal TVI links. The route is also not a blackhole route, because it has an active next hop and an exit interface.

The correct answers are A and C . If the onboarding VPN tunnel from the branch device to the Controller is up, the branch has reached at least the initial staging/control connectivity stage. Versa troubleshooting documentation explains that after a branch establishes IPsec connectivity to the Controller, the Controller sends a branch-connect notification to Versa Director. In response, Director pushes staging configuration and continues the onboarding lifecycle. If the expected later notification is not seen, the branch has not completed staging and further onboarding/debug steps are required.

The Tasks list in Versa Director is useful because device deployment and onboarding actions are executed as Director tasks. If template commit, workflow deployment, device claiming, or configuration push fails, the task output can show the error. The Unknown Devices dashboard is also relevant because a device that reaches the Controller but cannot be matched or fully associated with an expected workflow/appliance record may appear as an unknown device awaiting administrative review. The Monitor dashboard is not the best choice because the device is missing from the Appliances list and has not completed onboarding. Resource Pool is related to connector resources, not branch onboarding completion.

The correct answers are A, B, and D . For large-scale Versa Secure SD-WAN onboarding, common configuration is reusable through templates and grouping. A device template , also known as a post-staging template, provides the common base configuration that is applied to multiple VOS branch appliances. Versa documentation repeatedly shows configuration tasks being performed under Templates > Device Templates , where an organization is selected and the post-staging template is opened in Appliance view for common configuration.

A device group is also shared by multiple appliances because it groups devices that should receive the same template associations and common service behavior. This is the proper way to profile many branches with similar deployment requirements. Service templates are also shared objects. They are used to apply service-specific configurations, such as SD-WAN traffic steering, application steering, QoS, security, or other common services, across devices. Versa SD-WAN design documentation explains that application-steering templates automate business-intent policies and simplify management by combining application classification, forwarding-class mapping, and SD-WAN policy logic in a reusable template.

A workflow device is device-specific, and device bind data contains site-specific values such as interface addressing, gateways, VLANs, and other per-branch parameters. Therefore, those are not the shared configuration objects.

The correct answers are A and B . In the exhibit, the LAN interface shows a fixed VLAN ID value of 100 . Because this value is directly configured in the template rather than represented as a per-device variable, every branch that uses this template will receive the same LAN VLAN ID. This supports option A. Versa configuration examples show that VLAN-tagged interfaces are created by defining logical units with a vlan-id, and organizations then use those tagged interfaces for traffic identification and routing services.

For the MPLS WAN network , the VLAN ID field is shown as a variable or bind-data style value rather than a fixed number. This allows each branch device to receive a different MPLS VLAN ID during onboarding, depending on the branch-specific values supplied in the workflow or device bind data. Therefore, branches can have separate VLAN IDs on the MPLS WAN transport, which supports option B. Versa SD-WAN troubleshooting output also shows WAN interfaces as logical VNI subinterfaces, such as vni-0/1.0 and vni-0/2.0, mapped to SD-WAN transport networks like INET and MPLS.

Option C is incorrect because an INET interface can be untagged, commonly represented with VLAN ID 0. Option D is incorrect because the MPLS VLAN field is intentionally parameterized, not incorrectly configured.

The correct answers are B and C . During a migration from a legacy WAN, such as MPLS Layer 3 VPN, to Versa Secure SD-WAN, an SD-WAN gateway is used to allow communication between SD-WAN-enabled branches and legacy WAN sites. Versa SD-WAN design guidance states that an SD-WAN gateway allows sites connected to the SD-WAN VPN network to communicate with sites connected to a legacy MPLS VPN network. It also explains that this gateway facilitates route exchange between the MPLS underlay network and the SD-WAN VPN network, typically using a dynamic routing protocol such as BGP.

For this design, the hub or gateway must be configured with the Gateway option for the underlay transport so it can act as the interconnect point between the legacy and SD-WAN domains. Versa documentation further describes configuring a BGP peering session on the MPLS transport VR of the gateway to exchange routes from the MPLS provider to the SD-WAN network, and notes that Director Workflows can automate this configuration. Spoke-to-Spoke-Direct is not sufficient for legacy interconnect, and SD-WAN traffic steering policies do not advertise routes.