WGU D415 | Software-Defined
Networking (SDN) | Objective
Assessment (Oa) 2026 Update |
Questions And Answers With
Rationales Graded A+
Question 1: What is the primary architectural change introduced by Software-
Defined Networking (SDN)?
A) Combining the control and data planes into a single device
B) Decoupling the network control (control plane) from the forwarding functions (data
plane)
C) Eliminating all network protocols
D) Replacing IP addresses with MAC addresses
Correct Answer: B
Rationale: SDN fundamentally separates the control plane (decision-making) from the
data plane (packet forwarding). This decoupling enables centralized, programmable
network control, allowing the network to be managed holistically rather than on a
device-by-device basis .
Question 2: What advantage does separating the control plane from the data
plane provide in SDN?
A) Increased hardware dependency
B) Reduced network visibility
C) Centralized management and flexibility
D) Slower packet forwarding
Correct Answer: C
Rationale: Separating the control plane from the data plane allows for centralized
decision-making while keeping packet forwarding efficient. Network administrators can
manage policies from a single controller rather than configuring each device
individually, which improves flexibility, scalability, and simplifies troubleshooting .
,Question 3: Which SDN plane is responsible for actual packet forwarding?
A) Management plane
B) Control plane
C) Application plane
D) Data plane
Correct Answer: D
Rationale: The data plane consists of switches and routers that forward packets based
on instructions from the control plane. These devices do not make routing decisions
themselves but follow flow rules provided by the SDN controller, which allows for
simpler and faster forwarding hardware .
Question 4: What is the primary role of the southbound API in SDN?
A) Connect controllers together
B) Interface with applications
C) Communicate with network devices
D) Provide network monitoring
Correct Answer: C
Rationale: Southbound APIs enable communication between the SDN controller and
data plane devices like switches and routers. Protocols such as OpenFlow operate at this
level, allowing the controller to install flow rules and manage traffic behavior .
Question 5: Which API allows applications to communicate with the SDN
controller?
A) Southbound API
B) East–west API
C) Northbound API
D) Management API
Correct Answer: C
Rationale: Northbound APIs enable communication between SDN applications and the
controller. They allow applications to define policies such as security rules or traffic
prioritization, and this abstraction is key to simplifying network automation .
Question 6: What protocol is commonly used for communication between SDN
controllers and switches?
A) SNMP
B) BGP
C) OSPF
D) OpenFlow
,Correct Answer: D
Rationale: OpenFlow is a foundational SDN protocol that enables communication
between the controller and network devices. It allows the controller to define how
packets should be handled by switches and supports centralized traffic management
and dynamic flow control .
SDN Security and Controller Management
Question 7: Which approach improves the strength of software-defined
networking (SDN) security and intrusion tolerance?
A) Controller diversity
B) Controller consolidation
C) Logging
D) Virtualization
Correct Answer: A
Rationale: Controller diversity involves using multiple SDN controllers from different
vendors or configurations. This reduces the risk of a single vulnerability compromising
the entire network, as other controllers can continue to operate even if one is attacked
or fails .
Question 8: What is a common risk of centralized SDN controllers?
A) Increased hardware costs
B) Single point of failure
C) Reduced scalability
D) Lack of flexibility
Correct Answer: B
Rationale: Centralized controllers can become single points of failure if not properly
designed. If a controller goes down, network operations may be disrupted. Redundancy
and controller clustering are crucial to mitigate this risk .
Question 9: Which method improves SDN controller availability?
A) Static IP addressing
B) Controller clustering
C) Packet inspection
D) VLAN segmentation
Correct Answer: B
Rationale: Controller clustering uses multiple controllers to share load and provide
, redundancy. If one controller fails, others can take over seamlessly, improving fault
tolerance and reliability in production SDN deployments .
Question 10: Which network function commonly blocks the connectivity between
a controller and a southbound interface?
A) Virtual private network (VPN)
B) Domain name server (DNS)
C) Firewall
D) Access point
Correct Answer: C
Rationale: A firewall commonly blocks connectivity between an SDN controller and
southbound interfaces. Firewalls are designed to restrict access and can prevent the
controller from communicating with the network devices it needs to manage .
Question 11: Why does an intrusion detection system (IDS) use a TAP or SPAN
port to analyze a copy of the inline traffic stream?
A) To ensure that inline network performance is not impacted
B) To act as a gatekeeper through which all network traffic must pass
C) To prevent damage to any packet data that is analyzed
D) To facilitate the storage and tracking of network packet data
Correct Answer: A
Rationale: An IDS uses a TAP or SPAN port to analyze a copy of the traffic. This
approach ensures that inline network performance is not impacted, as the IDS is not in
the direct forwarding path and cannot create a bottleneck .
Question 12: What is a function of the bastion host in a screened subnet firewall
architecture?
A) To protect the perimeter and internal networks from the internet
B) To perform most of the data packet filtering for the firewall
C) To define a clear boundary between trusted and untrusted domains
D) To serve as the main point of contact for incoming connections
Correct Answer: D
Rationale: A bastion host is a hardened system exposed to untrusted networks such as
the internet. Its primary role is to act as the main point of contact for incoming
connections (e.g., web or email services). It is configured with strict security controls to
reduce the attack surface and protect internal systems .
OpenStack and Network Functions Virtualization (NFV)
Networking (SDN) | Objective
Assessment (Oa) 2026 Update |
Questions And Answers With
Rationales Graded A+
Question 1: What is the primary architectural change introduced by Software-
Defined Networking (SDN)?
A) Combining the control and data planes into a single device
B) Decoupling the network control (control plane) from the forwarding functions (data
plane)
C) Eliminating all network protocols
D) Replacing IP addresses with MAC addresses
Correct Answer: B
Rationale: SDN fundamentally separates the control plane (decision-making) from the
data plane (packet forwarding). This decoupling enables centralized, programmable
network control, allowing the network to be managed holistically rather than on a
device-by-device basis .
Question 2: What advantage does separating the control plane from the data
plane provide in SDN?
A) Increased hardware dependency
B) Reduced network visibility
C) Centralized management and flexibility
D) Slower packet forwarding
Correct Answer: C
Rationale: Separating the control plane from the data plane allows for centralized
decision-making while keeping packet forwarding efficient. Network administrators can
manage policies from a single controller rather than configuring each device
individually, which improves flexibility, scalability, and simplifies troubleshooting .
,Question 3: Which SDN plane is responsible for actual packet forwarding?
A) Management plane
B) Control plane
C) Application plane
D) Data plane
Correct Answer: D
Rationale: The data plane consists of switches and routers that forward packets based
on instructions from the control plane. These devices do not make routing decisions
themselves but follow flow rules provided by the SDN controller, which allows for
simpler and faster forwarding hardware .
Question 4: What is the primary role of the southbound API in SDN?
A) Connect controllers together
B) Interface with applications
C) Communicate with network devices
D) Provide network monitoring
Correct Answer: C
Rationale: Southbound APIs enable communication between the SDN controller and
data plane devices like switches and routers. Protocols such as OpenFlow operate at this
level, allowing the controller to install flow rules and manage traffic behavior .
Question 5: Which API allows applications to communicate with the SDN
controller?
A) Southbound API
B) East–west API
C) Northbound API
D) Management API
Correct Answer: C
Rationale: Northbound APIs enable communication between SDN applications and the
controller. They allow applications to define policies such as security rules or traffic
prioritization, and this abstraction is key to simplifying network automation .
Question 6: What protocol is commonly used for communication between SDN
controllers and switches?
A) SNMP
B) BGP
C) OSPF
D) OpenFlow
,Correct Answer: D
Rationale: OpenFlow is a foundational SDN protocol that enables communication
between the controller and network devices. It allows the controller to define how
packets should be handled by switches and supports centralized traffic management
and dynamic flow control .
SDN Security and Controller Management
Question 7: Which approach improves the strength of software-defined
networking (SDN) security and intrusion tolerance?
A) Controller diversity
B) Controller consolidation
C) Logging
D) Virtualization
Correct Answer: A
Rationale: Controller diversity involves using multiple SDN controllers from different
vendors or configurations. This reduces the risk of a single vulnerability compromising
the entire network, as other controllers can continue to operate even if one is attacked
or fails .
Question 8: What is a common risk of centralized SDN controllers?
A) Increased hardware costs
B) Single point of failure
C) Reduced scalability
D) Lack of flexibility
Correct Answer: B
Rationale: Centralized controllers can become single points of failure if not properly
designed. If a controller goes down, network operations may be disrupted. Redundancy
and controller clustering are crucial to mitigate this risk .
Question 9: Which method improves SDN controller availability?
A) Static IP addressing
B) Controller clustering
C) Packet inspection
D) VLAN segmentation
Correct Answer: B
Rationale: Controller clustering uses multiple controllers to share load and provide
, redundancy. If one controller fails, others can take over seamlessly, improving fault
tolerance and reliability in production SDN deployments .
Question 10: Which network function commonly blocks the connectivity between
a controller and a southbound interface?
A) Virtual private network (VPN)
B) Domain name server (DNS)
C) Firewall
D) Access point
Correct Answer: C
Rationale: A firewall commonly blocks connectivity between an SDN controller and
southbound interfaces. Firewalls are designed to restrict access and can prevent the
controller from communicating with the network devices it needs to manage .
Question 11: Why does an intrusion detection system (IDS) use a TAP or SPAN
port to analyze a copy of the inline traffic stream?
A) To ensure that inline network performance is not impacted
B) To act as a gatekeeper through which all network traffic must pass
C) To prevent damage to any packet data that is analyzed
D) To facilitate the storage and tracking of network packet data
Correct Answer: A
Rationale: An IDS uses a TAP or SPAN port to analyze a copy of the traffic. This
approach ensures that inline network performance is not impacted, as the IDS is not in
the direct forwarding path and cannot create a bottleneck .
Question 12: What is a function of the bastion host in a screened subnet firewall
architecture?
A) To protect the perimeter and internal networks from the internet
B) To perform most of the data packet filtering for the firewall
C) To define a clear boundary between trusted and untrusted domains
D) To serve as the main point of contact for incoming connections
Correct Answer: D
Rationale: A bastion host is a hardened system exposed to untrusted networks such as
the internet. Its primary role is to act as the main point of contact for incoming
connections (e.g., web or email services). It is configured with strict security controls to
reduce the attack surface and protect internal systems .
OpenStack and Network Functions Virtualization (NFV)
