How does a Cisco SD-WAN device establish a control plane tunnel with vSmart, and what security is used?

• A. It uses SSH with password authentication.
• B. It establishes a TLS-secured control plane tunnel to vSmart using mutual certificates; OMP runs over this control channel.
• C. It uses UDP with no encryption.
• D. It uses IPSec for control plane tunnels.

Answer: (B)

In Cisco SD-WAN, the control plane between an edge device and the vSmart controller is secured with TLS and mutual authentication. The edge and vSmart authenticate each other using certificates, establishing a TLS session that encrypts and protects all control messages. The overlay management protocol (OMP) then runs over this TLS control channel, carrying routing, policy, and reachability information between the edge and vSmart. This setup provides strong authentication and encryption for control traffic, which is why this option is correct. SSH with a password, UDP with no encryption, or IPsec for the control plane do not reflect how the SD-WAN control plane is securely transported and authenticated.