The correct answers are A and C . Versa supports upgrading deployed VOS branch devices either directly on the VOS appliance or centrally through Versa Director. The Director-based method is performed from the Administration > Appliances area: Versa documentation says to select one or more Controller nodes or VOS devices, click the Upgrade Selected Appliances icon, choose the software image package, and proceed with the appliance upgrade. The same upgrade procedure is referenced for remaining VOS branch devices, including the option to upgrade branches individually or all at once.
A CLI-based upgrade using a software .bin package is also a valid operational method when the image is copied to the device and installed locally, particularly for controlled or recovery-style maintenance.
Option B is not the best answer for already deployed branch upgrades because the Preferred Software Version field applies to zero-touch provisioning; Versa states that during ZTP, Director upgrades a branch to the preferred version if applicable. That setting influences onboarding behavior, not the normal upgrade workflow for already deployed branches. Option D is incorrect because System > Director Upgrade is used to upgrade the Versa Director node itself, not VOS branch appliances.

The correct answer is A . Versa throughput troubleshooting documentation includes a specific section titled Check that Packets Are not Dropped by CoS . It states that if a CoS shaper or rate limiter is configured on the VOS device, it may drop packets when traffic exceeds the configured shaping rate. To check whether CoS is dropping packets, Versa recommends commands including show class-of-services interfaces brief and show class-of-services interfaces detail interface-name.
The detailed interface output displays traffic statistics such as TX packets, TX packets dropped, TX bytes, TX bytes dropped, and per-traffic-class drops. This is exactly the evidence needed to confirm whether shaping or QoS enforcement is causing the observed loss.
show alarms last-n 10 may reveal major events but will not provide per-interface CoS drop counters.
show system uptime only indicates how long the system has been running. show cgnat tenants is relevant for NAT state and tenant CGNAT resources, not QoS drops.

The correct answers are B and D . In the exhibit, the Next-Hop Selection Method is configured as Load Balance , and both INET and INET-2 have the same next-hop priority value of 1 . Versa SD-WAN guidance states that load balancing between WAN paths is achieved by configuring at least two circuits with equal priority. Therefore, when both INET and INET-2 satisfy the SLA requirements, sessions can be load-balanced across those two internet circuits.
Option D is also correct because the exhibit shows SLA Violation Action: Forward . This means that if no next hop is SLA-compliant, the VOS device is still allowed to forward traffic instead of dropping it. This behavior is consistent with Versa SD-WAN traffic-steering concepts, where forwarding profiles define circuit or path priorities, connection methods, load-balancing behavior, and SLA handling for traffic that matches an SD-WAN policy.
Option A is incorrect because the exhibit does not use the Automatic next-hop selection method. Versa' s performance-based SaaS optimization uses monitoring metrics to select the best path when configured for automatic/performance-based selection, but this exhibit shows Load Balance instead. Option C is not the best answer because LTE has lower priority 2 and would be considered only after the higher- priority INET and INET-2 paths are unavailable or unusable, not merely when one INET circuit fails.

The correct answer is A . In Versa Secure SD-WAN onboarding, the branch moves through three staging phases before becoming fully operational. Versa documentation states that in Stage 3 , Versa Director pushes the stage-three configuration to the branch device over the IKE session and reboots the branch. After this stage, the branch becomes fully operational and is part of the customer SD-WAN network. At this point, IKE and IPsec sessions are created between the branch and Controller , and VXLAN and ESP sessions are created between branch to branch .
This distinction is important because the Controller connection is used for SD-WAN control-plane functions, while branch-to-branch overlay communication uses tunnel encapsulation for data forwarding. The documentation also notes that branch-to-branch ESP is maintained using a lightweight DH key-pair proprietary protocol.
Options B, C, and D are incorrect. HTTPS to Director alone does not represent the complete SD-WAN operational tunnel state. BGP to Analytics is not the required operational tunnel set. GRE-only tunnels without IPsec do not match the Versa Stage 3 SD-WAN tunnel behavior described in the staging documentation.

Symmetric Forwarding is the correct Versa SD-WAN feature for ensuring that return traffic between SD- WAN branches follows the same SD-WAN path on which the forward traffic was received. Versa documentation for SD-WAN traffic steering describes Symmetric forwarding as the option that specifies the path for reverse-direction traffic, meaning whether traffic returning from the destination branch to the originating branch should be sent on the same path on which it arrived. It further states that enabling symmetric traffic forwarding determines the reverse path for traffic returning from the destination branch to the originating branch.
This is different from Symmetric Routing, which is a routing design goal or behavior, not the Versa SD- WAN forwarding-profile feature named in the product documentation. Equal-Cost Multipath can distribute flows across equal-cost routes, but it does not specifically guarantee that both directions of the same SD-WAN session use the same path. Packet Striping is used to split or distribute packets across multiple links for performance, not to enforce bidirectional path symmetry. Therefore, the verified Versa feature to enable is Symmetric Forwarding.