The correct answer is B . The requirement is to stop branch devices from sourcing traffic using IP addresses that do not belong to the branch. This is a source-address enforcement problem, so the correct control is a stateful firewall policy that permits only traffic whose source IP address matches the valid branch LAN prefix or branch-assigned address range. Versa's stateful firewall configuration documentation explains that firewall policy rules include source matching, where the administrator selects the source zone and one or more source addresses to which the rule applies.
By creating an allow rule for the legitimate branch source prefixes and placing a deny rule for all other sources from the branch LAN zone, the VOS device prevents spoofed or unauthorized source addresses from leaving the branch. This is consistent with Versa security policy behavior, where firewall rules evaluate traffic based on zones, addresses, services, applications, and other match criteria. Captive portal verifies user identity but does not directly prevent IP spoofing. An IP filter profile based on applications does not ensure the source address belongs to the branch. Option D is incorrect because allowing traffic to the assigned LAN range controls destination traffic, while this requirement is about validating the source IP address of outbound branch traffic.

The correct answer is A . Versa documentation for internet speed tests states that before running an internet speed test, administrators must verify WAN internet connectivity and verify that CGNAT is configured on the provider organization. It also states that administrators should verify that they can retrieve the list of predeployed internet speed-test servers. If an error occurs while fetching the server list, the documentation instructs administrators to check the CGNAT and DNS configurations and then click Fetch Server List again.
This aligns with the scenario because DNS resolution and internet breakout depend on correct DNS reachability, NAT translation, and routing through the internet-facing transport. Even if DNS appears partially functional, CGNAT misconfiguration can still prevent application or HTTP test traffic from completing properly.
OSPF, BGP MED, SNMP, syslog, VRRP, and DHCP may be important in other designs, but they are not the first items Versa identifies for a failed internet speed-test server-list fetch in a DIA context.

The correct answer is D . In a Versa HA active-active branch deployment, the cross-connect link between the two CPE devices is used to extend WAN transport reachability between the peers. Versa SD-WAN design documentation explains that, in an HA active-active design, a cross-connect cable between the two devices extends one device's transport VR to the other device and vice versa. For example, the documentation describes the cross-connect as extending the MPLS-Transport-VR to one device and the Internet- Transport-VR to the peer device.
In the question, there are four total WAN networks across the HA pair: INET-1 , MPLS-1 , INET-2 , and MPLS-2 . The HA active-active workflow must create separate logical subinterfaces on the cross-connect link for each WAN network so that each transport segment can be extended and kept logically separated across the two appliances. Therefore, the number of subinterfaces created on the cross-connect link equals the total number of WAN networks across the HA pair, which is four .
Options A, B, and C are incorrect because they undercount the number of required transport extensions. Two subinterfaces would only account for two WAN networks, but this design has four separate WAN transport networks.

The correct answer is C . Versa's bandwidth and throughput troubleshooting documentation specifically instructs administrators to check link speed and half-duplex conditions with the command show interfaces detail interface-name. The example output shows an interface operating at half-duplex / 100 Mbps , and the documentation states that the interface should not be in half-duplex mode and that 100 Mbps was incorrect in that scenario.
A duplex mismatch or incorrect negotiated speed can severely reduce effective throughput, cause collisions or retransmissions, and make SD-WAN overlay performance appear poor even when the overlay itself is functioning. Versa recommends fixing half-duplex and link-speed issues by correcting the configuration on the device to which the VOS device is connected and checking the ISP-side transmission mode, such as auto
/auto.
SLA probing, Controller route advertisement, and VXLAN encapsulation may affect SD-WAN path selection or tunnel formation, but the evidence in the question directly points to a physical or underlay Ethernet negotiation problem.

The correct answer is C . In Versa Secure SD-WAN, Direct Internet Access, or DIA, provides local internet breakout from the branch rather than backhauling internet-bound traffic through a hub. Versa design documentation explains that the DIA architecture creates an internal connection between the tenant VRF and the WAN transport VR and uses CGNAT to translate internet-bound LAN traffic to the public IP address associated with the WAN transport interface. It specifically states that the main DIA components include the CGNAT function for translating internet-bound traffic and that DIA is configured using Director Workflows when configuring tunnels.
When the workflow template is used and the DIA option is selected for the internet breakout tunnel, Director automatically builds the required DIA infrastructure, including the NAPT/CGNAT configuration associated with the internet-facing transport network. This is why manual creation of the CGNAT pool and rule is not required in the workflow-based method. Option A describes a manual configuration approach, not the workflow-generated behavior. Option B is incorrect because NAT must be associated with the internet-facing breakout path, not simply the LAN interface. Option D is incorrect because DIA normally requires address translation for LAN users accessing the public internet.