Budget-Constrained Branch WAN: Internet with Site-to-Site VPN

300-420 By islever Editorial Last updated

Design site-to-site VPN for on-premises, hybrid, and cloud solutions Describe WAN connectivity options for on-premises, hybrid, and cloud solutions

Short answer

B Propose dual-homed Internet links on a single-edge router running a site-to-site VPN topology to meet redundancy, budget, and future bandwidth growth needs.

Question

An architect is working on a design to connect a company's main site to several small to medium-sized remote branches. The solution must include redundant
WAN links, but the customer has a limited budget and wants the ability to increase the link speed easily in the future. QoS will run on the branch routers, so there
is no need for consistent end-to-end QoS. Which solution does the architect propose?
  1. dual-homed WAN MPLS with single-edge router
  2. dual-homed Internet with a single-edge router running a site-to-site VPN topology Correct Answer
  3. dual-homed WAN MPLS and Internet links via dual-edge routers
  4. dual-homed Internet with dual-edge routers running a hub-and-spoke VPN topology

Key Takeaways

This tests WAN transport selection under cost and scalability constraints; the trap is assuming redundancy requires dual-edge routers or that QoS requires an MPLS circuit.

For a limited-budget branch design needing redundant WAN links and easy bandwidth upgrades, dual-homed Internet with one edge router running site-to-site VPNs is the correct choice. MPLS or dual-edge designs conflict with the cost constraints, while branch-local QoS removes the need for carrier end-to-end QoS.

Common mistake: Option D looks attractive because hub-and-spoke is a common branch topology, but its dual-edge routers violate the limited-budget requirement and spoke-to-spoke connectivity was never requested.

Expert Analysis

Governing principle: match transport and edge redundancy to cost and scalability constraints. In Cisco enterprise WAN design, MPLS VPN service carries an ongoing carrier cost that scales with committed bandwidth, and dual-edge routers add hardware, licensing and operational overhead. A budget-limited customer who wants to raise link speed later is therefore steered toward DIA (Internet access) with VPN overlays, where bandwidth changes are typically a simple upgrade with the ISP and no carrier-specific circuit changes.

Mapping the scenario. "Redundant WAN links" is satisfied by dual-homing the site to the Internet — two links terminating on one edge router still give path redundancy for the WAN transport. "Limited budget" rules out dual-edge routers (options C and D) and rules out the MPLS premium (options A and C). "Ability to increase the link speed easily" fits Internet transport rather than contracted MPLS bandwidth tiers. Because QoS runs only on the branch routers, there is no need for the carrier-delivered end-to-end QoS classes that MPLS typically provides — a site-to-site VPN overlay over the Internet handles encryption without carrier QoS commitments.

Why B over D. Option D pairs the correct low-cost Internet transport with dual-edge routers and a hub-and-spoke topology; the dual-edge requirement directly conflicts with the stated budget, and hub-and-spoke (often DMVPN) is an overlay topology choice that adds no requirement the question states — the question only asks to connect the main site to several branches, not spoke-to-spoke traffic. Option A keeps MPLS cost; option C combines both cost drivers. Option B is the correct choice: dual-homed Internet, single edge router, site-to-site VPN topology.

Official Reference

https://www.cisco.com/c/en/us/solutions/enterprise/design-zone.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

On design questions, extract each stated constraint (budget, redundancy, scalability, QoS scope) and eliminate options violating any one of them before comparing topologies. MPLS or dual-edge hints signal cost conflicts; a QoS-only-on-branch remark signals that carrier-delivered end-to-end QoS is unnecessary, pointing to Internet transport with VPN.

Frequently Asked Questions

Why does dual-homed Internet with one router still count as redundant WAN links?

Redundancy here refers to the WAN transport: two independent Internet links on one edge router fail over to each other via routing or object tracking, so a single circuit outage does not sever branch connectivity.

Why is MPLS rejected when the branch needs QoS?

The question states QoS runs only on the branch routers with no need for consistent end-to-end QoS, so the carrier-delivered QoS classes that justify MPLS are unnecessary, and MPLS adds recurring cost against a limited budget.

When would hub-and-spoke VPN with dual-edge routers be justified?

When spoke-to-spoke traffic, control-plane redundancy or high availability at the edge are explicit requirements and the budget supports extra hardware — none of which apply in this scenario.

More 300-420 FAQ →

Community Votes

B
55%
D
45%

55% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. ALOVEVIKS 👍 6 Answered B
    The solution must include redundant WAN links - dual-homed Internet but the customer has a limited budget - a single-edge router and wants the ability to increase the link speed easily in the future. QoS will run on the branch routers, so there is no need for consistent end-to-end QoS. - site-to-site VPN topology B. dual-homed Internet with a single-edge router running a site-to-site VPN topology
  2. bogd 👍 5 Answered D
    Multiple branches, redundant links.
  3. iLikeHamburgers 👍 4 Answered B
    First of all, these answers suck. An internet connection is usually cheaper than an MPLS 2 routers cost more to operate/own than 1 That being said C & D are out because both solution state "dual-edge" routers. The cheapest solution between A & B is B because B is an internet link, and A is an MPLS link. Further more it mention that "there is no need for consistent end-to-end QoS.", well with MPLS we can ask/require for SLA's in our contract, with an internet connection we cannot. That leaves me with answer B.
  4. jzzmth 👍 4 Answered B
    I am definitely going with B here. DIA is cheaper than MPLS Single edge router is cheaper than dual edge routers
  5. enterTheDevOps 👍 4
    Answer D: Single Hub to multiple branches? I believe this should be D
Show 11 more comments
  1. neiker45 👍 2
    Hub and spoke. The main site will be the hub and the branches the spokes. You could even use something like DMVPN to set up the links dynamically and while you're at it you are setting up the company for future expansion (more branches).
  2. salmarin 👍 2 Answered D
    I would go with Hub and spoke rather than site to site, and what's the point of two WAN links with a single router ? despite the limited budget dual homed router make sense.
  3. rjamxy 👍 2
    That does make sense... They mention only redundant WAN links and limited budget... It might imply that they would be fine with only one router.
  4. MD555 👍 2 Answered D
    The question says connect the main site to small and medium offices….not office to office connectivity…D is more suitable than B IMO
  5. cryptonite 👍 2
    The reason for B is the fact that the customer has limited budget.
  6. chaba7654321 👍 2 Answered D
    going with D, as hub and spoke is more suitable
  7. Noproblem22 👍 2
    I will go for D
  8. G_Singh12 👍 1 Answered B
    Using dual-edge routers at "several small to medium-sized remote branches" introduces redundant hardware costs that conflict with a limited budget constraint. A single-edge router configured with two internet connections satisfies the redundancy requirement at a much lower cost
  9. andrewChan 👍 1 Answered B
    I would prefer B as following reason, 1. limited budget 2. does not mention about spoke to spoke connectivity in the requirement. so D is not best in the suitation. the VPN may configure as GRE IPSec or under VTI
  10. cerifyme85 👍 1 Answered B
    multiple branches does not mean u need multiple physical links or routers.. the WAN transport is internet with VPN tunnels.. answer is B
  11. zlimvos 👍 1 Answered D
    it's the 'hub and spoke' that we need rather than site2site vpn with multiple branches

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

POV Report Builds the Customer Platform During Discovery

S-grade

VPLS design for sites sharing one IP subnet

S-grade

Inter-VN Communication in Cisco SD-WAN Architecture

S-grade

Advertising a Default Route from Core to Aggregation to Hide Instability

S-grade

Practice All 300-420 Questions

Access 150 questions with complete answers and detailed explanations.

View Full 300-420 Practice Test →

← Back to 300-420 Study Guide