Cisco 300-440 Online Practice Questions and Exam Preparation

Cisco 300-440 Online Questions & Answers

• Question 1:

  Which feature is unique to Cisco SD-WAN IPsec tunnels compared to native IPsec VPN tunnels?

  A. real-time dynamic path selection
  B. tunneling protocols
  C. end-to-end encryption
  D. authentication mechanisms
  A. real-time dynamic path selection

  ---

  Explanation/Reference:

  Cisco SD-WAN IPsec tunnels are different from native IPsec VPN tunnels in several ways. One of the unique features of Cisco SD-WAN IPsec tunnels is that they support real-time dynamic path selection, which means that they can

  automatically choose the best path for each application based on the network conditions and policies. This feature improves the performance, reliability, and efficiency of the network traffic. Native IPsec VPN tunnels, on the other hand, do not

  have this capability and rely on static routing or manual configuration to select the path for each tunnel. This can result in suboptimal performance, increased latency, and higher costs.

  References:

  Traditional IPsec Versus Cisco SD-WAN IPsec, SD-WAN vs IPsec VPN's - What's the difference?, SD-WAN vs. VPN: How Do They Compare?, Traditional IPSEC Versus SD-WAN IPSEC

• Question 2:

  DRAG DROP

  Drag and drop the commands from the left onto the purposes on the right to identify issues on a Cisco IOS XE SD-WAN device.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  Display the time and process information of the device, as well as CPU, memory, and disk usage data. = show sdwan system status Validate the configured zone-based firewall. = show policy-firewall config1 Display information about application-aware routing policy matched packet counts on the Cisco IOS XE SD-WAN devices. = show sdwan policy app-route-policy- filter View the security information that is configured for IPsec tunnel connections. = show sdwan security-info The commands used to identify issues on a Cisco IOS XE SD-WAN device are as follows show sdwan system status: This command is used to display the time and process information of the device, as well as CPU, memory, and disk usage data. show policy-firewall config: This command is used to validate the configured zone-based firewall. show sdwan policy app-route-policy-filter: This command is used to display information about application-aware routing policy matched packet counts on the Cisco IOS XE SD-WAN devices. show sdwan security-info: This command is used to view the security information that is configured for IPsec tunnel connections

  References: Cisco IOS XE Catalyst SD-WAN Qualified Command Reference Cisco Catalyst SD-WAN Command Reference Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE SD-WAN Tunnel Interface Commands - Cisco

• Question 3:

  Refer to the exhibit.

  

  A company uses Cisco SD-WAN in the data center. All devices have the default configuration. An engineer attempts to add a new centralized control policy in Cisco vManage but receives an error message. What is the problem?

  A. A centralized control policy is already applied to the specific site ID and direction
  B. The policy for "Hub" should be applied in the outbound direction, and the policy for "All- Site" should be applied inbound.
  C. Apply an additional outbound control policy to override the site ID overlaps.
  D. Site-list "All-Site" should be configured with a new match sequence that is lower than the sequence for site-list "Hub*.
  D. Site-list "All-Site" should be configured with a new match sequence that is lower than the sequence for site-list "Hub*.

  ---

  Explanation/Reference:

  The problem is that the site-list "All-Site" has a higher match sequence than the site-list "Hub", which means that the policy for "All-Site" will take precedence over the policy for "Hub" for any site that belongs to both lists. This creates a conflict

  and prevents the engineer from adding a new centralized control policy in Cisco vManage. To resolve this issue, the site-list "All-Site" should be configured with a new match sequence that is lower than the sequence for site-list "Hub", so that

  the policy for "Hub" will be applied first and then the policy for "All-Site" will be applied only to the remaining sites that are not in the "Hub" list.

  References:

  Designing and Implementing Cloud Connectivity (ENCC, Track 1 of 5), Module 3:

  Cisco SD-WAN Cloud OnRamp for Colocation, Lesson 3: Cisco SD-WAN Cloud OnRamp for Colocation - Centralized Control Policies Cisco SD-WAN Cloud OnRamp for Colocation Deployment Guide, Chapter 4:

  Configuring Centralized Control Policies Cisco SD-WAN Configuration Guide, Release 20.3, Chapter: Centralized Policy Framework, Section: Policy Configuration Overview

• Question 4:

  Refer to the exhibits.

  

  While troubleshooting, a network engineer discovers that the backup path fails between ASBR3 and ASBR4 for traffic between BGP AS6000 and BGP AS6500 when the connection between ASBR1 and ASBR2 goes down. The following configurations were performed on ASBR1:

  

  Which command is missing?

  A. bgp additional-paths Install
  B. bgp additional-paths select
  C. redistribute static
  D. bgp advertise-best-external
  D. bgp advertise-best-external

  ---

  Explanation/Reference:

  The bgp advertise-best-external command is used to enable the advertisement of the best external path to internal BGP peers. This command is useful when there are multiple exit points from the local AS to other ASes, and the local AS wants to use the closest exit point for each destination. By default, BGP only advertises the best path to its peers, and the best path is usually the one with the lowest IGP metric to the next hop. However, this may not be the optimal path for traffic leaving the local AS, as it may result in suboptimal hot-potato routing or MED oscillations. The bgp advertise-best-external command allows BGP to advertise the best external path, which is the path with the lowest MED among the paths from different neighboring ASes, in addition to the best path. This way, the internal BGP peers can choose the best exit point based on the MED value, rather than the IGP metric. In this scenario, ASBR1 is configured to receive additional paths from ASBR2, which is a route reflector. ASBR2 receivestwo paths for the same prefix from AS6500, one from ASBR3 and one from ASBR4. ASBR2 selects the best path based on the IGP metric to the next hop, and advertises it to ASBR1. However, this path may not be the best external path, as it may have a higher MED value than the other path. If the connection between ASBR1 and ASBR2 goes down, ASBR1 will not have any backup path to reach AS6500, as it does not know the other path from ASBR4. To prevent this situation, ASBR1 should be configured with the bgp advertise-best-external command, so that it can receive the best external path from ASBR2, along with the best path. This way, ASBR1 will have a backup path to reach AS6500, in case the primary path fails.

• Question 5:

  DRAG DROP

  An engineer must use Cisco vManage to configure an application-aware routing policy Drag and drop the steps from the left onto the order on the right to complete the configuration.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  Step 1 = Create the groups of interest.

  Step 2 = Configure the topology.

  Step 3 = Create the application-aware routing policy.

  Step 4 = Apply the application-aware routing policy to a specific VPN and sites.

  The process of configuring an application-aware routing policy in Cisco vManage involves several steps.

  Create the groups of interest: This is the first step where you define the applications or groups that the policy will affect. Configure the topology: This involves setting up the network topology that the policy will operate within.

  Create the application-aware routing policy: After setting up the groups and topology, you then create the application-aware routing policy. This policy tracks network and path characteristics of the data plane tunnels between Cisco SD- WAN

  devices and uses the collected information to compute optimal paths for data traffic.

  Apply the application-aware routing policy to a specific VPN and sites: Finally, the created policy is applied to a specific VPN and sites. This allows the policy to affect the desired network traffic.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0 Learning Plan: Designing and Implementing Cloud Connectivity v1.0 (ENCC 300- 440)

  Information About Application-Aware Routing - Cisco Configuring Application-Aware Routing (AAR) Policies | NetworkAcademy.io Policies Configuration Guide, Cisco IOS XE SD-WAN Releases 16.11, 16.12

• Question 6:

  Refer to the exhibit.

  

  An engineer troubleshoots a Cisco SD-WAN connectivity issue between an on-premises data center WAN Edge and a public cloud provider WAN Edge. The engineer discovers that BFD is Dapping on vEdge1. What is the problem?

  A. The remote Edge device BFD is down.
  B. The remote Edgedevice failed to respond BFD keepalives.
  C. The remote Edge device has a duplicate IP address.
  D. The control plane deleted the BFD session.
  B. The remote Edgedevice failed to respond BFD keepalives.

  ---

  Explanation/Reference:

• Question 7:

  A cloud engineer is setting up a new set of nodes in the AWS EKS cluster to manage database integration with Mongo Atlas. The engineer set up security to Mongo but now wants to ensure that the nodes are also secure on the network side. Which feature in AWS should the engineer use?

  A. EC2 Trust Lock
  B. security groups
  C. tagging
  D. key pairs
  B. security groups

  ---

  Explanation/Reference:

  Security groups are a feature in AWS that allow you to control the inbound and outbound traffic to your instances. They act as a virtual firewall that can filter the traffic based on the source, destination, protocol, and port. You can assign one or more security groups to your instances, and each security group can have multiple rules. Security groups are stateful, meaning that they automatically allow the response traffic for any allowed inbound traffic, and vice versa. Security groups are essential for securing your nodes in the AWS EKS cluster, as they can prevent unauthorized access to your Mongo Atlas database or other resources.

  References: AWS Security Groups Security Groups for Your VPC Security Groups for Your Amazon EC2 Instances Security Groups for Your Amazon EKS Cluster

• Question 8:

  Which architecture model establishes internet-based connectivity between on-premises networks and AWS cloud resources?

  A. That establishes an iPsec VPN tunnel with Internet Key Exchange (IKE) for secure key negotiation and encrypted data transmission
  B. That relies on AWS Elastic Load Balancing (ELB) for traffic distribution and uses SSL/TLS encryption for secure data transmission.
  C. That employs AWS Direct Connect for a dedicated network connection and uses private IP addresses tor secure communication.
  D. That uses Amazon CloudFrontfor caching and distributing content globally and uses HTTPS for secure data transfer.
  A. That establishes an iPsec VPN tunnel with Internet Key Exchange (IKE) for secure key negotiation and encrypted data transmission

  ---

  Explanation/Reference:

  The architecture model that establishes internet-based connectivity between on-premises networks and AWS cloud resources is the one that establishes an iPsec VPN tunnel with Internet Key Exchange (IKE) for secure key negotiation and encrypted data transmission. This model is also known as the VPN CloudHub model. It allows multiple remote sites to connect to the same virtual private gateway in AWS, creating a hub-and- spoke topology. The VPN CloudHub model provides the following benefits: It enables secure communication between remote sites and AWS over the public internet, using encryption and authentication protocols such as IPsec and IKE. It supports dynamic routing protocols such as BGP, which can automatically adjust the routing tables based on the availability and performance of the VPN tunnels. It allows for redundancy and load balancing across multiple VPN tunnels, increasing the reliability and throughput of the connectivity. It simplifies the management and configuration of the VPN connections, as each remote site only needs to establish one VPN tunnel to the virtual private gateway in AWS, rather than multiple tunnels to different VPCs or regions. The other options are not correct because they do not establish internet-based connectivity between on-premises networks and AWS cloud resources. Option B relies on AWS Elastic Load Balancing (ELB) for traffic distribution and uses SSL/TLS encryption for secure data transmission. However, ELB is a service that distributes incoming traffic across multiple targets within a VPC, not across different networks. Option C employs AWS Direct Connect for a dedicated network connection and uses private IP addresses for secure communication. However, AWS Direct Connect is a service that establishes a private connection between on-premises networks and AWS, bypassing the public internet. Option D uses Amazon CloudFront for caching and distributing content globally and uses HTTPS for secure data transfer. However, Amazon CloudFront is a service that delivers static and dynamic web content to end users, not to on-premises networks.

  References:

  1: Designing and Implementing Cloud Connectivity (ENCC, Track 1 of 5)

  2: Cisco ASA Site-to-Site VPN

  3: What Is Elastic Load Balancing?

  4: What is AWS Direct Connect?

• Question 9:

  A company has multiple branch offices across different geographic locations and a centralized data center. The company plans to migrate Its critical business applications to the public cloud infrastructure that is hosted in Microsoft Azure. The company requires high availability, redundancy, and low latency for its business applications. Which connectivity model meets these requirements?

  A. ExpressRoute with private peering using SDCI
  B. hybrid connectivity with SD-WAN
  C. AWS Direct Connect with dedicated connections
  D. site-to-site VPN with Azure VPN gateway
  A. ExpressRoute with private peering using SDCI

  ---

  Explanation/Reference:

  The connectivity model that meets the requirements of high availability, redundancy, and low latency for the company's business applications is ExpressRoute with private peering using SDCI.

  ExpressRoute is a service that provides a dedicated, private, and high-bandwidth connection between the customer's on-premises network and Microsoft Azure cloud network.

  Private peering is a type of ExpressRoute circuit that allows the customer to access Azure services that are hosted in a virtual network, such as virtual machines, storage, and databases.

  SDCI (Secure Data Center Interconnect) is a Cisco solution that enables secure and scalable connectivity between multiple data centers and cloud providers, using technologies such as MPLS, IPsec, and SD-WAN3.

  By using ExpressRoute with private peering and SDCI, the company can achieve the following benefits:

  References:

  What is Azure ExpressRoute?

  Azure ExpressRoute peering

  Cisco Secure Data Center Interconnect

  ExpressRoute circuit and routing domain

• Question 10:

  A company with multiple branch offices wants a suitable connectivity model to meet these network architecture requirements:

  1.

  high availability

  2.

  quality of service (QoS)

  3.

  multihoming

  4.

  specific routing needs

  Which connectivity model meets these requirements?

  A. hub-and-spoke topology using MPLS with static routing and dedicated bandwidth for QoS
  B. star topology with internet-based VPN connections and BGP for routing
  C. hybrid topology that combines MPLS and SD-WAN
  D. fully meshed topology with SD-WAN technology using dynamic routing and prioritized traffic for QoS
  D. fully meshed topology with SD-WAN technology using dynamic routing and prioritized traffic for QoS

  ---

  Explanation/Reference:

  A fully meshed topology with SD-WAN technology using dynamic routing and prioritized traffic for QoS meets the network architecture requirements of the company. A fully meshed topology provides high availability by eliminating single

  points of failure and allowing multiple paths between branch offices. SD-WAN technology enables multihoming by supporting multiple transport options, such as MPLS, internet, LTE, etc. SD-WAN also provides QoS by applying policies to

  prioritize traffic based on application, user, or network conditions. Dynamic routing allows the SD-WAN solution to adapt to changing network conditions and optimize the path selection for each traffic type. A fully meshed topology with SDWAN technology can also support specific routing needs, such as segment routing, policy-based routing, or application-aware routing.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0 [Cisco SD-WAN Design Guide]

  [Cisco SD-WAN Configuration Guide]