Cisco 300-440 Online Practice Questions and Exam Preparation

Cisco 300-440 Online Questions & Answers

• Question 1:

  Refer to the exhibit.

  

  An engineer troubleshoots a Cisco SD-WAN connectivity issue between an on-premises data center WAN Edge and a public cloud provider WAN Edge. The engineer discovers that BFD is Dapping on vEdge1. What is the problem?

  A. The remote Edge device BFD is down.
  B. The remote Edgedevice failed to respond BFD keepalives.
  C. The remote Edge device has a duplicate IP address.
  D. The control plane deleted the BFD session.
  B. The remote Edgedevice failed to respond BFD keepalives.

  ---

  explanation:

  Explanation/Reference:

• Question 2:

  Refer to the exhibits.

  

  An engineer must redistribute only the 10.0.10.0/24 network into BGP to connect an on-premises network to a public cloud provider. These routes are currently redistributed:

  

  Which command is missing on router R2?

  A. neighbor 10.0.10.2 remote-as 100
  B. redistribute ospf 1 match internal
  C. redistribute ospf 1 match external
  D. neighbor 10.0.10.0/24 remote-as 100
  C. redistribute ospf 1 match external

  ---

  explanation:

  Explanation/Reference:

  The command redistribute ospf 1 match external is missing on router R2. This command is needed to redistribute only the external OSPF routes into BGP. The external OSPF routes are those that are learned from another routing protocol or

  redistributed into OSPF. In this case, the 10.0.10.0/24 network is an external OSPF route, as it is redistributed from EIGRP into OSPF on router R1. The other commands are either already present or not relevant for this scenario.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3:

  Implementing Cloud Connectivity, Lesson 3.1: Implementing IPsec VPN from Cisco IOS XE to AWS, Topic 3.1.2: Configure BGP on the Cisco IOS XE Router Security for VPNs with IPsec Configuration Guide, Cisco IOS XE, Chapter:

  Configuring IPsec VPNs with Dynamic Routing Protocols, Section: Configuring BGP over IPsec VPNs

• Question 3:

  Refer to the exhibits.

  

  An engineer must redistribute OSPF internal routes into BGP to connect an on-premises network to a cloud provider. Which two commands should the engineer run on router R2? (Choose two.)

  A. router bgp 100
  B. redistribute bgp 100
  C. router ospf 1
  D. redistribute ospf 1
  E. redistribute ospf 100
  A. router bgp 100
  D. redistribute ospf 1

  ---

  explanation:

  Explanation/Reference:

• Question 4:

  An engineer must configure an IPsec tunnel to the cloud VPN gateway. Which Two actions send traffic into the tunnel? (Choose two.)

  A. Configure access lists that match the interesting user traffic.
  B. Configure a static route.
  C. Configure a local policy in Cisco vManage.
  D. Configure an IPsec profile and match the remote peer IP address.
  E. Configure policy-based routing.
  A. Configure access lists that match the interesting user traffic.
  E. Configure policy-based routing.

  ---

  explanation:

  Explanation/Reference:

  To send traffic into an IPsec tunnel to the cloud VPN gateway, the engineer must configure two actions:

  Configure access lists that match the interesting user traffic. This is the traffic that needs to be encrypted and sent over the IPsec tunnel. The access lists are applied to the crypto map that defines the IPsec parameters for the tunnel.

  Configure policy-based routing (PBR). This is a technique that allows the engineer to override the routing table and forward packets based on a defined policy. PBR can be used to send specific traffic to the IPsec tunnel interface, regardless

  of the destination IP address. This is useful when the cloud VPN gateway has a dynamic IP address or when multiple cloud VPN gateways are available for load balancing or redundancy.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3:

  Implementing Cloud Connectivity, Lesson 3: Implementing IPsec VPNs to the Cloud, Topic: Configuring IPsec VPNs on Cisco IOS XE Routers Security for VPNs with IPsec Configuration Guide, Cisco IOS XE, Chapter:

  Configuring IPsec VPNs, Topic: Configuring Crypto Maps [Cisco IOS XE Gibraltar 16.12.x Feature Guide], Chapter: Policy-Based Routing, Topic: Policy-Based Routing Overview

• Question 5:

  Refer to the exhibit.

  

  While troubleshooting an IPsec connection between a Cisco WAN edge router and an Amazon Web Services (AWS) endpoint, a network engineer observes that the security association status is active, but no traffic flows between the devices What is the problem?

  A. wrong ISAKMP policy
  B. identity mismatch
  C. wrong encryption
  D. IKE version mismatch
  B. identity mismatch

  ---

  explanation:

  Explanation/Reference:

  An identity mismatch occurs when the local and remote identities configured on the IPsec peers do not match. This can prevent the establishment of an IPsec tunnel or cause traffic to be dropped by the IPsec policy. In this case, the network

  engineer should verify that the local and remote identities configured on the Cisco WAN edge router and the AWS endpoint match the values expected by each peer. The identities can be an IP address, a fully qualified domain name (FQDN),

  or a distinguished name (DN). The identities are exchanged during the IKE phase 1 negotiation and are used to authenticate the peers. If the identities do not match, the peers will reject the IKE proposal and the IPsec tunnel will not be

  established or will be torn down.

  References: Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services, Topic:Troubleshooting

  Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3:

  Implementing Cloud Connectivity, Lesson 2: Implementing Cisco SD-WAN Cloud OnRamp for IaaS, Topic: Troubleshooting Cisco SD-WAN Cloud OnRamp for IaaS Cisco IOS Security Configuration Guide, Release 15MandT, Chapter:

  Configuring IPsec Network Security, Topic: Configuring IPsec Identity and Peer Addressing

• Question 6:

  Refer to the exhibits.

  

  An engineer must redistribute OSPF internal routes into BGP to connect an on-premises network to a cloud provider without introducing extra routes. Which two commands must be configured on router R2? (Choose two.)

  A. router ospf 1
  B. router bgp 100
  C. redistribute ospf 1
  D. redistribute bgp 100
  E. redistribute ospf 1 match internal external
  B. router bgp 100
  E. redistribute ospf 1 match internal external

  ---

  explanation:

  Explanation/Reference:

  To redistribute OSPF internal routes into BGP, the engineer needs to configure two commands on router R2. The first command is router bgp 100, which enables BGP routing process and specifies the autonomous system number of 100.

  The second command is redistribute ospf 1 match internal external, which redistributes the routes from OSPF process into BGP, and matches both internal and external OSPF routes. This way, the engineer can avoid introducing extra routes

  that are not part of OSPF process 1, such as the default route or the connected routes.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0, [ENCC: Configuring IPsec VPN from Cisco IOS XE to AWS], [Deploying Cisco IOS VTI-Based Point-to-Point IPsec VPNs]

• Question 7:

  Refer to the exhibit.

  

  A company uses Cisco SD-WAN in the data center. All devices have the default configuration. An engineer attempts to add a new centralized control policy in Cisco vManage but receives an error message. What is the problem?

  A. A centralized control policy is already applied to the specific site ID and direction
  B. The policy for "Hub" should be applied in the outbound direction, and the policy for "All- Site" should be applied inbound.
  C. Apply an additional outbound control policy to override the site ID overlaps.
  D. Site-list "All-Site" should be configured with a new match sequence that is lower than the sequence for site-list "Hub*.
  D. Site-list "All-Site" should be configured with a new match sequence that is lower than the sequence for site-list "Hub*.

  ---

  explanation:

  Explanation/Reference:

  The problem is that the site-list "All-Site" has a higher match sequence than the site-list "Hub", which means that the policy for "All-Site" will take precedence over the policy for "Hub" for any site that belongs to both lists. This creates a conflict

  and prevents the engineer from adding a new centralized control policy in Cisco vManage. To resolve this issue, the site-list "All-Site" should be configured with a new match sequence that is lower than the sequence for site-list "Hub", so that

  the policy for "Hub" will be applied first and then the policy for "All-Site" will be applied only to the remaining sites that are not in the "Hub" list.

  References:

  Designing and Implementing Cloud Connectivity (ENCC, Track 1 of 5), Module 3:

  Cisco SD-WAN Cloud OnRamp for Colocation, Lesson 3: Cisco SD-WAN Cloud OnRamp for Colocation - Centralized Control Policies Cisco SD-WAN Cloud OnRamp for Colocation Deployment Guide, Chapter 4:

  Configuring Centralized Control Policies Cisco SD-WAN Configuration Guide, Release 20.3, Chapter: Centralized Policy Framework, Section: Policy Configuration Overview

• Question 8:

  An engineer is implementing a highly securemultitierapplication in AWS that includes S3. RDS, and some additional private links. What is critical to keep the traffic safe?

  A. VPC peering and bucket policies
  B. specific routing and bucket policies
  C. EC2 super policies and specific routing policies
  D. gateway load balancers and specific routing policies
  B. specific routing and bucket policies

  ---

  explanation:

  Explanation/Reference:

  A highly secure multitier application in AWS that includes S3, RDS, and some additional private links requires specific routing and bucket policies to keep the traffic safe. The reasons are as follows:

  Specific routing policies are needed to ensure that the traffic between the tiers is routed through the private links, which provide secure and low-latency connectivity between AWS services and on-premises resources12. The private links can

  also prevent the exposure of the data and the application logic to the public internet12. Bucket policies are needed to control the access to the S3 buckets that store the application data34. Bucket policies can specify the conditions under

  which the requests are allowed or denied, such as the source IP address, the encryption status, the request time, etc.34. Bucket policies can also enforce encryption in transit and at rest for the data in S334.

  References:

  1: AWS PrivateLink

  2: AWS PrivateLink FAQs

  3: Using Bucket Policies and User Policies

  4: Bucket Policy Examples

• Question 9:

  What is the role of service providers to establish private connectivity between on-premises networks and Google Cloud resources?

  A. facilitate direct, dedicated network connections through Google Cloud Interconnect
  B. enable intelligent routing and dynamic path selection using software-defined networking
  C. provide end-to-end encryption for data transmission using native IPsec
  D. accelerate content delivery through integration with Google Cloud CDN
  A. facilitate direct, dedicated network connections through Google Cloud Interconnect
  C. provide end-to-end encryption for data transmission using native IPsec

  ---

  explanation:

  a service that allows customers to connect their on-premises networks to Google Cloud through a service provider partner. This provides low latency, high bandwidth, and secure connectivity to Google Cloud services, such as Google

  Compute Engine, Google Cloud Storage, and Google BigQuery. Google Cloud Interconnect also supports hybrid cloud scenarios, such as extending on-premises networks to Google Cloud regions, or connecting multiple Google Cloud

  regions together. Google Cloud Interconnect offers two types of connections: Dedicated Interconnect and Partner Interconnect. Dedicated Interconnect provides physical connections between the customer's network and Google's network at

  a Google Cloud Interconnect location. Partner Interconnect provides virtual connections between the customer's network and Google's network through a supported service provider partner. Both types of connections use VLAN attachments

  to establish private connectivity to Google Cloud Virtual Private Cloud (VPC) networks.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0 [Google Cloud Interconnect Overview] [Google Cloud Interconnect Documentation]

• Question 10:

  A company with multiple branch offices wants a suitable connectivity model to meet these network architecture requirements:

  1.

  high availability

  2.

  quality of service (QoS)

  3.

  multihoming

  4.

  specific routing needs

  Which connectivity model meets these requirements?

  A. hub-and-spoke topology using MPLS with static routing and dedicated bandwidth for QoS
  B. star topology with internet-based VPN connections and BGP for routing
  C. hybrid topology that combines MPLS and SD-WAN
  D. fully meshed topology with SD-WAN technology using dynamic routing and prioritized traffic for QoS
  D. fully meshed topology with SD-WAN technology using dynamic routing and prioritized traffic for QoS

  ---

  explanation:

  Explanation/Reference:

  A fully meshed topology with SD-WAN technology using dynamic routing and prioritized traffic for QoS meets the network architecture requirements of the company. A fully meshed topology provides high availability by eliminating single

  points of failure and allowing multiple paths between branch offices. SD-WAN technology enables multihoming by supporting multiple transport options, such as MPLS, internet, LTE, etc. SD-WAN also provides QoS by applying policies to

  prioritize traffic based on application, user, or network conditions. Dynamic routing allows the SD-WAN solution to adapt to changing network conditions and optimize the path selection for each traffic type. A fully meshed topology with SDWAN technology can also support specific routing needs, such as segment routing, policy-based routing, or application-aware routing.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0 [Cisco SD-WAN Design Guide]

  [Cisco SD-WAN Configuration Guide]