Free CCNP Enterprise 300-440 Ultimate Study Guide (Updated 40 Questions) [Q13-Q34]

Rate this post

Free CCNP Enterprise 300-440 Ultimate Study Guide (Updated 40 Questions)

Get to the Top with 300-440 Practice Exam Questions

Cisco 300-440 Exam Syllabus Topics:

Topic	Details
Topic 1	Operation: The topic delves into diagnosis of IPsec-based secure cloud connectivity between an on-premises native Cloud endpoints and Cisco IOS XE router. It also explains the diagnosis of routing issues on Cisco IOS XE routers, and diagnosis of Cisco SD-WAN policy issues, focusing on all the traffic.
Topic 2	IPsec Cloud Connectivity: The configuration of IPsec-based secure cloud connectivity is one of the focal points of this topic. Additionally, it delves into configuration of IPsec-based secure cloud connectivity between an on-premises Cisco IOS XE router and native Azure, AWS, and Google Cloud endpoints. Lastly, the topic discusses configuration of routing on Cisco IOS XE routers.
Topic 3	Architecture Models: In this topic different aspects of connectivity to cloud providers are discussed. It focuses on AWS, Azure, and Google Cloud. Moreover, the topic explains private connectivity to leading cloud providers and connectivity options for Software as a Service (SaaS) cloud providers.
Topic 4	SD-WAN Cloud Connectivity: Questions about configuration of SD-WAN-based cloud connectivity using Cisco infrastructure appear in this topic. Furthermore, it discusses configuration of Cisco SD-WAN OnRamp, configuration for connecting to a SaaS cloud provider, and configuration of Cisco SD-WAN policies to address traffic.
Topic 5	Design: Questions about cloud-native security policies for AWS, Azure, and Google Cloud appear in this topic. It also recommends connectivity models that ensure high availability, resiliency, SLAs, and reliability. Furthermore, the topic delves into connectivity models based on network architecture requirements. The topic further discusses factors including bandwidth, QoS, dedicated vs shared connections and multi-homing.

Q13. Refer to the exhibit.

Refer to the exhibits. An engineer must redistribute IBGP routes into OSPF to connect an on-premises network to a cloud provider. Which command must be configured on router R2?

redistribute ospf 1

redistribute bgp 100 ospf 1

redistribute bgp 100 subnets

bgp redistrlbute-lnternal

Q14.

Refer to the exhibits. An engineer must redistribute OSPF internal routes into BGP to connect an on-premises network to a cloud provider without introducing extra routes. Which two commands must be configured on router R2? (Choose two.)

router ospf 1

router bgp 100

redistribute ospf 1

redistribute bgp 100

redistribute ospf 1 match internal external

Q15. An engineer must enable the OMP advertisement of BGP routes for a specific VRF instance on a Cisco IOS XE SD-WAN device. What should be configured after the global address-family ipv4 is configured?

Enable bgp advertisement.

Disable bgp advertisement.

Enter sdwan mode.

Set the VRF-specific route advertisements.

Q16. Refer to the exhibit.

While troubleshooting an IPsec connection between a Cisco WAN edge router and an Amazon Web Services (AWS) endpoint, a network engineer observes that the security association status is active, but no traffic flows between the devices What is the problem?

wrong ISAKMP policy

identity mismatch

wrong encryption

IKE version mismatch

Q17. An engineer must edit the settings of a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS). IPsec must be configured to support multiple peers and failover after 120 seconds of idle time on the first entry of the crypto map named Cisco. Drag and drop the commands from the left onto the order on the right.

Explanation:
Step 1 = crypto map cisco 1 ipsec-isakmp Step 2 = set peer 192.168.10.1 default Step 3 = set peer
192.168.20.1 Step 4 = set security-association idle-time 120 default
The process of editing the settings of a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS), and configuring IPsec to support multiple peers and failover after 120 seconds of idle time on the first entry of the crypto map named Cisco involves several steps123456.
crypto map cisco 1 ipsec-isakmp: This command is used to create a new entry in the crypto map named
“cisco”. The “1” is the sequence number of the entry, and “ipsec-isakmp” specifies that the IPSec security associations (SAs) should be established using the Internet Key Exchange (IKE) protocol13.
set peer 192.168.10.1 default: This command is used to specify the IP address of the default peer for the crypto map entry. In this case, the default peer is at IP address 192.168.10.115.
set peer 192.168.20.1: This command is used to add an additional peer to the crypto map entry. In this case, the additional peer is at IP address 192.168.20.1. This allows the IPsec VPN to support multiple peers56.
set security-association idle-time 120 default: This command is used to set the idle time for the security association. If no traffic is detected over the VPN for the specified idle time (in this case, 120 seconds), the security association is deleted, and the VPN connection fails over to the next peer46.
References :=
Configure a Site-to-Site IPSec IKEv1 Tunnel Between an ASA and a Cisco IOS Router – Cisco Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services – Cisco Community Configuring Site to Site IPSec VPN Tunnel Between Cisco Routers Configure Failover for IPSec Site-to-Site Tunnels with Backup ISP Links on FTD Managed by FMC – Cisco Does Setting Multiple Peers in a Crypto Map Also Support Parallel IPSec Connections – Cisco Community Multiple WAN Connections – IPsec in Multi-WAN Environments | pfSense Documentation Multiple Set Peer for VPN Failover – Server Fault

Q18. An engineer is implementing a highly securemultitierapplication in AWS that includes S3. RDS, and some additional private links. What is critical to keep the traffic safe?

VPC peering and bucket policies

specific routing and bucket policies

EC2 super policies and specific routing policies

gateway load balancers and specific routing policies

Q19. A company with multiple branch offices wants a connectivity model to meet its network architecture requirements. The company focuses on ensuring low latency and efficient routing for its critical business applications. Which connectivity model meets these requirements?

hub-and-spoke topology with SD-WAN technology, using dynamic routing and OSPF as the routing protocol

fully meshed topology with SD-WAN technology, using dynamic routing and BGP as the routing protocol

point-to-point topology using dedicated leased lines and static routing

star topology with internet-based VPN connections and static routing

Q20. An engineer must configure a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router In Controller mode and AWS. The IKE version must be changed from IKEv1to IKEv2 in Cisco vManage.
Drag and drop the steps from the left onto the order on the right to complete the configuration.

Q21. What is the role of service providers to establish private connectivity between on-premises networks and Google Cloud resources?

facilitate direct, dedicated network connections through Google Cloud Interconnect

enable intelligent routing and dynamic path selection using software-defined networking

provide end-to-end encryption for data transmission using native IPsec

accelerate content delivery through integration with Google Cloud CDN

Q22. Refer to the exhibit.

Refer to the exhibits. An engineer troubleshoots a Cisco SD-WAN connectivity issue between an on-premises data center WAN Edge and a public cloud provider WAN Edge. The engineer discovers that BFD is Dapping on vEdge1. What is the problem?

The remote Edge device BFD is down.

The remote Edgedevice failed to respond BFD keepalives.

The remote Edge device has a duplicate IP address.

The control plane deleted the BFD session.

BFD (Bidirectional Forwarding Detection) is a protocol that detects failures in the overlay tunnel between Cisco SD-WAN devices. BFD packets are sent and received periodically by each device to check the liveliness and quality of the connection. If a device does not receive a BFD packet from its peer within a specified timeout interval, itconsiders the peer to be unreachable and reports a BFD down event. This event triggers a control connection state change and a possible route change in the SD-WAN fabric.
In this scenario, the engineer discovers that BFD is flapping on vEdge1, which means that the BFD session between vEdge1 and the remote Edge device is going up and down repeatedly. This indicates a connectivity issue between the two devices, such as network congestion, packet loss, or misconfiguration. The most likely cause of the problem is that the remote Edge device failed to respond BFD keepalives within the timeout interval, which resulted in a BFD timeout event on vEdge1. This event caused vEdge1 to mark the remote Edge device as down and notify the control plane. The control plane then tried to establish a new BFD session with the remote Edge device, which may have succeeded or failed depending on the network condition. This cycle of BFD session creation and deletion caused the BFD flapping on vEdge1.
The other options are less likely to be the cause of the problem. Option A is incorrect because if the remote Edge device BFD was down, vEdge1 would not receive any BFD packets from it and would not flap. Option C is incorrect because if the remote Edge device had a duplicate IP address, vEdge1 would not be able to establish a BFD session with it in the first place. Option D is incorrect because the control plane does not delete the BFD session unless there is a configuration change or a port-hop event on the device. References: Bidirectional Forwarding Detection Flap-Reason Definitions on Cisco vEdge Routers, Cisco Catalyst SD-WAN BFD, Cisco SD WAN: BFD (Bidirectional Forwarding Detection)

Q23. Which Microsoft Azure service enables a dedicated and secure connection between an on-premises infrastructure and Azure data centers through a colocation provider?

Azure Private Link

Azure ExpressRoute

Azure Virtual Network

Azure Site-to-Site VPN

Q24. Refer to the exhibit.

Which Cisco lKEv2 configuration brings up the IPsec tunnel between the remote office router and the AWS virtual private gateway?

Q25. Drag and drop the commands from the left onto the purposes on the right to identify issues on a Cisco IOS XE SD-WAN device.

Q26. Which approach does a centralized internet gateway use to provide connectivity to SaaS applications?

A cloud-based proxy server routes traffic from the on-premises infrastructure to the SaaS provider data center.

Internet traffic from the on-premises infrastructure is routed through a centralized gateway that provides access controls for SaaS applications.

VPN connections are used to provide secure access to SaaS applications from the on-premises infrastructure.

A dedicated, private connection is established between the on-premises infrastructure and the SaaS provider data center using colocation services.

Q27.

Refer to the exhibit. These configurations are complete:
* Create an account in the Equinix portal.
* Associate the Equinix account with Cisco vManage.
* Configure the global settings for Interconnect Gateways.
Drag the prerequisite steps from the left onto the order on the right to configure a Cisco SD-WAN Cloud Interconnect with Equinix