300-440 practice questions
Cisco · 300-440 · 300 questions
Original practice questions for the Designing and Implementing Secure Cloud Connectivity (ENCC) exam, covering every domain of the official exam objectives.
This course contains the use of artificial intelligence.
About the 300-440 exam
- Questions
- not published
- Passing score
- not published
- Format
- 90-minute exam associated with CCNP Enterprise; languages English and Japanese; price US$300 or Cisco Learning Credits
Schedule this exam The certification this earns
Exam details published by the vendor, checked 7 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Architecture Models (15%) · 45 questions
- A hospital will reach an AWS VPC from the campus edge router using only the public internet, and AWS will terminate the tunnels on a virtual private gateway. Which connectivity model is this?
- A university already has a cage in a colocation hall that houses the AWS Direct Connect location. They want a private VLAN from that cage to AWS and they do not use an MPLS carrier. Which model fits?
- A hospital already uses an MPLS WAN and wants private access to Azure virtual networks, with the carrier handing the network off into ExpressRoute. Which model is this?
- A logistics firm has a software-defined interconnect port in one metro and needs private virtual circuits from that port into both AWS and Azure, without a new physical cloud port for each attachment. Which model is this?
- A logistics company wants every branch on one Catalyst SD-WAN overlay into AWS, with centralized policy and the public internet as the underlay. Which model matches that requirement?
- A hotel branch has an approved local security stack and wants the lowest delay to Salesforce. Traffic should leave the branch straight to that application. Which SaaS connectivity model is this?
- A city government sends branch internet traffic through Catalyst SD-WAN tunnels to a secure internet gateway. The underlay is the public internet. There is no virtual private gateway in the path. Which model is this?
- A records company must reach a SaaS provider that sells a private interconnect for that application, and the contract says the records must not cross the public internet. Which model fits?
- A grocery chain's MPLS provider extends the private WAN into AWS Direct Connect. The grocery chain does not own a cage at the AWS location and does not order the cross-connect itself. Which model is this?
- A manufacturer will connect a plant router to an Azure virtual network over the public internet, terminating on an Azure VPN gateway. An ExpressRoute circuit exists in another region and will not be used. Which model is the plant path?
- A university sends Microsoft 365 traffic from each campus to a cloud security provider for inspection, and only then on to Microsoft. Users do not break out directly. Which SaaS connectivity model is this?
- A retailer forbids local internet breakout. Every branch must send Salesforce traffic to the data-center firewall, which is the only internet exit. Which SaaS connectivity model is this?
- A carrier wants one Catalyst SD-WAN overlay, over the public internet, that reaches both an AWS VPC and an Azure virtual network, with one policy for every branch. Which model is that?
- A clinic builds two IPsec tunnels across the public internet to a Google Cloud HA VPN gateway and peers BGP with Cloud Router. No interconnect port is ordered. Which model is this?
- A stadium wants guest wireless traffic to leave straight from the venue to the internet. Staff SaaS stays on the existing backhaul. Which model is the guest path?
- A lab company already has an SDCI port in one metro and wants a private virtual circuit from that port into Google Cloud. They do not want a new physical interconnect they would order themselves. Which model is this?
- A manufacturer's MPLS provider will extend the private WAN into Google Cloud. The manufacturer will not order its own interconnect port and will not use the public internet. Which model is this?
- A university has a cage in a colocation hall that offers an Azure ExpressRoute meet-me. The university will order the cross-connect itself. No MPLS carrier is involved. Which model is this?
- Every branch is already a Catalyst SD-WAN edge. A new private VPC must be reached with the same centralized policy as the rest of the overlay, over the internet. Which attachment should they add?
- A publisher already has an SDCI port in one metro into AWS. They need private paths from that same port into Azure and Google Cloud this week, without new physical ports. Which model covers the two new paths?
- A research lab has a cage in a building that hosts a Google Cloud interconnect location. The lab will order the cross-connect from that cage. No carrier MPLS service is used. Which model is this?
- A warehouse uses a standalone Cisco IOS XE router to send internet traffic through a GRE tunnel to a secure internet gateway. There is no SD-WAN controller. Which model is this?
- A clinic chain forbids both local breakout and data-center backhaul. Every Microsoft 365 session must be inspected by a cloud security provider first. Which SaaS model is this?
- A retailer sends every store's Salesforce traffic to a regional hub, and only that hub has an internet exit. Stores have no local breakout. Which SaaS model is this?
- A clinic's MPLS carrier offers a handoff into Azure ExpressRoute private peering for the virtual networks. The carrier also sells internet access. The clinic must stay off the public internet. Which handoff should they use?
- A campus router builds both tunnels of one AWS Site-to-Site VPN connection across the public internet to a virtual private gateway. No Direct Connect port exists. Which model is this?
- A co-op wants every branch edge on Catalyst SD-WAN to reach a new Azure virtual network with one centralized policy. The underlay will be the public internet. Which model fits?
- A hospital must send a defined set of Microsoft public-service prefixes over ExpressRoute Microsoft peering, and must not send them across the public internet. Virtual-network traffic uses a different peering. Which model is the Microsoft public-service path?
- A university lab has an approved local security stack and a delay target for Google Workspace. Backhaul to the main campus misses that target. Which SaaS model meets the delay target?
- Remote workers at a law firm send Microsoft 365 through a cloud security provider before it reaches Microsoft. They do not use the office internet gateway. Which SaaS model is this?
- A plant's private interconnect into Google Cloud has failed. The backup is a cellular internet circuit with IKEv2 to Cloud VPN. There is no SD-WAN overlay. What is that backup?
- A gallery's router sits in its colocation cage, and the cross-connect to the cloud on-ramp lands on that router. Someone proposes moving the router to the gallery and leaving the cage empty. What does this design require in the cage?
- Every branch sends SaaS to one of two regional hub firewalls, and no branch breaks out locally. There is no private circuit to the SaaS provider. Which model is this?
- A resort edge reaches an Azure cloud gateway on the biz-internet color, with the public-internet color as backup. Both colors are public internet. There is no MPLS. Which model is this?
- A shipper attaches several VPCs to one AWS transit gateway and builds a VPN attachment to the campus over the public internet. There is no Catalyst SD-WAN controller. Which model is this?
- A lab already has an SDCI port in the right metro, with a virtual circuit into one AWS region. A second AWS region must be added on that same private fabric. What should they order?
- An SDCI virtual circuit into a VPC is up and too small for the traffic. The fabric port has spare capacity. What should they change?
- Guest users at a venue ride Catalyst SD-WAN to a secure internet gateway over the public internet. Staff use an MPLS handoff into a private cloud. What is the guest path?
- A branch router uses business broadband and IKEv2 to an Azure VPN gateway. There is no private interconnect and no Catalyst SD-WAN controller. Someone calls the broadband private because the ISP sells it to businesses. Which model is this?
- A museum has a cage in one building. The cloud on-ramp is in another building on the same provider campus. The museum does not have an SDCI fabric port. How should the museum reach the on-ramp?
- A mill's MPLS carrier already hands the private WAN off to Google Cloud Partner Interconnect. Someone suggests the mill order Dedicated Interconnect on its own. The carrier path is the one they must use. Which path is that?
- A pharmacy breaks a telehealth application out through its own branch firewall to the internet. No cloud security provider is in the path, and nothing is backhauled. Which SaaS model is this?
- Every branch sends SaaS to one virtual firewall in a cloud hub, and no branch breaks out locally. There is no private circuit to the SaaS provider. Which model is this?
- A clinic firewall inspects guest web. Staff SaaS skips that firewall and goes to a cloud security provider before the application. Which model is the staff SaaS path?
- A payroll provider includes a private peering in the contract. The requirement is that payroll traffic stay off the public internet. The internet path is up. Which path should payroll use?
Design (15%) · 45 questions
- A hotel chain needs the WAN provider to queue voice ahead of bulk data and to commit to a loss target between the hotels and a cloud contact-center VPC. Which connectivity choice fits?
- A bank's control owner says a dataset must not cross the public internet and must run only in a FedRAMP-authorized cloud offering. Which connectivity recommendation fits?
- A retailer must keep an internet IPsec path into an Azure virtual network up through a gateway-instance failure, without waiting for a standby instance to claim one public address. Which design meets that requirement?
- A retailer wants the 99.99 percent availability target Google documents for HA VPN between the campus and a VPC. What must the campus build to qualify on the Google Cloud side?
- A hospital control says a records workload must stay off the public internet to meet the ISO control they adopted, and the workload already runs in the approved cloud environment. Which connectivity recommendation fits?
- A stadium has two internet providers and must keep AWS transit-gateway VPN paths independent, so one provider failure withdraws only that provider's routes. Which design fits?
- A hospital has one AWS Site-to-Site VPN connection from the campus. One of the two tunnels is down and the other is up, and traffic to the VPC continues. Why is that flow expected to survive?
- Two application subnets inside one AWS VPC must stop communicating with each other. The site-to-site VPN from the campus must stay up, and inbound internet publishing is unchanged. Which policy belongs on this change?
- A bank wants every internet-bound flow that starts inside an AWS VPC to be inspected by the campus firewall. Traffic between two private subnets in the VPC must stay inside AWS. Which policy matches the internet requirement?
- A broker must keep a private AWS path up if an entire Direct Connect location fails. One dedicated connection exists at a single location today. What adds that location resiliency?
- A studio needs its own AWS Direct Connect port speed, not a slice of a partner's shared port. Which attachment matches?
- A factory needs a committed bandwidth into an AWS VPC, sized to a port they order, rather than a best-effort internet rate. Which connectivity choice matches?
- A defense contractor's adopted NIST-based control says the regulated dataset must not traverse the public internet. The workload already sits in the approved cloud environment. Which connectivity recommendation fits?
- Two application VPCs are peered. The security team must stop one VPC from reaching the database subnet in the other. The campus site-to-site VPN must stay unchanged. Which policy is this?
- A ticket company wants customers on the public internet to reach a web application in a cloud VPC. Campus VPN users must keep today's site-to-site path. Which policy is the new requirement?
- A hospital has two campus routers and wants an AWS VPN path to survive the failure of either router. One VPN connection on one router exists today. What should they add?
- A records firm's adopted control says a dataset must stay in-region and off the public internet. A faster internet VPN would hairpin through another country's POP. The approved environment is already in-region. Which connectivity fits?
- A bank uses one AWS Direct Connect path for production and wants traffic to fall back to an internet VPN only when that private path fails. Which design matches?
- Internet customers reach a web application through a cloud load balancer. Return traffic is being forced back through the campus firewall, and the customers' sessions fail. Campus VPN users are a separate path. What should the return path do?
- A retailer's store prefixes change several times a month. Each change must reach an Azure virtual network without a ticket to edit static routes on the VPN. Which routing choice fits?
- A shipper has one SDCI port in a single metro into AWS and wants the private path to survive that metro failing. They can buy a second SDCI port in another metro. What routing should use both?
- A bank's adopted control requires the records path to be encrypted. The path today is an AWS Direct Connect private virtual interface with no encryption. Staying off the public internet is also required. What should they add?
- A gallery must let internet visitors reach a new web application in a cloud VPC. Two private subnets must keep talking to each other. The campus VPN stays as it is. Which change meets the visitor requirement?
- Two subnets in an Azure virtual network must stop talking to each other. Internet-bound traffic from those subnets must keep using Azure's internet path, not the campus. Which control fits?
- A retailer firewall drops any flow that returns on a different tunnel from the one it used outbound. They still want an Azure VPN that fails over if the active instance is lost. Which gateway mode fits?
- A hotel's MPLS provider contract schedules voice only when the voice class is marked at the handoff into a cloud contact-center path. The internet is not on this path. What must the hotel edge do?
- A contractor can save money with an internet VPN into a commercial cloud region. The workload must run in the dedicated government cloud offering that holds the FedRAMP authorization the contract names, and must stay off the public internet. Which recommendation fits?
- A clinic wants the 99.99 percent HA VPN topology Google documents to a VPC in one region. They have one HA VPN gateway and a tunnel on only one of its two interfaces. What completes that topology?
- A records firm may send guest traffic over an internet VPN. A stated control says the regulated dataset stays off the public internet. Which path can carry that dataset?
- Two workloads in a cloud VPC must be inspected when they talk to each other. The inspection must stay in the cloud. Campus delay is not acceptable. Which policy fits?
- A publisher keeps a replica of a VPC in a second AWS region. The campus must still reach the replica if the first region is lost. What provides that survival?
- A plant has two equal internet providers and an AWS VPN on each. Both paths should be used, and a provider failure should withdraw only that path. Static defaults are the only routing today. What should replace them?
- A clinic advertises one campus prefix into an AWS VPN, and that prefix has not changed in years. There is no plan to add prefixes. Which routing is sufficient?
- A hospital has one ExpressRoute circuit in one peering location. The private path must survive the loss of that location. What adds that survival?
- A bank must encrypt the Direct Connect link itself with MACsec. A hosted connection is what they have today. Which change fits that requirement?
- A clinic has one Google Cloud HA VPN gateway. BGP is up on only one of the two interfaces. That tunnel fails and the VPC prefix disappears. What should also be up?
- Every internet flow from an Azure virtual network must leave through the campus firewall. East-west traffic inside the virtual network can stay local. What meets the internet requirement?
- Internet traffic from a virtual network must be inspected in the cloud. Backhaul to campus is forbidden. East-west traffic inside the virtual network is out of scope. What meets the internet requirement?
- A control says a dataset must use a private path into one named cloud region. An internet VPN into that same region is up. Which path meets the control?
- Both tunnels of one AWS VPN connection leave through the same internet provider. A second provider is already installed and unused. One provider failure should leave a tunnel up. What should change?
- A campus must keep independent native VPNs to AWS and to Azure. Prefixes on each side change often. What fits?
- A partner must reach one published application in a VPC and must not reach the rest of the VPC. A full site-to-site VPN from the partner is proposed. What fits?
- A control says a dataset must stay in a named authorized cloud offering. A private interconnect into a cheaper commercial region is up. The commercial region is not that offering. Which path meets the control?
- A control requires encryption in transit for a dataset and does not require a private path. An unencrypted private port is available. An IPsec VPN over the internet is available. Which path meets the control?
- A startup needs best-effort private connectivity into a VPC and does not need a bandwidth commitment or the whole port. A partner can sell a hosted connection. What is sufficient?
IPsec Cloud Connectivity (25%) · 75 questions
- An IOS XE router has a working IPsec tunnel and an Established BGP session to an AWS virtual private gateway, but AWS never learns the campus prefix 10.8.0.0/16. The router uses a network statement for that prefix and has no route to it in the routing table. What is the cause?
- A government campus must extend its existing OSPF domain across an IPsec path into a cloud VPC. The native cloud VPN gateway will not run OSPF. What should they deploy in the VPC?
- A retailer redistributes BGP routes from an AWS virtual private gateway into OSPF, and OSPF routes back into BGP, on the same IOS XE router. No tags or prefix filters are applied. What failure should they expect?
- A stadium placed a Cisco IOS XE router in a cloud VPC to terminate IPsec from the campus. The campus router is behind NAT. IKE never completes. The cloud firewall allows only TCP 22 to the virtual router. What must that firewall also allow?
- A logistics IOS XE edge must send guest internet traffic to a secure internet gateway for inspection, while a separate tunnel still reaches an AWS VPC. How should the guest traffic be sent?
- A university edge running Cisco IOS XE must bring up internet connectivity to a native AWS virtual private gateway. Which tunnel configuration matches that endpoint?
- A stadium's Cisco IOS XE router in an AWS VPC has an up IPsec tunnel to the campus, but campus hosts still cannot reach VPC instances. Those instances use the VPC route table, which has no route for the campus prefix. What should be added?
- An IOS XE router will run BGP across a route-based tunnel to Azure. An engineer sets the BGP router ID and the advertised peer address to the router's public WAN address. Azure will not accept that peer. Which address should be used instead?
- A hospital IOS XE router will terminate internet IPsec to a new Google Cloud HA VPN gateway. Which configuration matches what HA VPN can actually peer with?
- A retailer IOS XE router sits behind a NAT device and builds a route-based tunnel to an Azure VPN gateway. IKE starts on UDP 500, then the SA never completes. UDP 4500 is blocked on the path. What is the failure?
- A university IOS XE router must exchange BGP routes with an Azure virtual network over internet IPsec. Which gateway and tunnel should they build?
- A government team placed a Cisco IOS XE router in a cloud VPC and gave it only a private address. Campus IKE packets never arrive, even though the cloud firewall allows UDP 500 and UDP 4500. What is missing?
- A manufacturer's Cisco IOS XE router in an AWS VPC has an up IPsec tunnel to the plant. The VPC route table already points the plant prefix at that router. The plant's routing table has no VPC prefix. The cloud router never advertises its connected VPC subnet. What should be added?
- A university IOS XE router uses the correct pre-shared key toward an Azure route-based VPN gateway, but IKEv2 never completes. The router identifies itself with a hostname. Azure is configured to expect the router's public IPv4 address. What must change?
- A cloud-hosted IOS XE router learns a VPC subnet as connected and advertises it by iBGP to the campus router. It does not set the next hop to itself. The campus router has no route to the advertised next hop. What should the cloud router do?
- A bank IOS XE router will use a native AWS virtual private gateway with BGP. Which IPsec style matches that route-based endpoint?
- A clinic will not run BGP to an AWS virtual private gateway. The IPsec tunnel is up, but AWS never installs the clinic prefix. No static route for that prefix was entered on the VPN connection. What is missing?
- A campus IOS XE router must send internet-bound traffic to a secure internet gateway. That gateway's current guide says to terminate plain GRE from the campus, not IPsec. Which tunnel should the engineer configure?
- An Azure VPN gateway is active-active and has two public addresses. The campus IOS XE router has one route-based tunnel to the first address only. What must be added so both instances are used?
- A campus IOS XE router learns its AWS VPC prefix by eBGP across the IPsec tunnel. The team wants a static route to a second tunnel to be used only when that BGP route disappears. Which distance should the static use?
- A Cisco IOS XE router in an Azure virtual network terminates IPsec and must forward campus traffic toward application hosts. Azure drops those transit packets. IP forwarding on the router's NIC is disabled. What must be enabled?
- One tunnel of an AWS VPN connection goes silent. The campus IOS XE router keeps the route toward that tunnel because it never declares the peer dead. The second tunnel is up. What should be enabled?
- A campus IOS XE router learns a default route from its internet edge and, by redistribution, advertises that default to an AWS virtual private gateway by BGP. VPC instances then try to use the campus for their internet path and fail. What should the router stop advertising?
- A cloud-hosted Cisco IOS XE router has a public address on one interface and only private addresses on the VPC inside interfaces. Campus IKE never arrives. The tunnel source is set to an inside private interface. What should the tunnel source be?
- Campus and cloud Cisco IOS XE routers exchange routes over GRE across the public internet. The security team requires the payload to be encrypted. GRE is up and readable on a capture. What should be added?
- A campus IOS XE router has two up BGP sessions to AWS across two tunnels. The team wants this router's outbound traffic to prefer tunnel 1. Which local change does that?
- Campus and cloud Cisco IOS XE routers run OSPF on a GRE tunnel. One side is network type point-to-point and the other is broadcast. Hellos arrive and the adjacency never forms. What must match?
- Two Cisco IOS XE routers, one on campus and one in a VPC, run OSPF over a protected GRE tunnel. Hellos arrive. One side is in area 0 and the other is in area 1. The adjacency stays down. What must match?
- An Azure route-based VPN connection is set to IKEv2 only. The campus IOS XE router offers only IKEv1. The pre-shared key matches and UDP 500 is open. IKE never completes. What must the router use?
- A clinic hosts one Cisco IOS XE router in a VPC as the only IPsec headend for the campus. A failure of that router isolates the VPC. They can add a second virtual router. What should the second router do?
- A campus router advertises its prefix to two AWS tunnels. Return traffic from the VPC should prefer tunnel 2. The campus outbound path is already correct. Which advertisement change influences AWS?
- A cloud IOS XE router learns campus prefixes by BGP and redistributes them into a second BGP session that also faces the campus. The campus starts preferring the path that points back at the cloud router. No outbound filter exists. What should be filtered?
- Two Cisco IOS XE routers, campus and cloud, peer eBGP using loopback addresses across an IPsec tunnel. The loopbacks are reachable with ping. The session stays down and eBGP multihop is not configured. What is missing?
- A campus VPN was moved from an AWS virtual private gateway to a transit gateway. The IOS XE router still targets the old gateway's outside address and BGP neighbor. Tunnels to the new gateway stay down. What must be retargeted?
- Instances in a VPC send return traffic for the campus prefix to the internet gateway. The cloud IOS XE router has the campus route, and the subnet route table has no entry for the campus prefix. What should the route table use as the target?
- A campus IOS XE router uses certificate authentication toward an AWS virtual private gateway. Small IKEv2 exchanges start, then the negotiation stalls, and a capture shows large UDP 500 packets dropped on the path. What should the router enable?
- A campus IOS XE tunnel toward an AWS outside address stays line-protocol down. The tunnel destination is correct, and the routing table has no route to that address. What should be added?
- IKEv2 to a Google Cloud HA VPN gateway is up. The IPsec SA never forms. The transform set on the IOS XE router is not one the HA VPN tunnel will accept. What must be aligned?
- One campus IOS XE router has two BGP paths to the same AWS prefix. Only this router should prefer the first path. Other campus routers must keep their own choices. Which attribute does that?
- Campus IKE to a cloud-hosted Cisco IOS XE router never arrives on the tunnel. The cloud firewall allows UDP 500 and UDP 4500. An ACL on the router's internet-facing interface denies those ports. What must change?
- Campus and cloud Cisco IOS XE routers use IKEv2. The cloud firewall allows UDP 500 and UDP 4500. The pre-shared keys on the two routers do not match. IKE fails. What must match?
- An Azure VPN connection expects a pre-shared key. The campus IOS XE router offers only a certificate. The peer address and IKEv2 version match, and IKE fails. What must the router use?
- A campus router advertises its prefix on two AWS tunnels. Return traffic prefers tunnel 1. The advertisement on tunnel 1 has a lower MED than the advertisement on tunnel 2. AWS is using MED. Which change makes AWS prefer tunnel 2?
- A Cisco IOS XE router in Azure has an up tunnel, a route to the campus, and a subnet route that points the campus prefix at its NIC. Transit packets toward application hosts are still dropped. IP forwarding on that NIC is disabled. What must be enabled?
- DPD marks one AWS tunnel down and BGP withdraws its routes. A static route at distance 1 for the VPC prefix still points at that dead tunnel, and traffic blackholes. What is keeping the bad path?
- A Cisco IOS XE router in a cloud VPC has only a private address in a private subnet. There is no public address and no inbound path from the internet. Campus IKE packets never arrive. What is missing?
- A cloud IOS XE router and a campus router run OSPF on a tunnel. Network type and MTU match. One interface is in area 2 and the other is in area 3. Neither side is area 0. Hellos arrive and no adjacency forms. What must be true?
- A campus IOS XE router sits behind NAT. The tunnel source is a private loopback the NAT device does not translate. AWS never completes IKE, and the packets that arrive still show the private source. What should the tunnel source be?
- A campus IOS XE GRE tunnel to a secure internet gateway is up. A capture on the internet shows the inner addresses in the clear. The gateway's guide requires IPsec as well as GRE. What should be added?
- Campus and cloud Cisco IOS XE routers use the same pre-shared key and IKEv2. The campus router presents a hostname. The cloud router expects the campus public address. IKE fails. What must agree?
- A campus IOS XE router is behind NAT. The firewall permits UDP 500 and UDP 4500 toward an Azure VPN gateway. IKE starts and never moves onto UDP 4500. NAT traversal is disabled on the router. What should be enabled?
- Two cloud IOS XE routers are OSPF neighbors of the campus. Users prefer the distant router because its tunnel has the lower OSPF cost. Both tunnels are healthy. How do you make the nearer router win?
- Campus and cloud IOS XE routers have a GRE tunnel that is up. Tunnel protection is configured on a different, unused tunnel. A capture shows the GRE payload in the clear. What must move?
- A studio must send multicast from the campus to an application in a VPC. A native site-to-site VPN is up and unicast works. Multicast never arrives. What should terminate the campus tunnel inside the VPC?
- Campus and cloud IOS XE routers have an IPsec SA up. GRE over that session stays down. One side sets a GRE tunnel key and the other side sets none. What must agree?
- Small pings across a cloud IOS XE tunnel work. Large TCP transfers hang. TCP MSS adjustment is configured on the physical internet interface and not on the tunnel. Where should it be applied?
- A secure internet gateway accepts IKE only from one agreed public address. The campus NAT pool uses a different public address, and IKE never completes. The gateway address is reachable. What should change?
- A campus IOS XE router aims its tunnel destination at an address inside the VPC. IKE never reaches AWS. The VPN connection page shows a different outside public address. What should the destination be?
- A clinic retired a campus prefix and is using a new one. AWS still sends return traffic toward the old prefix. BGP is not in use. The VPN connection still has a static route for the old prefix. What should be edited?
- Two IOS XE routers on a cloud GRE tunnel never become OSPF neighbors. Area, network type, and MTU match. The hello and dead timers do not. What must match?
- Two cloud IOS XE routers peer with iBGP. Return traffic should prefer the router closer to the users. The preference has to be shared between those routers. Which attribute does that?
- IKEv2 to an Azure VPN gateway starts and the IPsec SA never forms. The router offers a Diffie-Hellman group the gateway is not configured to accept. The pre-shared key matches. What must change?
- Campus and cloud IOS XE routers use IKEv2 certificates. The clocks match and the identity matches. The cloud router does not trust the campus certificate authority. IKE fails. What must the cloud router trust?
- A cloud IOS XE router advertises its GRE tunnel subnet to the campus by BGP, and that subnet is more specific than the path used to reach the tunnel destination. The tunnel then drops. What should be filtered?
- A campus router sets local preference on the prefixes it advertises to AWS and expects AWS to prefer tunnel 2 for return traffic. Return traffic stays on tunnel 1. What can influence AWS?
- Campus prefixes are redistributed into OSPF and never appear on the cloud IOS XE router. The tunnel on that router is in a stub area. Area numbers match. Why are the prefixes missing?
- Campus and cloud IOS XE routers fail to form an IPsec SA. One offers transport mode and the other offers tunnel mode. The pre-shared key matches. What must match?
- One campus router learns a cloud prefix by eBGP. A second campus router never sees it. There is no iBGP session between the two campus routers. Both can reach the cloud tunnel router. What is missing?
- A campus router has BGP multipath enabled and sends cloud traffic across both AWS tunnels. The design wants outbound traffic on tunnel 1 only. Tunnel 2 should remain a backup. What should you set?
- A campus router uses GRE toward a cloud IOS XE router. The cloud router is a route-based VTI with no GRE. OSPF never starts, and a capture shows the encapsulations do not match. What should both sides use?
- A cloud IOS XE router redistributes connected routes into OSPF toward the campus. The campus then tries to reach the router's public WAN address through the tunnel, and the tunnel drops. What should be stopped?
- An IOS XE router has two tunnels toward an AWS VPN connection. Tunnel 1 has an IPsec profile and an SA. Tunnel 2 has no profile and never forms an SA. What does tunnel 2 need?
- Pings across a cloud IOS XE tunnel work. Application TCP fails. An inbound ACL on the tunnel permits ICMP and denies everything else. The SA is up. What should the ACL permit?
- A route-based tunnel to AWS is up and idle. A crypto map on the physical internet interface matches the VPC prefixes, and that map's SA is the one carrying traffic. Users fail when the map's peer is wrong. What should be removed?
- AWS sends one subnet back through a dead tunnel and sends the rest of the range through the live tunnel. The campus still advertises that subnet toward the dead tunnel. BGP is up on the live tunnel. What should be withdrawn?
SD-WAN Cloud Connectivity (25%) · 75 questions
- A stadium's Catalyst SD-WAN sites use Microsoft 365. The network team wants each site to prefer whichever measured path to that application is healthier, including a local internet exit. Which feature does that?
- A bank will host a clearing application in a private AWS VPC and wants Catalyst SD-WAN branches to reach it over the internet, with the cloud side built from SD-WAN Manager. Which feature should they turn on?
- Two university service VPNs on Catalyst SD-WAN can each reach AWS, and each has an OMP route to the other, but hosts in the two VPNs cannot communicate. Firewall drop counters on that zone pair are increasing. Which policy is responsible?
- Cloud OnRamp for SaaS is enabled for a SaaS company's Microsoft 365 traffic. One branch has only an MPLS transport and no local internet exit. Local probes for that site stay absent. Why?
- Cloud OnRamp for SaaS is turned on for a retailer's Catalyst SD-WAN network, and one branch has a working local internet exit. Microsoft 365 still follows the data-center default. That application was never enabled in OnRamp. Why?
- A hotel chain runs Catalyst SD-WAN and wants branch web traffic inspected by Cisco Umbrella before it reaches the internet. VPC connectivity is a separate project. Which feature should they configure?
- A bank's Catalyst SD-WAN branches must send web traffic through the secure internet gateway, while voice to a cloud contact center stays on the direct internet path. Which policy creates that split?
- A manufacturer wants every branch to reach an Azure prefix only through the regional Catalyst SD-WAN cloud gateway, never directly on a branch-to-branch TLOC. Routes should not be offered any other way. Which policy does that?
- A retailer runs Catalyst SD-WAN with an MPLS color that has no internet breakout and a public internet color. The Azure cloud gateway uses a public address. Which transport should carry BFD to that gateway?
- A manufacturer enabled Cloud OnRamp for SaaS and expects it to attach branch service VPNs to a private Azure virtual network where an internal application lives. No SaaS application is involved. Why will that fail?
- A hotel will send guest web traffic through Cisco Umbrella using the Catalyst SD-WAN Secure Internet Gateway feature. An engineer also plans a manual crypto map, in VPN 0, to the same Umbrella headend. What should they do?
- A stadium wants voice to a cloud contact center to prefer the internet color, and to use MPLS when the internet path misses the loss target. Voice must not be dropped. Which policy behavior is that?
- A logistics company wants hosts in service VPN 10 and service VPN 20 to be unable to talk to each other, while both VPNs keep their existing paths to Azure. Which policy enforces the split?
- A logistics Catalyst SD-WAN edge has both an internet color and an MPLS color up. The cloud gateway is reachable on both, but the company wants the Azure prefix to prefer the internet TLOC. Which policy does that without removing MPLS?
- A university wants Catalyst SD-WAN to block known malicious URL categories for branch web traffic headed to the internet. Reachability and path selection are already correct. Which policy type does the blocking?
- A retailer uses Catalyst SD-WAN Secure Internet Gateway tunnels for guest web traffic and wants that inspection path to survive one provider point of presence failing. What should they configure?
- Cloud OnRamp for Multicloud has a healthy AWS cloud gateway, and BFD from the stores is up. Stores in service VPN 10 still have no route to the VPC. VPN 10 was never attached to that cloud gateway. What is missing?
- Cloud OnRamp for SaaS is enabled for Microsoft 365 at a retail store that has a local internet exit and a gateway path. Loss on the local exit rises sharply, and the gateway path stays healthy. What should OnRamp do?
- A hospital group wants branch edges to reach the regional cloud gateway and not to build branch-to-branch data paths. Which policy creates that overlay shape?
- A pharmacy chain wants Microsoft 365 to use the local internet exit at each store, and wants every other web flow to stay on the secure internet gateway. Which policy makes that split?
- A regional Catalyst SD-WAN hub is selected as a Cloud OnRamp for SaaS gateway for Microsoft 365. The hub has only an MPLS transport and no internet exit. Gateway probes from that hub do not appear. Why?
- A clinic wants voice to prefer the internet color, and to use only the MPLS color when internet misses the loss target. Voice must not be dropped, and it must not pick some third path. Which action is that?
- A new Catalyst SD-WAN edge should reach an Azure cloud gateway over the internet. The physical internet interface was placed in service VPN 10. BFD to the gateway never forms. Where does that interface belong?
- A resort's Catalyst SD-WAN edge shows both secure internet gateway tunnels up. Guest web traffic still leaves by uninspected local internet. No data policy references the SIG. What is missing?
- A cloud gateway advertises a default route into OMP, and branch stores start sending their local internet breakout traffic toward the gateway. The stores should keep local breakout. Which policy fixes it?
- A hospital wants Catalyst SD-WAN to inspect branch internet traffic for exploits and block matching flows. Path selection is already correct. Which policy does the inspection?
- Cloud OnRamp for SaaS is enabled only for Salesforce. Webex calls from a branch stay on a lossy backhaul even though a healthy local internet exit exists. Why is Webex left on the backhaul?
- A university security policy must block specific HTTPS URL paths, not only the host name. The current URL filter sees only the name. Which change lets the policy see the path?
- A hotel set the Catalyst SD-WAN Secure Internet Gateway feature to IPsec. The provider endpoint in the guide accepts only GRE. Both SIG tunnels stay down. What should be changed?
- An Azure cloud gateway is healthy, and other sites reach it. One store's internet color is forced down by a local interface tracker even though the circuit is up. BFD from that store to the gateway is down. What should be corrected?
- A new store edge has control connections and BFD on its internet color. It receives no service-VPN routes, and its users have no VPN 10. A VPN membership policy lists every other store and omits this one. What is missing?
- Cloud OnRamp for SaaS is enabled for both Webex and Salesforce at a branch. Webex scores better on the local internet exit. Salesforce scores better through the regional gateway. What should OnRamp do?
- A branch data policy uses a local TLOC action to send a payroll application out a specific transport. An application-aware routing policy for the same application prefers a different color. Which path does the application take?
- A logistics edge has internet and MPLS up. The Azure prefix must prefer the internet TLOC and must keep MPLS as a usable alternate. Which control-policy action is that?
- On a Catalyst SD-WAN edge, staff web through the SIG works and guest web fails. The guest zone pair denies web, the staff zone pair permits it, and both VPNs use the same SIG tunnel. What explains the guest failure?
- A branch internet interface is up and has no NAT. Cloud OnRamp for SaaS is enabled for Microsoft 365, and local probes from that interface do not run. A second interface with working NAT does probe. Why is the first interface skipped?
- Guest web fails and guest ping to the SIG zone works. The zone pair permits only ICMP from the guest zone to the SIG zone. The SIG tunnel is up. What is missing from the zone pair?
- A resort's SIG tunnels are up. Guest web still exits uninspected. The data policy matches guest web and sets the next hop to the local internet interface, not the SIG. What should that policy set?
- Every store in a region has Secure Internet Gateway tunnels except one new store. That store is missing from the site list where the SIG feature is attached. Its internet color is up. Why are its SIG tunnels absent?
- A store's only AWS cloud gateway is a single point of failure for the VPC. Catalyst SD-WAN needs a live alternate gateway, and only one cloud gateway can be created per AWS region. What should they add?
- Cloud OnRamp for SaaS is enabled for Microsoft 365. One store has a working local internet exit and is missing from the site list allowed to break out. That store stays on the gateway. Why?
- A branch has a healthy local internet exit, and Cloud OnRamp for SaaS is enabled for Microsoft 365. This site was excluded from local probing. Traffic stays on the gateway path. Why is the local exit unused?
- A European store's BFD to an AWS cloud gateway is up, and the gateway was built in a distant region. Application delay to the VPC is far higher than the store's internet delay to a European AWS region. What should move?
- A clinic wants voice to a cloud contact center on the MPLS color and bulk data on the internet color. Voice was placed in an SLA that prefers MPLS. Bulk data matches no SLA. Which outcome is correct?
- Cloud OnRamp for SaaS scored the gateway better for Microsoft 365, then a data policy was added that pins that application to the local internet exit. Users are on the worse local exit. Why is the score ignored?
- Cloud OnRamp for SaaS shows healthy Webex probes and no Microsoft 365 probes. Users say Microsoft 365 is stuck on a lossy backhaul. Webex is the only enabled application. What is missing?
- A new Catalyst SD-WAN edge has its internet interface in VPN 0 and no default route in that VPN. BFD to the Azure cloud gateway's public address never starts. What is missing in VPN 0?
- A hotel wants guest web inspected at the SIG and staff web broken out locally. Both currently match one data policy that sends all web to the SIG. What should the policy do?
- Guest web at a stadium should be inspected by the secure internet gateway. The SIG tunnels are up. A data policy sends guest web to the IaaS cloud gateway that holds a private VPC. What should the policy send it to?
- Voice and bulk file transfers both prefer the MPLS color. The voice SLA application list includes the file-transfer application as well as voice. Internet is healthy and unused by either. What should be removed from the voice list?
- Most stores learn a new cloud prefix by OMP. One store's centralized control policy rejects that prefix. The store has BFD to the cloud gateway and does not install the prefix. Why is this store different?
- Stores in one city send Microsoft 365 through a Cloud OnRamp for SaaS gateway site on another continent. A store in the same city has a healthy internet exit and is not a gateway. What should change?
- Guest users in VPN 20 can see a VPC prefix that only staff in VPN 10 should reach. OMP installed the prefix in both VPNs. What should limit it to the staff VPN?
- The secure internet gateway feature is set for one cloud security provider. The tunnel destination configured on the edge belongs to a different provider. The tunnels stay down. BFD to ordinary sites is up. What must match?
- Branches have BFD up to an AWS cloud gateway and an OMP route for a VPC. Instances in that VPC stay unreachable. The VPC was never attached to the gateway. What is missing?
- A store has two healthy internet colors. Cloud OnRamp for SaaS probes only the first, which is lossy, and sends Microsoft 365 to the gateway. The second color is not configured as a local exit. What is missing?
- A zone-based policy permits staff web to the internet and intrusion prevention is not applied to that policy. Malware in those sessions is allowed. Routes exist. What is missing?
- A URL filter blocks a category that contains a payroll site the staff must use. Every other site in that category should stay blocked. The payroll site is not on the allow list. What should be added?
- Cloud OnRamp for Multicloud already builds the path from a branch into a VPC. An older manual IPsec tunnel on the same edge also aims at that VPC and blackholes some flows. What should carry the VPC?
- A clinic enables Cloud OnRamp for SaaS only for a file-sharing application nobody uses. The telehealth application they do use has no probe and stays on a lossy backhaul. What should be enabled?
- Branches reach the internet and have no MPLS. The cloud gateway was built with only a private transport color. BFD to the gateway stays down. What does the gateway need?
- Cloud OnRamp for SaaS scores both Salesforce and Webex as better on the local exit. The store needs Salesforce local and Webex kept on the gateway. What keeps Webex on the gateway?
- Voice prefers MPLS. The backup color is down, strict is not set, and voice still flows on the remaining internet color. Loss on MPLS misses the class. Why does voice still flow?
- Cloud OnRamp for SaaS uses one gateway site. That site's internet exit fails, and every branch loses its SaaS probe. Branch local exits are not allowed. What should be added?
- Voice still uses a path with high delay. The SLA class for voice watches loss only, and loss on that path is inside the class. Delay is the problem users report. What should the class include?
- A store interface can reach the internet, and a tracker holds that color down. Cloud OnRamp for SaaS sends Microsoft 365 to the gateway and shows no local probe. What is keeping the local exit out?
- A firm has two secure internet gateway providers configured. Regulated web must use the approved provider. The data policy sends it to the other provider. Both tunnel sets are up. What should the policy use?
- A VPC prefix arrives by OMP from the cloud gateway and again from a data center that learned it on the side. Users follow the data-center copy. They should follow the cloud gateway. What should policy prefer?
- Branches reach an AWS cloud gateway. The application VPC is peered to the gateway VPC and is not attached itself. Its route table sends the campus prefixes to an internet gateway. What should that route table use?
- A control policy prefers the cloud gateway for the VPC prefix. It is applied to a site list that does not include this region. This region follows the data center. Other regions follow the gateway. What should include this region?
- Calls use a port the voice application list does not include. Those calls follow the bulk path. Calls that match the list use the voice SLA. What should the list include?
- Cloud OnRamp for SaaS should probe a local exit for staff SaaS in one service VPN. The only internet exit is attached to the guest VPN. Staff probes never start. What is missing for the staff VPN?
- Cloud OnRamp for Multicloud is connected to a cloud account that does not hold the application VPC. The VPC in the real account never appears. Branches have no route. What should OnRamp use?
- Malware protection is applied to the guest zone policy. Infected staff hosts in a different zone pass malware and never hit that policy. Routes exist. Where should the protection be applied?
- SIG tunnels from an edge stay down. They are sourced from an interface that has no route to the provider. The internet transport has a default route and is up. What should source the tunnels?
Operation (20%) · 60 questions
- A manufacturer IOS XE router has no IKEv2 SA and no IPsec SA to an AWS virtual private gateway. Pings to the gateway's public address succeed. What should the engineer compare next?
- A stadium sends voice to a cloud contact center with Catalyst SD-WAN. When both internet paths miss the loss target, voice is dropped even though the OMP route is present and firewall counters stay at zero. What explains the drops?
- Guest wireless users on a hospital Catalyst SD-WAN edge cannot open web sites. The SIG tunnel is up, staff in another service VPN can browse, and the guest zone-pair drop counter rises with each test. What explains the failure?
- A clinic's IOS XE tunnel to an AWS virtual private gateway is up, IKE and IPsec SAs look healthy, and ping to a VPC host works. Large TCP transfers hang. What should the engineer adjust on the tunnel?
- After a cutover, an IOS XE router has an established eBGP session to an Azure VPN gateway for 10.40.0.0/16, but packets still follow a static route for that prefix toward a tunnel that was removed. Why does the BGP route lose?
- Campus and cloud Cisco IOS XE routers form OSPF across an IPsec GRE tunnel and stick in EXSTART. The tunnel is up and ping between the tunnel addresses works. Interface MTU values differ. What is the cause?
- A manufacturer's IOS XE router shows an IKEv2 SA in a ready state to an AWS virtual private gateway, but no IPsec SA forms and no cloud traffic passes. What should the engineer check next?
- A government Catalyst SD-WAN edge has up control connections to its controllers, but BFD to the AWS cloud-gateway TLOC is down and no cloud traffic flows. Where should the engineer look first?
- Voice to a cloud contact center from a bank branch takes a lossy internet path. The strict voice SLA is configured, firewall counters are zero, and the voice application list used by that policy is empty. What is wrong?
- A hotel Catalyst SD-WAN edge has BFD up to its other sites, but both tunnels to the secure internet gateway are down and web traffic that should be inspected is failing. What should be checked first?
- A lab IOS XE tunnel to a Google Cloud HA VPN gateway passes traffic for a while, then both IPsec SAs drop at the first rekey and traffic stops. Ping to the gateway's public address still works. What should be compared?
- IPsec to an Azure route-based VPN gateway is up, but BGP stays down. The gateway uses its default ASN, 65515, and the campus IOS XE router is also configured with local ASN 65515. What is the fault?
- Guest web on a Catalyst SD-WAN edge is steered at a SIG tunnel that is up. The zone pair from the guest zone to the SIG zone permits the traffic, and the reverse zone pair does not exist. Sessions start and then fail. Why?
- A factory Catalyst SD-WAN edge has BFD up to the regional cloud gateway, firewall drop counters at zero, and no OMP route for an Azure prefix that other sites learn. A centralized control policy was just applied to this site list. What happened?
- A store edge has BFD up to the AWS cloud gateway. OMP shows the VPC prefix in service VPN 20. User traffic is in service VPN 10, which has no such route. What is the mismatch?
- A plant IOS XE router has an up IPsec SA to one AWS tunnel. The encrypt counter increases when hosts send traffic, and the decrypt counter stays at zero. The VPC route for the plant points at the other tunnel, which is down. What does that explain?
- A branch Catalyst SD-WAN edge shows a control connection to the management controller and no connection to the controller that distributes OMP routes. The OMP table is empty and cloud prefixes are missing. What is the failure?
- An IOS XE IPsec tunnel to an Azure VPN gateway is up, and ping across the tunnel works. BGP stays Idle. An ACL applied inbound on the tunnel permits ICMP and blocks TCP 179. What is the fault?
- A new Catalyst SD-WAN store edge has no control connections and an empty OMP table. Its local internet link can ping ordinary websites. The engineer has not yet checked reachability to the controller addresses. What is the first check?
- Phones in service VPN 10 take a lossy path to a cloud contact center. A strict voice policy exists and is attached only to VPN 20. Firewall counters are zero. Why do the phones miss the voice policy?
- A campus router redistributed its entire internal table into the BGP session toward an AWS virtual private gateway. The session reset and the VPC lost the campus routes. What should the router advertise instead?
- A cloud IOS XE router has a connected 10.50.1.0/24 and advertises only that prefix by BGP. The rest of the VPC is 10.50.0.0/16. The campus can reach 10.50.1.0/24 and nothing else in the VPC. What was advertised too narrowly?
- A branch has MPLS up and its internet color down. A centralized control policy restricts the Azure prefix to the internet color only. The prefix is in OMP and traffic to Azure fails. Why?
- Hosts in VPN 10 cannot reach hosts in VPN 30. OMP has routes both ways, BFD between the sites is up, and the zone-pair drop counter for VPN 10 to VPN 30 increases on each test. What is dropping the traffic?
- A Catalyst SD-WAN edge could ping its controllers and then lost every control connection at the certificate expiry shown on the device. OMP went empty. The internet circuit is still up. What expired?
- Campus and cloud Cisco IOS XE routers send OSPF hellos across a protected GRE tunnel. Both are in area 0 with the same network type and the same MTU. The adjacency stays down and the keys on the two tunnel interfaces differ. What is the fault?
- A plant IOS XE router still targets an AWS tunnel outside address from last quarter's notes. IKE to that address times out. The AWS console shows a different outside address for the up tunnel. What should be updated?
- After BGP to Azure came up, a campus IOS XE router started sending its own internet traffic into the tunnel. Azure is advertising 0.0.0.0/0, and the router has no inbound filter. What caused the change?
- IKEv2 to an Azure VPN gateway is up and the transform sets match. The IPsec SA passes traffic and then drops when the router hits its shorter lifetime. Azure's lifetime is longer. What should change?
- An IOS XE IPsec SA to an AWS tunnel stays up. Small pings succeed. Some packets drop, and the SA shows a rising anti-replay error count. What explains the drops?
- A clinic tunnel to an AWS virtual private gateway shows rising encrypt and decrypt counters. Ping to a VPC instance works. The instance's application port still fails, and its security group does not allow that port from the clinic prefix. What is the fault?
- An IOS XE router has an Established BGP session to an Azure VPN gateway and is advertising the campus prefix. Hosts in the virtual network still cannot reach the campus. The subnet route table has no route for the campus prefix toward the gateway. What is missing?
- A branch has BFD up to the cloud gateway and an OMP route for the VPC. A payroll application still fails. Its data policy sends it to a TLOC that is down. Other applications on the OMP route succeed. What is wrong?
- Voice to a cloud contact center is dropped. Bulk data on the same edge still flows. Every tunnel misses the voice loss target, the voice policy is strict, and firewall counters are zero. What is dropping the voice?
- Users cannot reach a cloud subnet through an IOS XE IPsec tunnel. The IPsec SA shows both encrypt and decrypt counters increasing. The cloud router has no route for that subnet. Where is the failure?
- A branch receives an OMP route for an Azure prefix whose only TLOC is one this site is not allowed to use. A centralized control policy sets that TLOC. Traffic fails, and firewall counters stay at zero. What made the route unusable?
- A campus router and a cloud IOS XE router never establish BGP. The neighbor statement on the campus names a different ASN than the ASN configured on the cloud router. The IPsec SA is up. What must match?
- Both tunnels of an AWS VPN connection are up. Encrypt counters rise on tunnel 1 and decrypt counters rise on tunnel 2. A campus firewall requires the return on the same tunnel and is dropping the flow. What is the mismatch?
- A store's public address changed after a circuit move. BFD to the AWS cloud gateway now flaps, and the TLOC still advertises the old public address. Other stores are stable. What is stale?
- Campus and cloud IOS XE routers do not establish BGP. Each side uses the tunnel address as the neighbor. The tunnel masks differ, so the peers are not on one subnet. eBGP multihop is not configured. What should match?
- A new edge never forms control connections. Ping to the controller addresses works. The organization name on the edge does not match the name on the controllers. What must match?
- A security policy permits a named payroll application from a store to the VPC and denies other web. Users who browse by the application's name succeed. Users who use only the server's IP address are dropped. Why?
- A store edge has control connections and BFD up to the cloud gateway. The VPC prefix is in OMP for VPN 10. VPN 10 on this edge is shut. Users in that VPN have no route. What is shut?
- Campus and cloud IOS XE routers have a Full OSPF adjacency. The campus then prefers a path for its own prefix that points back at the cloud router. The cloud router is redistributing that prefix with no filter. What should be stopped?
- An IPsec SA to AWS is up. The encaps counter stays at zero while users fail. The campus route for the VPC points out the internet interface, not the tunnel. What is wrong?
- A branch has BFD up to every ordinary site and BFD down only to the cloud gateway. Control connections are up. The firewall permits the other sites and blocks the gateway's public address. What is blocked?
- An edge receives a VPC prefix by OMP and does not install it. The TLOC that prefix needs was filtered by control policy. Other prefixes that use a different TLOC install normally. What was filtered?
- A campus router shows a cloud prefix in the BGP table and not in the routing table. The next hop is an address the router cannot reach. The BGP session is Established. Why is the prefix missing from the routing table?
- Control connections are up over MPLS. BFD to the public cloud gateway is down. The internet interface on the edge is administratively shut. What is shut?
- An AWS cloud gateway was rebuilt and its public address changed. Branch BFD to it stays down. The edge still targets the old public address. Control connections to the controllers are up. What is stale?
- An edge has the VPC prefix through the cloud gateway and through a data-center backhaul. A control policy sets a better preference on the backhaul. Users follow the backhaul. What is steering them?
- A new edge never forms control connections. Ping to the controller addresses works. The edge clock is a day behind, so its certificate is not yet valid. What should be corrected?
- Small pings across an IPsec tunnel work. Large pings fail, and the don't-fragment bit is set. The tunnel MTU is higher than the path can carry. TCP is not the traffic that fails. What should be lowered?
- A campus router and a cloud IOS XE router never keep BGP up. The IPsec SA is up and the neighbor addresses are reachable. The BGP passwords on the two routers do not match. What must match?
- IKEv2 to a cloud VPN gateway stays in negotiation. The peer address answers ping. The router's IKEv2 policy for this peer has no proposal attached. What is missing?
- Two IPsec tunnels to AWS are up. The preferred route points at tunnel 1, whose decrypt counter stays at zero while encrypt increases. Tunnel 2's encrypt and decrypt counters both move. Users fail. What should the route prefer?
- Staff payroll is denied. The zone policy has a permit for that application below a deny-all, and the deny counter increases. Routes to the server exist. What is wrong with the policy?
- OMP has a VPC prefix for VPN 10. This edge has VPN 0 and VPN 20 only. Users who should be in VPN 10 have no route to the VPC. What is missing on the edge?
- A BGP aggregate for a cloud range is installed and works. One subnet inside that range fails. A more specific static route points that subnet at a tunnel that is down. What is overriding BGP?
- Branch-to-cloud voice follows the voice SLA. Cloud-to-branch voice uses the bulk path. The SLA is applied only on the branch. The gateway has no matching policy. Where is the return policy missing?
These questions are original practice material and are NOT actual exam questions or brain-dump content. Cisco and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by Cisco.