Architecture Models (15%)

300-440 · 45 questions

• A hospital will reach an AWS VPC from the campus edge router using only the public internet, and AWS will terminate the tunnels on a virtual private gateway. Which connectivity model is this?
• A university already has a cage in a colocation hall that houses the AWS Direct Connect location. They want a private VLAN from that cage to AWS and they do not use an MPLS carrier. Which model fits?
• A hospital already uses an MPLS WAN and wants private access to Azure virtual networks, with the carrier handing the network off into ExpressRoute. Which model is this?
• A logistics firm has a software-defined interconnect port in one metro and needs private virtual circuits from that port into both AWS and Azure, without a new physical cloud port for each attachment. Which model is this?
• A logistics company wants every branch on one Catalyst SD-WAN overlay into AWS, with centralized policy and the public internet as the underlay. Which model matches that requirement?
• A hotel branch has an approved local security stack and wants the lowest delay to Salesforce. Traffic should leave the branch straight to that application. Which SaaS connectivity model is this?
• A city government sends branch internet traffic through Catalyst SD-WAN tunnels to a secure internet gateway. The underlay is the public internet. There is no virtual private gateway in the path. Which model is this?
• A records company must reach a SaaS provider that sells a private interconnect for that application, and the contract says the records must not cross the public internet. Which model fits?
• A grocery chain's MPLS provider extends the private WAN into AWS Direct Connect. The grocery chain does not own a cage at the AWS location and does not order the cross-connect itself. Which model is this?
• A manufacturer will connect a plant router to an Azure virtual network over the public internet, terminating on an Azure VPN gateway. An ExpressRoute circuit exists in another region and will not be used. Which model is the plant path?
• A university sends Microsoft 365 traffic from each campus to a cloud security provider for inspection, and only then on to Microsoft. Users do not break out directly. Which SaaS connectivity model is this?
• A retailer forbids local internet breakout. Every branch must send Salesforce traffic to the data-center firewall, which is the only internet exit. Which SaaS connectivity model is this?
• A carrier wants one Catalyst SD-WAN overlay, over the public internet, that reaches both an AWS VPC and an Azure virtual network, with one policy for every branch. Which model is that?
• A clinic builds two IPsec tunnels across the public internet to a Google Cloud HA VPN gateway and peers BGP with Cloud Router. No interconnect port is ordered. Which model is this?
• A stadium wants guest wireless traffic to leave straight from the venue to the internet. Staff SaaS stays on the existing backhaul. Which model is the guest path?
• A lab company already has an SDCI port in one metro and wants a private virtual circuit from that port into Google Cloud. They do not want a new physical interconnect they would order themselves. Which model is this?
• A manufacturer's MPLS provider will extend the private WAN into Google Cloud. The manufacturer will not order its own interconnect port and will not use the public internet. Which model is this?
• A university has a cage in a colocation hall that offers an Azure ExpressRoute meet-me. The university will order the cross-connect itself. No MPLS carrier is involved. Which model is this?
• Every branch is already a Catalyst SD-WAN edge. A new private VPC must be reached with the same centralized policy as the rest of the overlay, over the internet. Which attachment should they add?
• A publisher already has an SDCI port in one metro into AWS. They need private paths from that same port into Azure and Google Cloud this week, without new physical ports. Which model covers the two new paths?
• A research lab has a cage in a building that hosts a Google Cloud interconnect location. The lab will order the cross-connect from that cage. No carrier MPLS service is used. Which model is this?
• A warehouse uses a standalone Cisco IOS XE router to send internet traffic through a GRE tunnel to a secure internet gateway. There is no SD-WAN controller. Which model is this?
• A clinic chain forbids both local breakout and data-center backhaul. Every Microsoft 365 session must be inspected by a cloud security provider first. Which SaaS model is this?
• A retailer sends every store's Salesforce traffic to a regional hub, and only that hub has an internet exit. Stores have no local breakout. Which SaaS model is this?
• A clinic's MPLS carrier offers a handoff into Azure ExpressRoute private peering for the virtual networks. The carrier also sells internet access. The clinic must stay off the public internet. Which handoff should they use?
• A campus router builds both tunnels of one AWS Site-to-Site VPN connection across the public internet to a virtual private gateway. No Direct Connect port exists. Which model is this?
• A co-op wants every branch edge on Catalyst SD-WAN to reach a new Azure virtual network with one centralized policy. The underlay will be the public internet. Which model fits?
• A hospital must send a defined set of Microsoft public-service prefixes over ExpressRoute Microsoft peering, and must not send them across the public internet. Virtual-network traffic uses a different peering. Which model is the Microsoft public-service path?
• A university lab has an approved local security stack and a delay target for Google Workspace. Backhaul to the main campus misses that target. Which SaaS model meets the delay target?
• Remote workers at a law firm send Microsoft 365 through a cloud security provider before it reaches Microsoft. They do not use the office internet gateway. Which SaaS model is this?
• A plant's private interconnect into Google Cloud has failed. The backup is a cellular internet circuit with IKEv2 to Cloud VPN. There is no SD-WAN overlay. What is that backup?
• A gallery's router sits in its colocation cage, and the cross-connect to the cloud on-ramp lands on that router. Someone proposes moving the router to the gallery and leaving the cage empty. What does this design require in the cage?
• Every branch sends SaaS to one of two regional hub firewalls, and no branch breaks out locally. There is no private circuit to the SaaS provider. Which model is this?
• A resort edge reaches an Azure cloud gateway on the biz-internet color, with the public-internet color as backup. Both colors are public internet. There is no MPLS. Which model is this?
• A shipper attaches several VPCs to one AWS transit gateway and builds a VPN attachment to the campus over the public internet. There is no Catalyst SD-WAN controller. Which model is this?
• A lab already has an SDCI port in the right metro, with a virtual circuit into one AWS region. A second AWS region must be added on that same private fabric. What should they order?
• An SDCI virtual circuit into a VPC is up and too small for the traffic. The fabric port has spare capacity. What should they change?
• Guest users at a venue ride Catalyst SD-WAN to a secure internet gateway over the public internet. Staff use an MPLS handoff into a private cloud. What is the guest path?
• A branch router uses business broadband and IKEv2 to an Azure VPN gateway. There is no private interconnect and no Catalyst SD-WAN controller. Someone calls the broadband private because the ISP sells it to businesses. Which model is this?
• A museum has a cage in one building. The cloud on-ramp is in another building on the same provider campus. The museum does not have an SDCI fabric port. How should the museum reach the on-ramp?
• A mill's MPLS carrier already hands the private WAN off to Google Cloud Partner Interconnect. Someone suggests the mill order Dedicated Interconnect on its own. The carrier path is the one they must use. Which path is that?
• A pharmacy breaks a telehealth application out through its own branch firewall to the internet. No cloud security provider is in the path, and nothing is backhauled. Which SaaS model is this?
• Every branch sends SaaS to one virtual firewall in a cloud hub, and no branch breaks out locally. There is no private circuit to the SaaS provider. Which model is this?
• A clinic firewall inspects guest web. Staff SaaS skips that firewall and goes to a cloud security provider before the application. Which model is the staff SaaS path?
• A payroll provider includes a private peering in the contract. The requirement is that payroll traffic stay off the public internet. The internet path is up. Which path should payroll use?