IPsec Cloud Connectivity (25%)

300-440 · 75 questions

• An IOS XE router has a working IPsec tunnel and an Established BGP session to an AWS virtual private gateway, but AWS never learns the campus prefix 10.8.0.0/16. The router uses a network statement for that prefix and has no route to it in the routing table. What is the cause?
• A government campus must extend its existing OSPF domain across an IPsec path into a cloud VPC. The native cloud VPN gateway will not run OSPF. What should they deploy in the VPC?
• A retailer redistributes BGP routes from an AWS virtual private gateway into OSPF, and OSPF routes back into BGP, on the same IOS XE router. No tags or prefix filters are applied. What failure should they expect?
• A stadium placed a Cisco IOS XE router in a cloud VPC to terminate IPsec from the campus. The campus router is behind NAT. IKE never completes. The cloud firewall allows only TCP 22 to the virtual router. What must that firewall also allow?
• A logistics IOS XE edge must send guest internet traffic to a secure internet gateway for inspection, while a separate tunnel still reaches an AWS VPC. How should the guest traffic be sent?
• A university edge running Cisco IOS XE must bring up internet connectivity to a native AWS virtual private gateway. Which tunnel configuration matches that endpoint?
• A stadium's Cisco IOS XE router in an AWS VPC has an up IPsec tunnel to the campus, but campus hosts still cannot reach VPC instances. Those instances use the VPC route table, which has no route for the campus prefix. What should be added?
• An IOS XE router will run BGP across a route-based tunnel to Azure. An engineer sets the BGP router ID and the advertised peer address to the router's public WAN address. Azure will not accept that peer. Which address should be used instead?
• A hospital IOS XE router will terminate internet IPsec to a new Google Cloud HA VPN gateway. Which configuration matches what HA VPN can actually peer with?
• A retailer IOS XE router sits behind a NAT device and builds a route-based tunnel to an Azure VPN gateway. IKE starts on UDP 500, then the SA never completes. UDP 4500 is blocked on the path. What is the failure?
• A university IOS XE router must exchange BGP routes with an Azure virtual network over internet IPsec. Which gateway and tunnel should they build?
• A government team placed a Cisco IOS XE router in a cloud VPC and gave it only a private address. Campus IKE packets never arrive, even though the cloud firewall allows UDP 500 and UDP 4500. What is missing?
• A manufacturer's Cisco IOS XE router in an AWS VPC has an up IPsec tunnel to the plant. The VPC route table already points the plant prefix at that router. The plant's routing table has no VPC prefix. The cloud router never advertises its connected VPC subnet. What should be added?
• A university IOS XE router uses the correct pre-shared key toward an Azure route-based VPN gateway, but IKEv2 never completes. The router identifies itself with a hostname. Azure is configured to expect the router's public IPv4 address. What must change?
• A cloud-hosted IOS XE router learns a VPC subnet as connected and advertises it by iBGP to the campus router. It does not set the next hop to itself. The campus router has no route to the advertised next hop. What should the cloud router do?
• A bank IOS XE router will use a native AWS virtual private gateway with BGP. Which IPsec style matches that route-based endpoint?
• A clinic will not run BGP to an AWS virtual private gateway. The IPsec tunnel is up, but AWS never installs the clinic prefix. No static route for that prefix was entered on the VPN connection. What is missing?
• A campus IOS XE router must send internet-bound traffic to a secure internet gateway. That gateway's current guide says to terminate plain GRE from the campus, not IPsec. Which tunnel should the engineer configure?
• An Azure VPN gateway is active-active and has two public addresses. The campus IOS XE router has one route-based tunnel to the first address only. What must be added so both instances are used?
• A campus IOS XE router learns its AWS VPC prefix by eBGP across the IPsec tunnel. The team wants a static route to a second tunnel to be used only when that BGP route disappears. Which distance should the static use?
• A Cisco IOS XE router in an Azure virtual network terminates IPsec and must forward campus traffic toward application hosts. Azure drops those transit packets. IP forwarding on the router's NIC is disabled. What must be enabled?
• One tunnel of an AWS VPN connection goes silent. The campus IOS XE router keeps the route toward that tunnel because it never declares the peer dead. The second tunnel is up. What should be enabled?
• A campus IOS XE router learns a default route from its internet edge and, by redistribution, advertises that default to an AWS virtual private gateway by BGP. VPC instances then try to use the campus for their internet path and fail. What should the router stop advertising?
• A cloud-hosted Cisco IOS XE router has a public address on one interface and only private addresses on the VPC inside interfaces. Campus IKE never arrives. The tunnel source is set to an inside private interface. What should the tunnel source be?
• Campus and cloud Cisco IOS XE routers exchange routes over GRE across the public internet. The security team requires the payload to be encrypted. GRE is up and readable on a capture. What should be added?
• A campus IOS XE router has two up BGP sessions to AWS across two tunnels. The team wants this router's outbound traffic to prefer tunnel 1. Which local change does that?
• Campus and cloud Cisco IOS XE routers run OSPF on a GRE tunnel. One side is network type point-to-point and the other is broadcast. Hellos arrive and the adjacency never forms. What must match?
• Two Cisco IOS XE routers, one on campus and one in a VPC, run OSPF over a protected GRE tunnel. Hellos arrive. One side is in area 0 and the other is in area 1. The adjacency stays down. What must match?
• An Azure route-based VPN connection is set to IKEv2 only. The campus IOS XE router offers only IKEv1. The pre-shared key matches and UDP 500 is open. IKE never completes. What must the router use?
• A clinic hosts one Cisco IOS XE router in a VPC as the only IPsec headend for the campus. A failure of that router isolates the VPC. They can add a second virtual router. What should the second router do?
• A campus router advertises its prefix to two AWS tunnels. Return traffic from the VPC should prefer tunnel 2. The campus outbound path is already correct. Which advertisement change influences AWS?
• A cloud IOS XE router learns campus prefixes by BGP and redistributes them into a second BGP session that also faces the campus. The campus starts preferring the path that points back at the cloud router. No outbound filter exists. What should be filtered?
• Two Cisco IOS XE routers, campus and cloud, peer eBGP using loopback addresses across an IPsec tunnel. The loopbacks are reachable with ping. The session stays down and eBGP multihop is not configured. What is missing?
• A campus VPN was moved from an AWS virtual private gateway to a transit gateway. The IOS XE router still targets the old gateway's outside address and BGP neighbor. Tunnels to the new gateway stay down. What must be retargeted?
• Instances in a VPC send return traffic for the campus prefix to the internet gateway. The cloud IOS XE router has the campus route, and the subnet route table has no entry for the campus prefix. What should the route table use as the target?
• A campus IOS XE router uses certificate authentication toward an AWS virtual private gateway. Small IKEv2 exchanges start, then the negotiation stalls, and a capture shows large UDP 500 packets dropped on the path. What should the router enable?
• A campus IOS XE tunnel toward an AWS outside address stays line-protocol down. The tunnel destination is correct, and the routing table has no route to that address. What should be added?
• IKEv2 to a Google Cloud HA VPN gateway is up. The IPsec SA never forms. The transform set on the IOS XE router is not one the HA VPN tunnel will accept. What must be aligned?
• One campus IOS XE router has two BGP paths to the same AWS prefix. Only this router should prefer the first path. Other campus routers must keep their own choices. Which attribute does that?
• Campus IKE to a cloud-hosted Cisco IOS XE router never arrives on the tunnel. The cloud firewall allows UDP 500 and UDP 4500. An ACL on the router's internet-facing interface denies those ports. What must change?
• Campus and cloud Cisco IOS XE routers use IKEv2. The cloud firewall allows UDP 500 and UDP 4500. The pre-shared keys on the two routers do not match. IKE fails. What must match?
• An Azure VPN connection expects a pre-shared key. The campus IOS XE router offers only a certificate. The peer address and IKEv2 version match, and IKE fails. What must the router use?
• A campus router advertises its prefix on two AWS tunnels. Return traffic prefers tunnel 1. The advertisement on tunnel 1 has a lower MED than the advertisement on tunnel 2. AWS is using MED. Which change makes AWS prefer tunnel 2?
• A Cisco IOS XE router in Azure has an up tunnel, a route to the campus, and a subnet route that points the campus prefix at its NIC. Transit packets toward application hosts are still dropped. IP forwarding on that NIC is disabled. What must be enabled?
• DPD marks one AWS tunnel down and BGP withdraws its routes. A static route at distance 1 for the VPC prefix still points at that dead tunnel, and traffic blackholes. What is keeping the bad path?
• A Cisco IOS XE router in a cloud VPC has only a private address in a private subnet. There is no public address and no inbound path from the internet. Campus IKE packets never arrive. What is missing?
• A cloud IOS XE router and a campus router run OSPF on a tunnel. Network type and MTU match. One interface is in area 2 and the other is in area 3. Neither side is area 0. Hellos arrive and no adjacency forms. What must be true?
• A campus IOS XE router sits behind NAT. The tunnel source is a private loopback the NAT device does not translate. AWS never completes IKE, and the packets that arrive still show the private source. What should the tunnel source be?
• A campus IOS XE GRE tunnel to a secure internet gateway is up. A capture on the internet shows the inner addresses in the clear. The gateway's guide requires IPsec as well as GRE. What should be added?
• Campus and cloud Cisco IOS XE routers use the same pre-shared key and IKEv2. The campus router presents a hostname. The cloud router expects the campus public address. IKE fails. What must agree?
• A campus IOS XE router is behind NAT. The firewall permits UDP 500 and UDP 4500 toward an Azure VPN gateway. IKE starts and never moves onto UDP 4500. NAT traversal is disabled on the router. What should be enabled?
• Two cloud IOS XE routers are OSPF neighbors of the campus. Users prefer the distant router because its tunnel has the lower OSPF cost. Both tunnels are healthy. How do you make the nearer router win?
• Campus and cloud IOS XE routers have a GRE tunnel that is up. Tunnel protection is configured on a different, unused tunnel. A capture shows the GRE payload in the clear. What must move?
• A studio must send multicast from the campus to an application in a VPC. A native site-to-site VPN is up and unicast works. Multicast never arrives. What should terminate the campus tunnel inside the VPC?
• Campus and cloud IOS XE routers have an IPsec SA up. GRE over that session stays down. One side sets a GRE tunnel key and the other side sets none. What must agree?
• Small pings across a cloud IOS XE tunnel work. Large TCP transfers hang. TCP MSS adjustment is configured on the physical internet interface and not on the tunnel. Where should it be applied?
• A secure internet gateway accepts IKE only from one agreed public address. The campus NAT pool uses a different public address, and IKE never completes. The gateway address is reachable. What should change?
• A campus IOS XE router aims its tunnel destination at an address inside the VPC. IKE never reaches AWS. The VPN connection page shows a different outside public address. What should the destination be?
• A clinic retired a campus prefix and is using a new one. AWS still sends return traffic toward the old prefix. BGP is not in use. The VPN connection still has a static route for the old prefix. What should be edited?
• Two IOS XE routers on a cloud GRE tunnel never become OSPF neighbors. Area, network type, and MTU match. The hello and dead timers do not. What must match?
• Two cloud IOS XE routers peer with iBGP. Return traffic should prefer the router closer to the users. The preference has to be shared between those routers. Which attribute does that?
• IKEv2 to an Azure VPN gateway starts and the IPsec SA never forms. The router offers a Diffie-Hellman group the gateway is not configured to accept. The pre-shared key matches. What must change?
• Campus and cloud IOS XE routers use IKEv2 certificates. The clocks match and the identity matches. The cloud router does not trust the campus certificate authority. IKE fails. What must the cloud router trust?
• A cloud IOS XE router advertises its GRE tunnel subnet to the campus by BGP, and that subnet is more specific than the path used to reach the tunnel destination. The tunnel then drops. What should be filtered?
• A campus router sets local preference on the prefixes it advertises to AWS and expects AWS to prefer tunnel 2 for return traffic. Return traffic stays on tunnel 1. What can influence AWS?
• Campus prefixes are redistributed into OSPF and never appear on the cloud IOS XE router. The tunnel on that router is in a stub area. Area numbers match. Why are the prefixes missing?
• Campus and cloud IOS XE routers fail to form an IPsec SA. One offers transport mode and the other offers tunnel mode. The pre-shared key matches. What must match?
• One campus router learns a cloud prefix by eBGP. A second campus router never sees it. There is no iBGP session between the two campus routers. Both can reach the cloud tunnel router. What is missing?
• A campus router has BGP multipath enabled and sends cloud traffic across both AWS tunnels. The design wants outbound traffic on tunnel 1 only. Tunnel 2 should remain a backup. What should you set?
• A campus router uses GRE toward a cloud IOS XE router. The cloud router is a route-based VTI with no GRE. OSPF never starts, and a capture shows the encapsulations do not match. What should both sides use?
• A cloud IOS XE router redistributes connected routes into OSPF toward the campus. The campus then tries to reach the router's public WAN address through the tunnel, and the tunnel drops. What should be stopped?
• An IOS XE router has two tunnels toward an AWS VPN connection. Tunnel 1 has an IPsec profile and an SA. Tunnel 2 has no profile and never forms an SA. What does tunnel 2 need?
• Pings across a cloud IOS XE tunnel work. Application TCP fails. An inbound ACL on the tunnel permits ICMP and denies everything else. The SA is up. What should the ACL permit?
• A route-based tunnel to AWS is up and idle. A crypto map on the physical internet interface matches the VPC prefixes, and that map's SA is the one carrying traffic. Users fail when the map's peer is wrong. What should be removed?
• AWS sends one subnet back through a dead tunnel and sends the rest of the range through the live tunnel. The campus still advertises that subnet toward the dead tunnel. BGP is up on the live tunnel. What should be withdrawn?