Operation (20%)

300-440 · 60 questions

• A manufacturer IOS XE router has no IKEv2 SA and no IPsec SA to an AWS virtual private gateway. Pings to the gateway's public address succeed. What should the engineer compare next?
• A stadium sends voice to a cloud contact center with Catalyst SD-WAN. When both internet paths miss the loss target, voice is dropped even though the OMP route is present and firewall counters stay at zero. What explains the drops?
• Guest wireless users on a hospital Catalyst SD-WAN edge cannot open web sites. The SIG tunnel is up, staff in another service VPN can browse, and the guest zone-pair drop counter rises with each test. What explains the failure?
• A clinic's IOS XE tunnel to an AWS virtual private gateway is up, IKE and IPsec SAs look healthy, and ping to a VPC host works. Large TCP transfers hang. What should the engineer adjust on the tunnel?
• After a cutover, an IOS XE router has an established eBGP session to an Azure VPN gateway for 10.40.0.0/16, but packets still follow a static route for that prefix toward a tunnel that was removed. Why does the BGP route lose?
• Campus and cloud Cisco IOS XE routers form OSPF across an IPsec GRE tunnel and stick in EXSTART. The tunnel is up and ping between the tunnel addresses works. Interface MTU values differ. What is the cause?
• A manufacturer's IOS XE router shows an IKEv2 SA in a ready state to an AWS virtual private gateway, but no IPsec SA forms and no cloud traffic passes. What should the engineer check next?
• A government Catalyst SD-WAN edge has up control connections to its controllers, but BFD to the AWS cloud-gateway TLOC is down and no cloud traffic flows. Where should the engineer look first?
• Voice to a cloud contact center from a bank branch takes a lossy internet path. The strict voice SLA is configured, firewall counters are zero, and the voice application list used by that policy is empty. What is wrong?
• A hotel Catalyst SD-WAN edge has BFD up to its other sites, but both tunnels to the secure internet gateway are down and web traffic that should be inspected is failing. What should be checked first?
• A lab IOS XE tunnel to a Google Cloud HA VPN gateway passes traffic for a while, then both IPsec SAs drop at the first rekey and traffic stops. Ping to the gateway's public address still works. What should be compared?
• IPsec to an Azure route-based VPN gateway is up, but BGP stays down. The gateway uses its default ASN, 65515, and the campus IOS XE router is also configured with local ASN 65515. What is the fault?
• Guest web on a Catalyst SD-WAN edge is steered at a SIG tunnel that is up. The zone pair from the guest zone to the SIG zone permits the traffic, and the reverse zone pair does not exist. Sessions start and then fail. Why?
• A factory Catalyst SD-WAN edge has BFD up to the regional cloud gateway, firewall drop counters at zero, and no OMP route for an Azure prefix that other sites learn. A centralized control policy was just applied to this site list. What happened?
• A store edge has BFD up to the AWS cloud gateway. OMP shows the VPC prefix in service VPN 20. User traffic is in service VPN 10, which has no such route. What is the mismatch?
• A plant IOS XE router has an up IPsec SA to one AWS tunnel. The encrypt counter increases when hosts send traffic, and the decrypt counter stays at zero. The VPC route for the plant points at the other tunnel, which is down. What does that explain?
• A branch Catalyst SD-WAN edge shows a control connection to the management controller and no connection to the controller that distributes OMP routes. The OMP table is empty and cloud prefixes are missing. What is the failure?
• An IOS XE IPsec tunnel to an Azure VPN gateway is up, and ping across the tunnel works. BGP stays Idle. An ACL applied inbound on the tunnel permits ICMP and blocks TCP 179. What is the fault?
• A new Catalyst SD-WAN store edge has no control connections and an empty OMP table. Its local internet link can ping ordinary websites. The engineer has not yet checked reachability to the controller addresses. What is the first check?
• Phones in service VPN 10 take a lossy path to a cloud contact center. A strict voice policy exists and is attached only to VPN 20. Firewall counters are zero. Why do the phones miss the voice policy?
• A campus router redistributed its entire internal table into the BGP session toward an AWS virtual private gateway. The session reset and the VPC lost the campus routes. What should the router advertise instead?
• A cloud IOS XE router has a connected 10.50.1.0/24 and advertises only that prefix by BGP. The rest of the VPC is 10.50.0.0/16. The campus can reach 10.50.1.0/24 and nothing else in the VPC. What was advertised too narrowly?
• A branch has MPLS up and its internet color down. A centralized control policy restricts the Azure prefix to the internet color only. The prefix is in OMP and traffic to Azure fails. Why?
• Hosts in VPN 10 cannot reach hosts in VPN 30. OMP has routes both ways, BFD between the sites is up, and the zone-pair drop counter for VPN 10 to VPN 30 increases on each test. What is dropping the traffic?
• A Catalyst SD-WAN edge could ping its controllers and then lost every control connection at the certificate expiry shown on the device. OMP went empty. The internet circuit is still up. What expired?
• Campus and cloud Cisco IOS XE routers send OSPF hellos across a protected GRE tunnel. Both are in area 0 with the same network type and the same MTU. The adjacency stays down and the keys on the two tunnel interfaces differ. What is the fault?
• A plant IOS XE router still targets an AWS tunnel outside address from last quarter's notes. IKE to that address times out. The AWS console shows a different outside address for the up tunnel. What should be updated?
• After BGP to Azure came up, a campus IOS XE router started sending its own internet traffic into the tunnel. Azure is advertising 0.0.0.0/0, and the router has no inbound filter. What caused the change?
• IKEv2 to an Azure VPN gateway is up and the transform sets match. The IPsec SA passes traffic and then drops when the router hits its shorter lifetime. Azure's lifetime is longer. What should change?
• An IOS XE IPsec SA to an AWS tunnel stays up. Small pings succeed. Some packets drop, and the SA shows a rising anti-replay error count. What explains the drops?
• A clinic tunnel to an AWS virtual private gateway shows rising encrypt and decrypt counters. Ping to a VPC instance works. The instance's application port still fails, and its security group does not allow that port from the clinic prefix. What is the fault?
• An IOS XE router has an Established BGP session to an Azure VPN gateway and is advertising the campus prefix. Hosts in the virtual network still cannot reach the campus. The subnet route table has no route for the campus prefix toward the gateway. What is missing?
• A branch has BFD up to the cloud gateway and an OMP route for the VPC. A payroll application still fails. Its data policy sends it to a TLOC that is down. Other applications on the OMP route succeed. What is wrong?
• Voice to a cloud contact center is dropped. Bulk data on the same edge still flows. Every tunnel misses the voice loss target, the voice policy is strict, and firewall counters are zero. What is dropping the voice?
• Users cannot reach a cloud subnet through an IOS XE IPsec tunnel. The IPsec SA shows both encrypt and decrypt counters increasing. The cloud router has no route for that subnet. Where is the failure?
• A branch receives an OMP route for an Azure prefix whose only TLOC is one this site is not allowed to use. A centralized control policy sets that TLOC. Traffic fails, and firewall counters stay at zero. What made the route unusable?
• A campus router and a cloud IOS XE router never establish BGP. The neighbor statement on the campus names a different ASN than the ASN configured on the cloud router. The IPsec SA is up. What must match?
• Both tunnels of an AWS VPN connection are up. Encrypt counters rise on tunnel 1 and decrypt counters rise on tunnel 2. A campus firewall requires the return on the same tunnel and is dropping the flow. What is the mismatch?
• A store's public address changed after a circuit move. BFD to the AWS cloud gateway now flaps, and the TLOC still advertises the old public address. Other stores are stable. What is stale?
• Campus and cloud IOS XE routers do not establish BGP. Each side uses the tunnel address as the neighbor. The tunnel masks differ, so the peers are not on one subnet. eBGP multihop is not configured. What should match?
• A new edge never forms control connections. Ping to the controller addresses works. The organization name on the edge does not match the name on the controllers. What must match?
• A security policy permits a named payroll application from a store to the VPC and denies other web. Users who browse by the application's name succeed. Users who use only the server's IP address are dropped. Why?
• A store edge has control connections and BFD up to the cloud gateway. The VPC prefix is in OMP for VPN 10. VPN 10 on this edge is shut. Users in that VPN have no route. What is shut?
• Campus and cloud IOS XE routers have a Full OSPF adjacency. The campus then prefers a path for its own prefix that points back at the cloud router. The cloud router is redistributing that prefix with no filter. What should be stopped?
• An IPsec SA to AWS is up. The encaps counter stays at zero while users fail. The campus route for the VPC points out the internet interface, not the tunnel. What is wrong?
• A branch has BFD up to every ordinary site and BFD down only to the cloud gateway. Control connections are up. The firewall permits the other sites and blocks the gateway's public address. What is blocked?
• An edge receives a VPC prefix by OMP and does not install it. The TLOC that prefix needs was filtered by control policy. Other prefixes that use a different TLOC install normally. What was filtered?
• A campus router shows a cloud prefix in the BGP table and not in the routing table. The next hop is an address the router cannot reach. The BGP session is Established. Why is the prefix missing from the routing table?
• Control connections are up over MPLS. BFD to the public cloud gateway is down. The internet interface on the edge is administratively shut. What is shut?
• An AWS cloud gateway was rebuilt and its public address changed. Branch BFD to it stays down. The edge still targets the old public address. Control connections to the controllers are up. What is stale?
• An edge has the VPC prefix through the cloud gateway and through a data-center backhaul. A control policy sets a better preference on the backhaul. Users follow the backhaul. What is steering them?
• A new edge never forms control connections. Ping to the controller addresses works. The edge clock is a day behind, so its certificate is not yet valid. What should be corrected?
• Small pings across an IPsec tunnel work. Large pings fail, and the don't-fragment bit is set. The tunnel MTU is higher than the path can carry. TCP is not the traffic that fails. What should be lowered?
• A campus router and a cloud IOS XE router never keep BGP up. The IPsec SA is up and the neighbor addresses are reachable. The BGP passwords on the two routers do not match. What must match?
• IKEv2 to a cloud VPN gateway stays in negotiation. The peer address answers ping. The router's IKEv2 policy for this peer has no proposal attached. What is missing?
• Two IPsec tunnels to AWS are up. The preferred route points at tunnel 1, whose decrypt counter stays at zero while encrypt increases. Tunnel 2's encrypt and decrypt counters both move. Users fail. What should the route prefer?
• Staff payroll is denied. The zone policy has a permit for that application below a deny-all, and the deny counter increases. Routes to the server exist. What is wrong with the policy?
• OMP has a VPC prefix for VPN 10. This edge has VPN 0 and VPN 20 only. Users who should be in VPN 10 have no route to the VPC. What is missing on the edge?
• A BGP aggregate for a cloud range is installed and works. One subnet inside that range fails. A more specific static route points that subnet at a tunnel that is down. What is overriding BGP?
• Branch-to-cloud voice follows the voice SLA. Cloud-to-branch voice uses the bulk path. The SLA is applied only on the branch. The gateway has no matching policy. Where is the return policy missing?