SD-WAN Cloud Connectivity (25%)

300-440 · 75 questions

• A stadium's Catalyst SD-WAN sites use Microsoft 365. The network team wants each site to prefer whichever measured path to that application is healthier, including a local internet exit. Which feature does that?
• A bank will host a clearing application in a private AWS VPC and wants Catalyst SD-WAN branches to reach it over the internet, with the cloud side built from SD-WAN Manager. Which feature should they turn on?
• Two university service VPNs on Catalyst SD-WAN can each reach AWS, and each has an OMP route to the other, but hosts in the two VPNs cannot communicate. Firewall drop counters on that zone pair are increasing. Which policy is responsible?
• Cloud OnRamp for SaaS is enabled for a SaaS company's Microsoft 365 traffic. One branch has only an MPLS transport and no local internet exit. Local probes for that site stay absent. Why?
• Cloud OnRamp for SaaS is turned on for a retailer's Catalyst SD-WAN network, and one branch has a working local internet exit. Microsoft 365 still follows the data-center default. That application was never enabled in OnRamp. Why?
• A hotel chain runs Catalyst SD-WAN and wants branch web traffic inspected by Cisco Umbrella before it reaches the internet. VPC connectivity is a separate project. Which feature should they configure?
• A bank's Catalyst SD-WAN branches must send web traffic through the secure internet gateway, while voice to a cloud contact center stays on the direct internet path. Which policy creates that split?
• A manufacturer wants every branch to reach an Azure prefix only through the regional Catalyst SD-WAN cloud gateway, never directly on a branch-to-branch TLOC. Routes should not be offered any other way. Which policy does that?
• A retailer runs Catalyst SD-WAN with an MPLS color that has no internet breakout and a public internet color. The Azure cloud gateway uses a public address. Which transport should carry BFD to that gateway?
• A manufacturer enabled Cloud OnRamp for SaaS and expects it to attach branch service VPNs to a private Azure virtual network where an internal application lives. No SaaS application is involved. Why will that fail?
• A hotel will send guest web traffic through Cisco Umbrella using the Catalyst SD-WAN Secure Internet Gateway feature. An engineer also plans a manual crypto map, in VPN 0, to the same Umbrella headend. What should they do?
• A stadium wants voice to a cloud contact center to prefer the internet color, and to use MPLS when the internet path misses the loss target. Voice must not be dropped. Which policy behavior is that?
• A logistics company wants hosts in service VPN 10 and service VPN 20 to be unable to talk to each other, while both VPNs keep their existing paths to Azure. Which policy enforces the split?
• A logistics Catalyst SD-WAN edge has both an internet color and an MPLS color up. The cloud gateway is reachable on both, but the company wants the Azure prefix to prefer the internet TLOC. Which policy does that without removing MPLS?
• A university wants Catalyst SD-WAN to block known malicious URL categories for branch web traffic headed to the internet. Reachability and path selection are already correct. Which policy type does the blocking?
• A retailer uses Catalyst SD-WAN Secure Internet Gateway tunnels for guest web traffic and wants that inspection path to survive one provider point of presence failing. What should they configure?
• Cloud OnRamp for Multicloud has a healthy AWS cloud gateway, and BFD from the stores is up. Stores in service VPN 10 still have no route to the VPC. VPN 10 was never attached to that cloud gateway. What is missing?
• Cloud OnRamp for SaaS is enabled for Microsoft 365 at a retail store that has a local internet exit and a gateway path. Loss on the local exit rises sharply, and the gateway path stays healthy. What should OnRamp do?
• A hospital group wants branch edges to reach the regional cloud gateway and not to build branch-to-branch data paths. Which policy creates that overlay shape?
• A pharmacy chain wants Microsoft 365 to use the local internet exit at each store, and wants every other web flow to stay on the secure internet gateway. Which policy makes that split?
• A regional Catalyst SD-WAN hub is selected as a Cloud OnRamp for SaaS gateway for Microsoft 365. The hub has only an MPLS transport and no internet exit. Gateway probes from that hub do not appear. Why?
• A clinic wants voice to prefer the internet color, and to use only the MPLS color when internet misses the loss target. Voice must not be dropped, and it must not pick some third path. Which action is that?
• A new Catalyst SD-WAN edge should reach an Azure cloud gateway over the internet. The physical internet interface was placed in service VPN 10. BFD to the gateway never forms. Where does that interface belong?
• A resort's Catalyst SD-WAN edge shows both secure internet gateway tunnels up. Guest web traffic still leaves by uninspected local internet. No data policy references the SIG. What is missing?
• A cloud gateway advertises a default route into OMP, and branch stores start sending their local internet breakout traffic toward the gateway. The stores should keep local breakout. Which policy fixes it?
• A hospital wants Catalyst SD-WAN to inspect branch internet traffic for exploits and block matching flows. Path selection is already correct. Which policy does the inspection?
• Cloud OnRamp for SaaS is enabled only for Salesforce. Webex calls from a branch stay on a lossy backhaul even though a healthy local internet exit exists. Why is Webex left on the backhaul?
• A university security policy must block specific HTTPS URL paths, not only the host name. The current URL filter sees only the name. Which change lets the policy see the path?
• A hotel set the Catalyst SD-WAN Secure Internet Gateway feature to IPsec. The provider endpoint in the guide accepts only GRE. Both SIG tunnels stay down. What should be changed?
• An Azure cloud gateway is healthy, and other sites reach it. One store's internet color is forced down by a local interface tracker even though the circuit is up. BFD from that store to the gateway is down. What should be corrected?
• A new store edge has control connections and BFD on its internet color. It receives no service-VPN routes, and its users have no VPN 10. A VPN membership policy lists every other store and omits this one. What is missing?
• Cloud OnRamp for SaaS is enabled for both Webex and Salesforce at a branch. Webex scores better on the local internet exit. Salesforce scores better through the regional gateway. What should OnRamp do?
• A branch data policy uses a local TLOC action to send a payroll application out a specific transport. An application-aware routing policy for the same application prefers a different color. Which path does the application take?
• A logistics edge has internet and MPLS up. The Azure prefix must prefer the internet TLOC and must keep MPLS as a usable alternate. Which control-policy action is that?
• On a Catalyst SD-WAN edge, staff web through the SIG works and guest web fails. The guest zone pair denies web, the staff zone pair permits it, and both VPNs use the same SIG tunnel. What explains the guest failure?
• A branch internet interface is up and has no NAT. Cloud OnRamp for SaaS is enabled for Microsoft 365, and local probes from that interface do not run. A second interface with working NAT does probe. Why is the first interface skipped?
• Guest web fails and guest ping to the SIG zone works. The zone pair permits only ICMP from the guest zone to the SIG zone. The SIG tunnel is up. What is missing from the zone pair?
• A resort's SIG tunnels are up. Guest web still exits uninspected. The data policy matches guest web and sets the next hop to the local internet interface, not the SIG. What should that policy set?
• Every store in a region has Secure Internet Gateway tunnels except one new store. That store is missing from the site list where the SIG feature is attached. Its internet color is up. Why are its SIG tunnels absent?
• A store's only AWS cloud gateway is a single point of failure for the VPC. Catalyst SD-WAN needs a live alternate gateway, and only one cloud gateway can be created per AWS region. What should they add?
• Cloud OnRamp for SaaS is enabled for Microsoft 365. One store has a working local internet exit and is missing from the site list allowed to break out. That store stays on the gateway. Why?
• A branch has a healthy local internet exit, and Cloud OnRamp for SaaS is enabled for Microsoft 365. This site was excluded from local probing. Traffic stays on the gateway path. Why is the local exit unused?
• A European store's BFD to an AWS cloud gateway is up, and the gateway was built in a distant region. Application delay to the VPC is far higher than the store's internet delay to a European AWS region. What should move?
• A clinic wants voice to a cloud contact center on the MPLS color and bulk data on the internet color. Voice was placed in an SLA that prefers MPLS. Bulk data matches no SLA. Which outcome is correct?
• Cloud OnRamp for SaaS scored the gateway better for Microsoft 365, then a data policy was added that pins that application to the local internet exit. Users are on the worse local exit. Why is the score ignored?
• Cloud OnRamp for SaaS shows healthy Webex probes and no Microsoft 365 probes. Users say Microsoft 365 is stuck on a lossy backhaul. Webex is the only enabled application. What is missing?
• A new Catalyst SD-WAN edge has its internet interface in VPN 0 and no default route in that VPN. BFD to the Azure cloud gateway's public address never starts. What is missing in VPN 0?
• A hotel wants guest web inspected at the SIG and staff web broken out locally. Both currently match one data policy that sends all web to the SIG. What should the policy do?
• Guest web at a stadium should be inspected by the secure internet gateway. The SIG tunnels are up. A data policy sends guest web to the IaaS cloud gateway that holds a private VPC. What should the policy send it to?
• Voice and bulk file transfers both prefer the MPLS color. The voice SLA application list includes the file-transfer application as well as voice. Internet is healthy and unused by either. What should be removed from the voice list?
• Most stores learn a new cloud prefix by OMP. One store's centralized control policy rejects that prefix. The store has BFD to the cloud gateway and does not install the prefix. Why is this store different?
• Stores in one city send Microsoft 365 through a Cloud OnRamp for SaaS gateway site on another continent. A store in the same city has a healthy internet exit and is not a gateway. What should change?
• Guest users in VPN 20 can see a VPC prefix that only staff in VPN 10 should reach. OMP installed the prefix in both VPNs. What should limit it to the staff VPN?
• The secure internet gateway feature is set for one cloud security provider. The tunnel destination configured on the edge belongs to a different provider. The tunnels stay down. BFD to ordinary sites is up. What must match?
• Branches have BFD up to an AWS cloud gateway and an OMP route for a VPC. Instances in that VPC stay unreachable. The VPC was never attached to the gateway. What is missing?
• A store has two healthy internet colors. Cloud OnRamp for SaaS probes only the first, which is lossy, and sends Microsoft 365 to the gateway. The second color is not configured as a local exit. What is missing?
• A zone-based policy permits staff web to the internet and intrusion prevention is not applied to that policy. Malware in those sessions is allowed. Routes exist. What is missing?
• A URL filter blocks a category that contains a payroll site the staff must use. Every other site in that category should stay blocked. The payroll site is not on the allow list. What should be added?
• Cloud OnRamp for Multicloud already builds the path from a branch into a VPC. An older manual IPsec tunnel on the same edge also aims at that VPC and blackholes some flows. What should carry the VPC?
• A clinic enables Cloud OnRamp for SaaS only for a file-sharing application nobody uses. The telehealth application they do use has no probe and stays on a lossy backhaul. What should be enabled?
• Branches reach the internet and have no MPLS. The cloud gateway was built with only a private transport color. BFD to the gateway stays down. What does the gateway need?
• Cloud OnRamp for SaaS scores both Salesforce and Webex as better on the local exit. The store needs Salesforce local and Webex kept on the gateway. What keeps Webex on the gateway?
• Voice prefers MPLS. The backup color is down, strict is not set, and voice still flows on the remaining internet color. Loss on MPLS misses the class. Why does voice still flow?
• Cloud OnRamp for SaaS uses one gateway site. That site's internet exit fails, and every branch loses its SaaS probe. Branch local exits are not allowed. What should be added?
• Voice still uses a path with high delay. The SLA class for voice watches loss only, and loss on that path is inside the class. Delay is the problem users report. What should the class include?
• A store interface can reach the internet, and a tracker holds that color down. Cloud OnRamp for SaaS sends Microsoft 365 to the gateway and shows no local probe. What is keeping the local exit out?
• A firm has two secure internet gateway providers configured. Regulated web must use the approved provider. The data policy sends it to the other provider. Both tunnel sets are up. What should the policy use?
• A VPC prefix arrives by OMP from the cloud gateway and again from a data center that learned it on the side. Users follow the data-center copy. They should follow the cloud gateway. What should policy prefer?
• Branches reach an AWS cloud gateway. The application VPC is peered to the gateway VPC and is not attached itself. Its route table sends the campus prefixes to an internet gateway. What should that route table use?
• A control policy prefers the cloud gateway for the VPC prefix. It is applied to a site list that does not include this region. This region follows the data center. Other regions follow the gateway. What should include this region?
• Calls use a port the voice application list does not include. Those calls follow the bulk path. Calls that match the list use the voice SLA. What should the list include?
• Cloud OnRamp for SaaS should probe a local exit for staff SaaS in one service VPN. The only internet exit is attached to the guest VPN. Staff probes never start. What is missing for the staff VPN?
• Cloud OnRamp for Multicloud is connected to a cloud account that does not hold the application VPC. The VPC in the real account never appears. Branches have no route. What should OnRamp use?
• Malware protection is applied to the guest zone policy. Infected staff hosts in a different zone pass malware and never hit that policy. Routes exist. Where should the protection be applied?
• SIG tunnels from an edge stay down. They are sourced from an interface that has no route to the provider. The internet transport has a default route and is up. What should source the tunnels?