300-445 practice questions
Cisco · 300-445 · 300 questions
Original practice questions for the Designing and Implementing Enterprise Network Assurance exam, covering every domain of the official exam objectives.
This course contains the use of artificial intelligence.
About the 300-445 exam
- Questions
- not published
- Passing score
- not published
- Format
- 90 minutes, English. Question count is not published.
Exam details published by the vendor, checked 8 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Platforms and Architecture (20%) · 60 questions
- A retailer wants to know whether an outside shopper can open the public storefront the way a visitor would, without a scripted login. Which agent style fits?
- A university wants loss and delay measured on a residence-hall segment, collected where that traffic already is. Which agent style fits?
- A bank wants a repeatable check that logs into the customer portal and runs a search after each change window. Which agent style fits?
- A manufacturer wants the experience of an outside visitor opening the public parts-booking site, without a scripted login. Which agent style fits?
- A hospital campus wants proof that the patient-portal checkout still logs in, fills the required fields, and reaches the confirmation page after each release. Which agent style fits that job?
- A logistics hub needs ongoing visibility of traffic that is already crossing the branch LAN, rather than a new synthetic visit to an application. Which agent style fits that job?
- On a hospital campus, nurses report trouble only while on the ward Wi-Fi, and the same tests from the data center stay healthy. Where should the agent be placed?
- Shoppers at a retailer can use an application from every store except one, where the same application fails only inside that building. Where should the agent be placed?
- Traders at a bank reach the market application from every floor except one, where the same test fails. Where should an agent sit so the test includes that failure?
- A government agency gets complaints from one region and needs a visit that behaves like a person simply opening the service there. Which agent style fits?
- A hotel booking form fails only after the guest submits the second page, and loading the opening page never shows the error. Which agent style should walk that failure?
- Students at a university reach the learning system from classrooms and the library, but the same pages fail only in the residence halls. Where should the team place an agent so the test can see that failure?
- Dock workers at a logistics hub fail to reach the yard application only while they are on the loading network, and the same test succeeds from the office LAN. Where should the agent go?
- A retailer with branch stores must not inject test traffic onto a saturated in-store clinical link. Which measurement approach respects that limit?
- A hospital campus wants one-way delay measured by sending test packets, not by watching flows that are already on the wire. Which method fits that request?
- A government agency sees an application fail for users in a field office while the probe in the capital stays green for the same target. Where should the next agent be placed?
- Guests at a hotel chain reach the booking application from every property except one, where the same pages fail. Where should the team place an agent?
- A manufacturer's plant VLAN cannot reach the maintenance application, while an agent in the headquarters closet still succeeds against the same target. Where should the team place an agent so the test includes the plant failure?
- A manufacturer forbids any generated test packet on its trading floor, yet the network team still needs to see how real host traffic behaves there. Which approach fits that rule?
- A bank needs a controlled test from its network to a SaaS front door, sent when the bank chooses, whether or not a user is active. Which approach produces that test?
- A university wants loss figures for live voice calls and does not want extra synthetic calls placed on the trunk. Which method fits?
- A hotel chain must judge guest-network quality during peak check-in without adding probe traffic on that network. Which method matches the constraint?
- An auditor at a government agency asks which RFC defines active and passive methods for IP performance metrics. Which reference answers the auditor?
- A logistics hub design review asks the team to label active measurement and passive measurement correctly before the monitoring design is approved. Which statement is accurate?
- Branch users at a retailer say Microsoft 365 is slow, and measurements on the store LAN are clean. Which approach shows the SaaS and WAN experience behind that complaint?
- Remote staff at a bank report a slow HR portal, and checks of their local Wi-Fi show a healthy link. Which approach shows the SaaS and WAN experience beyond that link?
- A university wants to see how provider path changes affect experience for a cloud CRM used by admissions staff. Which capability fits that question?
- The operations center at a logistics hub disagrees about which SaaS path degraded this morning. Which capability settles that disagreement?
- A manufacturer is turning up a new WAN circuit and wants to compare the SaaS path and experience before and after the cut. Which capability supports that comparison?
- A hospital campus wants the path and user experience to a SaaS payroll site across the WAN explained for leadership. Which view matches that question?
- A hotel chain is planning WAN capacity and needs to know how each property actually experiences the chain's main SaaS applications. Which approach answers the planning question?
- A government agency lodging property reaches the central reservation system across the WAN, and planners need experience on that path rather than one device counter. Which approach fits?
- A bank wants Meraki branch health and the ThousandEyes tests for those same branches in one operational view. Which approach meets that request?
- A hospital campus already sees device health in Catalyst Center and wants ThousandEyes path data shown beside that health. What should the team do?
- A retailer with branch stores wants the SD-WAN controller included in the assurance picture instead of left as a separate inventory. What should be integrated?
- A university wants Webex call quality to sit next to ThousandEyes path tests so a poor call can be compared with the path. What should be integrated?
- A hotel chain needs call failures investigated with the Webex experience and the network path in the same effort. Which approach fits?
- A logistics hub already keeps its site inventory in Catalyst Center and wants assurance findings in that same system. Which approach fits?
- A manufacturer is rolling Secure Client out to plant laptops and wants endpoint experience data from that same rollout. Which approach fits?
- A retailer with branch stores gets an outage page every night when bandwidth spikes during the known backup window and then falls back to the daytime pattern. What should the assurance team do before calling that spike an incident?
- A university collected one hour of application metrics this afternoon and wants alerting turned on before tonight's peak. What should the team have in place before a spike is treated as an incident?
- A hospital campus sees Monday morning latency that matches every other Monday and sits inside the usual weekly pattern. What should the team do before treating that latency as an incident?
- A logistics hub just deployed an application that has no performance history, and the first afternoon shows a tall spike. What should the team have before calling that spike an incident?
- A bank has watched a latency metric drift slowly for a month and is deciding whether the drift is an incident. What should the team compare that drift with before calling it an incident?
- A manufacturer sees product-launch day traffic that does not resemble an ordinary weekday and must decide whether that day is an incident. What should the team compare the launch-day traffic with before calling it an incident?
- Two hotels in the same chain show different loss on their guest paths, and each site's chart has looked like that for weeks. How should the team decide whether today's loss is an incident?
- A retailer's metrics pipeline asks to receive OpenTelemetry and says it does not want a ticket. Which handoff should the assurance team use?
- A hospital's service desk wants a ticket opened whenever an assurance condition becomes true. Which handoff matches that request?
- A hospital campus wants to know whether the path to a clinical application is losing packets and where along that path the loss occurs. Which assurance view answers that question?
- A manufacturer's service desk works only from its ticket queue and has said it will not read a telemetry stream. Which handoff should assurance use for that desk?
- A bank's on-call rotation wants a page when a threshold is crossed and does not want a ticket or a telemetry feed. Which handoff fits?
- A hotel chain NOC wallboard already polls assurance APIs to fill its tiles, and the NOC has asked not to receive any more email. Which handoff should keep feeding that wallboard?
- A university already runs a dashboard that will poll an API for assurance data. Which handoff matches that design?
- At a logistics hub, the data-science group refuses tickets and wants measurements pushed continuously into the pipeline it already runs, not a poll it would have to build. Which handoff matches that request?
- Manufacturing leaders ask which SaaS paths got worse this week, and they are not asking about one web object or one laptop. Which assurance view matches their question?
- A bank network team wants a running stream of routing and reachability events rather than a study of one web page. Which assurance view matches that request?
- Hotel security asks for event evidence that a prefix was hijacked, and they do not want a page-load script. Which assurance view matches the request?
- A logistics web team asks which object on the customer portal is slow, and they do not want a list of BGP events. Which assurance view should they open?
- A retailer with branch stores needs to know what a register experienced during a failed checkout, including that device's local network, while a core SNMP poll in the data center stayed green. Which data answers the question?
- A university webmaster says one public course page is slow to load and asks which assurance view matches that complaint. Which view matches the question they asked?
Data Collection Implementation (25%) · 75 questions
- A hospital needs its network test to start on the clinical application server so the first hop is that server's own interface. Where should the Enterprise Agent run?
- At a logistics hub, the application owner will not install software on the warehouse servers, but tests must still start beside those servers. What placement fits?
- A manufacturer needs a probe at the data center edge that keeps running when no engineer laptop is logged in. Which placement fits?
- A retailer wants a probe that stays beside each store firewall and keeps testing when no associate laptop is open. Which placement matches that design?
- A bank's cloud probe reaches the public gateway but cannot show the hops between the teller VLAN and the core, and the team wants that inside path from an Enterprise Agent. Which placement provides it?
- A university network team will host the probing software on a campus device that supports an Enterprise Agent. Which placement is that?
- A SaaS company runs two data centers and needs each site to originate its own path tests from inside that data center. Which design meets that need?
- A government agency must test an application that lives only on an isolated VLAN, and probes from outside that VLAN cannot reach the target. Where should the Enterprise Agent sit?
- A stadium lab must run path tests on event-week builds without placing the agent on production servers. Which placement fits?
- A hotel chain has a branch with no server of its own, only a router that can host an agent. The team needs a ThousandEyes probing point on that branch LAN for tests toward the reservation service. Which placement meets that need?
- A retailer needs a path test from each branch to a SaaS checkout service, and a wireless controller was suggested as the host. Which placement is the right Enterprise Agent choice?
- A hospital campus hosts its Enterprise Agent only on the application server, and probing stops whenever that server is rebuilt. What should replace that placement?
- Room OS devices in a university's meeting rooms drop calls, while a probe in the data center still reaches the calling service. Which deployment captures the failure on those room devices?
- A manufacturer's standard laptop image already includes Secure Client, and the team needs an endpoint view from every plant laptop. Which deployment uses that image the right way?
- A hospital campus needs an endpoint view from thousands of Windows laptops that clinicians carry between wards. Which deployment matches that need?
- At a retailer, designers using Mac computers are the only people who fail to reach the product-image service, while other branch systems stay healthy. Which deployment shows the failure from those users?
- A university keeps installing its probing software on a laptop that sleeps, and the tests go dark whenever that laptop sleeps. What should they use instead for a steady Enterprise Agent?
- A bank installed an Endpoint Agent by hand on one laptop, and the rest of the laptop fleet still has no endpoint view. Which step covers the fleet the bank needs to see?
- Remote staff at a SaaS company use university lab machines that are reimaged every night, and endpoint test data is gone each morning. What should the collection design do?
- A logistics hub wants an endpoint view from staff laptops and has put contractor home PCs out of scope. Which deployment matches that boundary?
- A hospital campus issues staff laptops on Windows, Mac, or Room OS, while borrowed stadium handhelds run a different operating system. How should Endpoint Agents be rolled out?
- On event days a stadium depends on a partner hotel whose front-desk PCs are replaced often, and user tests disappear with each retired PC. What keeps collection intact?
- A hotel chain finished an Endpoint Agent pilot on ten devices and now treats that pilot as the production design for every property. What should the rollout become?
- A government agency wants endpoint experience from staff laptops, while lobby kiosks run an operating system other than Windows, Mac, or Room OS. What is the sound rollout?
- A retailer with branch stores wants one agent on a data-center server to stand for every cashier laptop. What actually captures experience on those laptops?
- A university installed Endpoint Agents on Windows laptops only, then saw the same campus portal fail for Mac users who have no agent. What should be deployed so both groups are measured?
- University users complain about voice quality, while a network test of the same path shows it idle and free of loss. Which test matches the complaint?
- On a hospital campus, clinicians report loss and jitter on the path to a clinical system, and name lookups for that system succeed. Which test matches the symptom?
- Loan officers at a bank say one internal page is slow, and a network test to that server shows a clean path. Which test should run next?
- Store registers at a retailer fail to resolve the payment hostname, while a ping to that server's address succeeds. Which test should the team run?
- At a logistics hub, clients that use one internal DNS resolver receive the wrong address for a warehouse application, while every other resolver returns the correct record. Which test should the assurance team run?
- On event days at a stadium, the same application name resolves to different addresses from the venue resolvers than from the club offices, by design of split-horizon DNS. Which test checks that behavior?
- A manufacturer's machine-vision feed, carried as UDP real-time media, shows loss and jitter, while camera name lookups succeed. Which test fits the failure?
- A government agency sees a public forms page where one embedded object is slow, while path metrics to the same host stay in their usual range. Which test fits the symptom?
- A hotel chain reports that guest-room call setup fails in the evening, while synthetic web tests to the booking site stay successful. Which test matches the failing service?
- Remote staff at a SaaS company complete the TCP handshake to a file service, yet the transfers stall and collapse. Which test matches that symptom?
- At a hospital campus, one clinician laptop cannot open the charting application while every Enterprise Agent in the data center stays green. Which test should be added?
- At a university, an Enterprise Agent in the data center reaches the learning application, but a branch laptop aimed at the same target does not. Which test should be added?
- A retailer will configure ThousandEyes at the branches, and the complaint is jitter on a point-of-sale path. Which test should they configure?
- At a retailer with branch stores, store laptops reach the inventory application until the VPN client connects, and then only those VPN sessions fail. Which test matches the failure?
- A university portal login completes and the page stays up, yet the live lecture audio breaks into gaps while students remain connected. Which ThousandEyes test should be built for that symptom?
- A hospital campus already collects Meraki Insight at the clinic, and nurses report that one clinical application is slow while basic connectivity stays up. Which view should the team use?
- At a bank, trading-floor laptops fail the market-data page only after a docking-station swap, while data-center Enterprise Agents stay green. Which test should be added?
- A manufacturer suspects the wireless hop on the client, because plant laptops fail the maintenance app on Wi-Fi and succeed on a docked cable. Which test should be added?
- A government agency finds that a remote worker's home router sits in front of a failing laptop, and data-center probes do not traverse that home router. Which test should the team run?
- A hotel chain finds that Room OS units fail a collaboration application while nearby desk PCs succeed, and the failures stay with those room devices. Which test should the team run?
- At a logistics hub, a shipping application fails only when the laptop proxy is on the path, while data-center probes reach the application without that proxy. Which test should the team run?
- A SaaS company with remote staff sees name failures only on laptops, and the enterprise probe cannot observe the resolver those laptops use. Which test should the team run?
- On a hospital campus, a synthetic login to the patient portal succeeds, yet clinicians whose browsers run a broken script still cannot finish that same login. What does the green synthetic result establish?
- A retailer with branch stores wants to close page-failure tickets because a synthetic test is green, but that scripted test does not run the browser extension installed on the store laptops. What should the team recognize before closing a ticket?
- A university wants a synthetic web test of the course portal to prove which database query plan the portal used for a slow search. Which statement describes the limit of that web test?
- A retailer with branch stores already runs healthy page-load tests from the data center, but the same page fails only on the register laptops at the checkout counters. Which test should the team add?
- On event days, a stadium hears application complaints that follow one guest from the seat to the concourse and stop when that person leaves. Which test should the team run?
- A hospital campus finds a VDI session healthy on the server and poor along the thin-client path, which data-center probes do not sit on. Which test should the team run?
- At a logistics hub, a scripted ThousandEyes web test stays green while one browser build throws a JavaScript error on the tracking page. What can the assurance team honestly claim about that error?
- A government agency runs synthetic web tests from a single city and treats each green result as proof for users in every country. What is the honest limit of that result?
- A bank's synthetic web test logs in with an account that skips a verification step every customer hits, and the test stays green. What limits the claim this green result can support?
- A hotel chain's synthetic web test ends on the loyalty login page, yet leaders say guest checkout is being monitored. What limits that claim?
- A manufacturer points to a green synthetic web test from 2 a.m. to deny a noon outage reported by the plant floor. What limits how far that green result can be taken?
- At a SaaS company, a captcha blocks the synthetic web script, and a teammate wants that captcha disabled in production so the test can pass. What is the right response?
- On event days, a stadium wants synthetic web tests to replace Endpoint Agent data collected from phones in the stands. What should the assurance lead say?
- A hospital web transaction requires a client certificate that the synthetic script does not possess. What can the team claim about users who present that certificate?
- A hospital campus application signs users in with SAML single sign-on, but the synthetic web test posts a basic username and password and never finishes login. How should that test be configured?
- A university application authenticates with OAuth, and the synthetic web test stops at the consent redirect without finishing the grant. What must the test do to measure the signed-in application?
- A retailer with branch stores calls an inventory API that accepts only a bearer token, while the synthetic test still submits a form password and is rejected. What should the test present?
- A retailer's synthetic web test follows only one of two page variants that shoppers are split across. What must the test report say?
- A SaaS company hosts two applications on one name, and only one of them uses SAML. The synthetic web test targets the application that does not use SAML. How should that test authenticate?
- A government agency web test logs in with a token, then fails halfway through the scripted transaction when that token expires. The real application refreshes the token and continues. What should the test do?
- At a logistics hub, the scheduling application redirects browsers through the corporate identity provider for single sign-on, but the synthetic test posts credentials only to the application host. What should the test do?
- A manufacturer's legacy maintenance tool accepts only basic authentication, and a proposed synthetic test would use OAuth the way the newer plant applications do. Which test matches this tool?
- A bank protects an internal status page with digest authentication, and a synthetic test sending a basic password is rejected by that page. Which test setup matches the page?
- A hotel chain stored a guest-portal password inside a network-loss test and expected that test to prove the guest login. What is wrong with that setup?
- On event days a stadium web test signs in with an account that skips the multi-factor prompt real guests must pass, then the rest of the page loads. What limitation should the team record?
- A hospital portal logs users in with OAuth, but the synthetic web test pastes one static bearer token and does not repeat the portal OAuth flow. What should the test do instead?
- A retailer branch portal uses basic authentication over TLS. A tester wants to turn TLS off so the synthetic web test is easier to run. What should the test keep?
Data Analysis (30%) · 90 questions
- Tests from a logistics hub stay clean in both directions until the hop at the far firewall, where loss begins. What should the analyst examine?
- On a hospital campus, path data is clean before one provider hop, and packet loss starts at that hop and stays high on every hop after it. Where does that evidence place the fault?
- A university test to a research archive changes to a new path, and packet loss appears only along that new path. What best explains the failure?
- A manufacturer fails over to the backup circuit, and only the tests that use that circuit show loss. Where is the fault?
- A bank's voice tests show high jitter while packet loss on the same path stays near zero, and the calls are breaking. What is the path problem?
- A retailer sees latency jump on a single provider hop toward a branch, while jitter on that hop stays low and earlier hops look unchanged. What does that pattern indicate?
- A SaaS company runs a path test for remote staff and sees loss that is random on every hop, including the first hop from the Enterprise Agent. What should the analyst conclude?
- On event days at a stadium, path tests show a healthy forward path and loss only where the return path takes a different route. Where should the analyst place the fault?
- A hospital campus runs path tests in which every MPLS hop stays clean and loss appears only at the internet exit. What should the analyst treat as the fault domain?
- A government agency's tests fail in the same minute a route flap is logged, and the path returns when the route stabilizes. What matches that failure?
- A retailer sees path tests fail at one branch while branches that use a different provider stay green to the same application. What does that pattern point to?
- A hotel chain sees extra delay only during the known busy hour, and only on one uplink, while other hours on that link look normal. What does the pattern show?
- A bank's path tests are dropped in one QoS queue while traffic in the other classes on the same circuit still passes. What should the analyst call the fault?
- A government agency's path test shows high latency and zero loss on one long-delay hop, while the other hops look ordinary. What should the analyst call the problem on that hop?
- At a logistics hub, tests to the warehouse application stay stable across the WAN, and the loss appears only on the segment inside the data center. What should the analyst conclude?
- A manufacturer sees loss on a path test, and fiber errors are climbing on the single interface whose counters match that loss. Where should the analyst point the fault?
- A university path test shows packet reordering together with jitter, while name lookup for the same target succeeds. What should the analyst treat as the problem?
- A hotel chain's tests to the reservation system start black-holing traffic at the moment a summary route appears on the path. What does the collected data point to?
- Branch stores at a retailer lose the inventory application, and every path trace from those stores stops responding at the same hop. What should the analyst investigate?
- A hospital campus sees packet loss on a path test only while the matching circuit is completely full, and the loss fades when that circuit has spare capacity again. What is the cause?
- On event days at a stadium, tests aimed at one anycast address start landing at a distant site, while the same address was reached at a nearby site on quiet days. What changed?
- On a hospital campus, a laptop is set with the wrong default gateway, and WAN tests sourced from the office agent stay green. What should be corrected?
- A university voice desk hears choppy calls only while the bulk data class is full, and the path view shows loss on that shared hop during the same intervals. What does the evidence indicate?
- At a SaaS company, two probes test the same application for remote staff. Only the probe behind a congested firewall shows loss, and the other probe stays clean. What does that pattern identify?
- At a manufacturer, the VPN client on one laptop does not establish, while path tests from the office agent stay healthy. Where should diagnosis focus?
- In a retail branch, wireless clients fail an application while wired clients at the same desk succeed. Where does that evidence place the failure?
- At a university, an endpoint resolves a service name to the wrong address while the data-center resolver returns the correct address for the same name. What is at fault?
- At a bank, a laptop proxy points at a host that does not answer, while office path tests to the application stay healthy. What should be fixed?
- At a logistics hub, real-time media fails on one soft client and succeeds on every other client that uses the same media servers. What does that isolate?
- A hotel chain sees high loss on the local network inside the property, before guest traffic reaches the WAN handoff. What should be repaired?
- Laptops at a hospital campus follow a PAC file that sends application traffic to a proxy, and a capture shows that proxy resetting the sessions. What should be corrected?
- A government agency finds that a split-tunnel VPN on staff laptops sends one required application out the local Internet path instead of through the tunnel. Where should diagnosis start?
- On stadium event days, endpoint drops line up with roaming between access points, and the same clients stay stable when they remain on one radio. Where does the evidence point?
- A retailer's VPN concentrator serves every store normally, except one laptop whose outdated client cannot complete the tunnel. Where should the fix be applied?
- Campus lab PCs at a university resolve a host when students type the full domain, and single-label names fail because the client search suffix is empty. What should be fixed?
- Remote staff at a SaaS company can reach their default gateway, yet the collaboration app on the laptop resolves to the wrong address. Which setting should be corrected?
- At a SaaS company, remote users lose an internal application at the same moment a proxy authentication prompt appears, and the application returns after they authenticate. What should diagnosis focus on?
- At a logistics hub, a dispatch video fails only while a laptop VPN is connected and plays as soon as that VPN drops. Where should diagnosis start?
- A packet capture on a bank laptop shows the TCP SYN for an internal app is not leaving the host, while other laptops that use the same gateway succeed. Where should diagnosis start?
- At a manufacturer, docking a laptop changes the path metrics, and a capture shows the flow leaving on a different NIC than it used before the dock. What does that evidence identify?
- At a government agency, trouble reports cluster on wireless clients in one building, while wired clients in that same building stay reachable. What does that pattern indicate?
- On one hotel subnet, hosts cannot complete ARP for the default gateway, and only devices on that subnet lose connectivity. What should the team treat as the fault domain?
- On a hospital campus, a patient-portal waterfall shows one third-party scheduling script consuming most of the page load while WAN loss counters stay quiet. What should the analyst treat as the cause?
- In a retail branch, a room system cannot reach a scheduling service while PCs on the same switch succeed, and the room system is configured with a different DNS server than the PCs. What should be checked?
- At a university, remote staff reach campus services with a public resolver, but the same laptops fail only while the home router is handing out its own DNS. Where should diagnosis start?
- On a hospital campus, a clinical laptop drops an application flow only while a local security agent is enabled, and the same flow succeeds when that agent is paused. Where is the fault?
- On event days at a stadium, one point-of-sale client fails when it uses IPv6, IPv4 tests from that client succeed, and neighboring clients that use IPv6 are fine. What should the team investigate?
- A retailer with branch stores sees a long time to first byte on the inventory page while the transfer after that byte is short. What does the waterfall indicate?
- At a logistics hub, the dispatch waterfall shows a long wait on the live API call while the static files are served from cache. What should the analyst treat as the delay?
- A government agency sees a fast browser waterfall from a data-center probe and a slow waterfall from the branch browser for the same intranet application. What should the team do before buying more bandwidth?
- A hotel chain's booking page stays blank until one web font finishes, and the waterfall shows every later resource waiting on that font. Which finding should the assurance team treat as the cause?
- A university course-site waterfall shows DNS as a small slice of load time, while one course image accounts for most of the bytes and the wait. What should be fixed first?
- A bank portal waterfall shows the TLS handshake taking most of the load time while the HTML document itself stays tiny. Which part of the waterfall explains the delay?
- At a manufacturer, the supplier portal spends most of its load time on a chain of redirects before any page content is returned. What does the waterfall identify as the cost?
- On event days, a stadium ticket page shows a waterfall in which one CSS file must finish before any later resource starts. Which finding should the team treat as the cause?
- A hospital campus waterfall for a clinical application shows connection reuse off, so every object pays a new handshake while the network path itself stays short. Which finding should the team treat as the cause?
- A retailer with branch stores captures a browser waterfall where network time is short and one call returns HTTP 500. Which finding should the team treat as the cause?
- A university portal waterfall shows compressed objects that stay small and uncompressed duplicates of those same objects that dominate the download. Which finding should the team treat as the cause?
- A bank's browser waterfall shows a short network row and a long main-thread stretch while the page paints. Which finding should the team treat as the cause?
- A SaaS company with remote staff reruns a slow portal test, and the repeat waterfall looks healthy because cached objects return at once. Which load should the team judge?
- A hotel chain compares two booking sites in browser waterfalls. Requests on the HTTP/1 site fan into a staggered set of bars, while the sister site on HTTP/2 overlaps that same kind of work. Which conclusion fits the HTTP/1 waterfall?
- A manufacturer opens a browser waterfall for a slow supplier portal. The document and the other objects finish quickly, and the long bar is the cookie-banner script. Which conclusion fits this waterfall?
- A logistics hub finds regional tracking pages stay slow. The browser waterfall shows a long bar for images pulled from a distant image host, with the page's other objects much shorter. Which conclusion fits this waterfall?
- A government agency traces a slow benefits page in a browser waterfall. The page's own objects are short, and the long row is the call to the identity provider. Which conclusion fits this waterfall?
- Remote staff at a SaaS company, working on a constrained link, report a slow home page. The browser waterfall shows most of the time spent downloading a very large video banner. Which conclusion fits this waterfall?
- On event days at a stadium, the browser waterfall shows the document finishing quickly, then a late request that repaints the page long after that document. Which conclusion fits this waterfall?
- A hospital campus sees traffic toward its public site surge from many sources while real users time out. What should the team conclude from that pattern?
- On a hospital campus, a browser waterfall shows a service worker serving a stale application shell, and the network row for that page does not run. Which conclusion fits this waterfall?
- A retailer with branch stores compares two variants of the same promotion and finds different long bars in the browser waterfall. Which conclusion fits these waterfalls?
- A bank sees prefixes that are supposed to stay inside the enterprise being advertised toward the internet. What does that evidence indicate?
- Branch stores at a retailer start resolving a corporate name to an unexpected address, and users reach the wrong site. Which reading fits that evidence?
- A university's public prefix shows up at an unexpected BGP origin while users say the campus site is unreliable. What does that routing evidence indicate?
- At a manufacturer, one public name is slow while other names on the same circuit stay healthy. What should the team conclude?
- At a government agency, the resolver returns an address for a critical name that the authoritative server does not publish, and users are sent to an unexpected host. Which conclusion fits that evidence?
- A SaaS company with remote staff sees an unexpected more-specific prefix appear and pull their traffic off the provider path those sessions normally follow. Which conclusion fits the evidence?
- On event day at a stadium, partner prefixes that should stay private show up in the provider routing table and shift spectator traffic. What does that evidence indicate?
- At a logistics hub, tests left the normal path during the same minutes a prefix was announced from an unexpected origin. What explains that shift?
- A hotel chain's internet link fills with volumetric noise, and loss hits every flow on that link. What does the pattern indicate?
- A retailer with branch stores sees tests fail while a bad route is present and recover at every store as soon as that route is withdrawn, with no application change. What caused the failure?
- A bank's users cannot reach a partner site, Internet Insights reports a disruption inside that destination network, and the bank's own path tests toward its edge stay clean. What explains the failure?
- At a university, two DNS views for the same name disagree, and the address users receive matches a known sinkhole. Which interpretation fits the evidence?
- On a hospital campus the application team wants a code rollback, but path measurements show a denial-of-service flood toward the application and the running build is not the source of the loss. Which response fits the evidence?
- A manufacturer sees packet loss only toward one anycast site that is under attack, while paths to every other destination stay clean. Which response fits that evidence?
- A logistics hub saw a route leak for about ten minutes, paths then returned to normal, and a teammate opened a month-long capacity project. Which response fits the evidence?
- A SaaS company finds internal route summaries visible to external peers, and latency for those prefixes collapsed at the same moment. What should analysts name as the cause?
- A government agency sees one of its prefixes originated by an unexpected autonomous system, and the local router configuration did not change. What should the team call this event?
- Branch stores of a retailer are slow, and routing data shows the service prefix originated by an unexpected network. What should the team name as the cause of the slowness?
- Hotel guests who request the chain booking name are sent to a look-alike address that still answers HTTP, while other names resolve as usual. Which response fits that evidence?
- A stadium circuit saturated during a distributed denial-of-service attack. After the attack ended, the same circuit carried normal event traffic again. Which response fits that evidence?
- At a hospital, the security log and the network path data both change in the same minute, when traffic moves onto an unexpected route. Two teams want two root-cause projects. Which response fits the timestamps?
Insights and Alerts (25%) · 75 questions
- A university edge router keeps dropping and restoring its BGP session toward the upstream provider. What should notify the network team?
- A hospital path that had been clean now shows TCP retransmissions climbing toward the imaging archive. What should page the network team about that condition?
- At a retail chain, interface error counters on a store uplink are rising while user CPU on the registers stays ordinary. Which response fits that network condition?
- A bank network operations center wants a page when Internet Insights reports a disruption on providers the bank uses. Which action does that?
- A government agency watches SNMP and sees one WAN interface stay pinned at full utilization through the workday. Operators want a page when that condition returns. Which alert fits?
- At a SaaS company, syslog on a border router starts repeating the same hardware fault. The on-call team wants a page when that message returns. Which alert fits?
- A logistics hub loses the VPN tunnel to the regional warehouse, and the tunnel state stays down. What should page the network team?
- At a manufacturer, packet loss appears in the same windows as MPLS label-switched path changes. What should page the WAN team?
- At a hotel chain, NetFlow shows guest traffic suddenly shifting onto one WAN interface while the other circuits stay quiet. The NOC wants a page when that shift happens again. Which response fits?
- A university network team wants an on-call page when tests show loss on the path to the learning system, and they have said a laptop fan is not that page. Which action matches the request?
- A manufacturer collects BGP session state, interface errors, and throughput toward a plant peer, and wants a page only when that BGP session leaves the established state. Which action matches the request?
- On event days at a stadium, WAN throughput falls below the level the operations team treats as normal, and they want a page when that drop returns. Which alert fits?
- A hospital campus sees drops concentrated in one traffic class while other classes on the same circuit stay clear. Operators want a page for that condition. Which alert fits?
- A retailer's edge router loses the expected prefix from its BGP table, and the branches that depend on that prefix go dark. The NOC wants a page when the prefix disappears. Which alert fits?
- A bank agreed that delay on the path to the trading service would page the network team once it crossed a line they had set, and that delay has now crossed the line. Which response fits the agreement?
- At a manufacturer, user tickets open at the same minutes the client Wi-Fi signal collapses, and the WAN path stays quiet. Which alert matches that evidence?
- Students at a university report long waits inside the browser, endpoint browser data shows those same waits, and the campus edge routing looks unchanged. Which alert matches the symptom?
- Traders at a bank lose the market application when the VPN client on the endpoint disconnects, and endpoint data records that disconnect. Which alert matches the symptom?
- Clinicians at a hospital campus report that a soft client fails at the same moments endpoint data shows the laptop CPU spiking. Which alert matches that user-experience symptom?
- Cashiers at a retailer move from the wired counter onto the wireless floor, and the point-of-sale application drops during that change. Which alert matches the user symptom?
- At a logistics hub, dispatch screens freeze only while the client CPU is saturated, and the WAN path stays clean. Which alert should watch that failure?
- A hotel chain sees the browser error rate climb on guest devices while path loss on the same tests stays low. Which alert fits that pattern?
- At a hospital campus, browser tests fail only on laptops running one Endpoint Agent version, while every other version reaches the same portal. Which alert matches that pattern?
- Branch laptops at a retailer show climbing Wi-Fi retries on the endpoint while the store WAN circuit stays clean. Which alert should page the team?
- A government agency sees the user failure at the moment the endpoint flips from a wired connection to wireless. Which rule should catch that change?
- Remote staff at a SaaS company lose their VPN while probes inside the office stay green for the same applications. Which rule matches those failures?
- During events, a stadium pages the WAN on-call for freezes that line up with client CPU saturation while the path stays clean. What should the rule watch instead?
- At a bank, teller browsers stall on one loan page while CPU on those PCs stays low and the branch VPN stays up. Which alert fits the symptom the tellers named?
- A retailer with branch stores wants a weekly view of store experience, because leadership cannot use a separate page for every interface flap. Which deliverable fits that audience?
- Hospital network operators need a live view they can act on tonight when a clinical path degrades. Which deliverable matches that audience?
- A university VPN drop is visible in endpoint data, but the only notice today is a weekly executive dashboard the on-call team does not read. What should notify the people who respond?
- A manufacturer pages the network on-call from a core-router SNMP trap each time a laptop roams between access points. Which rule fits this symptom?
- At a university, the application team asks which student-portal transaction is failing and says interface SNMP graphs do not help them. Which view should they receive?
- Production support at a bank asks for the open alert together with the tests that ran around the same time, so they can work the incident. Which deliverable matches that request?
- Leaders at a logistics hub ask for a one-page experience score they can read in a staff meeting. Which deliverable matches that request?
- A government agency's production support desk needs proof that last night's network alert both fired and later cleared so the ticket can close. Which deliverable matches that request?
- The network operations center at a manufacturer is working from executive slide decks and missing live faults. Which deliverable should that operations center receive?
- At a SaaS company with remote staff, operators were sent the monthly executive trend and executives were sent the live alert-rule pack. Operations now asks for the pack that belongs to operators. Which deliverable should operators receive?
- Developers at a hotel chain ask which reservation API call slowed down after last night's release. Which deliverable should they receive?
- A retailer with branch stores pages store managers from the monthly business review whenever a branch alert flaps. Which audience should keep the live paging channel?
- A manufacturer already has an executive summary of plant network health, yet someone sent the board a CSV of raw flows. Which deliverable should the board receive?
- A hospital application team received a BGP table dump and cannot use it to see why the charting page is slow. Which deliverable should that team receive instead?
- A university has both network operations and a production support desk, and the support desk asks for the view it will use to work alerts. Which deliverable should support receive?
- On stadium event days, operators need the live alert rule and executives need the experience trend, yet both groups were sent one identical packet. What should be delivered instead?
- A bank emails every interface flap to executives, and those leaders have started ignoring the mail. How should the executive deliverable change?
- A bank lowered alert thresholds until ordinary transactions paged, and real incidents are now buried in that noise. Which step should the team take?
- A manufacturer expected a maintenance window to suppress a known alert, but the rule still pages while that window is in effect. Which step should the team take?
- A hospital campus saved a congestion alert rule and has not exercised it against any known congestion. Which step should the team take next?
- A retailer with branch stores has an alert that fires during an outage and stays open after the stores have recovered. Which step should the team take?
- A university acknowledged one test alert and then deleted the rule, so nothing remains that can fire or clear. Which step should the team take?
- At a logistics hub, two alert rules page the on-call phone for one path event, so every incident arrives twice. What should the team do to validate those rules?
- A retailer with branch stores sees one link flap generate a storm of pages for the same incident. What should the assurance owner do with the alert rule before trusting it in production?
- At a government agency, a dependency alert pages the desk only after the parent alert has already paged for the same event. What should the team do before changing either rule?
- A hospital campus saved an alert rule that matches a lab target and does not match the production service clinicians use. What should the team prove before depending on that rule?
- On event days at a stadium, an alert rule matches the condition, but the notification goes to a mailbox nobody monitors. What should the team prove before relying on that rule?
- A SaaS company with remote staff pointed an alert rule at a new test and left the previous test in place. What should the team do before trusting pages from that rule?
- A hotel chain's guest-experience alert fires during a dip and then clears while that dip is still in progress, so the page ends before the experience recovers. What should the team do to validate the rule?
- A manufacturer edited an alert rule, and the on-call owner still cites yesterday's validation of the old rule. What should happen before the edited rule is trusted?
- A hospital campus link runs full at the same hour every week, and an alert already pages for that fullness. What should the next deliverable be?
- A university spoke reaches its applications only by hairpinning through a congested hub, and delay stays high even though the spoke link itself is quiet. Which recommendation belongs in the capacity report?
- A retailer's voice calls are dropped because the voice class is too small, and those drops are already being alerted. What should the recommendation be?
- At a university, a dashboard widget stays green while the related alert rule keeps paging the on-call team. What is the right next step for that rule?
- At a bank, an alert rule passes a syntax check and an engineer treats that check as proof the rule works. What still has to happen?
- A SaaS company sees the link that serves remote staff stay full through the workday, and someone proposes renaming the dashboard as the response. Which action belongs in the capacity report?
- A logistics hub can fail over to a backup path, but that path is too thin to carry the traffic the primary path carries today. Which capacity recommendation addresses the finding?
- A hotel chain finds a guest-facing application marked into the wrong traffic class, so it contends with bulk transfers even though the circuit still has spare capacity. Which capacity recommendation fits?
- A government agency sees two sites sending traffic through a distant exit even though a closer exit is available and healthy. What should the capacity recommendation propose?
- A manufacturer's plant uplink stays full through production shifts, and the team is about to add a third alert for that same saturation. What should the capacity report recommend instead?
- A bank sees one traffic queue starve during the business day while the WAN interface carrying that queue is not full. Which item belongs in the capacity recommendation?
- A manufacturer already has a working alert for a congested plant circuit and now asks for the optimization that would relieve the congestion. What should the assurance deliverable be?
- A bank sees loss only in the backup traffic class while backups run, and interactive classes on the same circuit stay clean. What should the capacity recommendation be?
- A hospital campus circuit stays full through the day, and QoS already marks clinical traffic ahead of bulk transfers. What should the capacity recommendation be?
- A retailer runs a large file transfer during the branch busy hour, the circuit fills, and the transfer can shift to a quiet hour without hurting store sales. What should the capacity recommendation be?
- Every university spoke slows when its traffic hairpins through one hub, and that hub link is the bottleneck shared by all of the spokes. What should the capacity recommendation be?
- On event days a stadium uplink sits full, ticket sales slow, and the charts already show the circuit is saturated. More synthetic tests will not widen that circuit. What should the team recommend?
These questions are original practice material and are NOT actual exam questions or brain-dump content. Cisco and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by Cisco.