Cisco CCNP Enterprise 300-415 Questions & Answers

• Question 321:

  Refer to the exhibit.

  

  The SD-WAN network is configured with a default full-mesh topology. The network engineer wants the Rome WAN Edge to use the MPLS TLOC as the preferred TLOC when handling Telnet traffic, as long as the MPLS link has the following characteristics:

  Loss: 5% Latency: 100 ms Jitter: 100 ms

  Which configuration must the network engineer use to create a list that classifies the MPLS link characteristics?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: C

  Configuration Analysis: The configurations provided in the images must be evaluated to determine which option correctly classifies the MPLS link based on the given criteria of loss, latency, and jitter. Preferred TLOC Configuration: The network engineer needs to configure the SD-WAN policy to prefer the MPLS transport for Telnet traffic, ensuring the link characteristics match the specified thresholds. References: Cisco SD-WAN Policy Configuration Guide Cisco SD-WAN Transport and TLOC Configuration Guide

• Question 322:

  What is the maximum number of IPsec SAs that are temporarily created and converged on a new set of IPsec SAs in the pairwise keys process during a simultaneous rekey?

  A. 2

  B. 4

  C. 6

  D. 8

  Correct Answer: B

  During a simultaneous rekey, up to four pairs of IPsec Security Associations (SAs) can be temporarily created. These four pairs converge on a single rekey of a device.

• Question 323:

  Which two mechanisms are used by vManage to ensure that the certificate serial number of the WAN Edge router that is needed to authenticate is listed in the WAN Edge Authorized Serial Number list? (Choose two.)

  A. Synchronize to the PnP.

  B. The vManage is shipped with the list.

  C. Synchronize to the Smart Account.

  D. Manually upload it to vManage.

  E. The devices register to vManage directly as the devices come online.

  Correct Answer: CD

  Reference: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/m-quick-connect-workflow.html

• Question 324:

  Refer to the exhibit.

  

  A WAN Edge device was recently added to vManage, but a control connection could not be established. Which action resolves this issue?

  A. Rectify the Root CA certificate mismatch on WAN Edge devices.

  B. Resolve the ZTP reachability and rectify smart account credentials issue.

  C. Install the bootstrap code on WAN Edge and check for CSR.

  D. Send the serial number to vBond from the vManage controller.

  Correct Answer: D

  Problem Statement

  A device's serial number is missing from the vSmart controllers.

  Identify the ProblemIssue the show control connections-history command. In the Local Error column of the output, the values BIDNTVRFD, CRTREJSER, and SERNTPRES indicate a missing serial number. BIDNTVRFD indicates a missing serial number for vBond orchestrators. CRTREJSER indicates a missing serial number for vEdge routers and vSmart controllers. SERNTPRES on a vBond orchestrator indicates a serial number mismatch between vSmart controllers.

  Resolve the Problem

  Send the device's serial number to the controllers:

  1.

  In vManage NMS, select the Configuration ► Certificates screen.

  2.

  In the vEdge List tab, select the device whose serial number is missing.

  3.

  Click Send to Controllers. https://community.cisco.com/t5/networking-knowledge-base/sd-wan-routers-troubleshoot-control-connections/ta-p/3813237

• Question 325:

  What is the default value for the Multiplier field of the BFD basic configuration in vManage?

  A. 3

  B. 4

  C. 5

  D. 6

  Correct Answer: D

• Question 326:

  What are the default username and password for vSmart Controller when it is installed on a VMware ESXi hypervisor?

  A. username admin password admin

  B. username admin password cisco

  C. username cisco password admin

  D. username cisco password cisco

  Correct Answer: A

  The default username and password for a vSmart Controller when it is installed on a VMware ESXi hypervisor typically follow the same default credentials used in the Cisco SD-WAN environment. These default credentials are provided during the initial setup or installation of the vSmart Controller, and they are typically as follows: Default Username: admin Default Password: admin

• Question 327:

  A customer wants to use AWS for Cisco SD-WAN IaaS services by deploying virtual SD-WAN routers in a transit AWS VPC. The transit VPC then connects via site-to-site IPsec tunnels to an AWS transit gateway. Which transit VPC connects via site-to-site IPsec tunnels to an AWS transit gateway?

  A. Cisco Cloud onRamp for SaaS

  B. Cisco Cloud onRamp for Colocation

  C. Cisco Cloud onRamp for IaaS

  D. Cisco Cloud onRamp for Multicloud

  Correct Answer: C

  Cisco Cloud OnRamp for IaaS is designed to simplify and optimize connectivity between on-premises locations, Cisco SD-WAN components, and public cloud environments like AWS. The key components and functionalities of Cisco Cloud OnRamp for IaaS in this scenario include:

  Transit VPC: The transit AWS VPC serves as a hub, where the virtual SD-WAN routers are deployed. These SD-WAN routers are responsible for efficiently connecting the customer's on-premises network with resources in the AWS cloud. AWS Transit Gateway: The AWS Transit Gateway provides centralized routing and connectivity management for multiple Amazon VPCs, including the transit VPC and other VPCs within the AWS environment. It simplifies and streamlines the routing of traffic between the VPCs and the on-premises network.

  Site-to-Site IPsec Tunnels: Site-to-site IPsec tunnels are used to secure the communication between the SD-WAN routers in the transit VPC and the AWS Transit Gateway, ensuring the confidentiality and integrity of data in transit.

• Question 328:

  What are the two reasons a customer chooses to use IPsec tunnels over GRE? (Choose two.)

  A. IPsec failure detection is faster.

  B. Generally, they provide a higher bandwidth for tunnel connection.

  C. CFlowd is required.

  D. A WAN Edge router is behind NAT.

  E. IPsec is more secure.

  Correct Answer: AE

• Question 329:

  What is the order of operations for software upgrades of Cisco SD-WAN nodes?

  A. vBond, vManage, vSmart, WAN Edge

  B. vManage, vBond, vSmart, WAN Edge

  C. vManage, vBond, WAN Edge, vSmart

  D. vManage, vSmart, vBond, WAN Edge

  Correct Answer: B

  When you upgrade a group of Cisco vBond Orchestrator, Cisco vSmart Controllers, and Cisco IOS XE SD-WAN devices or Cisco vEdge devices in either a standalone or Cisco vManage cluster deployment, the software upgrade and reboot is performed first on the Cisco vBond Orchestrator, next on the Cisco vSmart Controller, and finally on the Cisco IOS XE SD-WAN devices or Cisco vEdge devices.

• Question 330:

  What are two benefits of installing Cisco SD-WAN controllers on cloud-hosted services? (Choose two.)

  A. utilizes well-known cloud services such as Azure, AWS, and GCP

  B. accelerates Cisco SD-WAN deployment

  C. installs the controllers in two cloud regions in a primary and backup setup

  D. allows integration of the WAN Edge devices in the cloud

  E. automatically implements zone-based firewalling on the controllers

  Correct Answer: AB