Cisco CCNP Enterprise 300-440 Questions & Answers

• Question 1:

  DRAG DROP

  An engineer must configure an AppGoE service node for WAN optimization for applications that are hosted in the cloud using Cisco vManage for C8000V or C8500L-8S4X devices. Drag and drop the steps from the left onto the order on the right to complete the configuration.

  Select and Place:

  

  Correct Answer:

  

  Step 1 = Navigate to Configuration, select Templates, and then select Device Templates.

  Step 2 = Click Create Template, select From Feature Template, and then select the device model.

  Step 3 = Select Device, select Service Node, and then set Template Name and Description.

  Step 4 = Attach the device template to the device.

  The process of configuring an AppGoE service node for WAN optimization for applications that are hosted in the cloud using Cisco vManage for C8000V or C8500L-8S4X devices involves several steps.

  Navigate to Configuration, select Templates, and then select Device Templates:

  This is the first step where you navigate to the Templates section in the Configuration menu of Cisco vManage.

  Click Create Template, select From Feature Template, and then select the device model: In this step, you create a new template for the device model from the feature template.

  Select Device, select Service Node, and then set Template Name and Description:

  After setting up the template, you select the device and the service node, and then set the template name and description.

  Attach the device template to the device: Finally, you attach the created device template to the device.

  References:

  AppQoE - Step-by-Step Configuration - Cisco Community Cisco Catalyst SD-WAN AppQoE Configuration Guide, Cisco IOS XE Catalyst SD- WAN Release 17.x

• Question 2:

  DRAG DROP

  An engineer must configure a CLI add-on feature template in Cisco vManage for enhanced policy-based routing (ePBR) for IPv4. These configurations were deleted:

  1.

  licensing config enable false

  2.

  licensing config privacy hostname true

  3.

  licensing config privacy version false

  4.

  licensing config utility utility-enable true

  Drag and drop the steps from the left onto the order on the right to complete the configuration.

  Select and Place:

  

  Correct Answer:

  

  Step 1 = Click Configuration, select Templates, and then select Feature Templates.

  Step 2 = Click Add Template, select the device, and then click Select Template.

  Step 3 = Click CLI Add-On Template and enter the name and description.

  Step 4 = Paste the CLI configuration and then click Save.

  The process of configuring a CLI add-on feature template in Cisco vManage for enhanced policy-based routing (ePBR) for IPv4 involves several steps1234. Click Configuration, select Templates, and then select Feature Templates: This is the

  first step where you navigate to the Templates section in the Configuration menu of Cisco vManage.

  Click Add Template, select the device, and then click Select Template: In this step, you add a new template for the device.

  Click CLI Add-On Template and enter the name and description: After setting up the template, you select the CLI Add-On Template option, and then enter the name and description for the template.

  Paste the CLI configuration and then click Save: Finally, you paste the CLI configuration into the template and save the changes.

  References:

  CLI Add-On Feature Templates - Cisco

  Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x - CLI Add-On Feature Templates Cisco SD-WAN vSmart CLI Template - NetworkLessons.com CLI Templates for Cisco XE

  SD-WAN Routers

• Question 3:

  DRAG DROP

  An engineer signs in to Cisco vManage and needs to configure a custom application with a Cisco SD-WAN centralized policy. Drag and drop the steps from the left onto the order on the right to complete the configuration.

  Select and Place:

  

  Correct Answer:

  

  The process of configuring a custom application with a Cisco SD-WAN centralized policy using Cisco vManage involves several steps.

  Click Configuration, select Policies, and then select Centralized Policy: This is the first step where you navigate to the Policies section in the Configuration menu of Cisco vManage.

  Click Custom Options, select Centralized Policy, and then select Lists: In this step, you select the Custom Options, then select Centralized Policy, and finally select Lists.

  Click Custom Applications, and then select New Custom Application: After setting up the Lists, you click on Custom Applications and then select New Custom Application.

  Enter a name for the application, enter the match criteria, and then click Add:

  Finally, you enter a name for the application, specify the match criteria, and then click Add to complete the configuration.

  References:

  Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE

• Question 4:

  DRAG DROP

  An engineer needs to configure enhanced policy-based routing (ePBR) for IPv4 by using Cisco vManage. Drag and drop the steps from the left onto the order on the right to complete the configuration of the ePBR using the CLI add-on template.

  Select and Place:

  

  Correct Answer:

  

  Enhanced Policy-Based Routing (ePBR) is used to direct packets that arrive at an interface to a specified next-hop. It is very useful in managing a large number of configured access lists more efficiently. In ePBR, the router drops the traffic packets if the next hop configured in the PBR policy is not reachable. To avoid packet loss in such scenarios, you must configure multiple next hops for each access control entry. Here are the steps to configure ePBR for IPv4 using Cisco vManage: Configure an extended ACL: This step involves defining the network or the host. For example, you can permit IPv4 traffic from any source to specific hosts. Configure a class map that matches the ACL: Class maps match the parameters in the ACLs. For instance, you can create a class map of type traffic and match it with the previously created ACL. Configure the policy map with the action to set the next hop: Policy maps with ePBR then take detailed actions based on the set statements configured. You can configure an ePBR policy map with the class map and set the next hop. Apply the service policy on the interface: Finally, you apply the ePBR policy map to the interface. For example, you can apply the policy map to a GigabitEthernet interface. References : Implementing Enhanced Policy Based Routing - Cisco Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE How to configure PBR - Cisco Community

• Question 5:

  DRAG DROP

  An engineer must use Cisco vManage to configure an application-aware routing policy Drag and drop the steps from the left onto the order on the right to complete the configuration.

  Select and Place:

  

  Correct Answer:

  

  Step 1 = Create the groups of interest.

  Step 2 = Configure the topology.

  Step 3 = Create the application-aware routing policy.

  Step 4 = Apply the application-aware routing policy to a specific VPN and sites.

  The process of configuring an application-aware routing policy in Cisco vManage involves several steps.

  Create the groups of interest: This is the first step where you define the applications or groups that the policy will affect. Configure the topology: This involves setting up the network topology that the policy will operate within.

  Create the application-aware routing policy: After setting up the groups and topology, you then create the application-aware routing policy. This policy tracks network and path characteristics of the data plane tunnels between Cisco SD- WAN

  devices and uses the collected information to compute optimal paths for data traffic.

  Apply the application-aware routing policy to a specific VPN and sites: Finally, the created policy is applied to a specific VPN and sites. This allows the policy to affect the desired network traffic.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0 Learning Plan: Designing and Implementing Cloud Connectivity v1.0 (ENCC 300- 440)

  Information About Application-Aware Routing - Cisco Configuring Application-Aware Routing (AAR) Policies | NetworkAcademy.io Policies Configuration Guide, Cisco IOS XE SD-WAN Releases 16.11, 16.12

• Question 6:

  DRAG DROP

  Drag and drop the commands from the left onto the purposes on the right to identify issues on a Cisco IOS XE SD-WAN device.

  Select and Place:

  

  Correct Answer:

  

  Display the time and process information of the device, as well as CPU, memory, and disk usage data. = show sdwan system status Validate the configured zone-based firewall. = show policy-firewall config1 Display information about application-aware routing policy matched packet counts on the Cisco IOS XE SD-WAN devices. = show sdwan policy app-route-policy- filter View the security information that is configured for IPsec tunnel connections. = show sdwan security-info The commands used to identify issues on a Cisco IOS XE SD-WAN device are as follows show sdwan system status: This command is used to display the time and process information of the device, as well as CPU, memory, and disk usage data. show policy-firewall config: This command is used to validate the configured zone-based firewall. show sdwan policy app-route-policy-filter: This command is used to display information about application-aware routing policy matched packet counts on the Cisco IOS XE SD-WAN devices. show sdwan security-info: This command is used to view the security information that is configured for IPsec tunnel connections

  References: Cisco IOS XE Catalyst SD-WAN Qualified Command Reference Cisco Catalyst SD-WAN Command Reference Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE SD-WAN Tunnel Interface Commands - Cisco

• Question 7:

  DRAG DROP

  Refer to the exhibit.

  

  These configurations are complete:

  1.

  Create an account in the Equinix portal.

  2.

  Associate the Equinix account with Cisco vManage.

  3.

  Configure the global settings for Interconnect Gateways.

  Drag the prerequisite steps from the left onto the order on the right to configure a Cisco SD-WAN Cloud Interconnect with Equinix

  Select and Place:

  

  Correct Answer:

  

  The process of configuring a Cisco SD-WAN Cloud Interconnect with Equinix involves several steps.

  Ensure that you have UUIDs for the required number of Cisco SD WAN Virtual Edge instances that you want to deploy as Interconnect Gateways: This is the first step where you ensure that you have the necessary UUIDs for the Cisco SDWAN Virtual Edge instances that you want to deploy.

  Create the necessary network segments: After ensuring the availability of UUIDs, you create the necessary network segments.

  Attach Cisco SD-WAN Virtual Edge to the Equinix device template: After setting up the network segments, you attach the Cisco SD-WAN Virtual Edge to the Equinix device template.

  Create the Interconnect Gateway at the Equinix location that is closest to your SD- WAN branch location: Finally, you create the Interconnect Gateway at the Equinix location that is closest to your SD-WAN branch location.

  References:

  [Cisco SD-WAN Cloud Interconnect with Equinix]

  [Cisco SD-WAN Cloud OnRamp for CoLocation Deployment Guide]

• Question 8:

  DRAG DROP

  An engineer must edit the settings of a site-to-site IPsec VPN connection between an on- premises Cisco IOS XE router and Amazon Web Services (AWS). IPsec must be configured to support multiple peers and failover after 120 seconds of idle time on the first entry of the crypto map named Cisco. Drag and drop the commands from the left onto the order on the right.

  Select and Place:

  

  Correct Answer:

  

  Step 1 = crypto map cisco 1 ipsec-isakmp Step 2 = set peer 192.168.10.1 default Step 3 = set peer 192.168.20.1 Step 4 = set security-association idle-time 120 default

  The process of editing the settings of a site-to-site IPsec VPN connection between an on- premises Cisco IOS XE router and Amazon Web Services (AWS), and configuring IPsec to support multiple peers and failover after 120 seconds of idle time on the first entry of the crypto map named Cisco involves several steps123456. crypto map cisco 1 ipsec-isakmp: This command is used to create a new entry in the crypto map named "cisco". The "1" is the sequence number of the entry, and "ipsec-isakmp" specifies that the IPSec security associations (SAs) should be established using the Internet Key Exchange (IKE) protocol13. set peer 192.168.10.1 default: This command is used to specify the IP address of the default peer for the crypto map entry. In this case, the default peer is at IP address 192.168.10.115. set peer 192.168.20.1: This command is used to add an additional peer to the crypto map entry. In this case, the additional peer is at IP address 192.168.20.1. This allows the IPsec VPN to support multiple peers56. set security-association idle-time 120 default: This command is used to set the idle time for the security association. If no traffic is detected over the VPN for the specified idle time (in this case, 120 seconds), the security association is deleted, and the VPN connection fails over to the next peer46.

  References: Configure a Site-to-Site IPSec IKEv1 Tunnel Between an ASA and a Cisco IOS Router - Cisco Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services - Cisco Community Configuring Site to Site IPSec VPN Tunnel Between Cisco Routers Configure Failover for IPSec Site-to-Site Tunnels with Backup ISP Links on FTD Managed by FMC - Cisco Does Setting Multiple Peers in a Crypto Map Also Support Parallel IPSec Connections - Cisco Community Multiple WAN Connections -- IPsec in Multi-WAN Environments | pfSense Documentation Multiple Set Peer for VPN Failover - Server Fault

• Question 9:

  DRAG DROP

  Refer to the exhibit.

  

  Drag and drop the steps from the left onto the order on the right to configure a site-to-site VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS).

  Select and Place:

  

  Correct Answer:

  

  Step 1 = Create a Customer Gateway (CGW) in AWS.

  Step 2 = Create a Virtual Private Gateway (VGW) in AWS.

  Step 3 = Create a site-to-site VPN connection in AWS.

  Step 4 = Configure the IOS XE router with the required IPsec VPN parameters and routing settings.

  Step 5 = Verify and test the VPN connection.

  The process of configuring a site-to-site VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS) involves several steps

  Create a Customer Gateway (CGW) in AWS: This is the first step where you define the public IP address of your on-premises Cisco IOS XE router in AWS. Create a Virtual Private Gateway (VGW) in AWS: This involves creating a VGW and

  attaching it to the VPC in AWS.

  Create a site-to-site VPN connection in AWS: After setting up the CGW and VGW, you then create a site-to-site VPN connection in AWS. This involves specifying the CGW, VGW, and the static IP prefixes for your on-premises network.

  Configure the IOS XE router with the required IPsec VPN parameters and routing settings: After the AWS side is set up, you configure the on-premises Cisco IOS XE router with the required IPsec VPN parameters and routing settings. Verify

  and test the VPN connection: Finally, you verify and test the VPN connection to ensure that it is working correctly.

  References:

  Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services - Cisco Community

  SD-WAN Configuration Example: Site-to-site (LAN to LAN) IPSec between vEdge and Cisco IOS - Cisco Community

• Question 10:

  DRAG DROP

  An engineer must configure a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router In Controller mode and AWS. The IKE version must be changed from IKEv1to IKEv2 in Cisco vManage. Drag and drop the steps from the left onto the order on the right to complete the configuration.

  Select and Place:

  

  Correct Answer:

  

  Step 1 = Click Configuration, select Templates, and then select Feature Templates.

  Step 2 = Click Add Template, select the device, and then click Basic Configuration.

  Step 3 = Shut down the tunnel and then remove the ISAKMP profile.

  Step 4 = Attach the IKEv2 profile and then run the no shutdown command on the tunnel.

  The process of configuring a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router in Controller mode and AWS, and changing the IKE version from IKEv1 to IKEv2 in Cisco vManage involves several steps123. Click

  Configuration, select Templates, and then select Feature Templates: This is the first step where you navigate to the Templates section in the Configuration menu of Cisco vManage1.

  Click Add Template, select the device, and then click Basic Configuration: In this step, you add a new template for the device and proceed with the basic configuration.

  Shut down the tunnel and then remove the ISAKMP profile: Before changing the IKE version, you need to shut down the existing tunnel and remove the ISAKMP profile that is configured for IKEv12.

  Attach the IKEv2 profile and then run the no shutdown command on the tunnel:

  Finally, you attach the newly created IKEv2 profile to the tunnel and bring the tunnel back up.

  References:

  Configuring Internet Key Exchange Version 2 (IKEv2) - Cisco Switch from IKEv1 to IKEv2 on Cisco Routers - Cisco Community Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services - Cisco Community