Cisco CCNP Enterprise 300-440 Questions & Answers

• Question 31:

  Refer to the exhibit.

  

  A company uses Cisco SD-WAN in the data center. All devices have the default configuration. An engineer attempts to add a new centralized control policy in Cisco vManage but receives an error message. What is the problem?

  A. A centralized control policy is already applied to the specific site ID and direction

  B. The policy for "Hub" should be applied in the outbound direction, and the policy for "All- Site" should be applied inbound.

  C. Apply an additional outbound control policy to override the site ID overlaps.

  D. Site-list "All-Site" should be configured with a new match sequence that is lower than the sequence for site-list "Hub*.

  Correct Answer: D

  The problem is that the site-list "All-Site" has a higher match sequence than the site-list "Hub", which means that the policy for "All-Site" will take precedence over the policy for "Hub" for any site that belongs to both lists. This creates a conflict

  and prevents the engineer from adding a new centralized control policy in Cisco vManage. To resolve this issue, the site-list "All-Site" should be configured with a new match sequence that is lower than the sequence for site-list "Hub", so that

  the policy for "Hub" will be applied first and then the policy for "All-Site" will be applied only to the remaining sites that are not in the "Hub" list.

  References:

  Designing and Implementing Cloud Connectivity (ENCC, Track 1 of 5), Module 3:

  Cisco SD-WAN Cloud OnRamp for Colocation, Lesson 3: Cisco SD-WAN Cloud OnRamp for Colocation - Centralized Control Policies Cisco SD-WAN Cloud OnRamp for Colocation Deployment Guide, Chapter 4:

  Configuring Centralized Control Policies Cisco SD-WAN Configuration Guide, Release 20.3, Chapter: Centralized Policy Framework, Section: Policy Configuration Overview

• Question 32:

  Refer to the exhibits.

  

  An engineer must redistribute OSPF internal routes into BGP to connect an on-premises network to a cloud provider without introducing extra routes. Which two commands must be configured on router R2? (Choose two.)

  A. router ospf 1

  B. router bgp 100

  C. redistribute ospf 1

  D. redistribute bgp 100

  E. redistribute ospf 1 match internal external

  Correct Answer: BE

  To redistribute OSPF internal routes into BGP, the engineer needs to configure two commands on router R2. The first command is router bgp 100, which enables BGP routing process and specifies the autonomous system number of 100.

  The second command is redistribute ospf 1 match internal external, which redistributes the routes from OSPF process into BGP, and matches both internal and external OSPF routes. This way, the engineer can avoid introducing extra routes

  that are not part of OSPF process 1, such as the default route or the connected routes.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0, [ENCC: Configuring IPsec VPN from Cisco IOS XE to AWS], [Deploying Cisco IOS VTI-Based Point-to-Point IPsec VPNs]

• Question 33:

  Refer to the exhibit.

  

  While troubleshooting an IPsec connection between a Cisco WAN edge router and an Amazon Web Services (AWS) endpoint, a network engineer observes that the security association status is active, but no traffic flows between the devices What is the problem?

  A. wrong ISAKMP policy

  B. identity mismatch

  C. wrong encryption

  D. IKE version mismatch

  Correct Answer: B

  An identity mismatch occurs when the local and remote identities configured on the IPsec peers do not match. This can prevent the establishment of an IPsec tunnel or cause traffic to be dropped by the IPsec policy. In this case, the network

  engineer should verify that the local and remote identities configured on the Cisco WAN edge router and the AWS endpoint match the values expected by each peer. The identities can be an IP address, a fully qualified domain name (FQDN),

  or a distinguished name (DN). The identities are exchanged during the IKE phase 1 negotiation and are used to authenticate the peers. If the identities do not match, the peers will reject the IKE proposal and the IPsec tunnel will not be

  established or will be torn down.

  References: Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services, Topic:Troubleshooting

  Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3:

  Implementing Cloud Connectivity, Lesson 2: Implementing Cisco SD-WAN Cloud OnRamp for IaaS, Topic: Troubleshooting Cisco SD-WAN Cloud OnRamp for IaaS Cisco IOS Security Configuration Guide, Release 15MandT, Chapter:

  Configuring IPsec Network Security, Topic: Configuring IPsec Identity and Peer Addressing

• Question 34:

  An engineer must configure an IPsec tunnel to the cloud VPN gateway. Which Two actions send traffic into the tunnel? (Choose two.)

  A. Configure access lists that match the interesting user traffic.

  B. Configure a static route.

  C. Configure a local policy in Cisco vManage.

  D. Configure an IPsec profile and match the remote peer IP address.

  E. Configure policy-based routing.

  Correct Answer: AE

  To send traffic into an IPsec tunnel to the cloud VPN gateway, the engineer must configure two actions:

  Configure access lists that match the interesting user traffic. This is the traffic that needs to be encrypted and sent over the IPsec tunnel. The access lists are applied to the crypto map that defines the IPsec parameters for the tunnel.

  Configure policy-based routing (PBR). This is a technique that allows the engineer to override the routing table and forward packets based on a defined policy. PBR can be used to send specific traffic to the IPsec tunnel interface, regardless

  of the destination IP address. This is useful when the cloud VPN gateway has a dynamic IP address or when multiple cloud VPN gateways are available for load balancing or redundancy.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3:

  Implementing Cloud Connectivity, Lesson 3: Implementing IPsec VPNs to the Cloud, Topic: Configuring IPsec VPNs on Cisco IOS XE Routers Security for VPNs with IPsec Configuration Guide, Cisco IOS XE, Chapter:

  Configuring IPsec VPNs, Topic: Configuring Crypto Maps [Cisco IOS XE Gibraltar 16.12.x Feature Guide], Chapter: Policy-Based Routing, Topic: Policy-Based Routing Overview

• Question 35:

  Refer to the exhibits.

  

  An engineer must redistribute OSPF internal routes into BGP to connect an on-premises network to a cloud provider. Which two commands should the engineer run on router R2? (Choose two.)

  A. router bgp 100

  B. redistribute bgp 100

  C. router ospf 1

  D. redistribute ospf 1

  E. redistribute ospf 100

  Correct Answer: AD

• Question 36:

  Refer to the exhibits.

  

  An engineer must redistribute only the 10.0.10.0/24 network into BGP to connect an on-premises network to a public cloud provider. These routes are currently redistributed:

  

  Which command is missing on router R2?

  A. neighbor 10.0.10.2 remote-as 100

  B. redistribute ospf 1 match internal

  C. redistribute ospf 1 match external

  D. neighbor 10.0.10.0/24 remote-as 100

  Correct Answer: C

  The command redistribute ospf 1 match external is missing on router R2. This command is needed to redistribute only the external OSPF routes into BGP. The external OSPF routes are those that are learned from another routing protocol or

  redistributed into OSPF. In this case, the 10.0.10.0/24 network is an external OSPF route, as it is redistributed from EIGRP into OSPF on router R1. The other commands are either already present or not relevant for this scenario.

  References:

  Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3:

  Implementing Cloud Connectivity, Lesson 3.1: Implementing IPsec VPN from Cisco IOS XE to AWS, Topic 3.1.2: Configure BGP on the Cisco IOS XE Router Security for VPNs with IPsec Configuration Guide, Cisco IOS XE, Chapter:

  Configuring IPsec VPNs with Dynamic Routing Protocols, Section: Configuring BGP over IPsec VPNs

• Question 37:

  Refer to the exhibit.

  

  An engineer troubleshoots a Cisco SD-WAN connectivity issue between an on-premises data center WAN Edge and a public cloud provider WAN Edge. The engineer discovers that BFD is Dapping on vEdge1. What is the problem?

  A. The remote Edge device BFD is down.

  B. The remote Edgedevice failed to respond BFD keepalives.

  C. The remote Edge device has a duplicate IP address.

  D. The control plane deleted the BFD session.

  Correct Answer: B

• Question 38:

  DRAG DROP

  An engineer must use Cisco vManage to configure an SLA class to specify the maximum packet loss, packet latency, and jitter allowed on a connection. Drag and drop the steps from the left onto the order on the right to complete the configuration.

  Select and Place:

  

  Correct Answer:

  

  The process of configuring an SLA class to specify the maximum packet loss, packet latency, and jitter allowed on a connection using Cisco vManage involves several steps. Click Configuration, select Policies, and then select Add Policy:

  This is the first step where you navigate to the Policies section in the Configuration menu of Cisco vManage.

  Click SLA Class and then click New SLA Class List: In this step, you create a new SLA Class List.

  Select Criteria, select Loss, Latency and Jitter, and then click Add: After setting up the SLA Class List, you select the criteria for the SLA class. In this case, the criteria are Loss, Latency, and Jitter.

  Set values for Loss, Latency, Jitter, and App Probe Class: Finally, you set the values for Loss, Latency, Jitter, and App Probe Class.

  References:

  Information About Application-Aware Routing - Cisco Policies Configuration Guide for vEdge Routers, Cisco SD-WAN Release