Free 300-440 sample questions

Correct answers: Application-Aware Routing Policy; Centralized Data Policy

The Application-Aware Routing (AAR) policy is used to identify Microsoft Teams traffic and steer it onto the path that meets the defined SLA (e.g., lowest latency), enabling the direct internet access.

A Centralized Data Policy is required to create the traffic engineering logic. It will match the non-Teams Microsoft 365 traffic and direct it towards the service VPN that leads to the regional data center, while allowing the Teams traffic (handled by the AAR policy) to exit locally.

Correct answer: Utilizing a Software-Defined Cloud Interconnect (SDCI) provider with a private backbone.

An SDCI provider (like Megaport or Equinix Fabric) offers a private, high-speed backbone that connects to major cloud providers globally. This model allows the enterprise to connect its data centers to the SDCI fabric once and then programmatically spin up virtual cross-connects to various cloud regions and providers. This meets the requirements for private connectivity, low latency, and scalability without the complexity and cost of managing numerous individual private circuits.

Correct answer: False

This statement is false. Cisco SD-WAN Cloud OnRamp for SaaS does not use BGP for path selection. Instead, it continuously probes the SaaS application over all available paths using HTTP probes. It then calculates a quality of experience (QoE) score based on latency and loss, and steers user traffic down the best-performing path in real-time. BGP is used for underlay or overlay routing, not for the dynamic, application-level path selection specific to this feature.

Correct answer: ``` interface Tunnel0 ip address 169.254.1.1 255.255.255.252 tunnel source GigabitEthernet0/0 tunnel destination 35.x.x.x tunnel mode ipsec ipv4 tunnel protection ipsec profile MYPROFILE ```

This configuration correctly sets up a Virtual Tunnel Interface (VTI). A VTI creates a routable interface, which is essential for running dynamic routing protocols like BGP over the IPsec tunnel. The `tunnel mode ipsec ipv4` and `tunnel protection ipsec profile MYPROFILE` commands bind the IPsec policy to the tunnel interface. The crypto map configuration is used for policy-based VPNs, which do not support dynamic routing protocols effectively.

Correct answer: The TLOC for the MPLS transport is no longer listed in the device's control connections.

In Cisco SD-WAN, each transport on a vEdge is represented by a TLOC (Transport Locator). When a transport goes down, the vEdge loses its BFD sessions over that path, and the OMP route associated with that TLOC is withdrawn. In the vManage dashboard, specifically under the device's control connections monitoring, the entry for the TLOC associated with the failed MPLS transport will disappear or show as down. The vEdge icon itself will likely remain green as long as it has connectivity through its other transport.

Correct answer: AWS Direct Connect with a private VIF and MACsec encryption for Layer 2 security.

FEDRAMP High requires stringent security controls. AWS Direct Connect provides a private, dedicated connection that bypasses the public internet. Adding MACsec provides point-to-point security at Layer 2, encrypting all data between the on-premises router and the AWS Direct Connect device. This combination of a private circuit and strong, line-rate encryption is the most suitable approach for meeting the high-security posture demanded by FEDRAMP High compliance.

Correct answer: Contract with a Software-Defined Cloud Interconnect (SDCI) provider. Establish redundant 10 Gbps connections from the on-premises data center to the SDCI provider's network. Then, provision virtual circuits to AWS and Azure through the SDCI portal.

This is the optimal solution. It meets all requirements: high availability (redundant connections to SDCI), consistent low latency (private backbone), sufficient bandwidth (10 Gbps circuits), and simplified management. The SDCI provider abstracts the complexity of connecting to multiple clouds, allowing the IT team to manage connectivity and routing through a single portal. It also provides a clear path for routing between AWS and Azure over the private SDCI backbone, fulfilling the dynamic routing requirement efficiently.

Correct answer: To authenticate new vEdge routers joining the fabric and inform them of vManage and vSmart controller IP addresses.

The vBond Orchestrator is the initial point of contact for any device joining the SD-WAN fabric. Its primary roles are to authenticate the vEdge router (ensuring it's on a whitelist), authorize it to join the fabric, and provide the IP addresses of the vManage and vSmart controllers. It effectively bootstraps the device into the control plane. Policy distribution is handled by vSmart, and the GUI is provided by vManage.

Correct answers: Using a BGP route-map to apply a higher local preference to routes learned over the primary tunnel.; Setting up two separate Virtual Tunnel Interfaces (VTIs), one for each AWS tunnel endpoint.

BGP uses attributes like local preference to determine the best path. By setting a higher local preference on routes received from the primary tunnel's BGP neighbor, the router will prefer that path. When the primary tunnel fails, its BGP session goes down, those routes are withdrawn, and BGP automatically selects the routes from the secondary tunnel.

AWS provides two tunnel endpoints for redundancy. To connect to both, two distinct VTIs must be configured on the IOS XE router. Each VTI will have its own source/destination and establish a separate BGP peering session, forming the foundation for the redundant setup.

Correct answer: It offers greater flexibility for establishing low-latency, multi-cloud connectivity.

A key advantage of a colocation facility is its carrier-neutral ecosystem. These facilities typically host on-ramps for multiple cloud providers (AWS, Azure, GCP, etc.). An enterprise can establish a presence in the colo and then use simple, low-cost cross-connects to reach multiple clouds. An MPLS circuit is typically a point-to-point service to a single destination, making multi-cloud integration more complex and less flexible.