View Full Cisco CCNP Enterprise 300-440 Exam Dumps  and Practice Test Dumps

 

Question 221. An enterprise uses BGP to exchange routes between an on-premises network and a cloud environment. The engineer wants to influence which cloud connection is preferred for outbound traffic from the enterprise. Which BGP attribute is commonly used for this purpose?

1. MED
2. Local preference
3. Origin code
4. BGP router ID

Correct Answer: 2. Local preference

Explanation :-

Local preference is commonly used within an autonomous system to influence the preferred outbound path. A higher local-preference value is preferred over a lower value when the applicable BGP best-path process reaches that attribute. This makes local preference useful when an enterprise has multiple cloud connections and wants internal routers to prefer one exit over another. MED can influence path selection in appropriate inter-AS scenarios, while the origin code and router ID serve different roles in BGP path selection. The engineer should apply local preference consistently and verify the resulting best path across the relevant enterprise routing domain.

Question 222. A cloud provider requires the enterprise to advertise only selected corporate prefixes. The enterprise currently redistributes several internal routes into BGP. Which control should be applied before routes are advertised to the provider?

1. Increase the BGP keepalive timer
2. Change the OSPF cost
3. Disable redistribution completely
4. Apply an outbound route filter or routing policy

Correct Answer: 4. Apply an outbound route filter or routing policy

Explanation :-

An outbound route filter or routing policy can control which routes are advertised to a cloud provider. This is particularly important when redistribution introduces multiple internal prefixes into BGP but only a defined subset should be reachable from the cloud. Prefix lists, route maps, and related policy mechanisms can explicitly permit the required networks and deny unintended advertisements. Disabling redistribution entirely may remove legitimate routes, while BGP timers and OSPF cost do not directly control the prefixes sent to the provider. The resulting BGP advertisements should be verified after the policy is applied.

Question 223. An organization has two cloud connectivity paths and wants the enterprise routers to use both paths simultaneously when their routing characteristics are equivalent. Which routing capability can support this design?

1. Equal-cost multipath routing
2. DNS round-robin only
3. BGP session shutdown
4. OSPF passive-interface mode

Correct Answer: 1. Equal-cost multipath routing

Explanation :-

Equal-cost multipath, or ECMP, allows multiple paths with equivalent routing characteristics to participate in forwarding. When supported and appropriately configured, ECMP can distribute traffic across multiple available paths instead of keeping one path solely as a standby. This can improve utilization while also providing resilience if one path becomes unavailable. DNS round-robin does not provide routing-level path selection, and disabling BGP or making an interface passive would not create active forwarding redundancy. Engineers should verify that the routing protocols and forwarding platform support the desired ECMP behavior.

Question 224. A cloud connection uses BGP, but a required prefix is present in the BGP table and not installed in the routing table because another route to the same destination is preferred. Which factor should be examined first?

1. DNS response time
2. IPsec encryption strength
3. Administrative distance and route preference
4. Ethernet frame padding

Correct Answer: 3. Administrative distance and route preference

Explanation :-

When routes to the same destination are learned from different routing sources, administrative distance is used to determine which routing source is preferred. For example, a locally learned route from another protocol can prevent a BGP route from being installed even though the BGP route is valid. After identifying the competing route, the engineer should compare the relevant administrative distances and then investigate protocol-specific selection criteria if necessary. DNS, IPsec encryption strength, and Ethernet frame padding do not determine which routing protocol’s route is installed in the routing table.

Question 225. An enterprise wants to reduce the number of individual cloud prefixes carried across its WAN while maintaining reachability to a contiguous address block. Which routing technique can help?

1. Route summarization
2. Increasing IPsec replay windows
3. Disabling BGP
4. Changing DNS TTL values

Correct Answer: 1. Route summarization

Explanation :-

Route summarization combines multiple contiguous or appropriately structured prefixes into a larger aggregate prefix. This can reduce routing-table size, simplify route advertisements, and decrease the amount of routing information exchanged between network domains. Summarization must be designed carefully because an overly broad summary can create reachability problems or cause traffic to be directed toward an incorrect destination. IPsec replay settings and DNS TTL values do not reduce routing information. In cloud connectivity designs, summarization can be especially useful when many application subnets share a common address block.

Question 226. A cloud application must remain reachable if one of two Internet-based IPsec tunnels fails. Which feature is most important for detecting the failed path and moving traffic to the surviving path?

1. DNS caching
2. Static interface descriptions
3. Increasing the tunnel encryption key size
4. Reliable tunnel or path failure detection with failover routing

Correct Answer: 4. Reliable tunnel or path failure detection with failover routing

Explanation :-

Automatic failover requires the network to recognize that the preferred path is no longer usable and then select an alternate path. Depending on the architecture, tunnel monitoring, IP SLA, routing-protocol convergence, BFD, or SD-WAN performance detection can provide the required failure detection. Simply having two configured tunnels does not guarantee that traffic will automatically move between them. Encryption key size affects cryptographic security rather than path availability detection. The engineer should verify both failure detection and the routing mechanism responsible for withdrawing or replacing the failed path.

Question 227. An enterprise is evaluating cloud connectivity services. One application requires low latency and predictable performance, while another can tolerate variable Internet performance. What should the design team do?

1. Use the same connectivity model without considering application requirements
2. Match connectivity characteristics to each application’s requirements
3. Select the highest bandwidth option for every application
4. Require dedicated connectivity for all traffic regardless of need

Correct Answer: 2. Match connectivity characteristics to each application’s requirements

Explanation :-

Cloud connectivity should be selected according to application requirements rather than bandwidth alone. A latency-sensitive or business-critical application may justify a connectivity service with predictable performance, redundancy, and stronger service-level commitments. Less sensitive workloads may be adequately supported through Internet-based connectivity or other shared services. A requirements-driven approach can balance performance, resiliency, security, and cost. Selecting the same connectivity model for every workload may either over-engineer lower-priority applications or fail to provide adequate service for applications with demanding performance requirements.

Question 228. A company wants to prevent cloud workload traffic from one security segment from reaching another segment unless explicitly permitted. Which mechanism should enforce the communication policy?

1. BGP keepalive timers
2. OSPF router IDs
3. Security policy or firewall controls between the segments
4. Increasing WAN MTU

Correct Answer: 3. Security policy or firewall controls between the segments

Explanation :-

Segmentation establishes separate traffic domains, but security policy determines which communication is actually permitted between those domains. Firewalls, security groups, distributed firewalls, or other policy-enforcement mechanisms can explicitly allow required flows while blocking unauthorized lateral communication. BGP keepalive timers and OSPF router IDs are routing-control parameters and do not provide application-level access control. Increasing MTU affects packet transmission characteristics rather than authorization. A complete cloud security architecture should consider both routing reachability and security enforcement.

Question 229. An engineer observes that an IPsec tunnel is established, but no application traffic is being encrypted. The tunnel’s security associations are present. Which configuration should be checked for a policy-based VPN?

1. OSPF area type
2. BGP local preference
3. DNS resolver address
4. Interesting-traffic or crypto ACL definitions

Correct Answer: 4. Interesting-traffic or crypto ACL definitions

Explanation :-

In a policy-based IPsec VPN, crypto ACLs or equivalent traffic selectors determine which packets are considered interesting traffic and should be protected. A tunnel can have established security associations while application packets fail to match the configured selectors. The engineer should compare the local and remote protected networks and verify that the relevant traffic matches the encryption policy. OSPF area types, BGP local preference, and DNS configuration do not determine which packets are selected for a policy-based IPsec tunnel. Selector mismatches are a common cause of an apparently established but nonfunctional VPN.

Question 230. A company uses SD-WAN and wants business-critical traffic to prefer MPLS when it meets required performance thresholds, but use broadband when MPLS violates those thresholds. Which capability supports this requirement?

1. Application-aware routing based on SLA measurements
2. Static DNS records
3. OSPF route redistribution only
4. Increasing BGP AS-path length

Correct Answer: 1. Application-aware routing based on SLA measurements

Explanation :-

SD-WAN can use measured characteristics such as latency, loss, and jitter to determine whether a transport satisfies an application’s defined performance requirements. An application-aware policy can prefer one transport under normal conditions and move traffic to another when the preferred path fails its SLA criteria. This provides more responsive path selection than static routing alone. DNS records do not evaluate network performance, and BGP AS-path manipulation does not directly measure application-level transport quality. The SLA thresholds should be selected according to the actual application’s performance requirements.

Question 231. An enterprise has an Internet-based cloud VPN and wants to verify whether packets are being successfully encrypted and decrypted. Which information is most useful?

1. OSPF database entries
2. IPsec packet and security-association counters
3. DNS cache entries
4. BGP community values only

Correct Answer: 3. IPsec packet and security-association counters

Explanation :-

IPsec counters provide useful evidence about whether packets are being processed by the VPN. Encryption and decryption counters can help determine whether traffic is entering the IPsec policy, being encrypted, and successfully processed on the receiving side. Security-association information can also show whether the expected cryptographic relationships are established. OSPF databases and DNS cache entries do not directly verify IPsec packet processing. BGP communities may influence routing policy but do not confirm whether application packets are being encrypted or decrypted.

Question 232. A cloud provider advertises a default route and several specific private prefixes. The enterprise should accept the private prefixes but reject the default route. Which policy is required?

1. An outbound policy denying all cloud advertisements
2. An OSPF passive-interface configuration
3. An inbound BGP policy selectively permitting the required prefixes
4. An IPsec policy that disables encryption

Correct Answer: 2. An OSPF passive-interface configuration

Explanation :-

An inbound BGP routing policy is required to selectively control which prefixes are accepted from the cloud provider. The policy can permit the required private prefixes while denying the unwanted default route. This allows the enterprise to maintain its intended Internet exit while still receiving cloud-specific routes. OSPF passive-interface configuration does not filter BGP advertisements, and an IPsec policy does not determine which BGP routes enter the routing table. The policy should be tested carefully to ensure that only the intended prefixes are accepted.

Question 233. A cloud-connected router learns a route through eBGP and another route through OSPF. Both routes point to the same destination, and default administrative distances are in use. Which route is normally preferred?

1. OSPF, because it is an interior gateway protocol
2. Both routes are automatically installed
3. eBGP, because its default administrative distance is lower
4. OSPF, because its metric is always evaluated first

Correct Answer: 4. eBGP, because its default administrative distance is lower

Explanation :-

By default on Cisco IOS XE, external BGP has an administrative distance of 20, while OSPF has an administrative distance of 110. When the same destination is learned through these different routing protocols, the eBGP route is normally preferred because its administrative distance is lower. Administrative distance is used to compare routes from different routing sources. Once a routing protocol is selected, its own best-path mechanism determines the preferred route among paths learned through that protocol. Engineers should always verify whether the configuration has modified default administrative distances.

Question 234. A cloud provider requires the enterprise to use BGP but does not want the enterprise to advertise routes learned from another external provider. Which BGP control is appropriate?

1. Inbound DNS filtering
2. Outbound route filtering or policy based on permitted prefixes
3. Increasing the IPsec MTU
4. Disabling BGP route advertisements entirely

Correct Answer: 2. Outbound route filtering or policy based on permitted prefixes

Explanation :-

Outbound BGP policy can prevent routes learned from one source from being advertised to another external neighbor. This is important when connecting multiple routing domains because uncontrolled redistribution can create unintended transit behavior or expose prefixes that the cloud provider should not receive. Prefix lists, route maps, communities, and other policy mechanisms can help identify and control the permitted advertisements. Disabling all BGP advertisements would also prevent required routes from being exchanged. The policy should explicitly define the intended route set rather than relying on implicit behavior.

Question 235. A network team wants cloud connectivity to continue during a single WAN circuit failure while minimizing manual intervention. Which design characteristic is most important?

1. Automatic route or path convergence
2. Manual static-route replacement
3. Single-path forwarding
4. DNS-based failover alone

Correct Answer: 3. Automatic route or path convergence

Explanation :-

Automatic convergence allows the network to detect a failed path and transition traffic toward an available alternative without requiring an administrator to manually modify routing. Depending on the architecture, BGP, OSPF, SD-WAN path monitoring, BFD, IP SLA, or other mechanisms can contribute to failure detection and convergence. A single forwarding path cannot provide transport redundancy, while manual static-route replacement introduces operational delay. DNS-based failover alone may not address existing network sessions or internal routing. The convergence design should be tested under realistic circuit and device failure scenarios.

Question 236. An organization uses a cloud transit network to connect several virtual networks. A security requirement states that only specific application flows may cross between two virtual networks. What should be evaluated in addition to route reachability?

1. Only the BGP hold timer
2. Security-policy enforcement along the traffic path
3. Only the interface MTU
4. DNS recursion settings

Correct Answer: 1. Security-policy enforcement along the traffic path

Explanation :-

Routing determines whether traffic has a path to a destination, but security policy determines whether that traffic is permitted. In a cloud transit architecture, engineers must evaluate firewalls, security groups, network ACLs, distributed security controls, or other enforcement points in addition to routing. A route between two virtual networks does not automatically mean that every application flow should be allowed. BGP timers and MTU values address different technical concerns, while DNS recursion is unrelated to application-flow authorization. The design should therefore validate both reachability and policy enforcement.

Question 237. A cloud VPN uses TCP applications, and packet captures show fragmentation caused by encryption overhead. Which technique can reduce the likelihood of oversized TCP packets?

1. Increasing BGP local preference
2. Changing the OSPF router ID
3. Adjusting the TCP maximum segment size where appropriate
4. Increasing DNS cache duration

Correct Answer: 4. Adjusting the TCP maximum segment size where appropriate

Explanation :-

TCP MSS adjustment can limit the size of TCP segments so that, after encapsulation, packets are less likely to exceed the effective path MTU. IPsec adds headers and other overhead, reducing the amount of payload that can fit within the underlying transport MTU. Proper MSS handling can therefore help prevent fragmentation and packet loss for TCP applications. MSS adjustment does not change the actual interface MTU, and it does not address non-TCP traffic. Engineers should first understand the actual path MTU and tunnel overhead before selecting an appropriate MSS value.

Question 238. A cloud provider offers shared connectivity with variable performance and dedicated connectivity with committed capacity and stronger service characteristics. Which factor should primarily determine the selection?

1. The number of DNS records
2. The router’s hostname
3. Application and business connectivity requirements
4. The length of the BGP router ID

Correct Answer: 3. Application and business connectivity requirements

Explanation :-

Connectivity selection should be based on measurable application and business requirements. Factors can include required bandwidth, latency, availability, resiliency, security, compliance, and service-level expectations. Dedicated connectivity may provide characteristics that are important for demanding workloads, while shared connectivity may be sufficient for applications with more flexible requirements. Selecting solely on technical preference or an arbitrary network parameter can result in an inappropriate architecture. A requirements-driven evaluation also helps determine whether redundancy, multiple providers, or additional security controls are necessary.

Question 239. An enterprise needs to verify that a cloud BGP peer is reachable and that the BGP session is established before troubleshooting missing routes. Which information should be checked first?

1. BGP neighbor session state and summary information
2. DNS MX records
3. OSPF LSDB entries only
4. IPsec payload encryption counters only

Correct Answer: 1. BGP neighbor session state and summary information

Explanation :-

BGP neighbor summary and session-state information provides an initial indication of whether the BGP relationship is established and exchanging routes. If the session is not established, route troubleshooting should first focus on peer reachability, TCP connectivity, authentication, autonomous-system configuration, timers, and related BGP parameters. Once the session is established, the engineer can investigate received routes, advertised routes, route policies, next-hop reachability, and best-path selection. DNS MX records and OSPF LSDB information do not directly establish whether the BGP peer relationship is functioning.

Question 240. A company is designing an active-active cloud connectivity solution. Both connections will carry production traffic, and the failure of either connection must not overload the remaining connection beyond its supported capacity. What should be included in the design?

1. A single shared tunnel with no backup
2. Capacity planning for failure scenarios
3. Removal of all routing policies
4. A requirement that one connection remain unused

Correct Answer: 2. Capacity planning for failure scenarios

Explanation :-

Active-active connectivity requires capacity planning for both normal and failure conditions. If both links carry production traffic and one fails, the remaining link must have sufficient capacity to support the traffic that is expected to move onto it. Engineers should evaluate bandwidth, application demand, failover behavior, routing convergence, and performance requirements during degraded operation. Simply configuring two active connections does not guarantee that the design can sustain a single-link failure. Capacity planning should therefore include normal utilization as well as the expected traffic load after one connectivity path becomes unavailable.