View Full Cisco CCNP Enterprise 300-440 Exam Dumps  and Practice Test Dumps

 

Question 381. A network engineer is integrating an enterprise branch with a cloud provider using BGP. 

1. MED
2. Local preference
3. Origin code
4. AS-path length

Correct Answer: 2. Local preference

Explanation :-

Local preference is used within a BGP autonomous system to influence which exit path routers should prefer for outbound traffic. A higher local-preference value is preferred and is propagated to other iBGP peers within the same AS. This makes it appropriate when an enterprise has multiple cloud connectivity paths and wants consistent outbound path selection across its internal routers. MED serves a different purpose and is generally used to influence how a neighboring AS selects among multiple entry points. AS-path length and origin code are also BGP path-selection attributes, but they are not the primary mechanism for setting an organization’s preferred outbound exit path.

Question 382. A company connects its data center to a cloud provider through two Internet circuits. During testing, both IPsec tunnels remain established, but applications intermittently fail when sending large packets. Small ping packets work normally. Which issue should the engineer investigate first?

1. BGP router ID duplication
2. Incorrect local preference
3. Missing NTP synchronization
4. MTU or TCP MSS problems

Correct Answer: 4. MTU or TCP MSS problems

Explanation :-

IPsec encapsulation adds overhead to packets, reducing the effective payload size that can traverse the tunnel without fragmentation. When MTU handling is incorrect, small packets can succeed while larger application packets fail or experience retransmissions. TCP MSS adjustment can help ensure that TCP segments remain small enough to account for tunnel overhead. This symptom is therefore strongly associated with MTU or MSS problems. BGP router ID duplication, local preference, and NTP synchronization can affect routing or control-plane behavior, but they do not directly explain a pattern in which small packets succeed while larger packets fail across an established IPsec tunnel.

Question 383. An enterprise uses a Cisco IOS XE router to connect to a cloud network. The cloud routes are learned through BGP, while internal routes are learned through OSPF. The engineer needs the cloud prefixes to be available to internal OSPF routers. Which configuration concept is required?

1. Route redistribution between BGP and OSPF
2. Increasing the OSPF hello interval
3. Changing the BGP router ID
4. Disabling OSPF authentication

Correct Answer: 1. Route redistribution between BGP and OSPF

Explanation :-

When routes are learned by one routing protocol and need to be advertised through another routing protocol, route redistribution is required. In this scenario, BGP learns the cloud prefixes, while OSPF provides internal routing information. Redistributing appropriate BGP routes into OSPF allows internal OSPF routers to learn those cloud destinations. The redistribution policy should be carefully controlled with route maps, prefix lists, tags, or other filtering mechanisms to prevent unwanted route exchange or routing loops. Changing hello timers, router IDs, or authentication settings does not by itself transfer BGP-learned routes into the OSPF domain.

Question 384. A cloud-connected branch receives several BGP routes for the same destination. The engineer wants to prevent a specific cloud prefix from being installed because it is not permitted by the enterprise routing policy. Which mechanism is most appropriate for filtering routes received from the BGP neighbor?

1. BGP advertisement toward the neighbor
2. OSPF distribute-list on another router
3. An inbound BGP route policy or prefix list
4. Changing the IPsec encryption algorithm

Correct Answer: 3. An inbound BGP route policy or prefix list

Explanation :-

An inbound BGP policy controls routes received from a BGP neighbor before they are accepted into the local BGP routing process. Prefix lists, route maps, or route-policy mechanisms can identify permitted or denied prefixes and apply additional attributes where required. This is appropriate when an enterprise needs to reject a particular cloud prefix based on its routing policy. An outbound advertisement policy controls what the local router sends to the neighbor instead, so it does not directly solve the problem of filtering received routes. IPsec encryption settings and OSPF filtering are unrelated to the requested BGP inbound control.

Question 385. A company requires cloud connectivity to remain available if the primary WAN circuit fails. The secondary circuit uses a different provider and terminates on another enterprise router. Which design characteristic most directly provides this resilience?

1. A single IPsec tunnel over the primary circuit
2. A single default route with no tracking
3. A larger BGP AS number
4. Diverse physical connectivity with redundant paths

Correct Answer: 4. Diverse physical connectivity with redundant paths

Explanation :-

Resilient cloud connectivity requires more than simply configuring multiple logical tunnels over the same underlying failure domain. Using diverse physical circuits, preferably through different providers or paths, reduces the chance that one physical or provider failure will interrupt all connectivity. Redundant routers and appropriately designed routing or tunnel failover mechanisms can then select the surviving path. A single tunnel or untracked default route does not provide equivalent resilience. The BGP AS number has no direct relationship to physical path diversity. Therefore, diverse physical connectivity combined with redundant routing paths is the key design characteristic for maintaining cloud reachability after a primary WAN failure.

Question 386. An enterprise has multiple cloud connectivity links and wants internal routers to consistently select the same preferred exit toward the cloud. The engineer configures a higher local-preference value on routes learned through the preferred link. What behavior should result?

1. Internal BGP routers prefer the path with the higher local preference
2. The cloud provider automatically changes its MED values
3. OSPF routers ignore all BGP routes
4. IPsec tunnels automatically change encryption algorithms

Correct Answer: 1. Internal BGP routers prefer the path with the higher local preference

Explanation :-

Local preference is a BGP attribute used within an autonomous system to influence outbound route selection. When multiple paths to the same destination are available, the path with the higher local-preference value is preferred, assuming the relevant earlier path-selection criteria do not override the comparison. This allows an organization to establish a consistent preferred cloud exit across its internal BGP infrastructure. The attribute does not directly modify the cloud provider’s MED values, alter OSPF behavior, or change IPsec encryption. Local preference is therefore particularly useful when the enterprise controls multiple exits and wants internal routers to favor one cloud connectivity path.

Question 387. A cloud application is hosted outside the enterprise network, while users inside the enterprise access the application through a cloud-connected router. The traffic travels from the enterprise toward the cloud and ultimately to the external application. How should this traffic direction generally be classified?

1. East-west traffic
2. Management-plane traffic
3. North-south traffic
4. Control-plane traffic

Correct Answer: 3. North-south traffic

Explanation :-

North-south traffic generally refers to traffic entering or leaving an environment, such as communication between an enterprise network and an external cloud, Internet, or service-provider network. In this scenario, users inside the enterprise are accessing an application hosted outside the enterprise environment, so the traffic crosses the network boundary and is considered north-south. East-west traffic instead describes communication between workloads, segments, or services within the broader environment. Management-plane and control-plane classifications describe different types of network functions and do not describe the directional relationship between internal users and an externally hosted cloud application.

Question 388. A network engineer is troubleshooting an IPsec cloud connection. The tunnel status indicates that the security associations are established, but the IPsec packet counters do not increase when application traffic is generated. What should the engineer investigate next?

1. The BGP origin code only
2. Traffic selectors, crypto ACLs, and forwarding paths
3. The OSPF process ID
4. The router’s console speed

Correct Answer: 2. Traffic selectors, crypto ACLs, and forwarding paths

Explanation :-

An established IPsec security association confirms that the control-plane negotiation has succeeded, but it does not guarantee that user traffic is actually matching the protected traffic definitions. If packet counters remain unchanged, the engineer should verify that the source and destination traffic matches the configured traffic selectors or crypto ACLs and that routing sends the packets toward the tunnel. Incorrect selectors, missing routes, or an unexpected forwarding path can prevent traffic from entering IPsec processing. BGP origin codes and OSPF process IDs do not directly explain the lack of IPsec packet-counter activity, and console speed has no relationship to data-plane forwarding.

Question 389. An organization wants cloud traffic to use a centralized security stack rather than allowing every branch to send traffic directly to the Internet. Which design approach aligns with this requirement?

1. Internet backhaul through a centralized security location
2. Removing all default routes
3. Using only OSPF stub areas
4. Disabling security inspection for cloud-bound traffic

Correct Answer: 1. Internet backhaul through a centralized security location

Explanation :-

Internet backhaul routes branch Internet-bound traffic through a centralized location where security controls such as firewalls, intrusion prevention, URL filtering, or other inspection services can be applied. This design is useful when an organization requires centralized policy enforcement rather than independent local Internet breakout at every branch. It may introduce additional latency and bandwidth requirements, so the architecture should consider capacity and application performance. Removing default routes would prevent normal Internet reachability, while OSPF stub areas do not provide centralized security enforcement. Disabling inspection would have the opposite effect of the stated requirement.

Question 390. A cloud provider advertises a set of prefixes to an enterprise router. The engineer wants to confirm exactly which routes were received from the BGP neighbor before applying any outbound advertisement changes. Which information is most directly relevant?

1. The router’s IPsec encryption transform
2. The local OSPF neighbor state
3. The interface duplex setting
4. The BGP routes received from the neighbor

Correct Answer: 4. The BGP routes received from the neighbor

Explanation :-

When troubleshooting which cloud prefixes have been learned from a BGP neighbor, the most direct information is the set of routes received from that neighbor. This allows the engineer to determine whether the cloud is advertising the expected prefixes and whether inbound filtering or other policy has affected route acceptance. Outbound advertisements represent what the enterprise sends to the cloud provider and answer a different troubleshooting question. IPsec transforms, OSPF adjacency information, and interface duplex settings may be relevant to other problems, but they do not directly identify the BGP prefixes received from the cloud neighbor.

Question 391. An enterprise has two cloud paths. One path has significantly higher bandwidth but is more expensive, while the second path has lower bandwidth and lower cost. The organization wants applications with strict performance requirements to use the high-bandwidth path. Which design consideration should be evaluated first?

1. Application requirements and traffic characteristics
2. The number of characters in the router hostname
3. The OSPF process ID
4. The BGP router ID format

Correct Answer: 1. Application requirements and traffic characteristics

Explanation :-

Cloud connectivity design should begin with understanding application requirements and traffic characteristics. Bandwidth requirements, latency sensitivity, burst behavior, availability objectives, and application criticality help determine whether a high-capacity path is necessary for particular workloads. A more expensive circuit may be justified for applications that require predictable performance, but that decision should be tied to measurable requirements rather than bandwidth alone. Router hostname length, OSPF process ID, and BGP router ID format do not determine application connectivity requirements. Once application characteristics are understood, routing and QoS policies can be designed to steer appropriate traffic over the available cloud paths.

Question 392. A cloud-connected router has an eBGP session established with the provider. The provider’s prefix is also learned through OSPF after route redistribution. Assuming default administrative distances and otherwise comparable routes, which route source normally has the lower administrative distance?

1. OSPF
2. External BGP
3. Static routing learned dynamically
4. Both have identical administrative distance

Correct Answer: 2. External BGP

Explanation :-

By default, external BGP has an administrative distance of 20, while OSPF has an administrative distance of 110. Therefore, when the same destination is available through both eBGP and OSPF and no other route-selection mechanism changes the result, the eBGP route normally has the lower administrative distance and is preferred for installation in the routing table. This distinction is important when troubleshooting cloud connectivity involving redistribution because engineers may incorrectly assume that OSPF automatically takes precedence due to its internal routing role. Administrative distance is considered after a route has been selected by a routing protocol and is used to choose among routes from different sources.

Question 393. A Cisco Catalyst SD-WAN deployment needs to identify SaaS applications and select appropriate paths based on application performance. Which capability is most relevant to this requirement?

1. OnRamp for SaaS
2. Static ARP inspection
3. OSPF passive-interface mode
4. DHCP relay

Correct Answer: 1. OnRamp for SaaS

Explanation :-

Cisco Catalyst SD-WAN OnRamp for SaaS is designed to optimize connectivity to SaaS applications by providing application-aware path selection and visibility into available transport paths. It can use performance measurements and policy to select an appropriate path for supported applications rather than relying only on destination-prefix routing. This is particularly useful when multiple WAN transports are available and application performance varies between them. Static ARP inspection, OSPF passive-interface mode, and DHCP relay perform different network functions and do not provide the application-aware SaaS path-selection capability described in the scenario.

Question 394. A company is designing connectivity between two cloud environments where workloads communicate directly with each other without traversing the enterprise’s Internet edge. What traffic classification best describes this communication?

1. North-south
2. Internet backhaul
3. East-west
4. Management-plane

Correct Answer: 3. East-west

Explanation :-

East-west traffic describes communication between workloads, services, or network segments within an interconnected environment. When workloads in two cloud environments communicate directly without the traffic leaving through a traditional enterprise Internet edge, the communication can be treated as east-west from the perspective of the cloud-connected architecture. North-south traffic generally crosses the boundary between internal resources and external networks or services. Internet backhaul specifically describes routing Internet traffic through a centralized location, while management-plane traffic concerns network administration and control rather than workload communication.

Question 395. An enterprise advertises a default route toward a cloud-connected BGP neighbor. The engineer wants to verify what the enterprise router is actually sending to that neighbor. Which troubleshooting information should be examined?

1. BGP advertised routes toward the neighbor
2. IPsec replay counters only
3. OSPF database sequence numbers
4. TCP MSS values only

Correct Answer: 1. BGP advertised routes toward the neighbor

Explanation :-

BGP advertised-route information shows the routes that the local router is sending to a specific neighbor after outbound policy is applied. This is the appropriate information when verifying whether a default route or other enterprise prefixes are actually being advertised to the cloud provider. Looking only at routes received from the neighbor answers the opposite question. IPsec replay counters can help troubleshoot encrypted traffic, while OSPF database information relates to an internal routing protocol. TCP MSS is relevant to packet-size troubleshooting. For BGP advertisement verification, the engineer should inspect the routes advertised to the specific neighbor.

Question 396. During a cloud VPN outage, the IPsec tunnel is established again, but users still cannot reach the cloud application. The routing table shows a valid cloud prefix, but return traffic appears to use a different path. Which condition should the engineer investigate?

1. Duplicate OSPF process IDs
2. Asymmetric routing
3. Incorrect console authentication
4. BGP origin-code preference only

Correct Answer: 2. Asymmetric routing

Explanation :-

Asymmetric routing occurs when traffic travels through different paths in the forward and return directions. This can cause problems with stateful firewalls, security appliances, NAT, or other devices that expect flows to follow a consistent path. In the scenario, the local router has a valid route to the cloud application, but return traffic follows a different path, making asymmetric routing an important troubleshooting target. The engineer should inspect routing decisions in both directions, security-policy behavior, NAT, and cloud-side return routes. OSPF process IDs and console authentication do not directly explain this forwarding condition.

Question 397. An organization needs predictable performance for critical cloud applications and has a documented SLA requiring specific availability and latency characteristics. Which cloud-connectivity design factor should be explicitly evaluated when selecting the transport?

1. Router hostname length
2. Number of VLAN names
3. SLA and service-performance requirements
4. OSPF process ID

Correct Answer: 3. SLA and service-performance requirements

Explanation :-

Cloud connectivity should be selected according to documented application and business requirements, including availability, latency, jitter, packet loss, and service-level commitments. If critical applications depend on predictable performance, the transport’s SLA should be compared with the organization’s requirements before deployment. A shared Internet service and a dedicated connectivity option may provide different performance characteristics and contractual guarantees. Router hostname length, VLAN naming, and OSPF process identifiers do not establish service quality. Evaluating the SLA ensures that the chosen connectivity method can support the required operational objectives rather than simply providing basic network reachability.

Question 398. A network engineer configures a cloud BGP session and receives the expected prefixes, but the enterprise router does not advertise its internal prefixes to the cloud provider. Which area should be checked first?

1. Inbound policy applied to routes received from the cloud
2. IPsec encryption key lifetime only
3. Outbound BGP policy and the local routing table
4. NTP stratum on an unrelated server

Correct Answer: 3. Outbound BGP policy and the local routing table

Explanation :-

If the router receives cloud prefixes but does not advertise internal prefixes to the provider, the engineer should verify that the desired internal routes exist in the local routing table and that outbound BGP policy permits them. Route maps, prefix lists, route policies, network statements, redistribution, and other advertisement controls can determine whether a prefix is sent to the neighbor. Inbound policy affects routes received from the cloud and therefore does not directly control the enterprise’s outbound advertisements. IPsec key lifetime and NTP stratum do not normally determine which BGP prefixes are advertised.

Question 399. A cloud VPN is operational, but users experience poor performance only during periods of high traffic. Monitoring shows that the physical WAN circuit is approaching its committed capacity. Which design issue is most directly indicated?

1. Insufficient bandwidth capacity
2. Incorrect BGP router ID
3. Duplicate OSPF area numbers
4. Incorrect IPsec peer authentication

Correct Answer: 1. Insufficient bandwidth capacity

Explanation :-

When application performance deteriorates during periods of high utilization and the WAN circuit approaches its committed capacity, insufficient bandwidth is a likely design constraint. Capacity planning should account for normal traffic, peak demand, growth, overhead from encryption or encapsulation, and appropriate headroom. Simply confirming that an IPsec tunnel is established does not guarantee sufficient transport capacity for the application workload. BGP router IDs and OSPF area numbers do not explain a utilization-driven performance problem, while incorrect IPsec authentication would generally prevent tunnel establishment rather than cause degradation only during traffic peaks.

Question 400. An engineer must validate a new redundant cloud connection before production traffic is migrated. Which test provides the most meaningful evidence that the design meets its failover objective?

1. Checking only that the standby interface is administratively up
2. Measuring failover behavior, convergence, and application recovery during a controlled test
3. Verifying only the router hostname
4. Confirming that the IPsec encryption algorithm is configured

Correct Answer: 2. Measuring failover behavior, convergence, and application recovery during a controlled test

Explanation :-

A redundancy design should be validated by testing the actual failure condition and measuring how the network responds. A controlled failover test can reveal whether routing converges as expected, whether IPsec or SD-WAN paths transition correctly, whether security policies permit the new path, and how long applications take to recover. Merely confirming that a standby interface is administratively up does not prove end-to-end resilience. Likewise, checking the encryption algorithm or hostname does not validate failover behavior. Measuring convergence and application recovery provides operational evidence that the redundant cloud-connectivity design performs according to its intended objectives.