View Full Cisco CCNP Enterprise 300-440 Exam Dumps  and Practice Test Dumps

 

Question 141. The application requires predictable latency and a contractual availability commitment. Which requirement should drive the architecture decision?

1. Number of available DNS records
2. Application SLA and performance requirements
3. Number of switch VLANs
4. Device management protocol

Correct Answer: 2. Application SLA and performance requirements

Explanation :-

Cloud connectivity should be selected according to the requirements of the applications using the connection. Predictable latency and contractual availability requirements may make a dedicated connectivity model more suitable, depending on the provider’s actual SLA and architecture. An Internet VPN can provide secure connectivity and may be appropriate when variability is acceptable or cost and flexibility are important. DNS records, VLAN count, and management protocols do not directly determine whether the connectivity design meets the application’s performance and availability requirements.

Question 142. A cloud-connected Cisco IOS XE router has an active BGP session, but a specific enterprise prefix is not being advertised to the cloud provider. Which troubleshooting step is most appropriate?

1. Increase the Ethernet MTU
2. Disable BGP keepalives
3. Restart the cloud application
4. Check the local BGP advertisement policy and route availability

Correct Answer: 4. Check the local BGP advertisement policy and route availability

Explanation :-

A BGP session being established does not guarantee that every local prefix will be advertised. The engineer should first verify that the desired prefix exists in the local routing table and that the BGP configuration permits that prefix to be originated or advertised. Prefix lists, route maps, route policies, network statements, redistribution, and aggregate configuration can all affect advertisements. Increasing MTU or disabling BGP keepalives does not normally solve a missing BGP advertisement. Troubleshooting should therefore focus on route availability and outbound BGP policy.

Question 143. A company deploys multiple cloud connections through different providers. During normal operation, traffic unexpectedly uses the higher-cost provider. Which routing information should be examined first?

1. Route preference and path-selection attributes
2. DNS cache entries
3. NTP synchronization status
4. Layer 2 multicast settings

Correct Answer: 1. Route preference and path-selection attributes

Explanation :-

When multiple providers offer paths toward the same cloud destination, routing policy determines which path is selected. The engineer should examine administrative distance, routing-protocol metrics, BGP attributes, local policy, and any SD-WAN path-selection rules that influence the forwarding decision. A higher-cost provider may be selected because the intended preference was not configured or because another attribute takes precedence. DNS, NTP, and Layer 2 multicast settings do not normally determine which routed WAN path is selected for a cloud destination.

Question 144. A cloud provider requires BGP authentication between the enterprise router and the provider edge. Which security mechanism is commonly used for this BGP peering requirement?

1. IPsec encryption of every BGP update
2. DHCP authentication
3. TCP MD5 authentication
4. STP BPDU filtering

Correct Answer: 3. TCP MD5 authentication

Explanation :-

BGP peering can use TCP MD5 authentication to authenticate the TCP session between BGP neighbors. The configured authentication key must match on both peers for the session to establish successfully. This mechanism helps protect the BGP TCP connection against certain unauthorized session attempts. It is distinct from IPsec, which can provide broader traffic protection but is not the standard mechanism implied by a basic BGP TCP authentication requirement. DHCP authentication and STP BPDU filtering serve unrelated network functions.

Question 145. A cloud-connected branch experiences high application latency only during periods of Internet congestion. The organization cannot deploy a private circuit. Which design consideration should receive particular attention?

1. Switchport naming
2. MAC address aging
3. DNS recursion
4. Application-aware path selection and available alternate transports

Correct Answer: 4. Application-aware path selection and available alternate transports

Explanation :-

When private connectivity is unavailable, the architecture must make effective use of the transports that are available. Application-aware path selection can evaluate characteristics such as latency and loss and choose an eligible transport according to policy. If multiple Internet or WAN transports are available, the design can use them to improve resilience and application performance. Switchport names, MAC aging, and DNS recursion do not address WAN congestion or application path selection. The actual benefit depends on the configured policies and measurable transport conditions.

Question 146. An enterprise uses OSPF internally and receives cloud routes through BGP. The engineer wants to redistribute only a specific group of cloud prefixes into OSPF. Which approach provides the required control?

1. Redistribute all BGP routes without filtering
2. Use a route policy or prefix filtering during redistribution
3. Disable OSPF on all internal interfaces
4. Change the BGP router ID

Correct Answer: 2. Use a route policy or prefix filtering during redistribution

Explanation :-

Controlled redistribution is necessary when only selected BGP-learned cloud routes should enter the internal OSPF domain. A route policy, prefix list, route map, or equivalent policy mechanism can identify the permitted prefixes and prevent unrelated routes from being redistributed. Unrestricted redistribution can introduce unnecessary routes and may create routing loops or unintended transit behavior. Disabling OSPF would remove the internal routing function, while changing the BGP router ID has no direct relationship to selecting which prefixes are redistributed.

Question 147. An IPsec cloud tunnel is established, but only traffic initiated from the enterprise reaches the cloud application. Sessions initiated from the cloud fail. Which issue should be investigated?

1. Missing or incorrect return traffic policy and routing
2. NTP stratum
3. Switch port-security aging
4. DNS suffix configuration

Correct Answer: 3. NTP stratum

Explanation :-

The scenario describes a bidirectional connectivity problem, so the relevant troubleshooting areas include cloud-to-enterprise routing, security policy, IPsec traffic selectors, and return-path behavior. NTP stratum does not control application traffic forwarding and therefore would not explain why sessions initiated from the cloud fail. Engineers should verify that the cloud has a route toward the enterprise networks, that the enterprise accepts the return traffic, and that the IPsec policy permits both traffic directions. This also illustrates why tunnel establishment alone does not prove complete bidirectional application connectivity.

Question 148. A company wants to prevent a cloud provider from advertising a default route into the enterprise routing table. Which control should be implemented?

1. Increase the OSPF hello interval
2. Configure an inbound route filter for the BGP neighbor
3. Change the interface description
4. Disable IP address resolution

Correct Answer: 2. Configure an inbound route filter for the BGP neighbor

Explanation :-

An inbound BGP route filter can prevent unwanted prefixes, including a default route, from being accepted from a cloud provider. The policy can explicitly permit required cloud prefixes and reject the default route or other undesired advertisements. This approach provides predictable routing control at the cloud connectivity boundary. OSPF timers, interface descriptions, and address-resolution settings do not directly determine which BGP routes are accepted. Careful filtering is particularly important when a cloud provider advertises multiple routes or when the enterprise already has its own Internet exit.

Question 149. A cloud application is reachable through two WAN transports. One transport has lower latency, while the other has better packet-loss performance. Which design capability can help select the transport according to configured application requirements?

1. Application-aware performance-based path selection
2. Ethernet storm control
3. DHCP relay
4. CDP neighbor discovery

Correct Answer: 1. Application-aware performance-based path selection

Explanation :-

Application-aware path selection allows the network to evaluate transport performance against defined criteria and apply policy to application traffic. Depending on the configuration, measurements such as latency, loss, and jitter can influence whether a transport qualifies for a particular application. This is different from Layer 2 storm control, DHCP relay, or CDP, none of which determines WAN transport selection based on application performance. The policy should reflect the application’s actual requirements rather than selecting a path solely because it has the lowest value for one performance metric.

Question 150. A cloud provider requires the enterprise to establish an IPsec VPN using IKEv2. The tunnel fails during security negotiation. Which configuration should be compared between both peers first?

1. VLAN trunk configuration
2. DNS host records
3. IKEv2 proposals, authentication parameters, and peer settings
4. STP bridge priority

Correct Answer: 3. IKEv2 proposals, authentication parameters, and peer settings

Explanation :-

IKEv2 negotiation requires compatible security and peer parameters. When a tunnel fails during the negotiation phase, the engineer should compare IKEv2 proposals, authentication configuration, peer identities, cryptographic algorithms, and related settings on both sides. A mismatch can prevent the security association from being established before IPsec data-plane processing begins. VLAN trunks, DNS records, and STP bridge priority are unrelated to IKEv2 negotiation. Logs from the IKE and IPsec processes can provide additional evidence about the exact negotiation failure.

Question 151. An enterprise wants to minimize the number of routes advertised toward a cloud provider while retaining reachability to several contiguous internal networks. Which technique should be considered?

1. Route summarization
2. DHCP relay
3. Port security
4. ARP inspection

Correct Answer: 1. Route summarization

Explanation :-

Route summarization combines multiple contiguous prefixes into a larger aggregate when the addressing structure permits it. Advertising a summary toward the cloud provider can reduce the number of routes exchanged and simplify routing-table management. The engineer must ensure that the summary accurately represents the intended reachable address space and does not introduce undesirable traffic blackholing. DHCP relay, port security, and ARP inspection operate at different layers and do not reduce the number of Layer 3 routes advertised toward a cloud environment.

Question 152. A company has a private cloud connection and an Internet VPN. During a provider maintenance event, the private connection remains physically up but cannot reach the cloud. Which failover capability should the design include?

1. A larger DNS cache
2. Failure detection that can trigger route or policy convergence
3. A static hostname entry
4. Increased switch buffer size

Correct Answer: 2. Failure detection that can trigger route or policy convergence

Explanation :-

A physical interface remaining operational does not necessarily mean that the end-to-end cloud service is reachable. Effective failover requires a mechanism that can detect meaningful path failure and cause routing or policy convergence toward the backup connection. Depending on the architecture, this may involve routing-protocol convergence, tracking, IP SLA-related mechanisms, or SD-WAN performance monitoring. DNS caching and switch buffer size do not provide end-to-end path failure detection. The design should define what constitutes a usable path and how traffic transitions when that condition is no longer satisfied.

Question 153. A network engineer receives a BGP route from a cloud provider, but the route’s next hop is unreachable. What is a likely consequence?

1. The route is automatically encrypted
2. The route may not be installed or usable for forwarding
3. OSPF automatically changes its area
4. DNS automatically selects another gateway

Correct Answer: 2. The route may not be installed or usable for forwarding

Explanation :-

A BGP route depends on a reachable next hop for actual forwarding. If the next hop cannot be resolved through the routing table, the route may not become usable in the local routing table, or packets may not be forwarded correctly even if BGP information is present. Engineers should inspect next-hop reachability and the underlying routes that provide access to the next-hop address. Encryption, OSPF area changes, and DNS gateway selection do not resolve a BGP next-hop reachability problem.

Question 154. A cloud application requires strict data-path isolation between two groups of workloads. Which SD-WAN design concept can help provide separate routing and policy domains?

1. Shared Layer 2 broadcast domain
2. Single unrestricted default route
3. Virtual routing and forwarding instances or segmentation
4. Disabling application policies

Correct Answer: 1. Virtual routing and forwarding instances or segmentation

Explanation :-

Network segmentation can provide separate routing and policy domains for different application or workload groups. In Cisco architectures, VRFs and related segmentation mechanisms can isolate routing information and allow security or forwarding policies to be applied independently. A shared unrestricted Layer 2 domain does not provide the same degree of logical isolation. Similarly, a single unrestricted default route and disabling application policies would reduce rather than improve traffic separation. The specific implementation should match the cloud and SD-WAN architecture.

Question 155. An organization uses two Internet providers for cloud connectivity. The first provider has a lower administrative preference, but its path is currently failing. What should the routing design provide?

1. A mechanism to detect the failure and remove or de-preference the unusable path
2. Permanent preference for the failed provider
3. Manual route changes for every outage
4. Removal of the second provider

Correct Answer: 4. A mechanism to detect the failure and remove or de-preference the unusable path

Explanation :-

A resilient multi-provider design should detect when the preferred path is no longer usable and allow routing to select an available alternative. Depending on the design, this can involve dynamic routing convergence, tracking, BFD, performance monitoring, or other failure-detection mechanisms. Simply assigning a preferred administrative value does not guarantee useful failover if the path remains logically present while the actual service is unavailable. Manual changes increase operational dependency and are unnecessary when automated convergence can be appropriately designed.

Question 156. An engineer is troubleshooting cloud connectivity and confirms that the enterprise route table contains the cloud prefix. The cloud gateway also has the enterprise prefix. Traffic still fails. Which additional area should be investigated?

1. Device hostname configuration
2. IPsec selectors, security policies, and forwarding behavior
3. NTP server naming
4. Switch interface descriptions

Correct Answer: 3. NTP server naming

Explanation :-

Although the routing tables contain the expected prefixes, traffic can still fail because routing is only one part of the end-to-end forwarding process. The engineer should investigate IPsec traffic selectors, security policies, next-hop reachability, NAT where applicable, ACLs, and packet counters. NTP server naming does not normally affect application forwarding. A complete troubleshooting process should move from control-plane reachability into the data plane and verify that packets are permitted, correctly encapsulated, transmitted, and decapsulated in both directions.

Question 157. A cloud provider requires a specific enterprise ASN for BGP peering. Which configuration element must match the provider’s expected information?

1. The BGP autonomous system configuration
2. The switchport access VLAN
3. The DNS search suffix
4. The STP root bridge

Correct Answer: 1. The BGP autonomous system configuration

Explanation :-

BGP peers establish an autonomous-system relationship as part of the peering configuration. If a cloud provider expects a specific enterprise ASN, the enterprise router must be configured consistently with the provider’s requirements and the intended BGP session type. A mismatch in the expected autonomous-system configuration can prevent the session from establishing or produce an incorrect routing relationship. VLAN assignments, DNS search suffixes, and STP root-bridge selection are unrelated to the BGP ASN requirement.

Question 158. A company wants to use a cloud Internet connection for selected applications while sending other applications through a centralized security stack. Which design capability is most relevant?

1. Layer 2 trunking across the WAN
2. Application-aware routing and centralized policy
3. Disabling route advertisements
4. Static ARP entries

Correct Answer: 4. Application-aware routing and centralized policy

Explanation :-

Application-aware routing allows different applications to follow different forwarding policies based on their identity, transport availability, security requirements, and performance conditions. This can support designs where selected applications use local Internet connectivity while others are directed through centralized security or inspection points. Layer 2 trunking, static ARP, and disabling route advertisements do not provide this application-specific forwarding control. The policy should clearly identify the applications, permitted paths, security requirements, and fallback behavior.

Question 159. A cloud connectivity engineer notices that the BGP session remains established, but the cloud prefix disappears from the routing table after a policy change. Which item should be reviewed?

1. Console terminal width
2. Inbound BGP filtering and route-policy changes
3. Switch fan speed
4. DNS resolver cache

Correct Answer: 2. Inbound BGP filtering and route-policy changes

Explanation :-

A route disappearing after a policy change strongly suggests that the new policy is affecting route acceptance or installation. The engineer should inspect inbound prefix lists, route policies, route maps, communities where relevant, and any changes that could cause the cloud prefix to be rejected. The BGP session can remain established even when individual routes are filtered. Console width, switch fan speed, and DNS cache contents do not normally control whether a BGP-learned prefix is accepted into the routing table.

Question 160. An enterprise is designing cloud connectivity for a critical application and identifies bandwidth, resiliency, latency, and availability as requirements. What should the architect do before selecting a connectivity model?

1. Choose the least expensive transport immediately
2. Disable all backup paths
3. Translate the application requirements into measurable connectivity and SLA criteria
4. Use Internet VPN regardless of the requirements

Correct Answer: 3. Translate the application requirements into measurable connectivity and SLA criteria

Explanation :-

A sound cloud-connectivity design begins by translating application requirements into measurable network characteristics. Bandwidth, latency, packet loss, availability, resiliency, security, and SLA requirements can then be compared against the capabilities of available connectivity models. Selecting a transport before understanding these requirements can produce a design that does not meet application objectives. The architect should therefore establish measurable criteria first and evaluate private connectivity, Internet VPN, multiple providers, SD-WAN, and other options against those criteria.