View Full Cisco CCNP Enterprise 300-440 Exam Dumps  and Practice Test Dumps

 

Question 161. The application transfers large volumes of data and has strict throughput requirements. Which factor should be evaluated first when selecting between the options?

1. Number of DNS zones
2. Switch management VLAN
3. Required bandwidth and expected traffic volume
4. Device hostname conventions

Correct Answer: 3. Required bandwidth and expected traffic volume

Explanation :-

Cloud connectivity selection should begin with the application’s actual requirements. High-volume applications can place significant demands on available bandwidth, and the architect should determine peak and sustained traffic levels before selecting a transport. The evaluation can then consider whether the Internet VPN or dedicated connection can meet those requirements along with latency, resiliency, security, and cost objectives. DNS zones, management VLANs, and hostnames do not determine whether a connectivity model can provide sufficient application throughput.

Question 162. An enterprise has a cloud BGP session established over a private connection. The provider advertises a cloud prefix, but the enterprise routing table still uses an existing less-preferred path. What should the engineer investigate?

1. BGP path-selection attributes and route preference
2. DHCP lease timers
3. STP root priority
4. DNS server redundancy

Correct Answer: 1. BGP path-selection attributes and route preference

Explanation :-

When multiple routes exist for the same destination, the router applies route-selection rules to determine which path becomes active. The engineer should inspect the BGP path attributes, administrative distance, local policy, next-hop reachability, and the competing route’s source. Simply receiving a cloud prefix through BGP does not guarantee that it will replace an existing route. DHCP, STP, and DNS parameters do not normally determine Layer 3 route selection. Understanding the complete route-selection process is essential when troubleshooting why a private cloud path is not being used.

Question 163. A company uses an IPsec VPN to connect to a cloud environment. The tunnel establishes successfully, but packets from one enterprise subnet are not encrypted. Which item should be verified?

1. BGP router ID
2. OSPF area number
3. NTP authentication
4. IPsec traffic selectors or encryption policy

Correct Answer: 4. IPsec traffic selectors or encryption policy

Explanation :-

An IPsec security association can be established while specific traffic remains outside the tunnel if the traffic does not match the configured encryption policy. The engineer should verify the local and remote traffic selectors, crypto ACLs, VPN policy, or equivalent configuration. The source and destination networks must correspond to the intended encrypted traffic. BGP router IDs, OSPF areas, and NTP authentication do not determine whether a particular IP packet matches an IPsec encryption policy.

Question 164. A cloud provider requires the enterprise to advertise only two internal prefixes over a BGP session. Which configuration objective should be implemented?

1. Accept every route from the provider
2. Apply outbound BGP filtering to permit only the required prefixes
3. Disable the BGP session
4. Redistribute all connected routes

Correct Answer: 2. Apply outbound BGP filtering to permit only the required prefixes

Explanation :-

Outbound BGP filtering provides control over which enterprise prefixes are advertised to the cloud provider. A prefix list and route policy can explicitly permit the two required prefixes while preventing other routes from being propagated. This reduces unintended route exposure and keeps the cloud routing domain aligned with the design requirements. Accepting all provider routes does not control enterprise advertisements, disabling BGP removes the intended routing exchange, and unrestricted redistribution can expose unnecessary networks.

Question 165. A branch uses two WAN transports for cloud access. The primary transport remains available, but its latency exceeds the application’s configured threshold. What should an application-aware SD-WAN policy be able to do?

1. Ignore the measured performance
2. Disable all cloud routes
3. Force traffic onto the primary transport indefinitely
4. Select another qualified transport when policy conditions are met

Correct Answer: 4. Select another qualified transport when policy conditions are met

Explanation :-

Application-aware SD-WAN policies can evaluate transport performance against configured service-level thresholds. If the preferred transport no longer meets the application’s requirements and another eligible transport is available, policy can direct traffic toward the qualified alternative. This provides performance-based path selection rather than relying only on static route preference. The exact behavior depends on the configured policy and SLA measurements. Simply ignoring latency or disabling cloud routes would not provide the intended application-aware failover behavior.

Question 166. An enterprise wants to connect its cloud environment through two geographically separate provider facilities. Which requirement does this design primarily address?

1. DNS name resolution
2. Physical resiliency and failure-domain diversity
3. BGP authentication
4. Application-layer encryption

Correct Answer: 3. Physical resiliency and failure-domain diversity

Explanation :-

Using geographically separate provider facilities can reduce the impact of a single physical failure affecting both connectivity paths. This addresses resiliency by creating greater failure-domain diversity. True redundancy should consider shared facilities, fiber routes, provider infrastructure, power dependencies, and other common points of failure. BGP authentication and application encryption are important security or control-plane considerations but do not directly address physical facility diversity. DNS resolution is unrelated to the physical redundancy requirement described.

Question 167. A cloud-connected router learns an enterprise prefix through OSPF and the same prefix through external BGP. Which route normally has the lower default administrative distance on Cisco IOS XE?

1. External BGP
2. OSPF
3. Both have the same default administrative distance
4. Neither route can be installed

Correct Answer: 1. External BGP

Explanation :-

On Cisco IOS XE, external BGP normally has a default administrative distance of 20, while OSPF has a default administrative distance of 110. When comparing routes to the same prefix, administrative distance is considered after longest-prefix matching and before protocol-specific path selection across different routing protocols. Therefore, external BGP normally has the lower administrative distance in this comparison. Actual forwarding can still be affected by route policy, next-hop reachability, more-specific routes, or configured administrative-distance changes.

Question 168. An engineer needs to verify whether an IPsec tunnel is receiving encrypted traffic from the cloud provider. Which information is most useful?

1. BGP local preference
2. IPsec inbound packet and byte counters
3. OSPF interface priority
4. DHCP binding entries

Correct Answer: 2. IPsec inbound packet and byte counters

Explanation :-

IPsec inbound counters provide direct evidence that encrypted packets are arriving and being processed by the VPN. By observing packet and byte counters before and after generating traffic, an engineer can determine whether traffic is entering the local IPsec processing path. BGP local preference affects route selection, OSPF interface priority influences DR/BDR behavior, and DHCP bindings identify address assignments. None of these directly confirms that encrypted packets are being received by the IPsec tunnel.

Question 169. A company wants to prevent cloud-learned routes from being redistributed back toward the cloud through another routing domain. Which mechanism can help identify routes that should not be reintroduced?

1. Increasing the MTU
2. Changing DNS records
3. Route tagging combined with redistribution filtering
4. Disabling interface statistics

Correct Answer: 3. Route tagging combined with redistribution filtering

Explanation :-

Route tagging can mark prefixes as they cross a redistribution boundary. A subsequent route policy can examine those tags and prevent the same routes from being redistributed back toward their original routing domain. This helps reduce routing loops and unintended route propagation. The technique is particularly useful when multiple protocols or routing domains are interconnected. MTU changes, DNS records, and interface statistics do not provide the route-identification and filtering capabilities needed for controlled redistribution.

Question 170. A cloud application is reachable from the enterprise, but response traffic takes a different provider path and is dropped by a stateful security device. What routing problem should be investigated?

1. OSPF router ID duplication
2. DNS cache expiration
3. STP topology changes
4. Asymmetric routing and return-path selection

Correct Answer: 4. Asymmetric routing and return-path selection

Explanation :-

Stateful security devices can be affected by asymmetric traffic because the return flow may not traverse the device or session state expected for the connection. The engineer should examine both forward and reverse routing paths, provider preferences, BGP policies, SD-WAN rules, and security-device placement. OSPF router IDs, DNS cache expiration, and STP changes do not directly describe the Layer 3 path asymmetry in this scenario. Ensuring predictable bidirectional routing is important when cloud connectivity passes through stateful security infrastructure.

Question 171. An enterprise wants cloud traffic to remain encrypted while traversing a public Internet transport. Which technology directly provides the required protection?

1. IPsec
2. OSPF
3. BGP
4. VRRP

Correct Answer: 1. IPsec

Explanation :-

IPsec provides network-layer security services that can protect IP traffic across an untrusted transport such as the public Internet. It can provide confidentiality, integrity, authentication, and anti-replay protection depending on the configured algorithms and security associations. BGP and OSPF are routing protocols, while VRRP provides first-hop gateway redundancy. Although other security mechanisms may be used in a complete cloud architecture, IPsec is the technology directly associated with encrypting IP traffic across an Internet-based VPN connection.

Question 172. A cloud provider advertises a default route and several specific cloud prefixes. The enterprise wants to accept the specific cloud routes but retain its existing Internet exit. Which policy is appropriate?

1. Permit only the required cloud prefixes and filter the provider’s default route
2. Accept every provider advertisement
3. Remove all enterprise Internet routes
4. Disable inbound BGP processing

Correct Answer: 1. Permit only the required cloud prefixes and filter the provider’s default route

Explanation :-

Inbound BGP filtering can allow the enterprise to accept required cloud-specific prefixes while rejecting an unwanted default route. This prevents the cloud provider from unintentionally becoming the preferred Internet exit for enterprise traffic. The policy should explicitly identify permitted prefixes and reject unnecessary advertisements. Accepting every route could alter the enterprise’s Internet forwarding behavior, while disabling BGP would remove the desired cloud route exchange. Careful prefix filtering is therefore important when integrating cloud routing with an existing enterprise Internet architecture.

Question 173. A cloud connectivity design requires continuous operation during a single circuit failure and also requires sufficient bandwidth after failover. Which design activity is necessary?

1. Disable the backup circuit
2. Perform failover-capacity planning
3. Reduce the MTU on both circuits
4. Remove application traffic measurements

Correct Answer: 4. Perform failover-capacity planning

Explanation :-

Redundancy is not sufficient if the remaining path cannot carry the required traffic after a failure. Failover-capacity planning evaluates expected traffic loads, available bandwidth, application priorities, and degraded operating conditions when one circuit is unavailable. The architect may need to provision additional capacity or define traffic-priority policies for failure scenarios. Disabling the backup circuit contradicts the resiliency requirement, while changing MTU or removing traffic measurements does not ensure sufficient post-failure capacity.

Question 174. An engineer sees a BGP prefix in the received-routes table but not in the routing table. Which additional factor should be checked?

1. The device’s hostname
2. DNS recursion
3. Next-hop reachability and route-selection status
4. STP BPDU timers

Correct Answer: 3. Next-hop reachability and route-selection status

Explanation :-

A route can be received through BGP but remain absent from the active routing table if its next hop is unreachable, another route is preferred, or policy prevents installation. The engineer should inspect the BGP path, next-hop resolution, competing routes, administrative distance, and relevant routing policies. A received route therefore does not automatically mean that the router will use it for forwarding. Hostnames, DNS recursion, and STP timers do not normally determine whether a BGP prefix becomes an active Layer 3 route.

Question 175. A company wants to evaluate whether its cloud connectivity provider meets the application’s availability commitment. Which measurement is most directly relevant?

1. Switch MAC-table size
2. Measured service availability compared with the contracted SLA
3. Number of DHCP leases
4. Number of OSPF neighbors

Correct Answer: 2. Measured service availability compared with the contracted SLA

Explanation :-

An availability requirement should be expressed in measurable terms and compared against the provider’s contractual service commitment. Engineers can collect outage duration, uptime measurements, incident records, and other appropriate operational data to determine whether the service meets the defined SLA. MAC-table size, DHCP leases, and OSPF neighbor count do not directly measure provider service availability. The evaluation should also consider the measurement methodology and whether the provider and enterprise use the same definitions for service availability and exclusions.

Question 176. A branch has direct Internet access and a private WAN path to a central data center. SaaS traffic is currently being backhauled through the data center. Which design change could reduce unnecessary backhaul?

1. Route appropriate SaaS traffic directly through the branch Internet transport
2. Remove all Internet connectivity
3. Extend the data-center VLAN to the SaaS provider
4. Force every application through the central data center

Correct Answer: 1. Route appropriate SaaS traffic directly through the branch Internet transport

Explanation :-

When branch Internet access is available and policy permits it, appropriate SaaS traffic can use a direct local Internet path instead of being unnecessarily sent to a central data center and back to the Internet. Cisco Catalyst SD-WAN capabilities can provide centralized policy and application-aware path selection for this type of architecture. Security, compliance, and application requirements must still be considered before enabling local breakout. Forcing all applications through the data center would preserve the backhaul rather than reducing it.

Question 177. A cloud BGP connection uses multiple prefixes, but one prefix is unexpectedly accepted while another is rejected after a prefix-list change. Which item should be checked?

1. IPsec encryption lifetime
2. Prefix-list entries and their sequence logic
3. DNS server address
4. OSPF hello timer

Correct Answer: 4. Prefix-list entries and their sequence logic

Explanation :-

Prefix lists evaluate routes according to their configured entries and sequence numbers. A change to a permit or deny entry can cause one prefix to be accepted while another is rejected. The engineer should inspect the prefix-list entries, sequence order, prefix lengths, and the policy in which the prefix list is applied. IPsec lifetimes, DNS addresses, and OSPF hello timers do not determine whether a BGP prefix passes a prefix-list filter. Careful route-policy review is essential when troubleshooting selective route acceptance.

Question 178. An organization requires encrypted cloud connectivity but also needs dynamic route exchange between the enterprise and cloud environment. Which combination can provide these functions?

1. STP and DHCP
2. IPsec with a compatible dynamic routing design
3. CDP and LLDP
4. ARP and DNS

Correct Answer: 2. IPsec with a compatible dynamic routing design

Explanation :-

IPsec can provide secure transport for cloud connectivity, while a compatible routing design can provide dynamic exchange of routes between the enterprise and cloud environment. Depending on the architecture, routing may use BGP, OSPF, or another supported mechanism over or alongside the VPN connectivity. The routing protocol and IPsec design must be compatible with the cloud provider’s capabilities and addressing model. STP, DHCP, CDP, LLDP, ARP, and DNS do not provide the combination of encrypted connectivity and dynamic Layer 3 route exchange described.

Question 179. A cloud-connected enterprise has two routes to the same prefix with identical prefix lengths. One route is learned through an IGP and the other through a different routing protocol. Which general principle determines which source is preferred before protocol-specific path attributes are compared?

1. DNS priority
2. MAC address learning
3. Administrative distance
4. TCP window size

Correct Answer: 3. Administrative distance

Explanation :-

When routes to the same destination prefix are learned from different routing sources, administrative distance is used to compare the trustworthiness of those sources before selecting among different routing protocols. Once a routing protocol is selected, that protocol’s own path-selection rules determine the preferred path among its candidates. The exact administrative-distance values depend on the protocols and Cisco configuration. DNS priority, MAC learning, and TCP window size do not determine which routing protocol’s route is installed.

Question 180. A cloud connectivity implementation has sufficient bandwidth but experiences poor application performance because of high latency. Which design process should the engineer follow?

1. Evaluate only interface utilization
2. Compare measured latency against the application’s defined performance requirements
3. Replace the routing protocol immediately
4. Disable all redundant paths

Correct Answer: 1. Compare measured latency against the application’s defined performance requirements

Explanation :-

Bandwidth alone does not determine application performance. Some applications are highly sensitive to latency, so the design must compare measured path characteristics with the application’s actual requirements. Engineers should evaluate latency along with packet loss, jitter where relevant, availability, and other service-level criteria. Replacing a routing protocol or disabling redundancy without evidence does not address the underlying performance requirement. A requirements-driven approach helps determine whether the current transport is suitable or whether a different path, provider, or architecture should be considered.