Question 1

DRAG DROP
Refer to the exhibit. These configurations are complete:
• Create an account in the Equinix portal.
• Associate the Equinix account with Cisco vManage.
• Configure the global settings for Interconnect Gateways.
Drag the prerequisite steps from the left onto the order on the right to configure a Cisco SD-WAN Cloud Interconnect with Equinix

Accepted Answer

The process of configuring a Cisco SD-WAN Cloud Interconnect with Equinix involves several steps.
? Ensure that you have UUIDs for the required number of Cisco SD WAN Virtual Edge instances that you want to deploy as Interconnect Gateways: This is the first
step where you ensure that you have the necessary UUIDs for the Cisco SD-WAN Virtual Edge instances that you want to deploy.
? Create the necessary network segments: After ensuring the availability of UUIDs, you create the necessary network segments.
? Attach Cisco SD-WAN Virtual Edge to the Equinix device template: After setting up the network segments, you attach the Cisco SD-WAN Virtual Edge to the
Equinix device template.
? Create the Interconnect Gateway at the Equinix location that is closest to your SDWAN branch location: Finally, you create the Interconnect Gateway at the Equinix location that is closest to your SD-WAN branch location.
References :=
? [Cisco SD-WAN Cloud Interconnect with Equinix]
? [Cisco SD-WAN Cloud OnRamp for CoLocation Deployment Guide]

Question 2

Refer to the exhibit.

From SurePassExam
https://www.surepassexam.com/300-440-exam-dumps.html (38 New Questions)
An engineer needs to configure a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS). Which
configuration command must be placed in the blank in the code to complete the tunnel configuration?

Accepted Answer

In the given scenario, an engineer is configuring a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router and AWS. The correct
command to complete the tunnel configuration is ??tunnel source 20.20.20.21??. This command specifies the source IP address for the tunnel, which is essential
for establishing a secure connection between two endpoints over the internet or another network1. References:
? Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services - Cisco
Community
? [Security for VPNs with IPsec Configuration Guide, Cisco IOS XE Release 3S - Config

Question 3

Which approach does a centralized internet gateway use to provide connectivity to SaaS applications?

Accepted Answer

A centralized internet gateway is a network design that routes all internet- bound traffic from the on-premises infrastructure through a single point of egress,
typically located at the data center or a regional hub1. This approach allows the enterprise to apply consistent security policies and access controls for SaaS
applications, as well as optimize the bandwidth utilization and performance of the WAN links2. A centralized internet gateway can use various technologies to
provide connectivity to SaaS applications, such as proxy servers, firewalls, web filters, and WAN optimizers3. However, a cloud-based proxy server (option A) is
not a part of the centralized internet gateway, but rather a separate service that can be used to route traffic from the on-premises infrastructure to the SaaS
provider data center4. VPN connections (option C) and dedicated, private connections (option D) are also not related to the centralized internet gateway, but rather
alternative ways of providing secure and reliable access to SaaS applications from the on- premises infrastructure5. Therefore, the correct answer is option B,
which describes the basic function of a centralized internet gateway. References := 1: Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 1:
Cloud Connectivity Overview, Lesson 1: Cloud Connectivity Concepts, Topic: Centralized Internet Gateway 2: Cloud OnRamp for SaaS, Cisco IOS XE Catalyst SDWAN Release 17.3.1a and Later, Topic: Centralized Internet Gateway 3: Architect and optimize your internet traffic with Azure routing preference, Microsoft Azure
Blog, Topic: Routing via the premium Microsoft global network 4: What is SaaS? Softwareas a Service, Microsoft Azure, Topic: How SaaS works 5: How an
application gateway works, Microsoft Learn, Topic: Application gateway components

Question 4

Which Microsoft Azure service enables a dedicated and secure connection between an on- premises infrastructure and Azure data centers through a colocation
provider?

Accepted Answer

Azure ExpressRoute is a service that enables a dedicated and secure connection between an on-premises infrastructure and Azure data centers through a

From SurePassExam
https://www.surepassexam.com/300-440-exam-dumps.html (38 New Questions)
colocation provider. A colocation provider is a third-party data center that offers network connectivity services to multiple customers. Azure ExpressRoute allows
customers to bypass the public internet and connect directly to Azure services, such as virtual machines, storage, databases, and more. This provides benefits
such as lower latency, higher bandwidth, more reliability, and enhanced security. Azure ExpressRoute also supports hybrid scenarios, such as connecting to Office
365, Dynamics 365, and other SaaS applications hosted on Azure. Azure ExpressRoute requires a physical connection between the customer??s network and the
colocation provider??s network, as well as a logical connection between the customer??s network and the Azure virtual network. The logical connection is
established using a Border Gateway Protocol (BGP) session, which exchanges routing information between the two networks. Azure ExpressRoute supports two
models: standard and premium. The standard model offers connectivity to all Azure regionswithin the same geopolitical region, while the premium model offers
connectivity to all Azure regions globally, as well as additional features such as increased route limits, global reach, and Microsoft peering. References: Designing
and Implementing Cloud Connectivity (ENCC) v1.0, Learning Plan: Designing and Implementing Cloud Connectivity v1.0 (ENCC 300-440) Exam Prep, ENCC |
Designing and Implementing Cloud Connectivity| Netec

Question 5

Refer to the exhibit.
Which Cisco lKEv2 configuration brings up the IPsec tunnel between the remote office router and the AWS virtual private gateway?
A)
B)

From SurePassExam
https://www.surepassexam.com/300-440-exam-dumps.html (38 New Questions)
C)

Accepted Answer

Option C is the correct answer because it configures the IKEv2 profile with the correct match identity, authentication, and keyring parameters. It also configures the
IPsecprofile with the correct transform set and lifetime parameters. Option A is incorrect because it does not specify the match identity remote address in the IKEv2
profile, which is required to match the AWS virtual private gateway IP address. Option B is incorrect because it does not specify the authentication pre-share in the
IKEv2 profile, which is required to authenticate the IKEv2 peers using a pre-shared key. Option C also matches the configuration example provided by AWS1 and
Cisco2 for setting up an IKEv2 IPsec site-to- site VPN between a Cisco IOS-XE router and an AWS virtual private gateway. References :=
? 1: AWS VPN Configuration Guide for Cisco IOS-XE
? 2: Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services

Question 6

Refer to the exhibit.
An engineer successfully brings up the site-to-site VPN tunnel between the remote office and the AWS virtual private gateway, and the site-to-site routing works
correctly. However, the end-to-end ping between the office user PC and the AWS EC2 instance is not working. Which two actions diagnose the loss of
connectivity? (Choose two.)

Accepted Answer

The end-to-end ping between the office user PC and the AWS EC2 instance is not working because either the security group rules for the host VPC are blocking
the ICMP traffic or the IPsec SA counters are showing errors or drops. To diagnose the loss of connectivity, the engineer should check both the security group
rules and the IPsec SA counters. The network security group rules on the host VNET are not relevant because they apply to Azure, not AWS. The IPsec SA
configuration on the Cisco VPN router and the AWS private virtual gateway are not likely to be the cause of the problem because the site- to-site VPN tunnel is
already up and the site-to-site routing works correctly. References :=
? Designing and Implementing Cloud Connectivity (ENCC, Track 1 of 5), Module 3:
Configuring IPsec VPN from Cisco IOS XE to AWS, Lesson 3: Verify IPsec VPN Connectivity
? Security for VPNs with IPsec Configuration Guide, Cisco IOS XE, Chapter: IPsec VPN Overview, Section: IPsec Security Association
? AWS Documentation, User Guide for AWS VPN, Section: Security Groups for Your VPC

Question 7

Which method is used to create authorization boundary diagrams (ABDs)?

Accepted Answer

According to the FedRAMP Authorization Boundary Guidance document1, the method used to create authorization boundary diagrams (ABDs) is to identify all
tools as either external orinternal to the boundary. The ABD is a visual representation of the components that make up the authorization boundary, which includes
all technologies, external and internal services, and leveraged systems and accounts for all federal information, data, and metadata that a Cloud Service Offering
(CSO) is responsible for. The ABD should illustrate a CSP??s scope of control over the system and show components or services that are leveraged from external
services or controlled by the customer1. The other options are incorrect because they do not capture the full scope and details of the authorization boundary as
required by FedRAMP. References := FedRAMP Authorization Boundary Guidance document1

Question 8

Refer to the exhibits.
While troubleshooting, a network engineer discovers that the backup path fails between ASBR3 and ASBR4 for traffic between BGP AS6000 and BGP AS6500
when the connection between ASBR1 and ASBR2 goes down. The following configurations were performed on ASBR1:
Which command is missing?

Accepted Answer

The bgp advertise-best-external command is used to enable the advertisement of the best external path to internal BGP peers. This command is useful when
there are multiple exit points from the local AS to other ASes, and the local AS wants to use the closest exit point for each destination. By default, BGP only
advertises the best path to its peers, and the best path is usually the one with the lowest IGP metric to the next hop. However, this may not be the optimal path for
traffic leaving the local AS, as it may result in suboptimal hot-potato routing or MED oscillations. The bgp advertise-best-external command allows BGP to
advertise the best external path, which is the path with the lowest MED among the paths from different neighboring ASes, in addition to the best path. This way,
the internal BGP peers can choose the best exit point based on the MED value, rather than the IGP metric. In this scenario, ASBR1 is configured to receive
additional paths from ASBR2, which is a route reflector. ASBR2 receivestwo paths for the same prefix from AS6500, one from ASBR3 and one from ASBR4.
ASBR2 selects the best path based on the IGP metric to the next hop, and advertises it to ASBR1. However, this path may not be the best external path, as it may
have a higher MED value than the other path. If the connection between ASBR1 and ASBR2 goes down, ASBR1 will not have any backup path to reach AS6500,
as it does not know the other path from ASBR4. To prevent this situation, ASBR1 should be configured with the bgp advertise-best-external command, so that it
can receive the best external path from ASBR2, along with the best path. This way, ASBR1 will have a backup path to reach AS6500, in case the primary path
fails. References := IP Routing: BGP Configuration Guide - BGP Additional Paths ?? - Cisco, BGP Additional Paths

Question 9

Which architecture model establishes internet-based connectivity between on-premises networks and AWS cloud resources?

Accepted Answer

The architecture model that establishes internet-based connectivity between on-premises networks and AWS cloud resources is the one that establishes an iPsec
VPN tunnel with Internet Key Exchange (IKE) for secure key negotiation and encrypted data transmission. This model is also known as the VPN CloudHub
model12. It allows multiple remote sites to connect to the same virtual private gateway in AWS, creating a hub-and-spoke topology1. The VPN CloudHub model
provides the following benefits12:
? It enables secure communication between remote sites and AWS over the public internet, using encryption and authentication protocols such as IPsec and IKE.
? It supports dynamic routing protocols such as BGP, which can automatically adjust the routing tables based on the availability and performance of the VPN
tunnels.
? It allows for redundancy and load balancing across multiple VPN tunnels, increasing the reliability and throughput of the connectivity.
? It simplifies the management and configuration of the VPN connections, as each remote site only needs to establish one VPN tunnel to the virtual private
gateway in AWS, rather than multiple tunnels to different VPCs or regions.
The other options are not correct because they do not establish internet-based connectivity between on-premises networks and AWS cloud resources. Option B
relies on AWS Elastic Load Balancing (ELB) for traffic distribution and uses SSL/TLS encryption for secure data transmission. However, ELB is a service that
distributes incoming traffic across multiple targets within a VPC, not across different networks3. Option C employs AWS Direct Connect for a dedicated network
connection and uses private IP addresses for secure communication. However, AWS Direct Connect is a service that establishes a private connection between onpremises networks and AWS, bypassing the public internet4. Option D uses Amazon CloudFront for caching and distributing content globally and uses HTTPS for
secure data transfer. However, Amazon CloudFront is a service that delivers static and dynamic web content to end users, not to on-premises networks5.
References:
? 1: Designing and Implementing Cloud Connectivity (ENCC, Track 1 of 5)
? 2: Cisco ASA Site-to-Site VPN
? 3: What Is Elastic Load Balancing?
? 4: What is AWS Direct Connect?

Question 10

A company with multiple branch offices wants a suitable connectivity model to meet these network architecture requirements:
• high availability
• quality of service (QoS)
• multihoming
• specific routing needs
Which connectivity model meets these requirements?

Accepted Answer

A fully meshed topology with SD-WAN technology using dynamic routing and prioritized traffic for QoS meets the network architecture requirements of the
company. A fully meshed topology provides high availability by eliminating single points of failure and allowing multiple paths between branch offices. SD-WAN
technology enables multihoming by supporting multiple transport options, such as MPLS, internet, LTE, etc. SD-WAN also provides QoS by applying policies to
prioritize traffic based on application, user, or network conditions. Dynamic routing allows the SD-WAN solution to adapt to changing network conditions and
optimize the path selection for each traffic type. A fully meshed topology with SD-WAN technology can also support specific routing needs, such as segment
routing, policy-based routing, or application-aware routing. References:
? Designing and Implementing Cloud Connectivity (ENCC) v1.0
? [Cisco SD-WAN Design Guide]
? [Cisco SD-WAN Configuration Guide]