Cisco Designing and Implementing Secure Cloud Connectivity ENCC (300-440)

Question 1

A financial services company already has a 10 Gbps AWS Direct Connect dedicated connection terminating at a colocation facility. The network team now needs to give an internal analytics application private, low-latency access to a third-party market-data SaaS offering that is published through AWS PrivateLink in a provider VPC. The traffic must never traverse the public internet, and the team wants to avoid provisioning a second physical circuit. Which approach lets them consume this SaaS service over their existing Direct Connect?

Accepted Answer

Create an interface VPC endpoint to the SaaS provider's PrivateLink service in the consumer VPC, then reach that VPC through a private virtual interface (private VIF) over the existing Direct Connect

Answer

Configure a public virtual interface (public VIF) on the Direct Connect and connect directly to the SaaS provider's public service endpoints

Answer

Establish a site-to-site IPsec VPN over the internet to the SaaS provider VPC and route the analytics traffic through it

Answer

Enable VPC peering between the consumer VPC and the SaaS provider VPC and advertise the peered routes over the Direct Connect

Question 2

A financial services company must connect its on-premises data center to AWS using a dedicated private circuit. A security requirement states that all data traversing the Layer 2 link between the customer premises and the AWS Direct Connect location must be encrypted at line rate without adding routing overhead or reducing throughput. The design team wants to satisfy this at the physical link layer rather than relying on an IPsec tunnel over the connection. Which capability should the design recommend?

Accepted Answer

Enable MACsec (802.1AE) on a MACsec-capable Direct Connect dedicated connection (10, 100, or 400 Gbps at supported locations)

Answer

Establish a site-to-site IPsec VPN over the Direct Connect public virtual interface

Answer

Configure a private virtual interface with BGP MD5 authentication for payload encryption

Answer

Use AWS Transit Gateway Connect with GRE tunnels to encrypt the underlying link

Question 3

A financial services company hosts a customer-facing web application in an AWS VPC. Security requires that all inbound connections from the internet must terminate at a managed edge that provides DDoS protection and web application filtering before traffic reaches the application subnets. The team also wants to avoid exposing EC2 instances with public IP addresses. Which cloud security design for inbound connectivity best meets these requirements?

Accepted Answer

Place the application behind an internet-facing Application Load Balancer with AWS WAF and AWS Shield, keeping EC2 instances in private subnets

Answer

Assign Elastic IPs to each EC2 instance and rely on security group rules to filter inbound HTTP/HTTPS traffic

Answer

Route inbound traffic through a NAT gateway so the EC2 instances remain private while accepting connections

Answer

Use a VPC interface endpoint (PrivateLink) to expose the application to internet clients without public IPs

Question 4

A retail enterprise runs several application VPCs in AWS behind a Transit Gateway. Security policy requires that all outbound internet traffic from these workloads be centrally inspected for threats and logged before leaving AWS, with no workload allowed to reach the internet through its own path. Which cloud security design should the network architect recommend for the outbound (backhaul) internet traffic?

Accepted Answer

Route all VPC egress through a centralized inspection VPC containing a next-generation firewall, with a default route pointing to the Transit Gateway and NAT/inspection performed before internet egress

Answer

Attach an internet gateway to each application VPC and apply security group rules to filter outbound traffic per instance

Answer

Enable AWS PrivateLink endpoints in each application VPC so outbound internet traffic is tunneled privately to AWS services

Answer

Use VPC peering between all application VPCs and allow each VPC to reach the internet through the peer with the shortest path

Question 5

A financial services company runs a data-analytics application in an on-premises data center connected to AWS via an existing Direct Connect private VIF and a Direct Connect gateway. The security team mandates that traffic to Amazon S3 for storing regulatory reports must never traverse the public internet and must not require adding public IP prefixes to the Direct Connect public VIF. Which AWS connectivity construct should the network architect deploy to reach the S3 service privately over the existing private connectivity?

Accepted Answer

An S3 interface VPC endpoint (powered by AWS PrivateLink) accessed from on-premises through the private VIF

Answer

An S3 gateway VPC endpoint associated with the VPC route tables

Answer

A Direct Connect public VIF advertising the S3 public service prefixes

Answer

A NAT gateway in a public subnet routing S3 traffic to the internet gateway

Question 6

A global manufacturing firm hosts several VMs in an Azure VNet. Corporate security policy mandates that ALL outbound internet traffic from cloud workloads be inspected by the on-premises next-generation firewall stack before reaching the internet, with full logging for audit. The firm already has redundant ExpressRoute circuits to the on-premises data center. Which connectivity design should the network architect recommend to enforce this backhaul internet inspection requirement?

Accepted Answer

Configure forced tunneling to advertise a 0.0.0.0/0 default route to the VNet over ExpressRoute (or BGP), directing all internet-bound traffic back to on-premises for inspection

Answer

Deploy Azure NAT Gateway on each subnet so workloads egress directly to the internet with a static public IP

Answer

Enable a VNet service endpoint for internet-facing PaaS services and rely on default system routes

Answer

Attach a public IP to each VM and use Azure DDoS Protection Standard to inspect outbound flows

Question 7

A financial services company is migrating a latency-sensitive trading analytics workload to Azure. Requirements include: a consistent 5 Gbps of throughput, BGP-based dynamic routing between on-premises and Azure, redundancy across two physically diverse paths at the peering location, and the ability to advertise the same on-premises prefixes over both paths for active/active load distribution. Which connectivity design best satisfies these network architecture requirements?

Accepted Answer

An ExpressRoute circuit provisioned with a 5 Gbps port, using the built-in dual BGP peerings across the two redundant physical connections at the peering location

Answer

A single site-to-site IPsec VPN over the internet using BGP, sized with multiple tunnels to aggregate bandwidth

Answer

Two independent ExpressRoute circuits at the same peering location with static routing configured to each Azure VNet gateway

Answer

A single ExpressRoute circuit with Microsoft peering only, relying on ECMP toward SaaS endpoints for redundancy

Question 8

A financial services company already has an Azure ExpressRoute circuit terminating at a partner colocation facility. They now need to reach Microsoft 365 and Azure PaaS services (such as Azure Storage public endpoints) over their private ExpressRoute connection instead of the internet, while still using their existing IaaS VNet peering. The network team must configure the correct peering type for the SaaS and PaaS traffic. Which ExpressRoute peering type should be enabled to carry the Microsoft 365 and Azure public-service traffic?

Accepted Answer

Microsoft peering, which advertises Microsoft public IP prefixes for SaaS and PaaS services

Answer

Azure private peering, which advertises the VNet address space to the on-premises routers

Answer

Azure public peering, which is required for all PaaS endpoints in current deployments

Answer

A dedicated site-to-site IPsec VPN tunnel running over the ExpressRoute private peering

Question 9

A financial services company is migrating a latency-sensitive trading analytics platform to Microsoft Azure. The business requires a connectivity model that provides a contractual uptime guarantee, predictable low latency, and no dependency on the public internet. The network team already has a partner presence in a carrier-neutral colocation facility that offers Layer 2 connections to Azure peering locations. Which connectivity model should the architect recommend to best meet these requirements?

Accepted Answer

ExpressRoute circuit provisioned through the colocation provider's Layer 2 connection

Answer

Site-to-Site IPsec VPN over the public internet to an Azure VPN Gateway (VpnGw3 SKU)

Answer

Azure Virtual WAN with multiple internet-based VPN connections for scale

Answer

Point-to-Site VPN using OpenVPN for the analytics team's client access

Question 10

A retail company operates 45 branch sites and wants to connect them to workloads hosted in three Azure regions. They need centralized, hub-based routing and automated any-to-any branch connectivity over the public internet without provisioning a dedicated private circuit. Cost sensitivity is high, and they want Microsoft to manage the underlying transit infrastructure. Which internet-based connectivity approach best meets these requirements?

Accepted Answer

Deploy Azure Virtual WAN with a VPN gateway in each hub and connect branches using Site-to-Site IPsec VPN over the internet

Answer

Provision an Azure ExpressRoute circuit in each region and peer the branches through a partner exchange provider

Answer

Configure a single Azure VNet with a Point-to-Site VPN gateway and connect all 45 branch routers as individual clients

Answer

Deploy separate standalone VNets per region and manually configure VNet peering plus per-site IPsec tunnels between each pair

Question 11

A financial services company runs a critical third-party SaaS application that is published by the vendor as an Azure Private Link service. Security policy mandates that all traffic to this SaaS application must traverse the company's existing ExpressRoute private peering circuit and must never be exposed to the public internet, and the application must be reachable using a private IP address inside the company's Azure VNet. Which connectivity approach meets these requirements?

Accepted Answer

Create a Private Endpoint in the company VNet that maps to the vendor's Private Link service, and reach it over the existing ExpressRoute private peering

Answer

Enable ExpressRoute Microsoft peering and access the SaaS application through its public service endpoint

Answer

Deploy a Service Endpoint on the VNet subnet pointing to the vendor's SaaS resource over the Microsoft backbone

Answer

Configure a site-to-site IPsec VPN to the vendor and use NAT to translate the SaaS public IP to a private address

Question 12

A financial services company is deploying a multi-tier application across several Azure virtual networks (VNets) in a hub-and-spoke topology. Compliance auditors require that lateral (east/west) traffic between the web, application, and database tiers be inspected and filtered by a stateful firewall, and that no tier can communicate directly without policy enforcement. The security team wants to centralize this inspection with minimal per-VNet configuration. Which design best meets these requirements?

Accepted Answer

Deploy Azure Firewall in the hub VNet and configure user-defined routes (UDRs) in each spoke to force inter-spoke traffic through the firewall

Answer

Enable VNet peering between all spokes in a full-mesh topology and rely on default Azure NSG rules to segment tiers

Answer

Apply application security groups (ASGs) on each VM's NIC and allow all peered traffic between spokes to pass without central inspection

Answer

Route all east/west traffic out to the internet through Azure NAT Gateway so an external firewall appliance can inspect it before returning

Question 13

A U.S. federal agency contractor is migrating a sensitive workload to AWS GovCloud. Compliance mandates that the workload meet FedRAMP High requirements, and that all data in transit between the on-premises data center and the cloud must never traverse the public internet. The security team also requires that connectivity avoid shared transport infrastructure to reduce the risk of data commingling with other tenants. Which connectivity model should the network architect recommend?

Accepted Answer

AWS Direct Connect using a dedicated connection into AWS GovCloud with MACsec encryption on the physical link

Answer

Site-to-site IPsec VPN over the public internet with AES-256 encryption and FIPS 140-2 validated endpoints

Answer

AWS Direct Connect using a hosted connection provisioned through a partner's shared 10 Gbps port

Answer

Software-defined WAN overlay with dynamic path selection across multiple broadband internet circuits

Question 14

A financial services company runs multiple workloads in Google Cloud across several VPCs. Security policy mandates that all outbound internet-bound traffic from these workloads must be centrally inspected by a next-generation firewall for logging, threat prevention, and URL filtering before leaving the cloud. The design team wants to avoid each VPC egressing directly to the internet. Which connectivity/security design best meets this backhaul internet traffic requirement?

Accepted Answer

Route all workload VPC egress through a centralized hub VPC hosting NGFW appliances, then out to the internet after inspection

Answer

Deploy Cloud NAT in every VPC so each workload can reach the internet directly with source NAT

Answer

Enable Private Google Access on each subnet so traffic stays on Google's backbone

Answer

Assign external IP addresses to each VM and apply hierarchical firewall policies at the organization level

Question 15

A financial services company hosts a customer-facing web application in Google Cloud. Security requires that all inbound connections from the internet must terminate on a managed edge service that provides DDoS protection, TLS offload, and Layer 7 WAF filtering before traffic reaches backend VM instances. The backend instances must not have public IP addresses. Which connectivity and security design for inbound traffic best meets these requirements?

Accepted Answer

Deploy a Global External HTTP(S) Load Balancer with Cloud Armor policies attached, keep backend instances with private IPs only, and allow ingress from the load balancer proxy ranges via VPC firewall rules

Answer

Assign external IP addresses to each backend instance and apply hierarchical firewall policies to filter inbound HTTP traffic directly at each VM

Answer

Use Cloud NAT to publish the backend instances to the internet and rely on VPC ingress firewall rules for Layer 7 filtering

Answer

Configure a Network (Layer 4) Load Balancer with target pools and enable Identity-Aware Proxy on the backend instances for DDoS mitigation

Question 16

A mid-sized retail company is designing private connectivity from its on-premises data center to Google Cloud. Their analysis shows steady-state throughput of about 3 Gbps to VPCs, with occasional bursts. They do not have a physical presence in any Google colocation facility and want to avoid the cost and lead time of provisioning cross-connects in a Google peering location. Availability targets are moderate (99.9%), and they prefer to onboard within a few weeks. Which connectivity model should you recommend?

Accepted Answer

Partner Interconnect through a supported service provider

Answer

Dedicated Interconnect with two 10 Gbps circuits in a Google colocation facility

Answer

HA VPN over the public internet with two tunnels

Answer

Direct Peering at a Google edge point of presence

Question 17

A financial services company runs its data analytics platform in Google Cloud and consumes BigQuery and Cloud Storage as managed SaaS-like services. Compliance rules prohibit any of this traffic from traversing the public internet, and the security team requires that the Google APIs be reached over the private/restricted Google API VIP range (not the public internet) from the on-premises data center over an existing Dedicated Interconnect. Which Google Cloud feature should the network architect configure to meet these requirements?

Accepted Answer

Private Google Access for on-premises hosts using restricted.googleapis.com with routes advertised over Cloud Router

Answer

Cloud NAT with an external static IP to source the API calls from the on-premises range

Answer

A public IP path to Google APIs secured with an HA VPN tunnel over the internet

Answer

VPC Network Peering between the on-premises router and the Google API service project

Question 18

A retail company hosts a fleet of backend processing VMs in a private subnet within a Google Cloud VPC. These VMs have no external IP addresses but must initiate outbound calls to a third-party payment API over the public internet. The security team mandates that no inbound internet connections be permitted to these VMs. Which Google Cloud service should the network architect deploy to meet these requirements?

Accepted Answer

Cloud NAT configured for the private subnet's region

Answer

Cloud Interconnect (Dedicated) with a VLAN attachment

Answer

A Cloud VPN HA tunnel to the on-premises data center

Answer

Private Google Access enabled on the subnet

Question 19

A network engineer is connecting an on-premises Cisco IOS XE router to a native AWS Site-to-Site VPN using two IPsec tunnels terminated on an AWS Virtual Private Gateway. During configuration, the engineer must specify the transform set and IPsec mode required for the tunnel to establish successfully with the AWS native endpoint (which does not support GRE encapsulation). Which IPsec configuration element must be used on the IOS XE Virtual Tunnel Interface (VTI) to match the AWS native VPN endpoint?

Accepted Answer

An IPsec profile referencing a transform set configured with 'mode tunnel', applied to an IPsec VTI (tunnel mode ipsec ipv4)

Answer

A crypto map with 'mode transport' bound to the physical WAN interface

Answer

An IPsec profile with a transform set using 'mode transport', applied to a GRE tunnel interface (tunnel mode gre ip)

Answer

An IKEv1 crypto map using AH transform with 'mode tunnel' applied to the loopback interface

Question 20

A network engineer configures a GRE over IPsec tunnel between an on-premises Cisco IOS XE router and an AWS-hosted Cisco IOS XE router across the public internet. BGP peers establish over the tunnel and small ping tests succeed, but users report that large file transfers and HTTPS sessions to cloud applications stall or fail intermittently. The physical WAN interface uses the standard 1500-byte MTU. What is the most effective configuration change on the tunnel interface to resolve this issue?

Accepted Answer

Set 'ip mtu 1400' and 'ip tcp adjust-mss 1360' on the tunnel interface to account for GRE and IPsec overhead

Answer

Increase the tunnel interface bandwidth statement to match the WAN link speed

Answer

Disable BGP path MTU discovery and lower the BGP keepalive timers on both peers

Answer

Change the IPsec mode from tunnel mode to transport mode to reduce packet size

Question 21

A network engineer is establishing a site-to-site VPN from an on-premises Cisco IOS XE router to a native AWS Virtual Private Gateway (VGW). AWS has generated a configuration file specifying two tunnels, each with a pre-shared key and an inside tunnel address in the 169.254.0.0/16 range. The engineer wants dynamic route exchange over the tunnels using BGP. When configuring the IOS XE tunnel interfaces to match the AWS native endpoint, which combination correctly reflects how the tunnel must be built?

Accepted Answer

Use an IPsec VTI (tunnel mode ipsec ipv4) with the 169.254.x.x inside address and eBGP peering to the AWS-assigned APIPA neighbor

Answer

Use a GRE tunnel (tunnel mode gre ip) protected by an IPsec profile, and assign a public IP as the tunnel source

Answer

Use a crypto map applied to the physical WAN interface with no tunnel interface, and configure static routes to the VPC CIDR

Answer

Use a GRE tunnel with OSPF area 0 across the 169.254.x.x link because AWS VGW only supports OSPF for dynamic routing

Question 22

A network engineer is configuring a route-based IPsec (VTI) tunnel from an on-premises Cisco IOS XE router to a native Azure VPN Gateway (route-based, Generation 2). The IKEv2 SA is failing to establish, and debugs on the IOS XE router show the negotiation stalling during the IKE_SA_INIT exchange. The engineer confirms that the pre-shared key, IKEv2 encryption, and integrity algorithms are all correctly matched to Azure's default IPsec/IKE policy. Which additional IKEv2 proposal parameter must the engineer verify matches the Azure default policy to allow IKE_SA_INIT to complete?

Accepted Answer

The Diffie-Hellman (DH) group configured in the IKEv2 proposal

Answer

The IPsec transform-set ESP mode (tunnel vs. transport)

Answer

The BGP hold-timer value on the tunnel interface

Answer

The Perfect Forward Secrecy (PFS) group in the IPsec profile

Question 23

You are configuring a route-based IPsec VPN from an on-premises Cisco IOS XE router to a native Azure VPN Gateway (VpnGw2, Generation2). Azure will terminate the tunnel using IKEv2. To ensure Phase 2 (IPsec SA / child SA) negotiation succeeds with Azure's default supported parameters while maximizing hardware-accelerated throughput, which IPsec transform set should you configure on the IOS XE router?

Accepted Answer

crypto ipsec transform-set AZURE-TS esp-gcm 256, with mode tunnel

Answer

crypto ipsec transform-set AZURE-TS esp-des esp-md5-hmac, with mode tunnel

Answer

crypto ipsec transform-set AZURE-TS esp-3des esp-sha-hmac, with mode transport

Answer

crypto ipsec transform-set AZURE-TS ah-sha256-hmac, with mode tunnel

Question 24

A network engineer is building a GRE-over-IPsec tunnel from an on-premises Cisco IOS XE router to an Azure native VPN Gateway. Because the Azure VPN Gateway does not support GRE encapsulation, the engineer must terminate the design using a supported model while still reaching the 10.50.0.0/16 Azure VNet address space. The on-premises router uses a route-based configuration with a virtual tunnel interface (Tunnel1) and no dynamic routing protocol is permitted by policy. Which action correctly establishes reachability to the Azure VNet over this tunnel?

Accepted Answer

Configure Tunnel1 as an IPsec VTI (tunnel mode ipsec ipv4) and add a static route for 10.50.0.0/16 pointing to Tunnel1

Answer

Configure Tunnel1 with tunnel mode gre ip and a tunnel protection ipsec profile, then add a static route for 10.50.0.0/16 to Tunnel1

Answer

Configure a crypto map with a GRE ACL matching 10.50.0.0/16 and bind it to the physical interface

Answer

Enable BGP over the GRE tunnel to learn 10.50.0.0/16 dynamically from the Azure VPN Gateway

Question 25

A network engineer is designing GRE-over-IPsec connectivity from an on-premises Cisco IOS XE router to a native Azure VPN Gateway (not a cloud-hosted IOS XE instance). The design requires a routed tunnel interface running BGP over the encrypted overlay. During testing, IKEv2 and IPsec SAs come up successfully, but the GRE tunnel interface never reaches the up/up state and no BGP session forms. What is the most likely root cause of this failure?

Accepted Answer

The native Azure VPN Gateway does not support GRE encapsulation; it terminates route-based IPsec using VTI, so GRE-over-IPsec cannot be used and a plain IPsec VTI tunnel must be configured instead

Answer

The IKEv2 proposal on the IOS XE router is missing the GRE transform, which prevents the tunnel keepalives from being encrypted

Answer

BGP must be configured before the GRE tunnel interface is created, otherwise the tunnel remains administratively down

Answer

The Azure VPN Gateway requires the GRE tunnel key to match the IPsec pre-shared key for the tunnel to establish

Question 26

A network engineer is building a GRE over IPsec tunnel from an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in AWS. Both sides use IKEv2 with pre-shared key authentication. The IKEv2 SA comes up intermittently and the logs on the on-premises router show 'IKEv2 profile not found' during some negotiations, even though a single IKEv2 profile is configured. The peer sits behind a NAT device, so the source address seen for its IKE negotiations does not match the address configured in the profile. What is the most likely configuration cause and the correct fix?

Accepted Answer

The IKEv2 profile 'match identity remote address' statement uses the peer's private IP; change it to match the remote IKE identity by FQDN/key-id or use 'match identity remote any' so the profile is selected regardless of the NAT-translated source address

Answer

The tunnel is missing 'tunnel mode ipsec ipv4'; add it to force IPsec transport so the profile can be applied

Answer

The crypto IKEv2 proposal lists an unsupported DH group; remove group 14 and use group 2 to match AWS defaults

Answer

NAT traversal is disabled; enter 'crypto ipsec nat-transparency udp-encapsulation' to allow the profile to load

Question 27

An engineer is establishing an IPsec tunnel from an on-premises Cisco IOS XE router to a cloud-hosted Cisco IOS XE router in AWS. The on-premises router sits behind a corporate firewall that performs PAT (NAT overload) for all outbound traffic. IKEv2 Phase 1 negotiation begins but the tunnel never fully establishes, and debugs show the peers detecting an address translation during negotiation. Which behavior must occur for the IPsec tunnel to establish successfully through the PAT device?

Accepted Answer

The peers must switch ESP encapsulation to UDP port 4500 after NAT is detected during IKE_SA_INIT

Answer

The peers must disable NAT detection payloads so ESP is sent natively over IP protocol 50

Answer

The PAT device must be reconfigured to forward IP protocol 50 to the on-premises router's inside address

Answer

The peers must fall back to IKEv1 aggressive mode to allow ESP traversal of the PAT device

Question 28

A network engineer is configuring a GRE over IPsec tunnel from an on-premises Cisco IOS XE router to a Google Cloud HA VPN gateway that terminates a native (non-Cisco) endpoint. The engineer wants to protect the GRE tunnel with IPsec and dynamically exchange routes over the overlay. When reviewing the design, the team lead notes that the chosen Google Cloud HA VPN gateway does not support GRE encapsulation at all. What is the correct action to establish encrypted, routed connectivity to this native Google Cloud endpoint?

Accepted Answer

Replace the GRE over IPsec design with a route-based IPsec VTI (tunnel mode IPsec) using IKEv2 and run BGP over the VTI to the Cloud Router

Answer

Configure a GRE tunnel with 'tunnel key' matching the Google Cloud gateway ID and apply the IPsec profile to the GRE interface

Answer

Encapsulate GRE inside a DMVPN mGRE interface and peer NHRP with the Google Cloud HA VPN gateway

Answer

Enable GRE keepalives on the tunnel and switch the crypto map to transport mode so the native endpoint accepts the GRE packets

Question 29

A network engineer is building a GRE-over-IPsec design from an on-premises Cisco IOS XE router to a native Google Cloud HA VPN gateway. The requirement is that the connection provide a 99.99% availability SLA from Google. During design review, a colleague proposes terminating a single IPsec tunnel from the IOS XE router to one HA VPN gateway interface. What must the engineer do instead to meet the SLA requirement?

Accepted Answer

Configure two IPsec tunnels from the IOS XE router, one to each of the HA VPN gateway's two interfaces (each with its own external IP), and advertise routes over both with BGP.

Answer

Configure a single IPsec tunnel but enable Dead Peer Detection (DPD) with aggressive timers so the tunnel re-establishes quickly after a failure.

Answer

Terminate the single tunnel on a Google Cloud Classic VPN gateway instead, since Classic VPN provides the 99.99% SLA for single-tunnel designs.

Answer

Deploy two separate on-premises IOS XE routers, each with one tunnel to the same single HA VPN gateway interface.

Question 30

A network engineer is designing GRE over IPsec connectivity from an on-premises Cisco IOS XE router to a native Google Cloud HA VPN gateway. The engineer initially proposed running a GRE tunnel encapsulated in IPsec directly to the Cloud VPN gateway endpoint. During validation, the tunnel to the native Cloud VPN gateway will not establish the GRE overlay. What is the correct explanation and remediation for connecting to the native Google Cloud VPN endpoint?

Accepted Answer

Google Cloud native HA VPN gateways do not support GRE; the engineer must use a plain IPsec tunnel (IKEv2 with a VTI) directly to the Cloud VPN endpoint and run BGP over the tunnel interface.

Answer

GRE will work once the engineer disables IKEv2 and switches to IKEv1 main mode, since Google Cloud only negotiates GRE keys during IKEv1.

Answer

The GRE tunnel fails because DPD is enabled; disabling Dead Peer Detection on both ends allows the GRE overlay to form over the native gateway.

Answer

The engineer must enable jumbo MTU of 9000 bytes on the tunnel, because native Cloud VPN gateways require GRE frames larger than 1500 bytes to complete the overlay handshake.

Question 31

A network engineer is building a GRE over IPsec tunnel from an on-premises Cisco IOS XE router to a cloud-hosted Cisco IOS XE router in AWS to run eBGP across the overlay. After configuring the IPsec profile, tunnel interface, and BGP peering over the tunnel IP addresses, the IPsec SA comes up and the BGP session reaches Established, but it repeatedly resets once the peers exchange their full routing tables, and large file transfers across the tunnel stall. The tunnel source is a public interface behind a 1500-byte MTU internet path. What is the MOST likely cause and the correct remediation?

Accepted Answer

The tunnel keepalives and BGP packets are being dropped due to fragmentation; lower the tunnel IP MTU and set 'ip tcp adjust-mss' on the tunnel interface to account for GRE and IPsec overhead

Answer

The IPsec profile is applied in tunnel mode; change it to transport mode so BGP multicast hellos can traverse the tunnel

Answer

eBGP is unsupported over GRE/IPsec overlays to cloud endpoints; replace BGP with a static default route pointing at the tunnel interface

Answer

The tunnel keepalive interval is too long; disable GRE keepalives entirely so the line protocol stops flapping

Question 32

A retail company is deploying new branch sites that need connectivity to workloads hosted in Google Cloud. The company wants to avoid the cost and lead time of provisioning dedicated circuits, but still requires encrypted transport and dynamic routing between the branches and the cloud VPC. Which internet-based connectivity approach best meets these requirements?

Accepted Answer

Establish an IPsec VPN over the public internet using Cloud Router with BGP to the branch edge devices

Answer

Provision a Google Cloud Interconnect dedicated circuit terminating at a colocation facility

Answer

Use Google Cloud Partner Interconnect through a supported service provider

Answer

Peer directly with Google's public ASN at an internet exchange point using unencrypted BGP

Question 33

A retail company is deploying a new branch-to-cloud design to reach workloads hosted in a Google Cloud VPC. The network team must use the existing public internet circuits (no dedicated physical cross-connect is budgeted this quarter), but the design must survive the failure of a single Google-side tunnel endpoint and provide a Google-backed availability SLA. Which internet-based connectivity approach to Google Cloud best meets these requirements?

Accepted Answer

Deploy Google Cloud HA VPN with two tunnels terminating on separate Cloud VPN gateway interfaces, each with its own external IP, using BGP for dynamic failover

Answer

Deploy a single Classic VPN tunnel to the Cloud VPN gateway and rely on static routes for reachability

Answer

Provision a Dedicated Interconnect with two VLAN attachments in different metros

Answer

Configure a Partner Interconnect through a supported service provider with a single VLAN attachment

Question 34

A retail company is deploying a new branch-heavy architecture and wants to connect 30 branch sites to workloads running across multiple VPCs in a single AWS region. The networking team requires internet-based connectivity (no dedicated circuit budget), centralized route management across all VPCs, and encrypted transport. Which AWS connectivity approach best meets these requirements?

Accepted Answer

Terminate IPsec VPN connections on an AWS Transit Gateway and attach the VPCs to the Transit Gateway for centralized routing

Answer

Establish individual IPsec site-to-site VPN tunnels from each branch directly to a Virtual Private Gateway (VGW) attached to every VPC

Answer

Provision AWS Direct Connect with a private virtual interface to each VPC and encrypt with MACsec

Answer

Use AWS PrivateLink endpoints to expose each VPC service to the branch sites over the internet

Question 35

A retail company hosts its inventory microservices on Cisco Catalyst SD-WAN branch routers that must reach an application published in a partner's AWS VPC. The partner exposes the application only through an AWS PrivateLink endpoint service and will not accept traffic over the public internet. The company already terminates its cloud gateway in a hub VPC using a Cisco Cloud OnRamp for Multicloud deployment. Which approach lets the branches consume the partner's application while keeping the traffic off the public internet?

Accepted Answer

Create an interface VPC endpoint in the hub VPC that connects to the partner's endpoint service, and advertise the endpoint's private IP into the SD-WAN fabric

Answer

Assign the partner application an Elastic IP and have branches reach it over an internet-based IPsec overlay to the AWS Internet Gateway

Answer

Configure a NAT gateway in the hub VPC so branch traffic is source-translated to the partner's public API endpoint

Answer

Establish VPC peering directly between each branch site's local network and the partner VPC to access the endpoint service

Question 36

A network engineer is configuring a route-based IPsec VPN from an on-premises Cisco IOS XE router to a native Azure VPN Gateway over the internet. The design requires that traffic selectors be defined by the routing table rather than by policy-based ACLs, so that additional Azure VNets can be reached later simply by adding routes. Which IOS XE configuration approach meets this requirement?

Accepted Answer

Configure a static Virtual Tunnel Interface (sVTI) and route interesting traffic via the tunnel interface

Answer

Use a static crypto map with an ACL matching each source/destination subnet pair

Answer

Configure a dynamic crypto map bound to the outside interface with reverse-route injection only

Answer

Use a GRE tunnel with no IPsec protection and rely on Azure to encrypt the payload

Question 37

An engineer connects an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in Azure over an IPsec VPN using a route-based (VTI) tunnel. The on-premises site runs OSPF internally, while eBGP is used across the IPsec tunnel to the cloud router to exchange prefixes. The engineer redistributes BGP-learned cloud prefixes into the on-premises OSPF process. After the change, internal OSPF routers receive the cloud prefixes but users report that traffic to the cloud is intermittently blackholed when a second, less-preferred WAN path also injects the same prefixes. What is the most effective way to ensure the OSPF-redistributed cloud routes are correctly and consistently preferred?

Accepted Answer

Redistribute the BGP routes into OSPF as external type 1 (E1) with a route-map that tags them, and filter/adjust metrics on the redundant path so the intended tunnel path wins on cumulative cost

Answer

Change the eBGP session to iBGP so the cloud prefixes carry an unchanged AS_PATH into the OSPF domain

Answer

Redistribute the routes as OSPF external type 2 (E2) with the default metric on both WAN paths so OSPF always load-balances between them

Answer

Disable OSPF entirely on the tunnel-facing router and rely on static default routes pointing at the IPsec VTI interface

Question 38

A network engineer connects an on-premises Cisco IOS XE router to Google Cloud using two HA VPN tunnels, each terminating on a separate Cloud Router BGP interface in the same region. The on-premises router establishes eBGP sessions over both tunnels and receives identical prefixes from Google Cloud with the same AS-path length and MED. The engineer wants outbound traffic from on-premises to actively use both tunnels simultaneously for the cloud-bound prefixes. What must be configured on the Cisco IOS XE router to achieve this?

Accepted Answer

Enable 'maximum-paths 2' under the BGP address-family so equal-cost eBGP paths are installed for load sharing

Answer

Configure a lower local-preference on one tunnel's received routes to force deterministic primary/backup behavior

Answer

Apply 'bgp bestpath as-path multipath-relax' only, without any maximum-paths statement

Answer

Prepend the AS-path on one eBGP neighbor so both paths appear equal and are automatically used

Question 39

An engineer troubleshoots a route-based IPsec tunnel from a Cisco IOS XE router to a native Azure VPN gateway. The IOS XE router sits behind a corporate firewall that performs PAT (NAT overload) on its public interface. IKEv2 negotiation begins but never completes; 'show crypto ikev2 sa' shows the SA stuck in the IN-NEG state, and debugs show the Azure gateway is not authenticating the peer. The pre-shared keys, transform sets, and DH groups all match. What is the MOST likely cause?

Accepted Answer

IKEv2 is authenticating with the router's private IP as the IKE identity, which does not match the peer address Azure expects; the identity must be set to the public FQDN or address

Answer

The tunnel MTU is too large, causing the IKE_AUTH packet to fragment and be dropped by the firewall

Answer

Azure only supports policy-based (crypto map) VPNs, so the route-based VTI configuration is invalid

Answer

BGP has not established over the tunnel, which prevents Phase 1 from completing

Question 40

An engineer connects an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in an AWS VPC using two parallel IPsec VTI tunnels for redundancy. Both tunnels run eBGP over the tunnel interfaces to the same remote AS. The engineer notices that only one tunnel carries traffic, even though both BGP sessions are established and advertising the same prefixes. Return traffic from AWS also uses only a single tunnel. The engineer wants both tunnels to actively share load for the cloud-destined prefixes. Which configuration change on the IOS XE routers achieves this?

Accepted Answer

Enable 'maximum-paths 2' under the BGP address family on both routers so equal-cost eBGP paths are installed and used simultaneously

Answer

Change both tunnels from VTI to crypto map based configuration so IPsec can hash traffic across the tunnels

Answer

Configure 'bgp bestpath as-path multipath-relax' only on the on-premises router to relax the path selection

Answer

Increase the BGP hold timer on the standby tunnel so both sessions remain equally preferred

Question 41

An engineer configures a redundant design where an on-premises Cisco IOS XE router forms IPsec VTI tunnels to two AWS VGWs in separate regions. Both regions are interconnected, and AWS re-advertises the on-premises prefixes learned from one region toward the other. The IOS XE router logs no errors, tunnels are up, and BGP is established on both tunnels, but the router refuses to install the prefixes AWS advertises from the second region. 'show ip bgp' shows those prefixes received but with the reason 'received-only'. What is the most likely cause?

Accepted Answer

The router rejects the routes because its own ASN appears in the received AS-PATH (BGP loop prevention)

Answer

The IKEv2 rekey lifetime differs between the two tunnels, invalidating Phase 2 SAs

Answer

The tunnel MTU is too small, causing BGP UPDATE packets to be fragmented and dropped

Answer

The AWS VGW is advertising the prefixes with a MED higher than the local preference threshold

Question 42

An engineer manages an IPsec VTI tunnel between a Cisco IOS XE router and an AWS VGW. The AWS side advertises the VPC CIDR 10.20.0.0/16 to the router via BGP, and the router receives it correctly (visible in 'show ip bgp'). However, the route never appears in the IOS XE routing table, so on-premises hosts cannot reach the VPC. The tunnel is up, the BGP session is Established, and 'show ip bgp 10.20.0.0/16' shows the prefix marked with 'not advertised to any peer' and a status code of 'r RIB-failure'. What is the most likely cause?

Accepted Answer

A static route for 10.20.0.0/16 with a lower administrative distance already exists, preventing the BGP-learned route from being installed in the RIB

Answer

The IKEv2 Phase 2 lifetime is mismatched, causing the SA to expire before the route can be installed

Answer

The BGP neighbor is missing the 'next-hop-self' command, so the next hop is unreachable

Answer

AWS VGW only supports static routing, so BGP-learned prefixes are silently discarded

Question 43

An engineer diagnoses a route-based IPsec VTI tunnel between an on-premises Cisco IOS XE router and an AWS Virtual Private Gateway (VGW). The tunnel is up and the BGP session with AWS reaches the Established state, but the router logs show '%BGP-5-NBRSTATE: neighbor 169.254.10.1 Up' followed minutes later by repeated '%BGP-4-MAXPFX: No. of prefix received from 169.254.10.1 reached 100, max 100' messages, and the neighbor then transitions to Idle (PfxCt). On-premises reachability to VPC subnets breaks each time this occurs. What is the MOST likely cause?

Accepted Answer

The router's 'maximum-prefix' limit configured under the BGP neighbor is set too low for the number of routes AWS advertises, so BGP tears down the session when the limit is exceeded

Answer

The IKEv2 rekey lifetime on the IOS XE side is shorter than the AWS side, causing the tunnel to renegotiate and drop the BGP session

Answer

The AWS VGW is sending routes with an AS-path loop that the IOS XE router rejects, preventing prefix installation

Answer

BGP keepalive and hold timers are mismatched, causing the neighbor to time out after establishing

Question 44

A network engineer has built two IPsec VTI tunnels from an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in an AWS VPC. Both tunnels run eBGP and advertise the same on-premises prefixes. The engineer wants all traffic sourced from the cloud-hosted router destined to on-premises to prefer Tunnel1, using Tunnel2 only if Tunnel1 fails. Which BGP attribute should be configured, and on which router, to achieve this deterministic outbound path selection from the cloud router?

Accepted Answer

Configure a higher LOCAL_PREF on the cloud-hosted IOS XE router for prefixes received over Tunnel1

Answer

Configure AS-path prepending on the on-premises router for prefixes advertised over Tunnel2

Answer

Configure a lower MED on the on-premises router for prefixes advertised over Tunnel1

Answer

Configure a higher weight on the on-premises router for routes received over Tunnel1

Question 45

An engineer configures a Cisco IOS XE router as a route reflector for two internal iBGP peers (branch routers) while also maintaining an IPsec VTI eBGP session to an AWS Virtual Private Gateway. The AWS-learned VPC prefixes appear in the route reflector's BGP table as best paths, but the two iBGP branch peers install the AWS prefixes with an unreachable next hop and the routes fail to enter their RIB. The eBGP session to AWS is stable and the tunnel is up. What is the most likely cause?

Accepted Answer

The route reflector is advertising the AWS prefixes to iBGP peers without modifying the next hop, so the branches receive the AWS tunnel-endpoint next hop, which they cannot resolve

Answer

The AWS Virtual Private Gateway is prepending its ASN, causing the branches to reject the routes due to AS-path loop detection

Answer

Phase 2 PFS mismatch on the VTI is preventing prefix installation on the branch routers

Answer

The route reflector is missing the 'bgp additional-paths' command required to reflect eBGP-learned routes to iBGP clients

Question 46

An engineer configured a redundant IPsec VTI design between a Cisco IOS XE router and two AWS VPN tunnels toward a Transit Gateway. eBGP sessions to both AWS tunnel inside addresses come up and routes are learned. However, traffic destined to the VPC subnets is intermittently blackholed. On IOS XE, 'show ip route' shows the VPC prefixes as BGP routes whose next-hop is the AWS tunnel inside IP, but that next-hop is resolved via the default route pointing to the physical internet interface rather than the tunnel interface. What is the most likely cause of the blackholing?

Accepted Answer

The BGP next-hop for the learned prefixes is recursively resolving out the physical internet interface instead of the Tunnel interface, because the tunnel inside subnet is not directly attached or reachable via the correct tunnel

Answer

The IKEv2 rekey lifetime is mismatched, causing Phase 2 SAs to drop periodically

Answer

BGP maximum-paths is not configured, so only one tunnel is used and it flaps

Answer

The tunnel MTU is too high, causing large packets to be dropped due to DF-bit fragmentation

Question 47

An engineer manages an IPsec VTI tunnel from a Cisco IOS XE router to an AWS VPN gateway with eBGP over the tunnel. The tunnel interface is stable, but the AWS-learned prefixes for a specific VPC (10.50.0.0/16) intermittently disappear from the IOS XE routing table for several minutes at a time, then reappear. Other prefixes learned over the same BGP session remain stable throughout. 'show ip bgp 10.50.0.0/16' during the outage shows the path exists but is marked as 'dampened' with an accumulated penalty. What is the most likely cause?

Accepted Answer

BGP route dampening is configured on the IOS XE router, and the flapping upstream prefix accumulated enough penalty to be suppressed until its penalty decayed below the reuse limit

Answer

The IKEv2 SA for that traffic selector is rekeying and dropping the specific prefix during Phase 2 negotiation

Answer

AWS is applying inbound AS-path prepending only to the 10.50.0.0/16 prefix, causing it to lose the best-path selection intermittently

Answer

The tunnel MTU is too small for the larger BGP update carrying 10.50.0.0/16, causing that update to be dropped repeatedly

Question 48

A network engineer has established a redundant IPsec VTI connection between an on-premises Cisco IOS XE router and a Cisco IOS XE router hosted in AWS. The on-premises router advertises 40 individual /24 prefixes over BGP toward the AWS-hosted router. The cloud team reports that the AWS-hosted router is receiving all 40 routes, but they want the on-premises router to advertise only a single aggregate prefix (10.10.0.0/18) while suppressing the more-specific /24 routes to reduce the BGP table size. Which configuration on the on-premises router achieves this?

Accepted Answer

aggregate-address 10.10.0.0 255.255.192.0 summary-only under the BGP address-family

Answer

aggregate-address 10.10.0.0 255.255.192.0 as-set under the BGP address-family

Answer

network 10.10.0.0 mask 255.255.192.0 under the BGP address-family

Answer

neighbor <peer> maximum-prefix 1 under the BGP address-family

Question 49

An engineer builds a route-based IPsec VTI tunnel between an on-premises Cisco IOS XE router and an AWS cloud-hosted Cisco IOS XE router across the internet. The tunnel establishes successfully and passes traffic, but every few hours users report a brief drop of about 20-30 seconds, after which connectivity restores by itself. Debugs on the on-premises router show IKEv2 CHILD_SA re-creation events coinciding with the outages, and the two routers are configured with different IPsec SA lifetimes (on-prem 3600 seconds, AWS side 28800 seconds). What is the MOST likely cause of the periodic outage, and what corrective action addresses it?

Accepted Answer

The mismatched IPsec SA lifetimes cause the peer with the shorter lifetime to trigger a rekey that the other peer processes slowly; align the IPsec (CHILD_SA) lifetimes and ensure the IKEv2 profiles allow smooth rekeying to eliminate the reconvergence gap.

Answer

The IKEv2 proposal encryption transforms do not match, forcing full tunnel renegotiation; reconfigure both routers to use identical encryption and integrity algorithms.

Answer

BGP hold timers are expiring on the tunnel; increase the BGP keepalive and hold-time values on both routers to prevent the neighbor from resetting.

Answer

The tunnel MTU is too large, causing periodic fragmentation drops; lower the tunnel interface MTU and apply a TCP MSS clamp to stop the outages.

Question 50

An engineer manages a site-to-site IPsec VTI tunnel between an on-premises Cisco IOS XE router and an AWS VPN gateway. The tunnel comes up successfully and passes traffic, but every hour users report a brief loss of connectivity to VPC-hosted applications. 'show crypto ipsec sa' on the IOS XE router shows the SA being torn down and rebuilt at regular intervals with a momentary gap before traffic resumes. Phase 1 stays up throughout. Which action most directly resolves the periodic drop?

Accepted Answer

Align the IPsec (Phase 2) SA lifetime on the IOS XE router with the AWS default and ensure the rekey occurs before expiry rather than on hard timeout

Answer

Increase the IKEv2 dead peer detection (DPD) interval on the IOS XE router to prevent premature Phase 1 teardown

Answer

Change the tunnel interface MTU to 1400 and enable TCP MSS clamping to 1360 on the IOS XE router

Answer

Enable perfect forward secrecy (PFS) with DH group 14 in the IPsec transform set to speed up SA negotiation

Question 51

An engineer configured a route-based IPsec VTI tunnel from an on-premises Cisco IOS XE router to an AWS VPN gateway. IKEv2 Phase 1 completes successfully and the SA is established, but no Phase 2 IPsec SA forms and 'show crypto ipsec sa' shows zero encrypted/decrypted packets. Debug output on the router shows 'ts_unacceptable' notifications received from AWS. What is the most likely cause?

Accepted Answer

The router's IPsec profile applies a crypto ACL with specific proxy IDs instead of the any/any (0.0.0.0/0) traffic selectors that AWS route-based VPN expects

Answer

The IKEv2 proposal on the router uses a different DH group than the AWS-side policy

Answer

The tunnel interface MTU is set too high, causing fragmentation of the Phase 2 negotiation packets

Answer

BGP has not yet converged, so the router has no routes to send into the tunnel

Question 52

An engineer connects an on-premises Cisco IOS XE router to an Azure VNet using two IPsec VTI tunnels to a route-based Azure VPN Gateway, both running BGP. Azure is advertising the same VNet prefix (10.50.0.0/16) over both tunnels, and the on-premises router is load-sharing return traffic across both. The requirement is that Tunnel1 be the primary path for all traffic destined to Azure, with Tunnel2 used only if Tunnel1 fails. Which action on the Cisco IOS XE router achieves deterministic primary/backup path selection for traffic sent TO Azure?

Accepted Answer

Apply an inbound route-map on the Tunnel2 BGP neighbor that sets a lower local-preference for the 10.50.0.0/16 prefix learned over Tunnel2

Answer

Apply an outbound route-map toward the Tunnel2 neighbor that adds AS-path prepends to the advertised on-premises prefixes

Answer

Configure MED (metric) higher on the routes advertised outbound over Tunnel1 to Azure

Answer

Enable BGP multipath so both tunnels are installed and let ECMP hashing prefer Tunnel1

Question 53

An engineer has established an IPsec VTI tunnel from an on-premises Cisco IOS XE router to an Azure VPN Gateway configured for BGP. The BGP session over the tunnel comes up successfully and the router learns the Azure VNet prefix 10.20.0.0/16. However, Azure never learns the on-premises prefix 192.168.50.0/24, and no traffic can reach on-premises resources from the VNet. The on-premises subnet is directly connected to a LAN interface and BGP is otherwise configured correctly. What is the most likely cause?

Accepted Answer

The router is missing a 'network 192.168.50.0 mask 255.255.255.0' statement (or redistribution) under the BGP process, so the prefix is never advertised to Azure.

Answer

Azure VPN Gateway does not support receiving /24 prefixes over BGP and requires prefix aggregation to /16.

Answer

The tunnel MTU is too small, preventing BGP UPDATE messages carrying the prefix from being transmitted.

Answer

The IKEv2 proposal must include the on-premises subnet in the crypto ACL for the route to be advertised via BGP.

Question 54

A network engineer configures a route-based IPsec VPN using an IKEv2 VTI (Virtual Tunnel Interface) between an on-premises Cisco IOS XE router and an Azure VPN Gateway. The tunnel establishes successfully, but during a simulated failure test the Azure gateway reboots and the on-premises router keeps the SA active for several minutes, blackholing traffic until the tunnel is manually cleared. Which configuration change on the IOS XE router will allow it to detect the dead peer and tear down the stale SA automatically?

Accepted Answer

Enable IKEv2 Dead Peer Detection (DPD) by configuring 'crypto ikev2 dpd periodic' in the IKEv2 profile

Answer

Lower the IPsec SA lifetime with 'crypto ipsec security-association lifetime seconds 300'

Answer

Configure 'tunnel protection ipsec profile' with 'shared' keyword on the VTI

Answer

Increase the IKEv2 SA lifetime so the tunnel rekeys less frequently

Question 55

An on-premises Cisco IOS XE router terminates a route-based IPsec VTI tunnel to an Azure VPN Gateway. BGP is running across the tunnel. The network team wants all Azure-hosted VMs to reach the internet through the on-premises perimeter firewall by learning a default route dynamically from the IOS XE router, without adding any static routes on the Azure side. Which IOS XE BGP configuration achieves this?

Accepted Answer

Configure 'neighbor <azure-ip> default-originate' under the BGP address-family so the router advertises 0.0.0.0/0 to the Azure VPN Gateway

Answer

Add a 'network 0.0.0.0 mask 0.0.0.0' statement and expect the Azure Gateway to accept it as a summary

Answer

Redistribute a static route to Null0 for 0.0.0.0/0 into BGP without any route-map filtering

Answer

Configure 'neighbor <azure-ip> next-hop-self' so Azure installs the tunnel endpoint as its default gateway

Question 56

An engineer configures two IPsec VTI tunnels from a Cisco IOS XE router to an Azure VPN gateway that operates in active-active mode. Both eBGP sessions to the Azure gateway instances are established, and both are receiving the same Azure VNet prefix (10.20.0.0/16). However, 'show ip route 10.20.0.0' displays only a single next hop, and traffic is not load-sharing across both tunnels. IPsec and BGP are otherwise healthy. Which configuration change on the IOS XE router will enable traffic to use both tunnels?

Accepted Answer

Add 'maximum-paths 2' under the BGP IPv4 address family so equal-cost eBGP paths are installed

Answer

Enable 'bgp bestpath as-path multipath-relax' because the two Azure instances use different AS numbers

Answer

Increase the BGP hold timer on both neighbors so the second path is not aged out

Answer

Configure 'bgp always-compare-med' to force the router to consider both advertised paths equally

Question 57

An engineer maintains an IPsec VTI tunnel from a Cisco IOS XE router to an Azure VPN gateway with eBGP over the tunnel. During brief, sub-second control-plane restarts on the IOS XE router (SSO switchovers on a dual-RP chassis), branch users report short traffic drops even though the tunnel interface never goes down. The Azure gateway supports BGP graceful restart. What should the engineer verify or configure on the IOS XE router to preserve forwarding across these restarts?

Accepted Answer

Enable BGP graceful restart (bgp graceful-restart) under the router bgp process so forwarding continues using stale routes while the BGP session re-establishes

Answer

Lower the BGP keepalive and hold timers to 3 and 9 seconds so the session detects and reconverges faster during the switchover

Answer

Configure BFD on the tunnel to trigger immediate route withdrawal when the RP switches over

Answer

Increase the IPsec SA lifetime so the tunnel does not rekey during the control-plane restart

Question 58

A network engineer has built two IPsec VTI tunnels from an on-premises Cisco IOS XE router to a single Azure VPN Gateway (active-active) and established eBGP over both tunnels. The on-premises router advertises the same on-prem prefix 10.10.0.0/16 over both tunnels. Azure is load-balancing return traffic across both tunnels, but the engineer wants Azure to prefer Tunnel 1 for all return traffic to 10.10.0.0/16, keeping Tunnel 2 purely as backup. Which action on the IOS XE router achieves this influence over Azure's inbound path selection?

Accepted Answer

Apply an outbound route-map on the Tunnel 2 BGP neighbor that sets a higher MED (metric) for 10.10.0.0/16

Answer

Apply an outbound route-map on the Tunnel 1 BGP neighbor that sets a higher local-preference for 10.10.0.0/16

Answer

Configure a higher BGP weight for the Tunnel 1 neighbor on the IOS XE router

Answer

Increase the OSPF cost on Tunnel 2 and redistribute the prefix into BGP

Question 59

An engineer built a route-based IPsec VTI tunnel from a Cisco IOS XE router to an Azure VPN Gateway. The tunnel is up and eBGP with the Azure gateway is established. The on-premises router learns Azure VNet prefixes via BGP, but Azure workloads cannot reach the on-premises 10.20.0.0/16 subnet. On IOS XE, 'show ip bgp neighbors <azure-ip> advertised-routes' shows no prefix for 10.20.0.0/16, even though the route is present in the local RIB and BGP table. What is the MOST likely cause?

Accepted Answer

An outbound BGP route-map or prefix-list toward the Azure neighbor is filtering the 10.20.0.0/16 advertisement

Answer

The IPsec Phase 2 SA lifetime is mismatched, preventing prefix exchange in that direction

Answer

Azure VPN Gateway does not support advertising customer prefixes larger than /24

Answer

The tunnel interface MTU is too small, dropping the BGP UPDATE containing the prefix

Question 60

An engineer manages a route-based IPsec VTI tunnel from an on-premises Cisco IOS XE router to an Azure VPN Gateway. The tunnel came up successfully, but after several hours users report intermittent loss of connectivity to Azure workloads. On the IOS XE router, 'show crypto ikev2 sa' shows the SA state flapping between READY and DELETING, and the logs contain repeated 'IKEv2-ERROR: Received INVALID_SPI notify' messages. Ping traffic recovers only after a manual 'clear crypto ikev2 sa'. What is the MOST likely cause of this behavior?

Accepted Answer

Dead Peer Detection (DPD) is disabled on the IOS XE router, so it cannot detect and rebuild the stale SA after the Azure gateway performs a maintenance-driven rekey

Answer

The IKEv2 proposal on IOS XE offers only DH group 2, which Azure rejects during the initial exchange

Answer

The BGP hold timer is shorter than the IKEv2 SA lifetime, causing the routing session to drop before Phase 2 rekeys

Answer

The tunnel MTU is set too high, causing large packets to be fragmented and dropped by Azure

Question 61

An engineer configures OSPF over an IPsec VTI between a Cisco IOS XE router and an Azure VNet appliance to exchange routes. Phase 1 and Phase 2 complete successfully, and pings across the tunnel succeed with small packets. However, the OSPF adjacency is stuck in EXSTART/EXCHANGE and never reaches FULL. Debugging shows the routers exchanging DBD packets repeatedly. What is the MOST likely root cause?

Accepted Answer

An MTU mismatch on the tunnel interfaces causes large DBD packets to be dropped, preventing the exchange from completing

Answer

The OSPF process IDs differ between the IOS XE router and the Azure appliance

Answer

IPsec Phase 2 PFS group is mismatched, silently dropping OSPF traffic

Answer

The OSPF area IDs match but authentication keys are absent, blocking hello packets

Question 62

An engineer runs OSPF over an IPsec VTI (Tunnel10) between an on-premises Cisco IOS XE router and an Azure-hosted IOS XE NVA. IKEv2 and IPsec Phase 2 are up, and the tunnel interface shows line protocol up/up with correct IP addressing on the /30. However, the OSPF neighbor stays stuck in EXSTART/EXCHANGE and never reaches FULL. Debug shows the routers repeatedly retransmitting DBD packets. What is the MOST likely cause?

Accepted Answer

There is an MTU mismatch on the tunnel interfaces, so large DBD packets are dropped

Answer

The OSPF process IDs differ between the two routers, preventing adjacency formation

Answer

The OSPF network type is set to point-to-point on one side and broadcast on the other

Answer

The IPsec transform set uses AES-GCM, which is incompatible with OSPF over a VTI

Question 63

A network engineer establishes an IPsec VTI (tunnel mode, IPv4) between an on-premises Cisco IOS XE router and a Cisco IOS XE router hosted in an AWS VPC. BGP over the tunnel comes up and routes are exchanged successfully. However, users report that SSH and ICMP work fine, but HTTPS sessions to cloud application servers frequently hang or time out on large downloads. The physical WAN interface uses the default 1500-byte MTU. Which configuration on the tunnel interface most directly resolves the issue?

Accepted Answer

Apply 'ip tcp adjust-mss 1360' on the tunnel interface to clamp the TCP MSS below the tunnel's effective MTU

Answer

Increase the tunnel interface MTU to 1500 to match the physical WAN interface

Answer

Disable BGP path MTU discovery with 'no bgp transport path-mtu-discovery'

Answer

Configure 'crypto ipsec fragmentation before-encryption' on the crypto profile

Question 64

A network engineer is deploying a route-based IPsec VPN from an on-premises Cisco IOS XE router to a cloud-hosted Cisco IOS XE router (Cisc router in a VPC). The on-premises router has two physical internet-facing interfaces (GigabitEthernet0/0/0 and GigabitEthernet0/0/1) connected to two different ISPs for redundancy. The engineer wants a single stable IKEv2/IPsec tunnel identity that can survive the failure of either uplink without re-establishing the security association. What is the recommended way to configure the tunnel source on the on-premises router?

Accepted Answer

Configure a Loopback interface with a routable/NAT-mapped address, set 'tunnel source LoopbackX' on the VTI, and use IP SLA-tracked static routes so either ISP can reach the loopback.

Answer

Set 'tunnel source GigabitEthernet0/0/0' and add a floating static default route through GigabitEthernet0/0/1 as a backup.

Answer

Configure two separate tunnel interfaces, one sourced from each physical interface, and let the cloud router pick whichever SA arrives first.

Answer

Use 'tunnel source dynamic' on the VTI so IOS XE automatically rebinds the tunnel to whichever interface currently has a default route.

Exam domain	Exam weight	Practice
Architecture Models	15%	Practice this topic
Design	15%	Practice this topic
IPsec Cloud Connectivity	25%	Practice this topic
SD-WAN Cloud Connectivity	25%	Practice this topic
Operation	20%	Practice this topic

Cisco Designing and Implementing Secure Cloud Connectivity ENCC (300-440) (300-440) practice exam & study guide

Start studying 300-440

All 300-440 study resources

300-440 exam domains

Sample 300-440 questions

Key 300-440 terms

300-440 frequently asked questions

Architecture Models (15%)

Design (15%)

IPsec Cloud Connectivity (25%)

SD-WAN Cloud Connectivity (25%)

Operation (20%)