Hard — 300-440 Practice Quiz

Question 1

A financial services company already has a 10 Gbps AWS Direct Connect dedicated connection terminating at a colocation facility. The network team now needs to give an internal analytics application private, low-latency access to a third-party market-data SaaS offering that is published through AWS PrivateLink in a provider VPC. The traffic must never traverse the public internet, and the team wants to avoid provisioning a second physical circuit. Which approach lets them consume this SaaS service over their existing Direct Connect?

Accepted Answer

Create an interface VPC endpoint to the SaaS provider's PrivateLink service in the consumer VPC, then reach that VPC through a private virtual interface (private VIF) over the existing Direct Connect

Answer

Configure a public virtual interface (public VIF) on the Direct Connect and connect directly to the SaaS provider's public service endpoints

Answer

Establish a site-to-site IPsec VPN over the internet to the SaaS provider VPC and route the analytics traffic through it

Answer

Enable VPC peering between the consumer VPC and the SaaS provider VPC and advertise the peered routes over the Direct Connect

Question 2

A financial services company must connect its on-premises data center to AWS using a dedicated private circuit. A security requirement states that all data traversing the Layer 2 link between the customer premises and the AWS Direct Connect location must be encrypted at line rate without adding routing overhead or reducing throughput. The design team wants to satisfy this at the physical link layer rather than relying on an IPsec tunnel over the connection. Which capability should the design recommend?

Accepted Answer

Enable MACsec (802.1AE) on a MACsec-capable Direct Connect dedicated connection (10, 100, or 400 Gbps at supported locations)

Answer

Establish a site-to-site IPsec VPN over the Direct Connect public virtual interface

Answer

Configure a private virtual interface with BGP MD5 authentication for payload encryption

Answer

Use AWS Transit Gateway Connect with GRE tunnels to encrypt the underlying link

Question 3

A financial services company runs a data-analytics application in an on-premises data center connected to AWS via an existing Direct Connect private VIF and a Direct Connect gateway. The security team mandates that traffic to Amazon S3 for storing regulatory reports must never traverse the public internet and must not require adding public IP prefixes to the Direct Connect public VIF. Which AWS connectivity construct should the network architect deploy to reach the S3 service privately over the existing private connectivity?

Accepted Answer

An S3 interface VPC endpoint (powered by AWS PrivateLink) accessed from on-premises through the private VIF

Answer

An S3 gateway VPC endpoint associated with the VPC route tables

Answer

A Direct Connect public VIF advertising the S3 public service prefixes

Answer

A NAT gateway in a public subnet routing S3 traffic to the internet gateway

Question 4

A financial services company is migrating a latency-sensitive trading analytics workload to Azure. Requirements include: a consistent 5 Gbps of throughput, BGP-based dynamic routing between on-premises and Azure, redundancy across two physically diverse paths at the peering location, and the ability to advertise the same on-premises prefixes over both paths for active/active load distribution. Which connectivity design best satisfies these network architecture requirements?

Accepted Answer

An ExpressRoute circuit provisioned with a 5 Gbps port, using the built-in dual BGP peerings across the two redundant physical connections at the peering location

Answer

A single site-to-site IPsec VPN over the internet using BGP, sized with multiple tunnels to aggregate bandwidth

Answer

Two independent ExpressRoute circuits at the same peering location with static routing configured to each Azure VNet gateway

Answer

A single ExpressRoute circuit with Microsoft peering only, relying on ECMP toward SaaS endpoints for redundancy

Question 5

A U.S. federal agency contractor is migrating a sensitive workload to AWS GovCloud. Compliance mandates that the workload meet FedRAMP High requirements, and that all data in transit between the on-premises data center and the cloud must never traverse the public internet. The security team also requires that connectivity avoid shared transport infrastructure to reduce the risk of data commingling with other tenants. Which connectivity model should the network architect recommend?

Accepted Answer

AWS Direct Connect using a dedicated connection into AWS GovCloud with MACsec encryption on the physical link

Answer

Site-to-site IPsec VPN over the public internet with AES-256 encryption and FIPS 140-2 validated endpoints

Answer

AWS Direct Connect using a hosted connection provisioned through a partner's shared 10 Gbps port

Answer

Software-defined WAN overlay with dynamic path selection across multiple broadband internet circuits

Question 6

A financial services company runs its data analytics platform in Google Cloud and consumes BigQuery and Cloud Storage as managed SaaS-like services. Compliance rules prohibit any of this traffic from traversing the public internet, and the security team requires that the Google APIs be reached over the private/restricted Google API VIP range (not the public internet) from the on-premises data center over an existing Dedicated Interconnect. Which Google Cloud feature should the network architect configure to meet these requirements?

Accepted Answer

Private Google Access for on-premises hosts using restricted.googleapis.com with routes advertised over Cloud Router

Answer

Cloud NAT with an external static IP to source the API calls from the on-premises range

Answer

A public IP path to Google APIs secured with an HA VPN tunnel over the internet

Answer

VPC Network Peering between the on-premises router and the Google API service project

Question 7

A network engineer is establishing a site-to-site VPN from an on-premises Cisco IOS XE router to a native AWS Virtual Private Gateway (VGW). AWS has generated a configuration file specifying two tunnels, each with a pre-shared key and an inside tunnel address in the 169.254.0.0/16 range. The engineer wants dynamic route exchange over the tunnels using BGP. When configuring the IOS XE tunnel interfaces to match the AWS native endpoint, which combination correctly reflects how the tunnel must be built?

Accepted Answer

Use an IPsec VTI (tunnel mode ipsec ipv4) with the 169.254.x.x inside address and eBGP peering to the AWS-assigned APIPA neighbor

Answer

Use a GRE tunnel (tunnel mode gre ip) protected by an IPsec profile, and assign a public IP as the tunnel source

Answer

Use a crypto map applied to the physical WAN interface with no tunnel interface, and configure static routes to the VPC CIDR

Answer

Use a GRE tunnel with OSPF area 0 across the 169.254.x.x link because AWS VGW only supports OSPF for dynamic routing

Question 8

A network engineer is configuring a route-based IPsec (VTI) tunnel from an on-premises Cisco IOS XE router to a native Azure VPN Gateway (route-based, Generation 2). The IKEv2 SA is failing to establish, and debugs on the IOS XE router show the negotiation stalling during the IKE_SA_INIT exchange. The engineer confirms that the pre-shared key, IKEv2 encryption, and integrity algorithms are all correctly matched to Azure's default IPsec/IKE policy. Which additional IKEv2 proposal parameter must the engineer verify matches the Azure default policy to allow IKE_SA_INIT to complete?

Accepted Answer

The Diffie-Hellman (DH) group configured in the IKEv2 proposal

Answer

The IPsec transform-set ESP mode (tunnel vs. transport)

Answer

The BGP hold-timer value on the tunnel interface

Answer

The Perfect Forward Secrecy (PFS) group in the IPsec profile

Question 9

A network engineer is designing GRE-over-IPsec connectivity from an on-premises Cisco IOS XE router to a native Azure VPN Gateway (not a cloud-hosted IOS XE instance). The design requires a routed tunnel interface running BGP over the encrypted overlay. During testing, IKEv2 and IPsec SAs come up successfully, but the GRE tunnel interface never reaches the up/up state and no BGP session forms. What is the most likely root cause of this failure?

Accepted Answer

The native Azure VPN Gateway does not support GRE encapsulation; it terminates route-based IPsec using VTI, so GRE-over-IPsec cannot be used and a plain IPsec VTI tunnel must be configured instead

Answer

The IKEv2 proposal on the IOS XE router is missing the GRE transform, which prevents the tunnel keepalives from being encrypted

Answer

BGP must be configured before the GRE tunnel interface is created, otherwise the tunnel remains administratively down

Answer

The Azure VPN Gateway requires the GRE tunnel key to match the IPsec pre-shared key for the tunnel to establish

Question 10

A network engineer is building a GRE over IPsec tunnel from an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in AWS. Both sides use IKEv2 with pre-shared key authentication. The IKEv2 SA comes up intermittently and the logs on the on-premises router show 'IKEv2 profile not found' during some negotiations, even though a single IKEv2 profile is configured. The peer sits behind a NAT device, so the source address seen for its IKE negotiations does not match the address configured in the profile. What is the most likely configuration cause and the correct fix?

Accepted Answer

The IKEv2 profile 'match identity remote address' statement uses the peer's private IP; change it to match the remote IKE identity by FQDN/key-id or use 'match identity remote any' so the profile is selected regardless of the NAT-translated source address

Answer

The tunnel is missing 'tunnel mode ipsec ipv4'; add it to force IPsec transport so the profile can be applied

Answer

The crypto IKEv2 proposal lists an unsupported DH group; remove group 14 and use group 2 to match AWS defaults

Answer

NAT traversal is disabled; enter 'crypto ipsec nat-transparency udp-encapsulation' to allow the profile to load

Question 11

A network engineer is designing GRE over IPsec connectivity from an on-premises Cisco IOS XE router to a native Google Cloud HA VPN gateway. The engineer initially proposed running a GRE tunnel encapsulated in IPsec directly to the Cloud VPN gateway endpoint. During validation, the tunnel to the native Cloud VPN gateway will not establish the GRE overlay. What is the correct explanation and remediation for connecting to the native Google Cloud VPN endpoint?

Accepted Answer

Google Cloud native HA VPN gateways do not support GRE; the engineer must use a plain IPsec tunnel (IKEv2 with a VTI) directly to the Cloud VPN endpoint and run BGP over the tunnel interface.

Answer

GRE will work once the engineer disables IKEv2 and switches to IKEv1 main mode, since Google Cloud only negotiates GRE keys during IKEv1.

Answer

The GRE tunnel fails because DPD is enabled; disabling Dead Peer Detection on both ends allows the GRE overlay to form over the native gateway.

Answer

The engineer must enable jumbo MTU of 9000 bytes on the tunnel, because native Cloud VPN gateways require GRE frames larger than 1500 bytes to complete the overlay handshake.

Question 12

A network engineer is building a GRE over IPsec tunnel from an on-premises Cisco IOS XE router to a cloud-hosted Cisco IOS XE router in AWS to run eBGP across the overlay. After configuring the IPsec profile, tunnel interface, and BGP peering over the tunnel IP addresses, the IPsec SA comes up and the BGP session reaches Established, but it repeatedly resets once the peers exchange their full routing tables, and large file transfers across the tunnel stall. The tunnel source is a public interface behind a 1500-byte MTU internet path. What is the MOST likely cause and the correct remediation?

Accepted Answer

The tunnel keepalives and BGP packets are being dropped due to fragmentation; lower the tunnel IP MTU and set 'ip tcp adjust-mss' on the tunnel interface to account for GRE and IPsec overhead

Answer

The IPsec profile is applied in tunnel mode; change it to transport mode so BGP multicast hellos can traverse the tunnel

Answer

eBGP is unsupported over GRE/IPsec overlays to cloud endpoints; replace BGP with a static default route pointing at the tunnel interface

Answer

The tunnel keepalive interval is too long; disable GRE keepalives entirely so the line protocol stops flapping

Question 13

A retail company hosts its inventory microservices on Cisco Catalyst SD-WAN branch routers that must reach an application published in a partner's AWS VPC. The partner exposes the application only through an AWS PrivateLink endpoint service and will not accept traffic over the public internet. The company already terminates its cloud gateway in a hub VPC using a Cisco Cloud OnRamp for Multicloud deployment. Which approach lets the branches consume the partner's application while keeping the traffic off the public internet?

Accepted Answer

Create an interface VPC endpoint in the hub VPC that connects to the partner's endpoint service, and advertise the endpoint's private IP into the SD-WAN fabric

Answer

Assign the partner application an Elastic IP and have branches reach it over an internet-based IPsec overlay to the AWS Internet Gateway

Answer

Configure a NAT gateway in the hub VPC so branch traffic is source-translated to the partner's public API endpoint

Answer

Establish VPC peering directly between each branch site's local network and the partner VPC to access the endpoint service

Question 14

An engineer connects an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in Azure over an IPsec VPN using a route-based (VTI) tunnel. The on-premises site runs OSPF internally, while eBGP is used across the IPsec tunnel to the cloud router to exchange prefixes. The engineer redistributes BGP-learned cloud prefixes into the on-premises OSPF process. After the change, internal OSPF routers receive the cloud prefixes but users report that traffic to the cloud is intermittently blackholed when a second, less-preferred WAN path also injects the same prefixes. What is the most effective way to ensure the OSPF-redistributed cloud routes are correctly and consistently preferred?

Accepted Answer

Redistribute the BGP routes into OSPF as external type 1 (E1) with a route-map that tags them, and filter/adjust metrics on the redundant path so the intended tunnel path wins on cumulative cost

Answer

Change the eBGP session to iBGP so the cloud prefixes carry an unchanged AS_PATH into the OSPF domain

Answer

Redistribute the routes as OSPF external type 2 (E2) with the default metric on both WAN paths so OSPF always load-balances between them

Answer

Disable OSPF entirely on the tunnel-facing router and rely on static default routes pointing at the IPsec VTI interface

Question 15

An engineer troubleshoots a route-based IPsec tunnel from a Cisco IOS XE router to a native Azure VPN gateway. The IOS XE router sits behind a corporate firewall that performs PAT (NAT overload) on its public interface. IKEv2 negotiation begins but never completes; 'show crypto ikev2 sa' shows the SA stuck in the IN-NEG state, and debugs show the Azure gateway is not authenticating the peer. The pre-shared keys, transform sets, and DH groups all match. What is the MOST likely cause?

Accepted Answer

IKEv2 is authenticating with the router's private IP as the IKE identity, which does not match the peer address Azure expects; the identity must be set to the public FQDN or address

Answer

The tunnel MTU is too large, causing the IKE_AUTH packet to fragment and be dropped by the firewall

Answer

Azure only supports policy-based (crypto map) VPNs, so the route-based VTI configuration is invalid

Answer

BGP has not established over the tunnel, which prevents Phase 1 from completing

Question 16

An engineer configures a redundant design where an on-premises Cisco IOS XE router forms IPsec VTI tunnels to two AWS VGWs in separate regions. Both regions are interconnected, and AWS re-advertises the on-premises prefixes learned from one region toward the other. The IOS XE router logs no errors, tunnels are up, and BGP is established on both tunnels, but the router refuses to install the prefixes AWS advertises from the second region. 'show ip bgp' shows those prefixes received but with the reason 'received-only'. What is the most likely cause?

Accepted Answer

The router rejects the routes because its own ASN appears in the received AS-PATH (BGP loop prevention)

Answer

The IKEv2 rekey lifetime differs between the two tunnels, invalidating Phase 2 SAs

Answer

The tunnel MTU is too small, causing BGP UPDATE packets to be fragmented and dropped

Answer

The AWS VGW is advertising the prefixes with a MED higher than the local preference threshold

Question 17

An engineer configures a Cisco IOS XE router as a route reflector for two internal iBGP peers (branch routers) while also maintaining an IPsec VTI eBGP session to an AWS Virtual Private Gateway. The AWS-learned VPC prefixes appear in the route reflector's BGP table as best paths, but the two iBGP branch peers install the AWS prefixes with an unreachable next hop and the routes fail to enter their RIB. The eBGP session to AWS is stable and the tunnel is up. What is the most likely cause?

Accepted Answer

The route reflector is advertising the AWS prefixes to iBGP peers without modifying the next hop, so the branches receive the AWS tunnel-endpoint next hop, which they cannot resolve

Answer

The AWS Virtual Private Gateway is prepending its ASN, causing the branches to reject the routes due to AS-path loop detection

Answer

Phase 2 PFS mismatch on the VTI is preventing prefix installation on the branch routers

Answer

The route reflector is missing the 'bgp additional-paths' command required to reflect eBGP-learned routes to iBGP clients

Question 18

An engineer configured a redundant IPsec VTI design between a Cisco IOS XE router and two AWS VPN tunnels toward a Transit Gateway. eBGP sessions to both AWS tunnel inside addresses come up and routes are learned. However, traffic destined to the VPC subnets is intermittently blackholed. On IOS XE, 'show ip route' shows the VPC prefixes as BGP routes whose next-hop is the AWS tunnel inside IP, but that next-hop is resolved via the default route pointing to the physical internet interface rather than the tunnel interface. What is the most likely cause of the blackholing?

Accepted Answer

The BGP next-hop for the learned prefixes is recursively resolving out the physical internet interface instead of the Tunnel interface, because the tunnel inside subnet is not directly attached or reachable via the correct tunnel

Answer

The IKEv2 rekey lifetime is mismatched, causing Phase 2 SAs to drop periodically

Answer

BGP maximum-paths is not configured, so only one tunnel is used and it flaps

Answer

The tunnel MTU is too high, causing large packets to be dropped due to DF-bit fragmentation

Question 19

An engineer manages an IPsec VTI tunnel from a Cisco IOS XE router to an AWS VPN gateway with eBGP over the tunnel. The tunnel interface is stable, but the AWS-learned prefixes for a specific VPC (10.50.0.0/16) intermittently disappear from the IOS XE routing table for several minutes at a time, then reappear. Other prefixes learned over the same BGP session remain stable throughout. 'show ip bgp 10.50.0.0/16' during the outage shows the path exists but is marked as 'dampened' with an accumulated penalty. What is the most likely cause?

Accepted Answer

BGP route dampening is configured on the IOS XE router, and the flapping upstream prefix accumulated enough penalty to be suppressed until its penalty decayed below the reuse limit

Answer

The IKEv2 SA for that traffic selector is rekeying and dropping the specific prefix during Phase 2 negotiation

Answer

AWS is applying inbound AS-path prepending only to the 10.50.0.0/16 prefix, causing it to lose the best-path selection intermittently

Answer

The tunnel MTU is too small for the larger BGP update carrying 10.50.0.0/16, causing that update to be dropped repeatedly

Question 20

An engineer builds a route-based IPsec VTI tunnel between an on-premises Cisco IOS XE router and an AWS cloud-hosted Cisco IOS XE router across the internet. The tunnel establishes successfully and passes traffic, but every few hours users report a brief drop of about 20-30 seconds, after which connectivity restores by itself. Debugs on the on-premises router show IKEv2 CHILD_SA re-creation events coinciding with the outages, and the two routers are configured with different IPsec SA lifetimes (on-prem 3600 seconds, AWS side 28800 seconds). What is the MOST likely cause of the periodic outage, and what corrective action addresses it?

Accepted Answer

The mismatched IPsec SA lifetimes cause the peer with the shorter lifetime to trigger a rekey that the other peer processes slowly; align the IPsec (CHILD_SA) lifetimes and ensure the IKEv2 profiles allow smooth rekeying to eliminate the reconvergence gap.

Answer

The IKEv2 proposal encryption transforms do not match, forcing full tunnel renegotiation; reconfigure both routers to use identical encryption and integrity algorithms.

Answer

BGP hold timers are expiring on the tunnel; increase the BGP keepalive and hold-time values on both routers to prevent the neighbor from resetting.

Answer

The tunnel MTU is too large, causing periodic fragmentation drops; lower the tunnel interface MTU and apply a TCP MSS clamp to stop the outages.

Question 21

An engineer configured a route-based IPsec VTI tunnel from an on-premises Cisco IOS XE router to an AWS VPN gateway. IKEv2 Phase 1 completes successfully and the SA is established, but no Phase 2 IPsec SA forms and 'show crypto ipsec sa' shows zero encrypted/decrypted packets. Debug output on the router shows 'ts_unacceptable' notifications received from AWS. What is the most likely cause?

Accepted Answer

The router's IPsec profile applies a crypto ACL with specific proxy IDs instead of the any/any (0.0.0.0/0) traffic selectors that AWS route-based VPN expects

Answer

The IKEv2 proposal on the router uses a different DH group than the AWS-side policy

Answer

The tunnel interface MTU is set too high, causing fragmentation of the Phase 2 negotiation packets

Answer

BGP has not yet converged, so the router has no routes to send into the tunnel

Question 22

An engineer connects an on-premises Cisco IOS XE router to an Azure VNet using two IPsec VTI tunnels to a route-based Azure VPN Gateway, both running BGP. Azure is advertising the same VNet prefix (10.50.0.0/16) over both tunnels, and the on-premises router is load-sharing return traffic across both. The requirement is that Tunnel1 be the primary path for all traffic destined to Azure, with Tunnel2 used only if Tunnel1 fails. Which action on the Cisco IOS XE router achieves deterministic primary/backup path selection for traffic sent TO Azure?

Accepted Answer

Apply an inbound route-map on the Tunnel2 BGP neighbor that sets a lower local-preference for the 10.50.0.0/16 prefix learned over Tunnel2

Answer

Apply an outbound route-map toward the Tunnel2 neighbor that adds AS-path prepends to the advertised on-premises prefixes

Answer

Configure MED (metric) higher on the routes advertised outbound over Tunnel1 to Azure

Answer

Enable BGP multipath so both tunnels are installed and let ECMP hashing prefer Tunnel1

Question 23

An engineer maintains an IPsec VTI tunnel from a Cisco IOS XE router to an Azure VPN gateway with eBGP over the tunnel. During brief, sub-second control-plane restarts on the IOS XE router (SSO switchovers on a dual-RP chassis), branch users report short traffic drops even though the tunnel interface never goes down. The Azure gateway supports BGP graceful restart. What should the engineer verify or configure on the IOS XE router to preserve forwarding across these restarts?

Accepted Answer

Enable BGP graceful restart (bgp graceful-restart) under the router bgp process so forwarding continues using stale routes while the BGP session re-establishes

Answer

Lower the BGP keepalive and hold timers to 3 and 9 seconds so the session detects and reconverges faster during the switchover

Answer

Configure BFD on the tunnel to trigger immediate route withdrawal when the RP switches over

Answer

Increase the IPsec SA lifetime so the tunnel does not rekey during the control-plane restart

Question 24

A network engineer has built two IPsec VTI tunnels from an on-premises Cisco IOS XE router to a single Azure VPN Gateway (active-active) and established eBGP over both tunnels. The on-premises router advertises the same on-prem prefix 10.10.0.0/16 over both tunnels. Azure is load-balancing return traffic across both tunnels, but the engineer wants Azure to prefer Tunnel 1 for all return traffic to 10.10.0.0/16, keeping Tunnel 2 purely as backup. Which action on the IOS XE router achieves this influence over Azure's inbound path selection?

Accepted Answer

Apply an outbound route-map on the Tunnel 2 BGP neighbor that sets a higher MED (metric) for 10.10.0.0/16

Answer

Apply an outbound route-map on the Tunnel 1 BGP neighbor that sets a higher local-preference for 10.10.0.0/16

Answer

Configure a higher BGP weight for the Tunnel 1 neighbor on the IOS XE router

Answer

Increase the OSPF cost on Tunnel 2 and redistribute the prefix into BGP

Question 25

An engineer manages a route-based IPsec VTI tunnel from an on-premises Cisco IOS XE router to an Azure VPN Gateway. The tunnel came up successfully, but after several hours users report intermittent loss of connectivity to Azure workloads. On the IOS XE router, 'show crypto ikev2 sa' shows the SA state flapping between READY and DELETING, and the logs contain repeated 'IKEv2-ERROR: Received INVALID_SPI notify' messages. Ping traffic recovers only after a manual 'clear crypto ikev2 sa'. What is the MOST likely cause of this behavior?

Accepted Answer

Dead Peer Detection (DPD) is disabled on the IOS XE router, so it cannot detect and rebuild the stale SA after the Azure gateway performs a maintenance-driven rekey

Answer

The IKEv2 proposal on IOS XE offers only DH group 2, which Azure rejects during the initial exchange

Answer

The BGP hold timer is shorter than the IKEv2 SA lifetime, causing the routing session to drop before Phase 2 rekeys

Answer

The tunnel MTU is set too high, causing large packets to be fragmented and dropped by Azure