Medium 300-440 practice questions

A financial services company hosts a customer-facing web application in an AWS VPC. Security requires that all inbound connections from the internet must terminate at a managed edge that provides DDoS protection and web application filtering before traffic reaches the application subnets. The team also wants to avoid exposing EC2 instances with public IP addresses. Which cloud security design for inbound connectivity best meets these requirements?

A retail enterprise runs several application VPCs in AWS behind a Transit Gateway. Security policy requires that all outbound internet traffic from these workloads be centrally inspected for threats and logged before leaving AWS, with no workload allowed to reach the internet through its own path. Which cloud security design should the network architect recommend for the outbound (backhaul) internet traffic?

A global manufacturing firm hosts several VMs in an Azure VNet. Corporate security policy mandates that ALL outbound internet traffic from cloud workloads be inspected by the on-premises next-generation firewall stack before reaching the internet, with full logging for audit. The firm already has redundant ExpressRoute circuits to the on-premises data center. Which connectivity design should the network architect recommend to enforce this backhaul internet inspection requirement?

A financial services company already has an Azure ExpressRoute circuit terminating at a partner colocation facility. They now need to reach Microsoft 365 and Azure PaaS services (such as Azure Storage public endpoints) over their private ExpressRoute connection instead of the internet, while still using their existing IaaS VNet peering. The network team must configure the correct peering type for the SaaS and PaaS traffic. Which ExpressRoute peering type should be enabled to carry the Microsoft 365 and Azure public-service traffic?

A financial services company is migrating a latency-sensitive trading analytics platform to Microsoft Azure. The business requires a connectivity model that provides a contractual uptime guarantee, predictable low latency, and no dependency on the public internet. The network team already has a partner presence in a carrier-neutral colocation facility that offers Layer 2 connections to Azure peering locations. Which connectivity model should the architect recommend to best meet these requirements?

A retail company operates 45 branch sites and wants to connect them to workloads hosted in three Azure regions. They need centralized, hub-based routing and automated any-to-any branch connectivity over the public internet without provisioning a dedicated private circuit. Cost sensitivity is high, and they want Microsoft to manage the underlying transit infrastructure. Which internet-based connectivity approach best meets these requirements?

A financial services company runs a critical third-party SaaS application that is published by the vendor as an Azure Private Link service. Security policy mandates that all traffic to this SaaS application must traverse the company's existing ExpressRoute private peering circuit and must never be exposed to the public internet, and the application must be reachable using a private IP address inside the company's Azure VNet. Which connectivity approach meets these requirements?

A financial services company is deploying a multi-tier application across several Azure virtual networks (VNets) in a hub-and-spoke topology. Compliance auditors require that lateral (east/west) traffic between the web, application, and database tiers be inspected and filtered by a stateful firewall, and that no tier can communicate directly without policy enforcement. The security team wants to centralize this inspection with minimal per-VNet configuration. Which design best meets these requirements?

A financial services company runs multiple workloads in Google Cloud across several VPCs. Security policy mandates that all outbound internet-bound traffic from these workloads must be centrally inspected by a next-generation firewall for logging, threat prevention, and URL filtering before leaving the cloud. The design team wants to avoid each VPC egressing directly to the internet. Which connectivity/security design best meets this backhaul internet traffic requirement?

A financial services company hosts a customer-facing web application in Google Cloud. Security requires that all inbound connections from the internet must terminate on a managed edge service that provides DDoS protection, TLS offload, and Layer 7 WAF filtering before traffic reaches backend VM instances. The backend instances must not have public IP addresses. Which connectivity and security design for inbound traffic best meets these requirements?

A mid-sized retail company is designing private connectivity from its on-premises data center to Google Cloud. Their analysis shows steady-state throughput of about 3 Gbps to VPCs, with occasional bursts. They do not have a physical presence in any Google colocation facility and want to avoid the cost and lead time of provisioning cross-connects in a Google peering location. Availability targets are moderate (99.9%), and they prefer to onboard within a few weeks. Which connectivity model should you recommend?

A retail company hosts a fleet of backend processing VMs in a private subnet within a Google Cloud VPC. These VMs have no external IP addresses but must initiate outbound calls to a third-party payment API over the public internet. The security team mandates that no inbound internet connections be permitted to these VMs. Which Google Cloud service should the network architect deploy to meet these requirements?

A network engineer is connecting an on-premises Cisco IOS XE router to a native AWS Site-to-Site VPN using two IPsec tunnels terminated on an AWS Virtual Private Gateway. During configuration, the engineer must specify the transform set and IPsec mode required for the tunnel to establish successfully with the AWS native endpoint (which does not support GRE encapsulation). Which IPsec configuration element must be used on the IOS XE Virtual Tunnel Interface (VTI) to match the AWS native VPN endpoint?

A network engineer configures a GRE over IPsec tunnel between an on-premises Cisco IOS XE router and an AWS-hosted Cisco IOS XE router across the public internet. BGP peers establish over the tunnel and small ping tests succeed, but users report that large file transfers and HTTPS sessions to cloud applications stall or fail intermittently. The physical WAN interface uses the standard 1500-byte MTU. What is the most effective configuration change on the tunnel interface to resolve this issue?

You are configuring a route-based IPsec VPN from an on-premises Cisco IOS XE router to a native Azure VPN Gateway (VpnGw2, Generation2). Azure will terminate the tunnel using IKEv2. To ensure Phase 2 (IPsec SA / child SA) negotiation succeeds with Azure's default supported parameters while maximizing hardware-accelerated throughput, which IPsec transform set should you configure on the IOS XE router?

A network engineer is building a GRE-over-IPsec tunnel from an on-premises Cisco IOS XE router to an Azure native VPN Gateway. Because the Azure VPN Gateway does not support GRE encapsulation, the engineer must terminate the design using a supported model while still reaching the 10.50.0.0/16 Azure VNet address space. The on-premises router uses a route-based configuration with a virtual tunnel interface (Tunnel1) and no dynamic routing protocol is permitted by policy. Which action correctly establishes reachability to the Azure VNet over this tunnel?

An engineer is establishing an IPsec tunnel from an on-premises Cisco IOS XE router to a cloud-hosted Cisco IOS XE router in AWS. The on-premises router sits behind a corporate firewall that performs PAT (NAT overload) for all outbound traffic. IKEv2 Phase 1 negotiation begins but the tunnel never fully establishes, and debugs show the peers detecting an address translation during negotiation. Which behavior must occur for the IPsec tunnel to establish successfully through the PAT device?

A network engineer is configuring a GRE over IPsec tunnel from an on-premises Cisco IOS XE router to a Google Cloud HA VPN gateway that terminates a native (non-Cisco) endpoint. The engineer wants to protect the GRE tunnel with IPsec and dynamically exchange routes over the overlay. When reviewing the design, the team lead notes that the chosen Google Cloud HA VPN gateway does not support GRE encapsulation at all. What is the correct action to establish encrypted, routed connectivity to this native Google Cloud endpoint?

A network engineer is building a GRE-over-IPsec design from an on-premises Cisco IOS XE router to a native Google Cloud HA VPN gateway. The requirement is that the connection provide a 99.99% availability SLA from Google. During design review, a colleague proposes terminating a single IPsec tunnel from the IOS XE router to one HA VPN gateway interface. What must the engineer do instead to meet the SLA requirement?

A retail company is deploying new branch sites that need connectivity to workloads hosted in Google Cloud. The company wants to avoid the cost and lead time of provisioning dedicated circuits, but still requires encrypted transport and dynamic routing between the branches and the cloud VPC. Which internet-based connectivity approach best meets these requirements?

A retail company is deploying a new branch-to-cloud design to reach workloads hosted in a Google Cloud VPC. The network team must use the existing public internet circuits (no dedicated physical cross-connect is budgeted this quarter), but the design must survive the failure of a single Google-side tunnel endpoint and provide a Google-backed availability SLA. Which internet-based connectivity approach to Google Cloud best meets these requirements?

A retail company is deploying a new branch-heavy architecture and wants to connect 30 branch sites to workloads running across multiple VPCs in a single AWS region. The networking team requires internet-based connectivity (no dedicated circuit budget), centralized route management across all VPCs, and encrypted transport. Which AWS connectivity approach best meets these requirements?

A network engineer is configuring a route-based IPsec VPN from an on-premises Cisco IOS XE router to a native Azure VPN Gateway over the internet. The design requires that traffic selectors be defined by the routing table rather than by policy-based ACLs, so that additional Azure VNets can be reached later simply by adding routes. Which IOS XE configuration approach meets this requirement?

A network engineer connects an on-premises Cisco IOS XE router to Google Cloud using two HA VPN tunnels, each terminating on a separate Cloud Router BGP interface in the same region. The on-premises router establishes eBGP sessions over both tunnels and receives identical prefixes from Google Cloud with the same AS-path length and MED. The engineer wants outbound traffic from on-premises to actively use both tunnels simultaneously for the cloud-bound prefixes. What must be configured on the Cisco IOS XE router to achieve this?

An engineer connects an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in an AWS VPC using two parallel IPsec VTI tunnels for redundancy. Both tunnels run eBGP over the tunnel interfaces to the same remote AS. The engineer notices that only one tunnel carries traffic, even though both BGP sessions are established and advertising the same prefixes. Return traffic from AWS also uses only a single tunnel. The engineer wants both tunnels to actively share load for the cloud-destined prefixes. Which configuration change on the IOS XE routers achieves this?