[May-2024] Verified Cisco Exam Dumps with 300-440 Exam Study Guide [Q24-Q45]

4.5/5 - (2 votes)

[May-2024] Verified Cisco Exam Dumps with 300-440 Exam Study Guide

Best Quality Cisco 300-440 Exam Questions Real4Prep Realistic Practice Exams [2024]

Cisco 300-440 Exam Syllabus Topics:

Topic	Details
Topic 1	Operation: The topic delves into diagnosis of IPsec-based secure cloud connectivity between an on-premises native Cloud endpoints and Cisco IOS XE router. It also explains the diagnosis of routing issues on Cisco IOS XE routers, and diagnosis of Cisco SD-WAN policy issues, focusing on all the traffic.
Topic 2	Architecture Models: In this topic different aspects of connectivity to cloud providers are discussed. It focuses on AWS, Azure, and Google Cloud. Moreover, the topic explains private connectivity to leading cloud providers and connectivity options for Software as a Service (SaaS) cloud providers.
Topic 3	SD-WAN Cloud Connectivity: Questions about configuration of SD-WAN-based cloud connectivity using Cisco infrastructure appear in this topic. Furthermore, it discusses configuration of Cisco SD-WAN OnRamp, configuration for connecting to a SaaS cloud provider, and configuration of Cisco SD-WAN policies to address traffic.
Topic 4	IPsec Cloud Connectivity: The configuration of IPsec-based secure cloud connectivity is one of the focal points of this topic. Additionally, it delves into configuration of IPsec-based secure cloud connectivity between an on-premises Cisco IOS XE router and native Azure, AWS, and Google Cloud endpoints. Lastly, the topic discusses configuration of routing on Cisco IOS XE routers.
Topic 5	Design: Questions about cloud-native security policies for AWS, Azure, and Google Cloud appear in this topic. It also recommends connectivity models that ensure high availability, resiliency, SLAs, and reliability. Furthermore, the topic delves into connectivity models based on network architecture requirements. The topic further discusses factors including bandwidth, QoS, dedicated vs shared connections and multi-homing.

NO.24 Refer to the exhibits.

While troubleshooting, a network engineer discovers that the backup path fails between ASBR3 and ASBR4 for traffic between BGP AS6000 and BGP AS6500 when the connection between ASBR1 and ASBR2 goes down. The following configurations were performed on ASBR1:

Which command is missing?

bgp additional-paths Install

bgp additional-paths select

redistribute static

bgp advertise-best-external

NO.25 A company has multiple branch offices across different geographic locations and a centralized data center. The company plans to migrate Its critical business applications to the public cloud infrastructure that is hosted in Microsoft Azure. The company requires high availability, redundancy, and low latency for its business applications. Which connectivity model meets these requirements?

ExpressRoute with private peering using SDCI

hybrid connectivity with SD-WAN

AWS Direct Connect with dedicated connections

site-to-site VPN with Azure VPN gateway

NO.26 Which architecture model establishes internet-based connectivity between on-premises networks and AWS cloud resources?

That establishes an iPsec VPN tunnel with Internet Key Exchange (IKE) for secure key negotiation and encrypted data transmission

That relies on AWS Elastic Load Balancing (ELB) for traffic distribution and uses SSL/TLS encryption for secure data transmission.

That employs AWS Direct Connect for a dedicated network connection and uses private IP addresses tor secure communication.

That uses Amazon CloudFrontfor caching and distributing content globally and uses HTTPS for secure data transfer.

The architecture model that establishes internet-based connectivity between on-premises networks and AWS cloud resources is the one that establishes an iPsec VPN tunnel with Internet Key Exchange (IKE) for secure key negotiation and encrypted data transmission. This model is also known as the VPN CloudHub model12. It allows multiple remote sites to connect to the same virtual private gateway in AWS, creating a hub-and-spoke topology1. The VPN CloudHub model provides the following benefits12:
It enables secure communication between remote sites and AWS over the public internet, using encryption and authentication protocols such as IPsec and IKE.
It supports dynamic routing protocols such as BGP, which can automatically adjust the routing tables based on the availability and performance of the VPN tunnels.
It allows for redundancy and load balancing across multiple VPN tunnels, increasing the reliability and throughput of the connectivity.
It simplifies the management and configuration of the VPN connections, as each remote site only needs to establish one VPN tunnel to the virtual private gateway in AWS, rather than multiple tunnels to different VPCs or regions.
The other options are not correct because they do not establish internet-based connectivity between on-premises networks and AWS cloud resources. Option B relies on AWS Elastic Load Balancing (ELB) for traffic distribution and uses SSL/TLS encryption for secure data transmission. However, ELB is a service that distributes incoming traffic across multiple targets within a VPC, not across different networks3. Option C employs AWS Direct Connect for a dedicated network connection and uses private IP addresses for secure communication. However, AWS Direct Connect is a service that establishes a private connection between on-premises networks and AWS, bypassing the public internet4. Option D uses Amazon CloudFront for caching and distributing content globally and uses HTTPS for secure data transfer. However, Amazon CloudFront is a service that delivers static and dynamic web content to end users, not to on-premises networks5.
References:
1: Designing and Implementing Cloud Connectivity (ENCC, Track 1 of 5)
2: Cisco ASA Site-to-Site VPN
3: What Is Elastic Load Balancing?
4: What is AWS Direct Connect?

NO.27 An engineer must configure a CLI add-on feature template in Cisco vManage for enhanced policy-based routing (ePBR) for IPv4. These configurations were deleted:
* licensing config enable false
* licensing config privacy hostname true
* licensing config privacy version false
* licensing config utility utility-enable true
Drag and drop the steps from the left onto the order on the right to complete the configuration.

NO.28 An engineer must configure an AppGoE service node for WAN optimization for applications that are hosted in the cloud using Cisco vManage for C8000V or C8500L-8S4X devices. Drag and drop the steps from the left onto the order on the right to complete the configuration.

NO.29

Refer to the exhibit. An engineer successfully brings up the site-to-site VPN tunnel between the remote office and the AWS virtual private gateway, and the site-to-site routing works correctly. However, the end-to-end ping between the office user PC and the AWS EC2 instance is not working. Which two actions diagnose the loss of connectivity? (Choose two.)

Check the network security group rules on the host VNET.

Check the security group rules for the host VPC.

Check the IPsec SA counters.

On the Cisco VPN router, configure the IPsec SA to allow ping packets.

On the AWS private virtual gateway, configure the IPsec SA to allow ping packets.

NO.30 Which method is used to create authorization boundary diagrams (ABDs)?

identify only interconnected systems that are FedRAMP-authorized

show all networks in CIDR notation only

identify all tools as either external or internal to the boundary

show only minor or small upgrade level software components

NO.31 Refer to the exhibit.

A company uses Cisco SD-WAN in the data center. All devices have the default configuration. An engineer attempts to add a new centralized control policy in Cisco vManage but receives an error message. What is the problem?

A centralized control policy is already applied to the specific site ID and direction

The policy for “Hub” should be applied in the outbound direction, and the policy for “All-Site” should be applied inbound.

Apply an additional outbound control policy to override the site ID overlaps.

Site-list “All-Site” should be configured with a new match sequence that is lower than the sequence for site-list “Hub*.

NO.32 An engineer needs to configure enhanced policy-based routing (ePBR) for IPv4 by using Cisco vManage.
Drag and drop the steps from the left onto the order on the right to complete the configuration of the ePBR using the CLI add-on template.

NO.33

Refer to the exhibits. An engineer must redistribute only the 10.0.10.0/24 network into BGP to connect an on-premises network to a public cloud provider. These routes are currently redistributed:

Which command is missing on router R2?

neighbor 10.0.10.2 remote-as 100

redistribute ospf 1 match internal

redistribute ospf 1 match external

neighbor 10.0.10.0/24 remote-as 100

NO.34

Refer to the exhibits. An engineer must redistribute OSPF internal routes into BGP to connect an on-premises network to a cloud provider without introducing extra routes. Which two commands must be configured on router R2? (Choose two.)

router ospf 1

router bgp 100

redistribute ospf 1

redistribute bgp 100

redistribute ospf 1 match internal external

NO.35 An engineer must configure an IPsec tunnel to the cloud VPN gateway. Which Two actions send traffic into the tunnel? (Choose two.)

Configure access lists that match the interesting user traffic.

Configure a static route.

Configure a local policy in Cisco vManage.

Configure an IPsec profile and match the remote peer IP address.

Configure policy-based routing.

NO.36 An engineer must enable the OMP advertisement of BGP routes for a specific VRF instance on a Cisco IOS XE SD-WAN device. What should be configured after the global address-family ipv4 is configured?

Enable bgp advertisement.

Disable bgp advertisement.

Enter sdwan mode.

Set the VRF-specific route advertisements.

NO.37

Refer to the exhibits. An engineer needs to configure a site-to-site IPsec VPN connection between an on premises Cisco IOS XE router and Amazon Web Services (AWS). Which two IP prefixes should be used to configure the AWS routing options? (Choose two.)

30.30.30.0/30

20.20.20.0/24

30.30.30.0/24

50.50.50.0/30

40.40.40.0/24

NO.38 A cloud engineer is setting up a new set of nodes in the AWS EKS cluster to manage database integration with Mongo Atlas. The engineer set up security to Mongo but now wants to ensure that the nodes are also secure on the network side. Which feature in AWS should the engineer use?

EC2 Trust Lock

security groups

tagging

key pairs

NO.39

Refer to the exhibit. An engineer needs to configure a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS). Which configuration command must be placed in the blank in the code to complete the tunnel configuration?