300-440 Sample Questions & Answers

This configuration correctly sets up a Virtual Tunnel Interface (VTI). A VTI creates a routable interface, which is essential for running dynamic routing protocols like BGP over the IPsec tunnel. The tunnel mode ipsec ipv4 and tunnel protection ipsec profile MYPROFILE commands bind the IPsec policy to the tunnel interface. The crypto map configuration is used for policy-based VPNs, which do not support dynamic routing protocols effectively.

In Cisco SD-WAN, each transport on a vEdge is represented by a TLOC (Transport Locator). When a transport goes down, the vEdge loses its BFD sessions over that path, and the OMP route associated with that TLOC is withdrawn. In the vManage dashboard, specifically under the device's control connections monitoring, the entry for the TLOC associated with the failed MPLS transport will disappear or show as down. The vEdge icon itself will likely remain green as long as it has connectivity through its other transport.

FEDRAMP High requires stringent security controls. AWS Direct Connect provides a private, dedicated connection that bypasses the public internet. Adding MACsec provides point-to-point security at Layer 2, encrypting all data between the on-premises router and the AWS Direct Connect device. This combination of a private circuit and strong, line-rate encryption is the most suitable approach for meeting the high-security posture demanded by FEDRAMP High compliance.

This is the optimal solution. It meets all requirements: high availability (redundant connections to SDCI), consistent low latency (private backbone), sufficient bandwidth (10 Gbps circuits), and simplified management. The SDCI provider abstracts the complexity of connecting to multiple clouds, allowing the IT team to manage connectivity and routing through a single portal. It also provides a clear path for routing between AWS and Azure over the private SDCI backbone, fulfilling the dynamic routing requirement efficiently.

The vBond Orchestrator is the initial point of contact for any device joining the SD-WAN fabric. Its primary roles are to authenticate the vEdge router (ensuring it's on a whitelist), authorize it to join the fabric, and provide the IP addresses of the vManage and vSmart controllers. It effectively bootstraps the device into the control plane. Policy distribution is handled by vSmart, and the GUI is provided by vManage.

BGP uses attributes like local preference to determine the best path. By setting a higher local preference on routes received from the primary tunnel's BGP neighbor, the router will prefer that path. When the primary tunnel fails, its BGP session goes down, those routes are withdrawn, and BGP automatically selects the routes from the secondary tunnel.

AWS provides two tunnel endpoints for redundancy. To connect to both, two distinct VTIs must be configured on the IOS XE router. Each VTI will have its own source/destination and establish a separate BGP peering session, forming the foundation for the redundant setup.

A key advantage of a colocation facility is its carrier-neutral ecosystem. These facilities typically host on-ramps for multiple cloud providers (AWS, Azure, GCP, etc.). An enterprise can establish a presence in the colo and then use simple, low-cost cross-connects to reach multiple clouds. An MPLS circuit is typically a point-to-point service to a single destination, making multi-cloud integration more complex and less flexible.

Even when a BGP session is established over ExpressRoute, Azure does not automatically advertise the VNet's address space. The administrator must explicitly associate a route filter or advertise the VNet's prefixes to the circuit. A common oversight is to have a working BGP session but no prefixes being advertised from the Azure side, resulting in one-way or no connectivity. If the BGP state is Established, the gateway is provisioned correctly.

This statement is true. While data policies are configured centrally on vSmart for ease of management, vSmart compiles and distributes these policies to the vEdge routers via OMP. The vEdge routers then install these policies into their local data plane forwarding hardware or software, where the actual traffic classification, matching, and action (e.g., permit, drop, redirect) are performed on packets as they are processed.

The core feature for network segmentation in Cisco SD-WAN is the use of service-side VPNs, which are analogous to VRFs. By assigning each traffic profile (Corporate, IoT, Guest) to a different VPN, the administrator creates separate, isolated routing tables. This provides the foundational segmentation. Centralized data policies can then be used to control traffic flow between these VPNs (e.g., allowing Corporate to talk to the data center VPN) and to direct traffic within a VPN (e.g., sending Guest VPN traffic to a local internet exit).