300-440 Cisco Exam Questions and Answers

Question 1

A company with multiple branch offices has strict regulatory compliance requirements and must adhere to NIST standards for data encryption.

Which connectivity model meets these requirements?

A. hybrid connectivity with SD-WAN over public internet with GRE encryption
B. site-to-site VPN using public internet connections with IPsec encryption
C. point-to-point topology with dedicated leased lines and end-to-end encryption
D. private MPLS connections with IPsec tunnels

Answer : B

Question 2

Which connection type enables low latency and secures data transfer to businesses with multiple distributed locations?

A. MPLS
B. internet
C. broadband VPN
D. leased lines

Answer : A

Question 3

A multinational corporation with multiple branches worldwide must connect its branches for better collaboration and data sharing. The solution must use quality of service to ensure that time sensitive voice and video data are transmitted reliably and provide transport across multiple connection types.

Which connectivity model meets the requirements in the most cost-effective way?

A. IPsec tunnels between branches
B. DMVPN
C. Cisco Catalyst SD-WAN
D. MPLS VPN

Answer : C

Question 4

How are low latency connections achieved for SaaS applications in Microsoft Azure?

A. Establish a dedicated private link to the SaaS provider.
B. Setup a VPN connection to the SaaS provider’s data center from the on-premises infrastructure.
C. Implement a dedicated cross-connect to the SaaS provider’s data center via the customer’s hub site.
D. Access the SaaS provider’s application directly using public internet connectivity.

Answer : D

Question 5

A company has strict service-level agreements and requires high availability and resiliency between its on-premises data center and the public cloud.

Which scalable connectivity design meets these requirements?

A. Cloud OnRamp for IaaS transit virtual private cloud
B. private connectivity over a dedicated MPLS network
C. Cloud OnRamp for Multicloud branch connect
D. Cloud OnRamp for Multicloud SD-WAN cloud gateway

Answer : A

Question 6

Refer to the exhibit.

A network architect is designing a high-availability Cisco Catalyst SD-WAN solution for a global organization with offices in Canada, the United States, and Europe.

Which two components must be configured? (Choose two.)

A. multiple control connections
B. SD-WAN Manager server redundancy
C. SD-WAN Validator redundancy
D. single control connection
E. geographically dispersed SD-WAN Controllers

Answer : AE

Question 7

Which model should an engineer recommend for a company looking for multiple Azure regions with highly reliable connectivity within the cloud for region-to-region communication?

A. redundant private MPLS connections with IPsec on top
B. vHub default peering
C. ExpressRoute circuits
D. site-to-site VPN gateways

Answer : B

Question 8

Refer to the exhibit.

An engineer successfully brings up the site-to-site VPN tunnel between the remote office and the AWS virtual private gateway, and the site-to-site routing works correctly. However, the end-to-end ping between the office user PC and the AWS EC2 instance is not working. Which two actions diagnose the loss of connectivity? (Choose two.)

A. Check the network security group rules on the host VNET.
B. Check the security group rules for the host VPC.
C. Check the IPsec SA counters.
D. On the Cisco VPN router, configure the IPsec SA to allow ping packets.
E. On the AWS private virtual gateway, configure the IPsec SA to allow ping packets.

Answer : BC

Question 9

DRAG DROP -
An engineer must configure a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router in Controller mode and AWS. The IKE version must be changed from IKEv1 to IKEv2 in Cisco vManage. Drag and drop the steps from the left onto the order on the right to complete the configuration.

Answer :

Question 10

DRAG DROP -
An engineer must edit the settings of a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS). IPsec must be configured to support multiple peers and failover after 120 seconds of idle time on the first entry of the crypto map named cisco. Drag and drop the commands from the left onto the order on the right.

Answer :

Question 11

DRAG DROP -
Refer to the exhibit.

Drag and drop the steps from the left onto the order on the right to configure a site-to-site VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS).

Answer :

Question 12

Which two types of target gateways, under VPC > VPN connections, should an engineer select to configure an AWS site-to-site VPN? (Choose two.)

A. Local network gateway
B. Transit gateway
C. Virtual private gateway
D. VPN gateway
E. Bastion gateway

Answer : BC

Question 13

Refer to the exhibit.

An engineer needs to configure a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS). Which configuration command must be placed in the blank in the code to complete the tunnel configuration?

A. address 20.20.20.21
B. address 192.10.10.10
C. tunnel source 20.20.20.21
D. tunnel source 192.10.10.10

Answer : B

Question 14

Refer to the exhibit.

Which Cisco IKEv2 configuration brings up the IPsec tunnel between the remote office router and the AWS virtual private gateway?