300-440 Practice Questions

A highly secure multitier application in AWS that includes S3, RDS, and some additional private links

requires specific routing and bucket policies to keep the traffic safe. The reasons are as follows:

Specific routing policies are needed to ensure that the traffic between the tiers is routed through the

private links, which provide secure and low-latency connectivity between AWS services and on-

premises resources12. The private links can also prevent the exposure of the data and the application

logic to the public internet12.

Bucket policies are needed to control the access to the S3 buckets that store the application

data34. Bucket policies can specify the conditions under which the requests are allowed or denied,

such as the source IP address, the encryption status, the request time, etc.34. Bucket policies can

also enforce encryption in transit and at rest for the data in S334.

Reference :=

1: AWS PrivateLink

2: AWS PrivateLink FAQs

3: Using Bucket Policies and User Policies

4: Bucket Policy Examples

Security groups are a feature in AWS that allow you to control the inbound and outbound traffic to

your instances. They act as a virtual firewall that can filter the traffic based on the source,

destination, protocol, and port. You can assign one or more security groups to your instances, and

each security group can have multiple rules. Security groups are stateful, meaning that they

automatically allow the response traffic for any allowed inbound traffic, and vice versa. Security

groups are essential for securing your nodes in the AWS EKS cluster, as they can prevent

unauthorized access to your Mongo Atlas database or other resources. You can also use security

groups to isolate your nodes from other instances in the same VPC or subnet, or to allow

communication between nodes in different clusters or regions. Reference :=

AWS Security Groups

Security Groups for Your VPC

Security Groups for Your Amazon EC2 Instances

Security Groups for Your Amazon EKS Cluster

Step 1 = Click Configuration, select Templates, and then select Feature Templates. Step 2 = Click Add

Template, select the device, and then click Select Template. Step 3 = Click CLI Add-On Template and

enter the name and description. Step 4 = Paste the CLI configuration and then click Save.

The process of configuring a CLI add-on feature template in Cisco vManage for enhanced policy-

based routing (ePBR) for IPv4 involves several steps1234.

Click Configuration, select Templates, and then select Feature Templates: This is the first step where

you navigate to the Templates section in the Configuration menu of Cisco vManage1.

Click Add Template, select the device, and then click Select Template: In this step, you add a new

template for the device1.

Click CLI Add-On Template and enter the name and description: After setting up the template, you

select the CLI Add-On Template option, and then enter the name and description for the template1.

Paste the CLI configuration and then click Save: Finally, you paste the CLI configuration into the

template and save the changes1.

Reference :=

CLI Add-On Feature Templates - Cisco

Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE Catalyst SD-WAN

Release 17.x - CLI Add-On Feature Templates

Cisco SD-WAN vSmart CLI Template - NetworkLessons.com

CLI Templates for Cisco XE SD-WAN Routers

The bgp advertise-best-external command is used to enable the advertisement of the best external

path to internal BGP peers. This command is useful when there are multiple exit points from the

local AS to other ASes, and the local AS wants to use the closest exit point for each destination. By

default, BGP only advertises the best path to its peers, and the best path is usually the one with the

lowest IGP metric to the next hop. However, this may not be the optimal path for traffic leaving the

local AS, as it may result in suboptimal hot-potato routing or MED oscillations. The bgp advertise-

best-external command allows BGP to advertise the best external path, which is the path with the

lowest MED among the paths from different neighboring ASes, in addition to the best path. This way,

the internal BGP peers can choose the best exit point based on the MED value, rather than the IGP

metric. In this scenario, ASBR1 is configured to receive additional paths from ASBR2, which is a route

reflector. ASBR2 receives two paths for the same prefix from AS6500, one from ASBR3 and one from

ASBR4. ASBR2 selects the best path based on the IGP metric to the next hop, and advertises it to

ASBR1. However, this path may not be the best external path, as it may have a higher MED value

than the other path. If the connection between ASBR1 and ASBR2 goes down, ASBR1 will not have

any backup path to reach AS6500, as it does not know the other path from ASBR4. To prevent this

situation, ASBR1 should be configured with the bgp advertise-best-external command, so that it can

receive the best external path from ASBR2, along with the best path. This way, ASBR1 will have a

backup path to reach AS6500, in case the primary path fails. Reference := IP Routing: BGP

Configuration Guide - BGP Additional Paths … - Cisco, BGP Additional Paths

This command redistributes the routes learned from BGP AS100 into OSPF Area 1, which allows

router R2 to advertise those routes to router R1 and connect the on-premises network to the cloud

provider. The other options are incorrect because they either redistribute the wrong routes or use

the wrong syntax5 .

I hope this helps you understand the question and the answer. If you have any other questions or

requests, please let me know. I am always happy to help.

Reference: 1: Learning Plan: Designing and Implementing Cloud Connectivity v1.0 (ENCC 300-440)

Exam Prep 2: Designing and Implementing Cloud Connectivity (ENCC) v1.0 3: Cisco Multiprotocol

Label Switching 4: Exploring Cisco Cloud OnRamp for Colocation 5: ENCC: Configuring IPsec VPN from

Cisco IOS XE to AWS : [Deploying Cisco IOS VTI-Based Point-to-Point IPsec VPNs]

To enable the OMP advertisement of BGP routes for a specific VRF instance on a Cisco IOS XE SD-

WAN device, the engineer must first configure the global address-family ipv4 and then enable bgp

advertisement under the vrf definition. This will allow the device to advertise the BGP routes learned

from the cloud provider to the OMP control plane, which will then distribute them to the other SD-

WAN devices in the overlay network1

Reference := 1: Designing

and Implementing

Cloud

Connectivity

(ENCC) v1.0,

Module

3:

Implementing Cloud Connectivity, Lesson 3: Configuring IPsec VPN from Cisco IOS XE to AWS, Topic:

Configuring BGP on the Cisco IOS XE Device, Page 3-24.

To configure a custom application with Cisco SD-WAN centralized policy, you need to follow these

steps25:

Click Configuration, select Policies, and then select Centralized Policy.

Click Custom Options, select Centralized Policy, and then select Lists.

Click Custom Applications, and then select New Custom Application.

Enter a name for the application, enter the match criteria, and then click Add.

The process of configuring a custom application with a Cisco SD-WAN centralized policy using Cisco

vManage involves several steps1.

Click Configuration, select Policies, and then select Centralized Policy: This is the first step where you

navigate to the Policies section in the Configuration menu of Cisco vManage1.

Click Custom Options, select Centralized Policy, and then select Lists: In this step, you select the

Custom Options, then select Centralized Policy, and finally select Lists1.

Click Custom Applications, and then select New Custom Application: After setting up the Lists, you

click on Custom Applications and then select New Custom Application1.

Enter a name for the application, enter the match criteria, and then click Add: Finally, you enter a

name for the application, specify the match criteria, and then click Add to complete the

configuration1.

Reference :=

Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE

The configuration of cloud connectivity with Cisco Umbrella Secure Internet Gateway (SIG) in

active/backup mode involves several steps. After configuring the SIG Credentials and SIG Feature

Templates, the engineer must:

Select the SIG provider for the primary tunnel: This is the first step in setting up the active/backup

mode. The primary tunnel is the main connection path for the cloud connectivity.

Add the secondary tunnel: The secondary tunnel serves as a backup in case the primary tunnel fails.

It ensures that the cloud connectivity remains uninterrupted even if there are issues with the

primary tunnel.

Create one high-availability pair using primary and secondary tunnels: This step involves pairing the

primary and secondary tunnels to create a high-availability pair. This ensures that the cloud

connectivity will switch over to the secondary tunnel seamlessly if the primary tunnel fails.

Edit the service-side VPN template to inject a service route: The final step involves modifying the

VPN template on the service side to include a service route. This ensures that the traffic is correctly

routed through the primary or secondary tunnel as needed.

Reference :=

Designing and Implementing Cloud Connectivity (ENCC) v1.01

Learning Plan: Designing and Implementing Cloud Connectivity v1.0 (ENCC 300-440) Exam Prep2

Configure Umbrella SIG Tunnels for Active/Backup or Active/Active Scenarios - Cisco3

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/300-440/page_22_img_1.jpg

Step 1 = Create a Customer Gateway (CGW) in AWS. Step 2 = Create a Virtual Private Gateway

(VGW) in AWS. Step 3 = Create a site-to-site VPN connection in AWS. Step 4 = Configure the IOS XE

router with the required IPsec VPN parameters and routing settings. Step 5 = Verify and test the VPN

connection.

The process of configuring a site-to-site VPN connection between an on-premises Cisco IOS XE router

and Amazon Web Services (AWS) involves several steps12.

Create a Customer Gateway (CGW) in AWS: This is the first step where you define the public IP

address of your on-premises Cisco IOS XE router in AWS1.

Create a Virtual Private Gateway (VGW) in AWS: This involves creating a VGW and attaching it to the

VPC in AWS1.

Create a site-to-site VPN connection in AWS: After setting up the CGW and VGW, you then create a

site-to-site VPN connection in AWS. This involves specifying the CGW, VGW, and the static IP prefixes

for your on-premises network1.

Configure the IOS XE router with the required IPsec VPN parameters and routing settings: After the

AWS side is set up, you configure the on-premises Cisco IOS XE router with the required IPsec VPN

parameters and routing settings2.

Verify and test the VPN connection: Finally, you verify and test the VPN connection to ensure that it is

working correctly12.

Reference :=

Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services - Cisco Community

SD-WAN Configuration Example: Site-to-site (LAN to LAN) IPSec between vEdge and Cisco IOS - Cisco

Community

The end-to-end ping between the office user PC and the AWS EC2 instance is not working because

either the security group rules for the host VPC are blocking the ICMP traffic or the IPsec SA counters

are showing errors or drops. To diagnose the loss of connectivity, the engineer should check both the

security group rules and the IPsec SA counters. The network security group rules on the host VNET

are not relevant because they apply to Azure, not AWS. The IPsec SA configuration on the Cisco VPN

router and the AWS private virtual gateway are not likely to be the cause of the problem because the

site-to-site VPN tunnel is already up and the site-to-site routing works correctly. Reference :=

Designing and Implementing Cloud Connectivity (ENCC, Track 1 of 5), Module 3: Configuring IPsec

VPN from Cisco IOS XE to AWS, Lesson 3: Verify IPsec VPN Connectivity

Security for VPNs with IPsec Configuration Guide, Cisco IOS XE, Chapter: IPsec VPN Overview,

Section: IPsec Security Association

AWS Documentation, User Guide for AWS VPN, Section: Security Groups for Your VPC