300-445 Practice Questions

ThousandEyes synthetic tests cannot interact with external, dynamic, time-based one-time password (TOTP) generators like a mobile app. Attempting to automate this step is infeasible and unreliable. The industry-standard best practice for monitoring applications with MFA is to create a dedicated test user account for which MFA is disabled. Alternatively, access can be controlled by whitelisting the IP addresses of the ThousandEyes agents, allowing them to bypass the MFA challenge. This allows the test to focus on application performance without being blocked by an un-automatable security step.

A. The ThousandEyes agent has no mechanism to interface with a user's mobile app to retrieve a dynamically generated OTP. This is technically not possible.

B. OTPs are short-lived (typically 30-60 seconds). Manually updating the test configuration for every test run is impractical for automated monitoring.

C. Webhooks in ThousandEyes are for sending notifications out from the platform, not for pulling real-time data like an OTP into a running test script.

1. Cisco ThousandEyes Documentation, "Working with Transaction Tests," Section: "Authentication". The documentation notes that for complex authentication like MFA/2FA, "the recommended approach is to disable multi-factor authentication for the test user account, or to whitelist the IP addresses of the ThousandEyes agents assigned to the test."

2. Cisco ThousandEyes Documentation, "Transaction Scripting Reference". This reference guide for creating transaction scripts does not include any commands or functions for handling dynamic OTPs, highlighting the limitation.

According to the ThousandEyes Page Breakdown metric provided, images constitute the vast majority of the total page weight (nearly two-thirds of the 953 kB across 7 resources). This large payload directly extends the total Page Load Time (1023 ms) well past the DOM Load Time (375 ms), meaning the browser spends significant time fetching heavy visual assets after the initial structural markup is parsed. Implementing lazy loading delays the transmission of non-critical off-screen images until they are needed, drastically lowering the initial payload weight and reducing the overall page-load time to meet the target threshold under 500 ms.

A is incorrect: While XHR/Fetch queries are present in the breakdown, they occupy a very small fraction of the total page size and are not the primary bottleneck driving the 1023 ms load time.

B is incorrect: Moving image elements to the bottom of the document body does not reduce the overall page-load time payload size or the network overhead required to render them.

D is incorrect: Fonts make up an insignificant slice of the total page resources; optimizing font delivery using a CDN would yield negligible savings toward the 500 ms goal.

Official Vendor Documentation: Cisco ThousandEyes Knowledge Base – Page Load Test Metrics and Views. Section: "Page Breakdown (Domain, Provider, Type)". Explains how resource allocation per type correlates with overall Page Load Time versus DOM Load Time.

University Courseware / Web Standards: MDN Web Docs (Mozilla) – Performance / Lazy Loading. Details how delaying the loading of non-critical image assets improves initial load speeds and minimizes page payload.

W3C Web Performance Standards: W3C Recommendation – Navigation Timing API. Outlines the structural differences between DOM Content Loaded milestones and total page-load metrics when parsing heavy media types.

In Cisco ThousandEyes, when configuring Single Sign-On (SSO) with an Identity Provider (IdP) such as Microsoft Entra ID (formerly Azure AD), the Service Provider Issuer field represents the SAML Entity ID (or Audience Restriction). By default, this is set to https://app.thousandeyes.com. However, many enterprise IdPs require a unique identifier or a specific tenant-specific URL structure to uniquely distinguish authentication requests among multiple instances or organizations. Checking the Override checkbox next to the Service Provider Issuer allows the administrator to modify this default string to exactly match the expected Audience Restriction configured within the Microsoft Entra ID enterprise application settings.

B. Logout Page URL: This URL specifies where users are redirected after logging out of ThousandEyes; overriding it is not required to complete or establish the core SAML trust relationship.

C. Login Page URL: This is the entry point provided by the IdP for authentication. It is a mandatory field populated directly from Entra ID and does not require a service provider override.

D. Identity Provider Issuer: This is the unique identifier (Entity ID) of the IdP (Microsoft Entra ID) itself, which is read from the IdP metadata and does not get overridden on the Service Provider side.

Cisco ThousandEyes Documentation: User Management & Single Sign-On (SSO) Configuration Guide, Section on "SAML Service Provider Settings and Audience Restriction".

Cisco ThousandEyes Release Notes: SSO Audience Restriction Logic and Arbitrary Restriction URLs Support.

A network baseline establishes a standard for normal network performance. To be accurate and useful, this baseline must represent the full range of typical network activity. This includes periods of high usage (peak hours, month-end processing) and low usage (overnight, weekends). Capturing only one extreme would create a skewed perspective, leading to either missed problems (if the baseline is too high) or excessive false alarms (if the baseline is too low). A representative view ensures that anomaly detection is effective and meaningful.

A. Selecting the lowest traffic volume would create an inaccurate baseline, causing normal peak traffic to be flagged as an anomaly.

B. The financial year is a business metric and typically does not align with the cyclical, operational patterns of network traffic.

D. Limiting the time period for convenience sacrifices accuracy; a proper baseline requires sufficient data to identify recurring patterns.

1. Cisco. (2009). End-to-End QoS Network Design: Quality of Service in LANs, WANs, and VPNs. Cisco Press. In Chapter 2, "The Need for a QoS Strategy," the concept of baselining is introduced, emphasizing the need to understand traffic patterns, including peaks, to properly provision network resources.

2. Cisco. (2021). Cisco DNA Center User Guide, Release 2.2.2, Network Baselines. Section: "About Network Baselines". This guide explains that Cisco DNA Center computes baselines by learning the network's behavior over time to determine what is "normal," which inherently requires observing the full range of traffic variations.

The primary advantage of passive monitoring is that it is non-intrusive. It works by observing and analyzing actual user traffic as it crosses the network, using methods like packet capture, NetFlow, or SNMP. Because it does not generate any new or synthetic packets, it does not consume additional bandwidth or alter the network's behavior. This allows it to provide insights into real-time performance and actual user experience without any risk of impacting the network services it is intended to monitor.

A. Measuring performance under synthetic conditions is a characteristic and advantage of active monitoring, not passive monitoring.

C. Generating test traffic to simulate user behavior is the definition of active monitoring, such as using an IP SLA HTTP operation.

D. Active monitoring is generally better for directly measuring specific services on-demand, as it can test a service even when no real users are active.

1. Dharmapurikar, S., & Krishnamurthy, P. (2008). "System and method for passive real-time measurement of network performance." U.S. Patent No. 7,447,163. Washington, DC: U.S. Patent and Trademark Office. The patent background discusses that passive techniques "do not inject any traffic into the network and hence are non-intrusive."

2. Clark, D. D., & Blumenthal, M. S. (2001). Rethinking the design of the Internet: The end-to-end arguments vs. the brave new world. National Research Council. This and similar foundational networking texts discuss the trade-offs, noting passive monitoring's benefit of observing real traffic without interference.

3. Cisco Systems, "Cisco IOS NetFlow," White Paper, 2007. The paper describes NetFlow as a passive technology, stating, "NetFlow provides a key set of services for IP applications... without introducing overhead on the network itself."

Catalyst Center (formerly DNA Center) is Cisco's primary network command center, utilizing AI for automated enterprise network operations. AppDynamics is an Application Performance Management (APM) solution specifically designed to monitor application performance and correlate those insights directly with real-time business metrics. ThousandEyes provides Digital Experience Monitoring, delivering end-to-end visibility across the internet and enterprise networks from any user to any hosted application. Cisco Meraki is engineered as a cloud-native platform for the centralized management of distributed networks, handling routing, switching, wireless, and integrated IoT technologies like smart cameras.

This is a drag-and-drop question, so individual options are not "incorrect" in the same way as multiple-choice. Any other combination would be incorrect because it would misalign the platform's core purpose with the business case. For example, using DNA Assurance to monitor SaaS performance would fail as it lacks visibility into the internet path, which is ThousandEyes' strength.

Cisco Systems, Inc. "Cisco Catalyst Center Data Sheet." Section: Product Overview. Details the platform's role as an AI-driven, cloud or on-premises management system for connecting, securing, and automating network operations.

Cisco Systems, Inc. "AppDynamics Application Performance Monitoring (APM)." Section: Business iQ Overview. Corroborates the platform's capability to alert and analyze real-time business impacts from application performance to pinpoint root causes.

Cisco Systems, Inc. "ThousandEyes Platform Overview." Section: Digital Experience Monitoring. Confirms the platform's architectural goal of providing end-to-end visibility from users to applications across any underlying network infrastructure.

Cisco Systems, Inc. "Cisco Meraki Cloud Managed IT." Section: Architecture and IoT Solutions. Validates Meraki as a cloud-based dashboard dedicated to managing distributed enterprise networks and IoT endpoints with unified visibility.

The primary purpose of integrating ThousandEyes with the Cisco Meraki platform is to gain deep visibility into the performance of external, business-critical services from the perspective of the SD-WAN branch office. By deploying a ThousandEyes Enterprise Agent on a Meraki MX security and SD-WAN appliance, administrators can proactively monitor the network paths to SaaS applications (like Microsoft 365, Salesforce) and services hosted in IaaS/PaaS clouds. This allows for rapid identification and diagnosis of performance issues that occur outside the local network, ensuring a better user experience for cloud-dependent applications.

A. Endpoint Agents are for user devices and are not deployed via the Meraki dashboard integration, which focuses on agents for network appliances.

C. ThousandEyes is a performance visibility platform, not a security enforcement or compliance tool. Other solutions like Cisco Umbrella handle cloud security.

D. User access policies and permissions are managed through Meraki's native features or integrated Identity and Access Management (IAM) solutions, not ThousandEyes.

1. Cisco Meraki Documentation, "ThousandEyes Integration with Meraki." The overview section states, "The ThousandEyes integration with Meraki allows you to quickly pinpoint the source of performance issues with the SaaS and IaaS applications your business relies on... by running a ThousandEyes Enterprise Agent directly on your Meraki MX."

2. Cisco, "Meraki and ThousandEyes At-a-Glance," 2022. Page 1 highlights the key benefit: "Gain hop-by-hop visibility into network underlay, overlay, and application performance from the Meraki MX appliance to any application or service, whether on-premises or in the cloud."

The ThousandEyes Enterprise Agent can be deployed on compatible Cisco Catalyst 9000 series switches using the native Application Hosting framework on IOS XE. This can be done directly via the Command-Line Interface (CLI). For scaled deployments and centralized management, Cisco Catalyst Center (formerly DNA Center) provides a graphical user interface and automation workflows to deploy, manage, and monitor the ThousandEyes agent application across multiple compatible switches. These are the two primary, officially documented methods for deploying the agent on switches.

C. Catalyst SD-WAN Manager is used to deploy agents on Cisco SD-WAN routers (e.g., ISR, ASR, Catalyst 8000 series), not on Catalyst 9000 series switches.

D. The ThousandEyes portal is used to obtain the agent installation package and account token, but it is not the mechanism that performs the deployment onto the switch itself.

E. This option is incorrect because options C and D are not valid deployment methods for a switch.

1. Cisco, "ThousandEyes Enterprise Agent Deployment Using Application Hosting on Catalyst 9300/9400 Switches," Configuration Guide. This guide details the CLI-based deployment using the app-hosting commands. (Reference: Document ID: C11-744223-00, Section: "Deploy and Activate the ThousandEyes Enterprise Agent").

2. Cisco, "Deploy ThousandEyes Enterprise Agent on Catalyst 9300 and 9400 Switches Using Cisco DNA Center," White Paper, 20-Sep-2022. This document outlines the step-by-step workflow for deploying the agent using the Catalyst Center GUI. (Reference: Document ID: C11-744223-00, Section: "Deploy ThousandEyes Enterprise Agent Using Cisco DNA Center").

3. Cisco, "Cisco SD-WAN and ThousandEyes Integration," Deployment Guide. This guide specifies that vManage (now Catalyst SD-WAN Manager) is used for deployment on IOS XE SD-WAN devices, listing router platforms like ISR 4000, ASR 1000, and Catalyst 8000 series. (Reference: Section: "Supported Platforms").

An agent installed as a Linux package corresponds to a ThousandEyes Enterprise Agent. For creating dashboard widgets and reports, Enterprise Agents are grouped with Cloud Agents under the "Cloud & Enterprise Agents" data source. The question asks for the "average" packet loss, which statistically corresponds to the "Mean" calculation. Therefore, the correct data source is "Cloud & Enterprise Agents" and the correct measure is "Mean".

A. Endpoint Agents: These agents are installed on user workstations (e.g., Windows, macOS) to measure end-user experience, not deployed as a server-side Linux package for infrastructure monitoring.

C. Routing: This data source provides BGP routing path information, not agent-based performance metrics like packet loss. Standard Deviation measures data variability, not the average.

D. Devices: This data source is for SNMP-monitored hardware like routers and switches, not for data collected from ThousandEyes software agents.

1. Cisco ThousandEyes Documentation, "Dashboards". This documentation details the process of creating dashboard widgets, including the selection of a data source (e.g., Cloud & Enterprise Agents) and a metric/measure (e.g., Packet Loss/Mean).

2. Cisco ThousandEyes Documentation, "What is an Enterprise Agent?". This document describes Enterprise Agents, including their deployment on Linux systems, distinguishing them from Endpoint Agents.

Transaction monitoring is specifically designed to simulate and measure multi-step user workflows. An e-commerce checkout is a classic example of such a transaction, involving steps like adding items to a cart, entering shipping details, and completing payment. This test type validates the functionality and performance of the entire critical user path, which is essential for an e-commerce site. Other test types monitor individual components but not the integrated process.

A. HTTP server monitoring only checks the availability and response time of a single URL. It cannot simulate the sequential steps of a checkout process.

C. DNS monitoring focuses solely on the performance of DNS resolution for the website's domain, which is only the first step in accessing the site.

D. Routing visibility analyzes the network path to the server. While important for connectivity, it does not test the application-layer functionality of the checkout workflow.

1. Cisco ThousandEyes Documentation, "Transaction Tests". This document states, "Transaction tests, also known as web transaction tests, are used to test user workflows such as logging into a web application, filling out a form, or completing a purchase on an e-commerce site."

2. Cisco ThousandEyes Documentation, "Web Layer Tests". This page contrasts different web test types, clarifying that HTTP Server tests check a single page's availability, while Transaction tests "measure the performance of user workflows".