Cisco 300-440 ENCC Cloud Connectivity Practice Exam

An enterprise needs predictable low-latency, high-bandwidth connectivity to a single public cloud for a latency-sensitive application, and wants to avoid traversing the public internet. Which connectivity model best fits?

1. A dedicated/private interconnect (such as a direct connection or software-defined cloud interconnect) to the cloud provider
2. A best-effort IPsec tunnel over the public internet
3. Public internet access with no encryption to reduce overhead
4. A single site-to-site VPN with no redundancy

A network engineer is configuring a site-to-site IPsec VPN from a Cisco IOS XE router to an AWS VPN gateway and wants dynamic routing over the tunnel so new cloud subnets are learned automatically. Which design should the engineer implement?

1. A policy-based VPN with static ACLs defining every subnet pair
2. A GRE tunnel with no encryption to simplify routing
3. A route-based VPN using a virtual tunnel interface (VTI) with IKEv2, running BGP over the tunnel to exchange routes dynamically
4. A crypto map with manually configured static routes for each cloud subnet

An enterprise running Cisco Catalyst SD-WAN wants to automate connectivity from its branches to workloads in AWS, provisioning a cloud gateway and mapping host VPCs without manual per-branch tunnels. Which capability should the consultant use?

1. Cloud OnRamp for Multicloud in Cisco SD-WAN Manager, deploying a cloud gateway and mapping host VPCs to the overlay
2. Manually configure IPsec tunnels from each branch router to AWS
3. A single static default route pointing at the internet
4. Per-branch GRE tunnels managed by hand

During IKEv2 negotiation to an Azure VPN gateway, the tunnel fails to establish. The engineer suspects a Phase 1 mismatch. Which set of parameters must match on both peers for IKEv2 SA establishment?

1. Only the pre-shared key
2. Encryption algorithm, integrity/PRF, Diffie-Hellman group, and authentication method
3. Only the tunnel interface IP addresses
4. Only the BGP autonomous system numbers

A company is designing connectivity to two cloud providers and must keep routing and security policy consistent while avoiding asymmetric routing between the providers. Which design practice best addresses this?

1. Use each provider’s defaults independently and reconcile issues reactively
2. Connect to only one provider to avoid complexity
3. Disable route filtering so all routes propagate everywhere
4. Define consistent routing policy (BGP attributes, route filtering) and uniform security controls across both providers, with a clear active/standby or active/active path design

An engineer is extending Cisco Catalyst SD-WAN to Google Cloud and needs the overlay to reach workloads in existing VPCs across multiple GCP regions. Which Cloud OnRamp step accomplishes this?

1. Manually peer every branch router with each GCP VPC
2. Use a public-internet default route from each branch to GCP
3. Associate the Google Cloud account, then discover and tag host VPCs so the cloud gateway maps them into the SD-WAN overlay
4. Configure a single VLAN that spans on-premises and GCP

A retailer wants dedicated private Layer 2 connectivity with SLA-backed bandwidth from branch locations to multiple clouds, provisioned on demand rather than via long carrier lead times. Which option fits?

1. Software-defined cloud interconnect (SDCI) via a provider such as Megaport or Equinix, provisioned through Cisco SD-WAN Manager
2. A best-effort IPsec tunnel over broadband internet
3. A traditional MPLS circuit ordered from a carrier with a multi-week lead time
4. A single ISP link with no interconnect

After deploying multicloud connectivity, operations needs ongoing visibility into cloud-gateway health, tunnel status, and reachability to catch degradations before users report them. What should the engineer use?

1. Wait for user tickets, then investigate reactively
2. Check each router’s CLI manually once a week
3. Disable logging to reduce noise
4. The Cisco SD-WAN Manager multicloud monitoring dashboards for cloud-gateway health, device/BFD status, and connectivity, with proactive alerting

A regulated enterprise must ensure cloud workloads and their data stay within a specific geographic region and that connectivity is encrypted end to end. Which design choices satisfy both requirements?

1. Deploy in any available cloud region and rely on the provider’s defaults
2. Select cloud regions that meet data-residency rules, and enforce encrypted transport (IPsec or encrypted interconnect) for all connectivity into and within the deployment
3. Use unencrypted direct links because private circuits are inherently compliant
4. Store data anywhere and encrypt only at rest

An enterprise needs application-aware routing from branches to SaaS and IaaS in Azure, steering traffic over the best-performing path and failing over automatically when a path degrades. Which Cisco Catalyst SD-WAN capability provides this?

1. Static routing with a single default gateway
2. Disabling probes to reduce control traffic
3. Application-aware routing policies with SLA classes over Cloud OnRamp, measuring loss/latency/jitter and steering to the best path with automatic failover
4. A manually pinned single tunnel with no measurement