300-440 Practice Questions

SDCI providers operate their own private backbone, which ensures predictable latency and performance by avoiding the public internet.

The 'Software-Defined' aspect means connectivity can be rapidly provisioned, modified, and de-provisioned through a self-service portal or API, enabling on-demand bandwidth.

SDCI providers build direct, dedicated entry points into cloud provider networks (like AWS Direct Connect, Azure ExpressRoute), which is fundamental to their service offering.

All control connections in Cisco SD-WAN are secured with DTLS/TLS and rely on certificates for authentication. If the system clock on the vEdge is significantly out of sync, the validity period of the vSmart controller's certificate will appear incorrect to the vEdge. This causes the certificate validation to fail, preventing the DTLS control connection from being established. Since vBond was reachable, initial authentication and IP discovery worked, pointing to a problem with the subsequent connection to vSmart.

Under the shared responsibility model, the cloud provider secures the underlying infrastructure, but the customer is responsible for security in the cloud. This includes configuring network controls for east-west traffic (traffic between resources within the VPC). Customers must use services like AWS Security Groups/NACLs, Azure Network Security Groups (NSGs), or Google Cloud Firewall Rules to implement micro-segmentation and control communication between their own virtual machines and services.

This is the classic cause for such symptoms. IPsec adds encapsulation overhead, reducing the effective MTU of the tunnel. If large packets (e.g., 1500 bytes) are sent through the tunnel without adjustment, the router must fragment them, which is a CPU-intensive process. During peak hours, the high volume of packets needing fragmentation overwhelms the router's CPU, causing it to drop packets in its output queue. The solution is to set ip mtu on the tunnel interface (e.g., to 1400) and configure ip tcp adjust-mss (e.g., to 1360) to prevent fragmentation from occurring.

This is the ideal architecture. A global SD-WAN fabric provides central management (via vManage) and policy enforcement. Deploying vSmart controllers regionally allows for regional autonomy and reduces control plane latency. Cloud OnRamp for IaaS automates the deployment of vEdge Cloud routers in each cloud provider and the creation of secure tunnels. Application-aware routing policies can then be used to ensure local traffic prefers in-region cloud resources, while centralized data policies can securely enable specific inter-regional traffic flows. This model perfectly balances central control with regional performance.

This design provides the highest resiliency by eliminating single points of failure. Using different on-premises routers protects against a device failure on the customer side. Using separate Direct Connect gateways protects against a logical failure within the AWS Direct Connect service. Attaching both to a Transit Gateway allows for centralized routing and seamless failover between the paths. Terminating on a single router or VGW introduces a single point of failure.

The MM_NO_STATE status indicates that the initiator (the Cisco router) sent the initial IKE Main Mode (MM) packets but received no response from the peer (Azure VPN Gateway). This almost always points to a connectivity issue where the IKE negotiation packets (UDP port 500 for ISAKMP) are being blocked by a firewall, an ACL, or a routing problem. Phase 2 mismatches would occur after Phase 1 is complete, and BGP issues are irrelevant to the IPsec tunnel establishment itself.

The Application-Aware Routing (AAR) policy is used to identify Microsoft Teams traffic and steer it onto the path that meets the defined SLA (e.g., lowest latency), enabling the direct internet access.

A Centralized Data Policy is required to create the traffic engineering logic. It will match the non-Teams Microsoft 365 traffic and direct it towards the service VPN that leads to the regional data center, while allowing the Teams traffic (handled by the AAR policy) to exit locally.

An SDCI provider (like Megaport or Equinix Fabric) offers a private, high-speed backbone that connects to major cloud providers globally. This model allows the enterprise to connect its data centers to the SDCI fabric once and then programmatically spin up virtual cross-connects to various cloud regions and providers. This meets the requirements for private connectivity, low latency, and scalability without the complexity and cost of managing numerous individual private circuits.

This statement is false. Cisco SD-WAN Cloud OnRamp for SaaS does not use BGP for path selection. Instead, it continuously probes the SaaS application over all available paths using HTTP probes. It then calculates a quality of experience (QoE) score based on latency and loss, and steers user traffic down the best-performing path in real-time. BGP is used for underlay or overlay routing, not for the dynamic, application-level path selection specific to this feature.