Free Cisco 300-445 Practice Exam with Questions & Answers | Set: 2

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum,ThousandEyes WAN Insightsis a predictive analytics solution designed to transform network management from a reactive to a proactive model.10In the scenario provided, the voice quality issues are recurring and peak-hour dependent, indicating a need for optimization rather than just standard real-time alerting.11

The most relevant capability for this scenario isanalyzing historical SD-WAN performance datato generatepath recommendations(Option B). WAN Insights integrates withCisco Catalyst SD-WAN Manager(vManage) andvAnalyticsto ingest massive volumes of telemetry.12It uses advanced statistical models to analyze the performance of all active circuits (MPLS, Internet, etc.) over time. If the system identifies that a different available path consistently delivers a higher Quality of Experience (QoE) or better adherence to the voice SLA during those peak windows, it generates a recommendation to adjust theApplication-Aware Routing (AAR)policy.1314

This predictive approach allows the administrator to fine-tune network policies in advance, ensuring that sensitive traffic like voice is automatically rerouted to the most stable path before the congestion impacts the users. Option A describes standard ThousandEyes synthetic testing, while Option C is incorrect because WAN Insights specifically uses existing SD-WAN telemetry rather tha15n generating its own synthetic voice16probes. Option D and E describe general NMS or security features not specific to WAN Insights' predictive mission. Thus, the proactive recommendation of alternative paths based on historical SLA adherence is the core function of WAN Insights for improving voice quality.171819

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, the integration between ThousandEyes andWebex Control Hubprovides a streamlined troubleshooting experience for collaboration services. For the VoIP team to access the specific ThousandEyes network telemetry—such as latency, loss, and jitter—they must navigate to theNetwork Path(Option B) section within the Troubleshooting tab of the Control Hub.15

TheNetwork Pathvisualization is a direct result of the ThousandEyes Endpoint Agent data being pulled into the Webex interface.16When a user or RoomOS device experiences poor audio or video quality during a meeting, the Control Hub's troubleshooting view displays a "Network Path" line under the participant's details.17By clicking on this line, the VoIP team can see a hop-by-hop breakdown of the entire route from the collaboration device to the Webex media node. This view highlights specific hops where performance is "Poor" (red), "Fair" (yellow), or "Good" (green) based on predefined thresholds for latency (>400ms) or loss (>5%).

While "Devices" (Option A) is where the agents are activated, and "Users" (Option C) allows for selecting a specific participant, the actualtelemetry metricsand the visualization of the network route are strictly located in theNetwork Pathview. This integration eliminates the need for the VoIP team to leave the Webex environment for initial triage, as they can identify if a problem is local to the branch office or deep within a service provider's network directly from the "Network Path" dashboard.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, monitoring modern APIs often requires handling complex authentication flows, such as OAuth 2.0 with specific client credential parameters. The provided exhibit illustrates theHTTP Authenticationoptions available within a standard HTTP Server test: None, Basic, NTLM, Kerberos, and OAuth.

According to the ENNA implementation standards, while the HTTP Server test type supportsOAuth(Option C), its native implementation is limited. Specifically, it is designed to use a pre-existing token or a simple token refresh flow; it does not support the injection of custom parameters in the initial POST request required to obtain a token in many enterprise client-credential scenarios. Basic and NTLM (Options A and B) are legacy protocols that rely on simple username/password headers and cannot facilitate the multi-step token exchange process described.

To fulfill the requirement of a two-step flow (POST for token, followed by GET for resource), engineers must use more flexible test types:

Transaction scripts (Option D):These allow the engineer to write custom JavaScript using the ThousandEyes transaction library to programmatically handle the POST request, parse the resulting JSON token, and then pass that token into the subsequent GET request's header.

API tests (Option E):These are purpose-built for API monitoring and natively support the definition of variables and multi-step requests where the output of one call (the token) serves as the input for the next.

By utilizing these advanced test types, the engineer can successfully navigate complex authentication requirements that the standard HTTP Server test cannot accommodate.

The architecture forDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)specifies that ThousandEyes WAN Insights relies on deep integration with the Cisco SD-WAN management stack. To generate its predictive path recommendations, the platform must ingest specific telemetry data that reflects both the network's behavior and the applications traversing it.

The first essential data source ishistorical network performance metrics collected by vAnalytics(Option B). Before WAN Insights can be activated, vAnalytics must be enabled to collect and enrich raw network telemetry from the edge routers.34This data includes granular metrics for every SD-WAN tunnel, such as packet loss, latency, and jitter.35WAN Insights analyzes these historical trends to forecast future path quality and determine which transport circuits are most likely to meet application SLAs over a long-term period.

The second essential data source isapplication traffic flow data(Option D). WAN Insights must understand which applications are currently active in the fabric to prioritize recommendations for "business-critical" services like Office 365, Webex, or custom internal apps.38This information is ingested as flow records from the SD-WAN data plane and categorized based on theApplication Listsdefined inCisco Catalyst SD-WAN Manager (vManage).

Options A and E are configuration or logging data that, while useful for general management, are not the raw telemetry inputs used by the WAN Insights predictive engine. Option C is incorrect because WAN Insights explicitly uses infrastructure telemetry rather than ThousandEyes agent-based synthetic data for its SD-WAN fabric calculations. By combiningvAnalytics performance metricsandapplication flow data, WAN Insights can provide the "Predictive Path Recommendatio41ns" that are a hallmark of modern network assurance.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)architecture, secure administrative access via Single Sign-On (SSO) is a critical component of platform governance. The exhibit illustrates the ThousandEyes SSO configuration panel being integrated withMicrosoft Entra ID(formerly Azure AD). When configuring SAML-based authentication, the "Identity Provider Issuer" (Option D) is a unique identifier provided by the IdP (Microsoft) that must match exactly between the two systems.

According to ENNA implementation guidelines, ThousandEyes populates default fields based on standard SAML metadata. However, Microsoft Entra ID often utilizes a specific GUID-based format for the Issuer URL (e.g., https://sts.windows.net/tenant-id/) that may differ from the generic URL format expected by the platform's initial auto-fill. To ensure a successful SAML handshake, the engineer must select the "Override"checkbox next to theIdentity Provider Issuerfield. This action unlocks the field, allowing the engineer to manually paste the exact string provided in the Entra ID Federation Metadata document. If this value is not overridden and matched precisely, the SAML assertion will be rejected, resulting in a failed authentication attempt.

While the Login and Logout URLs (Options B and C) are also critical, they are typically correctly identified during the initial setup or metadata import; theIdentity Provider Issueris the most frequent point of mismatch requiring an manual override in Entra ID environments due to its strict "Audience Restriction" requirements. TheService Provider Issuer(Option A) is generally a fixed value (https://app.thousandeyes.com) that rarely requires overriding as it defines ThousandEyes' own identity to the IdP.

Therefore, selecting the override for theIdentity Provider Issueris the necessary step to complete the integration and allow enterprise users to authenticate securely using their corporate credentials.

In the framework ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), selecting the appropriate ThousandEyes agent type is critical to balancing visibility requirements with infrastructure constraints. For Branch A, the primary objective is to gain network-layer metrics (such as latency, packet loss, and jitter) and path visualization for a SaaS application while strictly avoiding any performance impact on employee endpoints.

TheEnterprise Agent(Option C) is the correct choice because it is designed for "inside-out" monitoring from within the corporate network environment. These agents are lightweight software probes that can be deployed on existing network infrastructure, such asCisco Catalyst 9300/9400 switchesorCatalyst 8000 Edge Platforms, using Docker containers or virtual machines. By hosting the agent on the branch router or a dedicated local server, the engineer can execute synthetic tests to the SaaS provider's destination. This approach provides the necessary network vantage point from Branch A without requiring any software installation or resource consumption on the individual employee workstations (endpoints).

Other agent types do not satisfy the specific constraints of this scenario:

Endpoint Agentsare installed directly on user devices (Windows/macOS) to provide "last-mile" visibility. However, they use the endpoint's CPU and memory, which contradicts the requirement to not affect endpoint performance.

Cloud Agentsare maintained by Cisco in global ISP data centers. While they provide "outside-in" visibility, they cannot capture internal branch network characteristics or the specific path from Branch A's internal local area network.

Application Agentis a non-standard term and does not exist as a standalone agent type within the ThousandEyes architecture.

Therefore, deploying anEnterprise Agentwithin the branch infrastructure ensures that the network engineer obtains high-fidelity network metrics while keeping employee devices entirely unburdened.

Introduction to ThousandEyes

This video provides an essential overview of how ThousandEyes agents function within a CCNP-level enterprise network assurance strategy.

InDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), dashboard widgets must be mapped to the correct telemetry data source and statistical measure. When an agent is installed as aLinux packageon an organization's infrastructure, it is classified as anEnterprise Agent.

The correct configuration for this widget isCloud & Enterprise Agents and Mean(Option B).

Data Source:Since the Linux-based agent is an Enterprise Agent, it shares the same data source category as Cloud Agents in the ThousandEyes dashboard configuration menu.

Measure:To display the "average" packet loss as requested, theMean(the arithmetic average) is the appropriate statistical measure.

Other options are unsuitable:

Option A:Endpoint Agentsare those installed on Windows/macOS user devices, not typically a standard Linux server package used for infrastructure monitoring.Medianwould show the middle value, not the average.

Option C:Routingrefers to BGP data, which does not report packet loss in the same way as synthetic network tests.

Option D:Devicesrefers to hardware monitored via SNMP, and annth Percentileis a specific statistical cutoff (like 95th percentile) rather than a simple average.

As shown inExhibit 4.1-1(image_6e19fb.png), the alert rule is configured for the BGP layer with the name "AS origin AS 1234". The critical logic is defined in theAlert Conditionssection, which specifies: BGP Origin meets all of: ASN not in 1234.

This specific configuration is the standard method used in ThousandEyes to detectBGP hijacking(Option C). BGP hijacking occurs when an unauthorized Autonomous System (AS) announces a network prefix that it does not own, effectively stealing the traffic meant for the legitimate owner. By setting an alert that triggers when a monitored prefix is seen originating from an Autonomous System Number (ASN) that isnotthe expected authorized ASN (in this case, AS 1234), ThousandEyes provides immediate notification of a routing takeover.

Identifying this via BGP Origin alerts is superior to simple connectivity checks because it catches the issue at the routing control plane.

DNS Issues (Options B and D):These involve the translation of names to IPs and would be detected via DNS-specific tests rather than BGP Origin checks.

Route Poisoning (Option A):This is a generic term often referring to the manipulation of distance-vector protocol metrics to make a route unreachable; while related to routing, BGP Origin checks are the specific tool for detecting external prefix hijacks.

By monitoring the ASN origin, network engineers can quickly distinguish between a local ISP outage and a global security event where their traffic is being misdirected to an illegitimate network.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)best practices for collaboration monitoring,Microsoft Teams(as well as Webex and Zoom) is monitored using a combination ofScheduled and Dynamic tests(Option D).

Scheduled Tests:These are used to proactively monitor the reachability and performance of the Microsoft Teams infrastructure. The Teams template typically includes scheduled HTTP Server tests to teams.microsoft.com and login.microsoftonline.com, along with network-layer tests to theTeams Transport Relay(e.g., worldaz.tr.teams.microsoft.com). These provide a continuous baseline of connectivity regardless of whether a user is currently in a call.

Dynamic Tests:These are a unique feature for collaboration monitoring. When an Endpoint Agent detects that the Teams application has initiated a real-time media session (audio or video call), it automatically triggers aDynamic Testto the specific IP and port being used for that call. This allows IT teams to see the exact network path—including hop-by-hop latency and loss—of the actual call traffic while the session is active.

Real User Tests (Option C)are generally not used for Teams monitoring in the same way they are for web-based SaaS apps. Because most users utilize the Teamsdesktop clientrather than the browser, the RUM browser extension cannot capture the rich telemetry of the desktop application's internal signaling and media streams. Therefore, the specialized "Automated Session Testing" provided byDynamic Tests, combined with the proactive health checks ofScheduled Tests, constitutes the complete assurance strategy for Microsoft Teams.

In the context ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), analyzing page-load metrics within Cisco ThousandEyes requires identifying the primary bottlenecks that contribute to theTotal Page Load Time. The provided screenshot displays a "Page Breakdown" of 7 resources totaling 953 kB. A critical observation of the pie chart reveals thatImages(the teal-colored segment) constitute the vast majority of the page's payload and resource count.

When the goal is to reduce the page-load time from1023 msto below500 ms, the engineer must target the heaviest components.Lazy loadingis a design pattern that defers the initialization of non-critical resources at page load time. Instead of loading all images simultaneously when the userfirst navigates to the URL, lazy loading ensures that images are only downloaded as they are about to enter the viewport. This significantly reduces the initial DOM load time and the total Page Load Time because the browser does not have to wait for large image files to be fully retrieved before declaring the page "loaded."

Alternative options are less effective in this specific scenario based on the data:

AJAX (XHR/Fetch):The chart shows that XHR and Fetch resources represent a negligible sliver of the total weight; optimizing them would yield minimal gains.

Moving IMG elements:While moving scripts to the bottom can help with rendering, moving image elements to the bottom of the body does not stop the browser from initiating the download requests immediately, thus failing to significantly reduce the total load time.

CDN for Fonts:The "Font" category is also a small fraction of the total 953 kB. While a CDN is a best practice for latency, it does not address the primary "weight" issue caused by the images.

Therefore, implementinglazy loading(Option C) is the most impactful recommendation. It directly addresses the largest resource consumer (Images) identified in the ThousandEyes Page Breakdown, allowing the engineer to reach the sub-500 ms performance target.