Free 300-440: Designing and Implementing Cloud Connectivity (ENCC) Exam Questions and Answers
22 verified practice questions for 300-440.
The first 10 questions on this page are free to read, answers included — no account and no card. A plan opens the rest of the bank, the full timed practice test and your weak-topic reporting.
Last updated: September 19, 2026
- Exam code
- 300-440
- Provider
- Cisco
- Questions in our bank
- 1000+
- Free to read
- First 10, with answers
- Our test mode duration & pass mark
- 130 mins · 70%
- Verified answers
- Reviewed weekly
Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.
Question #1
A company with multiple branch offices wants a connectivity model to meet its network architecture requirements. The company focuses on ensuring low latency and efficient routing for its critical business applications. Which connectivity model meets these requirements?
Please select an optionIncorrectCorrect answer: B
A fully meshed SD-WAN topology gives every branch a direct path to every other branch, minimizing latency, while dynamic BGP routing lets SD-WAN select the most efficient path for critical applications.
Was this answer correct?Question #2
Refer to the exhibit. Refer to the exhibits. An engineer must redistribute IBGP routes into OSPF to connect an on-premises network to a cloud provider. Which command must be configured on router R2?
Please select an optionIncorrectCorrect answer: D
• This command redistributes the routes learned from BGP AS100 into OSPF Area 1, which allows router R2 to advertise those routes to router R1 and connect the on-premises network to the cloud provider. The other options are incorrect because they either redistribute the wrong routes or use the wrong syntax5 . I hope this helps you understand the question and the answer. If you have any other questions or requests, please let me know. I am always happy to help. References: 1: Learning Plan: Designing and Implementing Cloud Connectivity v1.0 (ENCC 300-440) Exam Prep 2: Designing and Implementing Cloud Connectivity (ENCC) v1.0 3: Cisco Multiprotocol Label Switching 4: Exploring Cisco Cloud OnRamp for Colocation 5: ENCC: Configuring IPsec VPN from Cisco IOS XE to AWS : [Deploying Cisco IOS VTI-Based Point-to-Point IPsec VPNs]
Was this answer correct?Question #3
Refer to the exhibit. An engineer needs to configure a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS). Which configuration command must be placed in the blank in the code to complete the tunnel configuration?
Please select an optionIncorrectCorrect answer: B
In the given scenario, an engineer is configuring a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router and AWS. The correct command to complete the tunnel configuration is ??tunnel source 20.20.20.21??. This command specifies the source IP address for the tunnel, which is essential for establishing a secure connection between two endpoints over the internet or another network1. References: • Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services - Cisco Community • [Security for VPNs with IPsec Configuration Guide, Cisco IOS XE Release 3S - Config
Was this answer correct?Question #4
Refer to the exhibit. Which Cisco lKEv2 configuration brings up the IPsec tunnel between the remote office router and the AWS virtual private gateway?
Please select an optionIncorrectCorrect answer: B
Option C is the correct answer because it configures the IKEv2 profile with the correct match identity, authentication, and keyring parameters. It also configures the IPsecprofile with the correct transform set and lifetime parameters. Option A is incorrect because it does not specify the match identity remote address in the IKEv2 profile, which is required to match the AWS virtual private gateway IP address. Option B is incorrect because it does not specify the authentication pre-share in the IKEv2 profile, which is required to authenticate the IKEv2 peers using a pre-shared key. Option C also matches the configuration example provided by AWS1 and Cisco2 for setting up an IKEv2 IPsec site-to- site VPN between a Cisco IOS-XE router and an AWS virtual private gateway. References := • 1: AWS VPN Configuration Guide for Cisco IOS-XE • 2: Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services
Was this answer correct?Question #5
Refer to the exhibit. An engineer successfully brings up the site-to-site VPN tunnel between the remote office and the AWS virtual private gateway, and the site-to-site routing works correctly. However, the end-to-end ping between the office user PC and the AWS EC2 instance is not working. Which two actions diagnose the loss of connectivity? (Choose two.)
Select 2 answers.
Please select an optionIncorrectCorrect answer: B, C
The end-to-end ping between the office user PC and the AWS EC2 instance is not working because either the security group rules for the host VPC are blocking the ICMP traffic or the IPsec SA counters are showing errors or drops. To diagnose the loss of connectivity, the engineer should check both the security group rules and the IPsec SA counters. The network security group rules on the host VNET are not relevant because they apply to Azure, not AWS. The IPsec SA configuration on the Cisco VPN router and the AWS private virtual gateway are not likely to be the cause of the problem because the site- to-site VPN tunnel is already up and the site-to-site routing works correctly. References := • Designing and Implementing Cloud Connectivity (ENCC, Track 1 of 5), Module 3: Configuring IPsec VPN from Cisco IOS XE to AWS, Lesson 3: Verify IPsec VPN Connectivity • Security for VPNs with IPsec Configuration Guide, Cisco IOS XE, Chapter: IPsec VPN Overview, Section: IPsec Security Association • AWS Documentation, User Guide for AWS VPN, Section: Security Groups for Your VPC
Was this answer correct?Question #6
An engineer must enable the OMP advertisement of BGP routes for a specific VRF instance on a Cisco IOS XE SD-WAN device. What should be configured after the global address-family ipv4 is configured?
Please select an optionIncorrectCorrect answer: B
To enable the OMP advertisement of BGP routes for a specific VRF instance on a Cisco IOS XE SD-WAN device, the engineer must first configure the global address-family ipv4 and then enable bgp advertisement under the vrf definition. This will allow the device to advertise the BGP routes learned from the cloud provider to the OMP control plane, which will then distribute them to the other SD-WAN devices in the overlay network1 References := 1: Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3: Implementing Cloud Connectivity, Lesson 3: Configuring IPsec VPN from Cisco IOS XE to AWS, Topic: Configuring BGP on the Cisco IOS XE Device, Page 3-24.
Was this answer correct?Question #7
Refer to the exhibits. While troubleshooting, a network engineer discovers that the backup path fails between ASBR3 and ASBR4 for traffic between BGP AS6000 and BGP AS6500 when the connection between ASBR1 and ASBR2 goes down. The following configurations were performed on ASBR1: Which command is missing?
Please select an optionIncorrectCorrect answer: A
The bgp advertise-best-external command is used to enable the advertisement of the best external path to internal BGP peers. This command is useful when there are multiple exit points from the local AS to other ASes, and the local AS wants to use the closest exit point for each destination. By default, BGP only advertises the best path to its peers, and the best path is usually the one with the lowest IGP metric to the next hop. However, this may not be the optimal path for traffic leaving the local AS, as it may result in suboptimal hot-potato routing or MED oscillations. The bgp advertise-best-external command allows BGP to advertise the best external path, which is the path with the lowest MED among the paths from different neighboring ASes, in addition to the best path. This way, the internal BGP peers can choose the best exit point based on the MED value, rather than the IGP metric. In this scenario, ASBR1 is configured to receive additional paths from ASBR2, which is a route reflector. ASBR2 receivestwo paths for the same prefix from AS6500, one from ASBR3 and one from ASBR4. ASBR2 selects the best path based on the IGP metric to the next hop, and advertises it to ASBR1. However, this path may not be the best external path, as it may have a higher MED value than the other path. If the connection between ASBR1 and ASBR2 goes down, ASBR1 will not have any backup path to reach AS6500, as it does not know the other path from ASBR4. To prevent this situation, ASBR1 should be configured with the bgp advertise-best-external command, so that it can receive the best external path from ASBR2, along with the best path. This way, ASBR1 will have a backup path to reach AS6500, in case the primary path fails. References := IP Routing: BGP Configuration Guide - BGP Additional Paths ?? - Cisco, BGP Additional Paths
Was this answer correct?Question #8
A company with multiple branch offices wants a suitable connectivity model to meet these network architecture requirements: • high availability • quality of service (QoS) • multihoming • specific routing needs Which connectivity model meets these requirements?
Please select an optionIncorrectCorrect answer: D
A fully meshed topology with SD-WAN technology using dynamic routing and prioritized traffic for QoS meets the network architecture requirements of the company. A fully meshed topology provides high availability by eliminating single points of failure and allowing multiple paths between branch offices. SD-WAN technology enables multihoming by supporting multiple transport options, such as MPLS, internet, LTE, etc. SD-WAN also provides QoS by applying policies to prioritize traffic based on application, user, or network conditions. Dynamic routing allows the SD-WAN solution to adapt to changing network conditions and optimize the path selection for each traffic type. A fully meshed topology with SD-WAN technology can also support specific routing needs, such as segment routing, policy-based routing, or application-aware routing. References: • Designing and Implementing Cloud Connectivity (ENCC) v1.0 • [Cisco SD-WAN Design Guide] • [Cisco SD-WAN Configuration Guide]
Was this answer correct?Question #9
What is the role of service providers to establish private connectivity between on-premises networks and Google Cloud resources?
Please select an optionIncorrectCorrect answer: A
Service providers offer Partner Interconnect, a form of Google Cloud Interconnect that gives on-premises networks direct, dedicated private connectivity to Google Cloud through the provider's facility, bypassing the public internet.
Was this answer correct?Question #10
An engineer is implementing a highly secure multitier application in AWS that includes S3, RDS, and some additional private links. What is critical to keep the traffic safe?
Please select an optionIncorrectCorrect answer: B
Specific routing policies keep traffic between tiers on private links instead of the public internet, and S3 bucket policies restrict who can access the stored data and under which conditions.
Was this answer correct?
Continue with 300-440: Designing and Implementing Cloud Connectivity (ENCC)
Unlock the full question bank
You have read the first 10 questions. A subscription opens every question in 300-440: Designing and Implementing Cloud Connectivity (ENCC), the full timed practice test, and your progress and weak-topic reporting.
Single exam
$19.99for 30 days
Full question bank and practice test for one exam, for 30 days.
Single exam
$49.99for 1 year
One exam for a full year. Nothing renews and nothing to cancel.
Full access
$39.99/mo
Every exam in the catalogue, month to month.
Full access
$199.99/yr
Every exam in the catalogue for a year.
Already subscribed? Sign in to pick up where you left off.
Other Cisco certifications
- 200-301: Cisco Certified Network Associate (CCNA) (opens in a new tab)
- 350-401: Implementing Cisco Enterprise Network Core Technologies (ENCOR) (opens in a new tab)
- 350-701: Implementing and Operating Cisco Security Core Technologies (opens in a new tab)
- 350-501: Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) (opens in a new tab)
- 300-410: Implementing Cisco Enterprise Advanced Routing and Services (ENARSI) (opens in a new tab)
- 350-601: Implementing and Operating Cisco Data Center Core Technologies (DCCOR) (opens in a new tab)
Reviews
★★★★★
This platform is a lifesaver. The practice questions and explanations are so detailed. It’s the best study tool I’ve ever used.
Hannah Smith
USA
★★★★★
I highly recommend Exam Practice. The feedback after each test helped me improve significantly, and I passed my exams easily.
Oscar Nyström
Sweden
★★★★★
Exam Practice is worth every penny. The mock exams are realistic, and the feedback helped me focus on key areas.
Amit Sharma
India
FAQ
Learn More: https://www.cisco.com/site/us/en/learn/training-certifications/certifications/index.html
- Q1: What are Cisco Certification Exams?
- A: Cisco Certification Exams validate your expertise in using and managing Cisco networking and IT solutions. These certifications demonstrate your proficiency in designing, implementing, and troubleshooting Cisco-based networks and systems, covering areas such as routing and switching, security, wireless, data center, and collaboration.
- Q2: Why should I pursue Cisco Certification?
- A: Cisco Certification enhances your professional credibility, showcasing your skills and knowledge in Cisco technologies. This can lead to better job opportunities, higher salaries, and career advancement in networking and IT industries.
- Q3: What are the benefits of Cisco Certification?
- A: Benefits include recognition as a certified networking professional, improved job performance, access to exclusive resources, continuing education opportunities, and staying current with the latest Cisco technologies and best practices.
- Q4: Who should take Cisco Certification Exams?
- A: Network engineers, system administrators, IT professionals, and anyone involved in designing, implementing, and managing network solutions using Cisco products should consider these certifications to validate their expertise and advance their careers.
- Q5: What types of Cisco Certification Exams are available?
- A: Cisco offers various certification paths, including:
- Q6: How do I prepare for Cisco Certification Exams?
- A: Preparation can include official Cisco training courses, study guides, practice exams, online tutorials, and hands-on experience with Cisco networking equipment and solutions.
- Q7: Where can I take Cisco Certification Exams?
- A: Cisco Certification Exams can be taken at authorized Pearson VUE testing centers worldwide or online, providing flexibility to fit your schedule and location.
- Q8: How do Cisco Certifications impact my career?
- A: Cisco Certifications significantly boost your career by demonstrating your expertise to employers, making you a more competitive candidate for advanced roles and promotions in networking and IT.
- Q9: Are there any prerequisites for Cisco Certification Exams?
- A: Some exams may have prerequisites, such as foundational knowledge or prior certifications. Check the specific requirements for each certification path on the Cisco website.
- Q10: How often do I need to recertify for Cisco Certifications?
- A: Cisco Certifications typically require recertification every three years to ensure that certified professionals stay updated with the latest networking technologies and industry practices.