SkillTestPro | CCNP 300-440 ENCC Practice Test 1

CCNP ENCC 300-440 Practice Test 1 (Hard) - Internet-Based Connectivity to Cloud Providers (Native IPsec & SD-WAN)

CCNP Enterprise logo

1 / 10

An enterprise needs the simplest connectivity model to reach a native cloud VPC over the public Internet, using standard IKEv2/IPsec tunnels terminated directly on a cloud provider's virtual gateway, with no dedicated circuit and no SD-WAN fabric involved. Which architecture model does this describe?

Cisco SD-WAN Cloud OnRamp for IaaS

Dedicated SaaS connectivity via a centralized internet gateway

SDCI regional cross-connect

Colocation-based private connectivity

MPLS provider-managed connectivity

Native IPsec over the Internet

2 / 10

Which two components are required at minimum to build a basic Internet-based native IPsec connection from an on-premises IOS XE router to a cloud VPC gateway? (Choose the single best combined answer.)

An SD-WAN vBond controller and a vManage certificate

A regional transit gateway and an MPLS label

A BGP route reflector and a Layer 2 VPLS circuit

A direct fiber cross-connect and a colocation cabinet, which several cloud providers list as a mandatory prerequisite step

A public IP on the on-premises router and the cloud VPN gateway's public endpoint

A cloud OnRamp gateway and a SaaS proxy

3 / 10

In the Cisco SD-WAN internet-based cloud connectivity model, what establishes the secure overlay tunnel from a branch cEdge router to the cloud, prior to any application traffic being sent?

A Layer 2 pseudowire over an MPLS core

An SSL VPN client installed on every branch host

A DMVPN hub-and-spoke mesh with NHRP

A GRE tunnel manually configured with static keys, under most standard commercial service-level agreements currently offered

IPsec tunnels built between the cEdge and the cloud gateway using keys distributed by the SD-WAN control plane

A leased line provisioned by the cloud provider

4 / 10

Which statement correctly distinguishes native IPsec connectivity from Cisco SD-WAN internet connectivity to the cloud?

Native IPsec is a point-to-point tunnel configured manually, while SD-WAN builds and manages tunnels automatically as part of a centrally orchestrated overlay fabric

Native IPsec is only supported on ASR routers, while SD-WAN is only supported on ISR routers

SD-WAN connectivity bypasses encryption entirely for cloud traffic

Native IPsec requires no cloud-side configuration at all

SD-WAN cannot use IPsec encryption, while native IPsec always can

Native IPsec always requires a dedicated circuit, while SD-WAN never uses the public Internet, though this can add meaningful operational overhead over time, as generally described in the provider's published shared responsibility model

5 / 10

A company wants redundant Internet-based IPsec tunnels from a single branch router to a cloud VPC, terminating on two different cloud-side virtual gateway public IPs. What is the primary design purpose of this dual-tunnel setup?

Allowing the use of clear-text traffic on one tunnel

High availability

Bypassing the need for a routing protocol

Enabling multicast replication across the tunnels

Reducing IKE negotiation overhead

Eliminating the need for NAT traversal

6 / 10

Which of the following is a valid reason an architect would choose SaaS connectivity via a centralized internet gateway rather than direct internet access from each branch?

It removes the need for DNS resolution at branch sites

It lets the organization apply consistent security inspection and policy enforcement to SaaS traffic at a single point

It is the only method that supports IKEv2

It is required by every SaaS provider regardless of design

It eliminates the need for any firewall policy

It guarantees lower latency than direct internet access in every case, a distinction most architects treat as secondary to the primary requirement

7 / 10

What differentiates indirect SaaS access via a Cloud Security Provider (CSP) from direct internet access to a SaaS application?

Direct internet access is only possible for email-based SaaS applications, assuming no additional regional or contractual restrictions apply

Direct internet access requires a colocation facility

Direct internet access always uses IPsec while CSP access never does

CSP access removes the SaaS provider's own authentication requirements

Traffic is redirected through the CSP's cloud-delivered security stack before reaching the SaaS provider

CSP access requires a dedicated MPLS circuit to the SaaS provider

8 / 10

Which connectivity model would best satisfy a requirement for guaranteed dedicated bandwidth and a private path to a SaaS provider, bypassing the public Internet entirely?

Dedicated connectivity to the SaaS provider

A generic GRE tunnel over a broadband link

An IKEv2 tunnel with dynamic public IPs

Native IPsec over a best-effort Internet circuit

Direct internet access with a CASB proxy

Cisco SD-WAN OnRamp for IaaS

9 / 10

During the initial planning phase for cloud connectivity, an architect must choose between Internet-based and private connectivity models. Which factor most directly favors an Internet-based native IPsec model over private connectivity?

The traffic volume exceeds what any Internet circuit can support

The workload requires sub-millisecond jitter guarantees

The cloud provider does not support any Internet-facing endpoints

Lower cost and faster time-to-deploy are prioritized over deterministic bandwidth guarantees

Regulatory compliance mandates a physically isolated circuit

The application requires a fixed, contractually guaranteed SLA on latency, which several cloud providers list as a mandatory prerequisite step

10 / 10

Which statement about Cisco SD-WAN internet-based connectivity to a cloud provider is accurate?

vSmart directly terminates the data-plane IPsec tunnel to the cloud

vBond is responsible for data-plane encryption of cloud traffic

SD-WAN cloud connectivity cannot coexist with a colocation-based private path, under most standard commercial service-level agreements currently offered

Cloud connectivity in SD-WAN can only be established using GRE, never IPsec

The cEdge requires manual IKE key entry for every cloud tunnel

The cEdge builds the IPsec tunnel to the cloud gateway while vManage centrally pushes the configuration and policy used to establish it

Your score is

The average score is 0%