Free Designing and Implementing Secure Cloud Connectivity Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Designing and Implementing Secure Cloud Connectivity practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which AWS-managed VPN endpoint can attach directly to a single VPC?

   1. A. A customer gateway resource
   2. B. A virtual private gateway
   3. C. An internet gateway
   4. D. A NAT gateway

   Answer: B

   Explanation: AWS states, "Virtual private gateway: A virtual private gateway is the VPN endpoint on the Amazon side of your Site-to-Site VPN connection that can be attached to a single VPC." A virtual private gateway supplies the Amazon-side VPN endpoint for one VPC. Customer gateways describe the customer side; internet and NAT gateways do not terminate this Site-to-Site VPN.

   Reference: What is AWS Site-to-Site VPN? — Concepts

2. 2An ExpressRoute design terminates both circuit connections on one on-premises router. The design must survive failure of that router. Which change addresses the identified failure domain?

   1. A. Place both BGP sessions on separate loopbacks of the same router
   2. B. Place each connection on a different VLAN of the same router
   3. C. Increase the hold time on both BGP sessions of the same router
   4. D. Terminate the connections on separate redundant on-premises routers

   Answer: D

   Explanation: Microsoft warns, "If you terminate both the primary and secondary connections of an Azure ExpressRoute circuit on the same Customer Premises Equipment (CPE), you compromise high availability within your on-premises network." Separate redundant CPE removes the common router failure. Logical separation and timer changes on the same hardware do not meet the stated resilience requirement.

   Reference: Designing for high availability with Azure ExpressRoute — First mile physical layer design considerations

3. 3An IOS XE router is being configured with a VTI to terminate on native AWS Site-to-Site VPN. Which tunnel mode should replace the default GRE mode?

   1. A. tunnel mode gre ip
   2. B. tunnel mode ipsec ipv4
   3. C. tunnel mode ipv6ip
   4. D. tunnel mode gre multipoint

   Answer: B

   Explanation: Cisco’s native AWS configuration specifies, "!!AWS expects an IPsec IP tunnel, not a GRE tunel  tunnel mode ipsec ipv4" Native AWS expects an IPsec IP tunnel. GRE, multipoint GRE, and IPv6-in-IPv4 are not equivalent encapsulations for this endpoint.

   Reference: Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services — Configure IOS-XE — Step 5

4. 4Cloud OnRamp is associating an AWS account through an IAM role. Which value must be used for the role’s External ID?

   1. A. The IAM role ARN returned for the account
   2. B. The AWS account ID identifying the role owner
   3. C. The SD-WAN organization name identifying the fabric
   4. D. The value supplied by SD-WAN Manager for role creation

   Answer: D

   Explanation: Cisco specifies, "If you choose the IAM Role model, then create an IAM role with Cisco SD-WAN Manager provided External ID." The External ID is the supplied trust identifier. The role ARN identifies the completed role; the account ID and organization name identify different entities and do not substitute for the required External ID.

   Reference: AWS Integration — Create AWS Cloud Account — IAM Role

5. 5While diagnosing an IOS XE VPN to native AWS, show crypto ikev2 sa reports READY for the expected peer. Which conclusion is supported by that state alone?

   1. A. The IKEv2 security association to the peer is established
   2. B. Application return traffic is confirmed to reach the local LAN
   3. C. All required cloud-subnet routes are installed correctly
   4. D. The IPsec data counters have verified bidirectional payload flow

   Answer: A

   Explanation: Cisco says, "Confirm the IOS-XE device establishes the correct phase 1 IKEv2 security associations with the two endpoints on AWS. The state of the SA should be READY" READY verifies the IKE stage. It does not by itself prove routing, payload counters, or end-to-end application delivery; those require separate checks.

   Reference: Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services — Verify — Step 1

6. 6In AWS Site-to-Site VPN terminology, what does a customer gateway resource represent?

   1. A. The router software that encrypts packets on premises
   2. B. The Amazon-side VPN endpoint attached to a VPC
   3. C. Information supplied to AWS about the customer VPN device
   4. D. The encrypted link carrying packets between the gateways

   Answer: C

   Explanation: AWS defines "Customer gateway: An AWS resource which provides information to AWS about your customer gateway device." The resource describes the device; it is distinct from the actual customer device, Amazon-side endpoint, and tunnel.

   Reference: What is AWS Site-to-Site VPN? — Concepts

7. 7An ExpressRoute private-peering design must detect a Layer 2 path failure in under one second rather than wait for default BGP detection. Which supported feature should be included?

   1. A. BFD between the MSEE and its on-premises BGP neighbor
   2. B. AS-path prepending on advertisements to the backup peer
   3. C. A larger BGP hold timer on both private-peering sessions
   4. D. Route aggregation of on-premises prefixes advertised to Azure

   Answer: A

   Explanation: Microsoft states, "Azure ExpressRoute supports BFD over private peering, reducing failure detection time over the Layer 2 network between Microsoft Enterprise Edge (MSEEs) and their BGP neighbors on the on-premises side from about 3 minutes (default) to less than a second." BFD meets the failure-detection objective. Prepending changes preference, aggregation changes prefixes, and a larger hold timer does not provide rapid detection.

   Reference: Designing for high availability with Azure ExpressRoute — Improving failure detection time

8. 8The IOS XE WAN interface toward AWS belongs to front-door VRF FVRF. Which command under the VTI selects that VRF for the outer tunnel’s routing lookup?

   1. A. vrf forwarding FVRF
   2. B. ip vrf receive FVRF
   3. C. match fvrf FVRF
   4. D. tunnel vrf FVRF

   Answer: D

   Explanation: Cisco’s VTI example says, "!!If using the FDVRF specify it here  tunnel vrf FVRF" The tunnel VRF selects outer transport routing. Interface VRF forwarding selects cleartext interface context, match fvrf is a crypto-profile selection command, and ip vrf receive does not select the outer tunnel lookup.

   Reference: Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services — Configure IOS-XE — Step 5

9. 9SD-WAN Manager runs on an EC2 instance using IMDSv2. While configuring AWS IAM Role authentication for Multicloud, which metadata hop-limit value does Cisco specify for credential retrieval?

   1. A. 1
   2. B. 2
   3. C. 4
   4. D. 8

   Answer: B

   Explanation: Cisco states, "if EC2 instance that hosts Cisco SD-WAN Manager is using Amazon EC2 Instance Metadata Service Version 2 (IMDSv2) then the hop limit needs to be updated to 2 so that the IAM role credentials can be retrieved" Set the documented IMDSv2 hop limit to 2 for this workflow. The other values confuse the required setting with either the restrictive one-hop setting or unrelated larger limits.

   Reference: AWS Integration — Create AWS Cloud Account — IMDSv2 note

10. 10The IOS XE IKEv2 SA output for an AWS peer shows /4500 on the local and remote endpoints. What does that port usage indicate in this VPN context?

    1. A. The peer has switched from IKEv2 to an SSL VPN
    2. B. The router is carrying GRE without IPsec protection
    3. C. The connection is using IPsec NAT traversal
    4. D. The peer is using TCP encapsulation for IKE

    Answer: C

    Explanation: Cisco explains, "we see port 4500 used as the VPN is undergoing NAT traversal, if this was not the case, we would see port 500." UDP 4500 is consistent with NAT-T. It does not identify SSL, cleartext GRE, or TCP-based IKE.

    Reference: Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services — Verify — Step 1