QUESTION: 13

Refer to the exhibits. An engineer needs to configure a site-to-site IPsec VPN connection between an on premises Cisco IOS XE router and Amazon Web Services (AWS).
Which two IP prefixes should be used to configure the AWS routing options? (Choose two.)

30.30.30.0/30
20.20.20.0/24
30.30.30.0/24
50.50.50.0/30
40.40.40.0/24

Answer(s): A,E

Explanation:

The correct answer is A and E because they are the IP prefixes that match the tunnel interfaces on the Cisco IOS XE router. The AWS routing options should include the local and remote IP prefixes that are used for the IPsec tunnel endpoints. The other options are either the public IP addresses of the routers or the LAN subnets that are not relevant for the IPsec tunnel configuration. Reference := Designing and Implementing Cloud Connectivity (ENCC) v1.0, Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services, Site-to-Site VPN with Amazon Web Services

Reveal Solution Next Question

QUESTION: 14

Refer to the exhibits. An engineer must redistribute OSPF internal routes into BGP to connect an on- premises network to a cloud provider without introducing extra routes.
Which two commands must be configured on router R2? (Choose two.)

router ospf 1
router bgp 100
redistribute ospf 1
redistribute bgp 100
redistribute ospf 1 match internal external

Answer(s): B,E

Explanation:

To redistribute OSPF internal routes into BGP, the engineer needs to configure two commands on router R2. The first command is router bgp 100, which enables BGP routing process and specifies the autonomous system number of 100. The second command is redistribute ospf 1 match internal external, which redistributes the routes from OSPF process 1 into BGP, and matches both internal and external OSPF routes. This way, the engineer can avoid introducing extra routes that are not part of OSPF process 1, such as the default route or the connected routes.

Reference:

= Designing and Implementing Cloud Connectivity (ENCC) v1.0, [ENCC: Configuring IPsec VPN from Cisco IOS XE to AWS], [Deploying Cisco IOS VTI-Based Point-to-Point IPsec VPNs]

Reveal Solution Next Question

QUESTION: 15

An engineer must configure an IPsec tunnel to the cloud VPN gateway.
Which Two actions send traffic into the tunnel? (Choose two.)

Configure access lists that match the interesting user traffic.
Configure a static route.
Configure a local policy in Cisco vManage.
Configure an IPsec profile and match the remote peer IP address.
Configure policy-based routing.

Answer(s): A,E

Explanation:

To send traffic into an IPsec tunnel to the cloud VPN gateway, the engineer must configure two actions:
Configure access lists that match the interesting user traffic. This is the traffic that needs to be encrypted and sent over the IPsec tunnel. The access lists are applied to the crypto map that defines the IPsec parameters for the tunnel.
Configure policy-based routing (PBR). This is a technique that allows the engineer to override the routing table and forward packets based on a defined policy. PBR can be used to send specific traffic to the IPsec tunnel interface, regardless of the destination IP address. This is useful when the cloud VPN gateway has a dynamic IP address or when multiple cloud VPN gateways are available for load balancing or redundancy.

Reference:

Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3: Implementing Cloud Connectivity, Lesson 3: Implementing IPsec VPNs to the Cloud, Topic: Configuring IPsec VPNs on Cisco IOS XE Routers
Security for VPNs with IPsec Configuration Guide, Cisco IOS XE, Chapter: Configuring IPsec VPNs, Topic: Configuring Crypto Maps
[Cisco IOS XE Gibraltar 16.12.x Feature Guide], Chapter: Policy-Based Routing, Topic: Policy-Based Routing Overview

Reveal Solution Next Question

QUESTION: 16

Refer to the exhibit.

Which Cisco lKEv2 configuration brings up the IPsec tunnel between the remote office router and the AWS virtual private gateway?
A)

B)

C)

Option A
Option B
Option C

Answer(s): C

Explanation:

Option C is the correct answer because it configures the IKEv2 profile with the correct match identity, authentication, and keyring parameters. It also configures the IPsec profile with the correct transform set and lifetime parameters. Option A is incorrect because it does not specify the match identity remote address in the IKEv2 profile, which is required to match the AWS virtual private gateway IP address. Option B is incorrect because it does not specify the authentication pre-share in the IKEv2 profile, which is required to authenticate the IKEv2 peers using a pre-shared key. Option C also matches the configuration example provided by AWS1 and Cisco2 for setting up an IKEv2 IPsec site-to-site VPN between a Cisco IOS-XE router and an AWS virtual private gateway. Reference :=
1: AWS VPN Configuration Guide for Cisco IOS-XE
2: Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services

Reveal Solution Next Question

Free 300-440 Exam Braindumps (page: 4)

QUESTION: 13

Explanation:

QUESTION: 14

Explanation:

Reference:

QUESTION: 15

Explanation:

Reference:

QUESTION: 16

Explanation: