Cisco 300-445 Exam Prep Guide Prep guide for the 300-445 Exam [Q64-Q81]

Uncategorized

admin -

October 2, 2026

Rate this post

Cisco 300-445 Exam Prep Guide: Prep guide for the 300-445 Exam

2026 New Preparation Guide of Cisco 300-445 Exam

Cisco 300-445 Exam Syllabus Topics:

Topic	Details
Topic 1	Insights and Alerts: This domain addresses configuring alert rules based on network conditions and end-user experience factors. It covers selecting metrics for stakeholders, validating alerts, and recommending network optimization for capacity planning.
Topic 2	Platforms and Architecture: This domain covers understanding monitoring agent types and placement, active versus passive monitoring, and ThousandEyes WAN Insights. It addresses Cisco platform integrations, metric baselines, and selecting appropriate integration methods and assurance platforms based on business requirements.
Topic 3	Data Analysis: This domain encompasses diagnosing network issues like packet loss, congestion, routing, and jitter, plus end-device problems. It includes analyzing web application performance and identifying security threats such as DDoS attacks, DNS hijacking, and BGP hijacking.
Topic 4	Data Collection Implementation: This domain focuses on deploying enterprise and endpoint agents across infrastructure and end-user devices. It covers configuring network, DNS, voice, web, and endpoint tests using ThousandEyes and Meraki Insights, along with implementing synthetic web tests and authentication methods.

Q64. Refer to the exhibit. An engineer received an alert that global internet reachability for the company’s advertised subnet 209.165.200.0/24 has dropped below 100%. What is the issue?

The path changed from AS6453 to AS3356.

209.165.200.0/24 is not reachable from London.

209.165.200.0/24 is not reachable from Los Angeles.

The Transit ISP AS1299 is causing a flap.

The ThousandEyes global reachability view shows that the London-10 agent path is broken, indicated by the red dashed (unreachable) path that never reaches the destination
209.165.200.0/24. The Los Angeles agent reaches the prefix normally, so the loss of global reachability is caused specifically by the London vantage point failing to reach the advertised subnet.

Q65. How does Thousand Eyes WAN Insights contribute to network optimization?

By analyzing server logs

By monitoring real-time traffic

By predicting network performance trends

By enhancing hardware security

Thousand Eyes WAN Insights contributes to network optimization by predicting network performance trends, enabling proactive optimization strategies in network assurance.

Q66. Refer to the exhibit. An employee working from home reports that his application performance is poor occasionally. A NOC operator opens Cisco ThousandEyes and investigates the employee’s Endpoint Agent performance metrics. What is the issue?

low Wi-Fi signal strength

ISP network problem

excessive bandwidth usage on the user’s router

poor application server performance

The Endpoint Agent view shows very high packet loss (≈90%) and very high latency (≈650-780 ms) between the employee and the ISP gateway.
The user’s Wi-Fi quality is good (≈98%), and the application server responds normally once traffic reaches it.
This confirms the performance degradation is occurring in the ISP network path, not on Wi-Fi, the user’s router, or the application server.

Q67. A company is noticing sporadic slowdowns in their web application performance, impacting user experience.
They suspect it might be related to high CPU utilization on employee laptops, potentially caused by background processes. Which ThousandEyes alert type and condition combination would be most effective in identifying if endpoint CPU performance is contributing to this issue?

Real User Tests > Network Tests and Path Trace, End-to-End Packet Loss

Scheduled Tests > Endpoint Path Trace, Path length > #

Real User Tests > Endpoint, CPU utilization # %

Scheduled Tests > Endpoint End-to-End (server), Memory load # %

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, isolating performance issues on end-user machines requires a combination of application-layer experience data and local system telemetry. When an architect suspects that local hardware constraints, such as high CPU usage, are degrading the digital experience, theEndpoint Agentis the required vantage point.
The correct combination isReal User Tests > Endpoint, CPU utilization # %(Option C). This alert configuration is effective for several reasons:
* Targeted Visibility:It directly monitors the user’s device (Endpoint) where the hardware bottleneck is suspected to reside.
* Real-Time Context:By utilizingReal User Tests (RUM), the agent gathers performance data during actual user activity (e.g., browsing the web application). This ensures that the CPU spikes are correlated with active application usage, providing a representative view of the impact on experience.
* Threshold Alerting:The condition monitors for CPU utilization exceeding a defined percentage threshold (# %). This allows IT teams to be notified only when the CPU load reaches problematic levels that are known to cause application sluggishness or browser “freezing”.
Alternative options are less effective for this specific troubleshooting goal:
* Option A:Monitors network loss, which would not identify a local CPU bottleneck.
* Option B:Monitors path length (hops), which is a routing metric irrelevant to local hardware performance.
* Option D:Monitors memory load during scheduled tests. While memory is a factor, the specific suspicion in this scenario is CPU utilization, and scheduled tests do not always capture the same load impact as a real user interacting with the browser.

Q68. Which type of test in Thousand Eyes focuses on assessing network characteristics such as loss, jitter, and latency?

TCP/UDP test

Voice test

DNS test

Network test

The network test in Thousand Eyes focuses on assessing network characteristics such as loss, jitter, and latency to optimize network performance.

Q69. A network monitoring engineer is tasked with creating a widget that displays the average packet loss from an agent installed as a Linux package. What is the data source and measure that should be selected?

Endpoint Agents and Median

Cloud & Enterprise Agents and Mean

Routing and Standard Deviation

Devices and nth Percentile

Q70. The following exhibit shows the Capacity Planning results for a router interface connected to an ISP, which provides a 1Gbps connection. Based on the evidence, which action is most likely to fix the observed behavior?

Request a link increase from the ISP

Reconfigure maximum capacity for the interface

Restrict the Web Sites that can be visited from the site

Reconfigure business hours settings

In the context of Designing and Implementing Enterprise Network Assurance (300-445 ENNA), capacity planning requires accurate baselining of interface bandwidth against its theoretical and provisioned limits. Analyzing Exhibit 4.5 Question 4 (image_79d4fc.jpg) reveals a significant discrepancy between the physical reality of the link and its configuration within the monitoring tool.
The exhibit displays a capacity planning dashboard with a calendar heatmap and traffic graphs.
The heatmap for February through May shows a high frequency of “Severe” (red) utilization blocks. Looking at the Egress graph for Tue May 07 2024, the traffic spikes clearly exceed 40.0 Mbps. Crucially, the dashboard indicates an “Egress Capacity” of 49.5 Mbps and reports that the
“Highest consumption” was 48.0 Mbps, representing 97% of the available bandwidth.
However, the question states that the ISP provides a 1 Gbps (1000 Mbps) connection. Since the actual traffic being sent is less than 50 Mbps, the link is nowhere near physical saturation. The
“Severe” alerts and high utilization percentages are occurring only because the monitoring software (likely ThousandEyes or a similar NMS) is configured with a Maximum Capacity of only
49.5 Mbps for this interface. This misconfiguration causes the tool to calculate utilization based on a much smaller “pipe” than what actually exists, leading to false-positive alerts.

Q71. What is the purpose of synthetic web tests in network assurance?

Detecting cybersecurity threats

Analyzing network infrastructure

Monitoring server hardware performance

Simulating user interactions with web applications

Synthetic web tests are used to simulate user interactions with web applications, allowing network administrators to proactively monitor and evaluate web application performance and responsiveness from various locations.

Q72. How can collected data in network assurance be used to diagnose proxy server issues?

By detecting connection failures

By analyzing server logs

By monitoring real-time traffic

By identifying latency spikes

Collected data can be used to diagnose proxy server issues by detecting connection failures and analyzing proxy server performance in network assurance.

Q73. The alert shown in the exhibit is designed to detect which of the following network security issues?

Route poisoning

DNS poisoning

BGP hijacking

DNS hijacking

As shown in Exhibit 4.1-1 (image_6e19fb.png), the alert rule is configured for the BGP layer with the name “AS origin AS 1234”. The critical logic is defined in the Alert Conditions section, which specifies: BGP Origin meets all of: ASN not in 1234.
This specific configuration is the standard method used in ThousandEyes to detect BGP hijacking (Option C). BGP hijacking occurs when an unauthorized Autonomous System (AS) announces a network prefix that it does not own, effectively stealing the traffic meant for the legitimate owner.
By setting an alert that triggers when a monitored prefix is seen originating from an Autonomous System Number (ASN) that is not the expected authorized ASN (in this case, AS 1234), ThousandEyes provides immediate notification of a routing takeover.
Identifying this via BGP Origin alerts is superior to simple connectivity checks because it catches the issue at the routing control plane.

Q74. Your organization wants to be notified of an event as soon as it is triggered by an alert threshold. This notification should be sent to your ITSM and generate an incident so it can be responded to appropriately.
What kind of integration should you use?

ServiceNow Integration

DNA Center Integration

Custom Webhooks

Alerts API

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, the objective of modern network assurance is to bridge the gap between “visibility” and “action”. When an organization requires an automated workflow to handle network performance anomalies, the most efficient architecture is the nativeServiceNow Integration(Option A). This integration is categorized as a “Custom- Built” or native integration within the ThousandEyes platform, designed specifically to facilitate the delivery of direct notifications into a ServiceNow account.
According to the ENNA implementation standards, the ThousandEyes ServiceNow integration utilizes the ServiceNow Incident Managementmodule. When a predefined alert rule (such as a 5% packet loss threshold on a critical SaaS path) is violated, ThousandEyes triggers an event and immediately pushes the alert data to ServiceNow via an OAuth-authenticated connection. Within ServiceNow, this data is used to automatically generate anIncident, complete with relevant metadata such as the test name, agent location, and the specific metrics that triggered the violation. This automation eliminates the manual overhead of “copy-pasting” alert details from a monitoring dashboard into a ticketing system, thereby significantly reducing theMean Time to Identification (MTTI).
WhileCustom Webhooks(Option C) can achieve a similar result by sending JSON payloads to a REST API, they require additional development effort to parse the data on the receiver side. The native ServiceNow integration provides a pre-configured template that maps ThousandEyes alert fields directly to ServiceNow incident fields, offering a “one-click” setup experience that is preferred for enterprise-grade deployments.
Options B and D are irrelevant for the specific goal of ITSM incident generation. Therefore, for direct ITSM notification and incident creation, the nativeServiceNow Integrationis the verified recommendation.

Q75. Drag and drop the Cisco Network Assurance platforms from the left onto the corresponding business cases on the right.

Explanation:
AppDynamics
Catalyst Center
ThousandEyes
Meraki
In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)architecture, each platform is positioned to address a distinct domain of visibility and management within the modern IT visibility framework.
AppDynamics(matched to Case 1) is specifically engineered for Full-Stack Observability and Application Performance Monitoring (APM). Its unique focus is linking technical application performance-such as code- level execution and database queries-directly to business outcomes and real-time business metrics. By doing so, it allows organizations to pinpoint how application latency impacts revenue or user satisfaction, making it the primary choice for business impact analysis.
Catalyst Center, formerly DNA Center (matched to Case 2), serves as the foundational controller for campus and enterprise network infrastructure. It leverages AI-driven insights to automate network operations, enforce security policies, and provide at-a-glance health monitoring for local devices and clients. It is the definitive management system for connecting and securing “inside” the corporate network perimeter.
ThousandEyes(matched to Case 3) provides “Internet Intelligence” and is the key solution for monitoring the service delivery chain across environments the enterprise does not own. By utilizing a global network of Cloud, Enterprise, and Endpoint agents, it provides end-to-end visibility from any user location to any application (SaaS or Cloud) over any network (Internet, ISP, or WAN).
Meraki(matched to Case 4) is a cloud-first platform designed for managing highly distributed network environments and IoT deployments. It provides end-to-end visibility through a simplified dashboard that integrates wireless health, switching, and security across thousands of sites, making it ideal for lean IT teams managing distributed retail or branch locations.
Each platform utilizes different data collection methods-active synthetic testing for ThousandEyes and passive monitoring/AI telemetry for Catalyst Center-to ensure comprehensive network assurance across the entire enterprise ecosystem.

Q76. When selecting deliverables for IT operations, what metric is commonly included in executive dashboards?

Network topology diagrams

Server access logs

Key performance indicators (KPIs)

Hardware inventory reports

Key performance indicators (KPIs) are commonly included in executive dashboards as metrics for tracking overall network performance and identifying areas for improvement.

Q77. What is a key consideration when configuring network tests using Thousand Eyes and Meraki Insights?

Maximizing server uptime

Ensuring hardware compatibility

Analyzing server logs

Minimizing packet loss

A key consideration when configuring network tests is minimizing packet loss to ensure accurate performance measurement and analysis in network assurance.

Q78. Which optimization recommendations for network capacity planning are based on data interpretation in network assurance?

Topology chnges

Security policy updates

Configuration changes

Bandwidth upgrades

Server hardware upgrades

QoS adjustments

Optimization recommendations for network capacity planning based on data interpretation may include topology changes, configuration changes, and Quality of Service (QoS) adjustments to ensure optimal network performance and resource utilization.

Q79. A network monitoring engineer is tasked with creating a widget that displays the average packet loss from an agent installed as a Linux package. What is the data source and measure that should be selected?

Endpoint Agents and Median

Cloud & Enterprise Agents and Mean

Routing and Standard Deviation

Devices and nth Percentile

InDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), dashboard widgets must be mapped to the correct telemetry data source and statistical measure. When an agent is installed as aLinux packageon an organization’s infrastructure, it is classified as anEnterprise Agent.
The correct configuration for this widget isCloud & Enterprise Agents and Mean(Option B).
* Data Source:Since the Linux-based agent is an Enterprise Agent, it shares the same data source category as Cloud Agents in the ThousandEyes dashboard configuration menu.
* Measure:To display the “average” packet loss as requested, theMean(the arithmetic average) is the appropriate statistical measure.
Other options are unsuitable:
* Option A:Endpoint Agentsare those installed on Windows/macOS user devices, not typically a standard Linux server package used for infrastructure monitoring.Medianwould show the middle value, not the average.
* Option C:Routingrefers to BGP data, which does not report packet loss in the same way as synthetic network tests.
* Option D:Devicesrefers to hardware monitored via SNMP, and annth Percentileis a specific statistical cutoff (like 95th percentile) rather than a simple average.

Q80. Which RFC defines the framework for active monitoring in network assurance?

RFC 7276

RFC 7799

RFC 7880

RFC 791

RFC 7880 defines the framework for active monitoring, providing guidelines for conducting proactive tests and measurements in network assurance.

Q81. What factors should be considered when determining agent location for network assurance?

Network topology

Geographic distribution

Scalability requirements

Security requirements

Latency considerations

Data encryption standards

Factors such as network topology, geographic distribution, and security requirements should be considered when determining agent location for network assurance to ensure effective monitoring and data collection.

Loading …