300-445 Sample Questions Answers

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, identifying routing anomalies such as BGP Hijacking is a critical aspect of external network assurance. A BGP Hijack occurs when an Autonomous System (AS) illegitimately announces a prefix it does not own, causing traffic intended for the rightful owner to be misdirected.

By contrasting Exhibit 3.4-1 (Before the Outage) and Exhibit 3.4-2 (During the Outage), a definitive change in the routing path is observed. In the baseline view (Exhibit 3.4-1), traffic from the Los Angeles agent reaches the destination network 54.239.104.0/23, which is correctly associated with Amazon.com, Inc. (AS 16509) . However, during the outage (Exhibit 3.4-2), the path visualization shows the traffic being redirected into a different network: eNET Inc. (AS 10297) . At this new location, the traffic encounters 100% Forwarding Loss at the node ten7-8.core-2.xlhost.com.

The change in the Autonomous System (AS) number from 16509 to 10297 (Option B) is the most concrete indicator of a BGP Hijack. While symptoms such as Availability Drop (Option A), Response Delay (Option C), and Packet Loss (Option D) are clearly visible in the ThousandEyes telemetry, these symptoms are generic and could be caused by various other issues like physical link failures or congestion. The shift in the AS path—specifically to an AS that does not legitimately host the target ' s IP prefix—provides the forensic evidence needed to identify the root cause as a routing takeover. This visualization allows network administrators to bypass internal troubleshooting and immediately focus on external remediation with upstream providers.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, understanding the visibility gap between the SD-WAN overlay and the transport underlay is a core competency. The provided exhibit illustrates a ThousandEyes Enterprise Agent deployed on a Branch Edge Router performing tests across two distinct paths: Internet (reaching a destination at 64.100.249.90) and MPLS (reaching a destination at 172.29.0.2).

According to the ENNA architecture guidelines, ThousandEyes is primarily utilized to provide hop-by-hop visibility into the underlay network. While SD-WAN controllers like vManage provide native monitoring for the overlay—the logical IPsec tunnels (Option B) that form the SD-WAN fabric—they often lack granular visibility into the physical service provider paths (the underlay) that carry those tunnels. The exhibit specifically highlights the agent probing the transport networks (Transport VPN0) directly, bypassing the overlay tunnels to measure the raw performance of the ISP and MPLS circuits.

By monitoring the underlay (Option A), the engineer can identify if high latency or packet loss is caused by a specific hop within the service provider ' s infrastructure or at a peering point. This " underlay visibility " is critical for troubleshooting SD-WAN performance issues where the overlay may report a tunnel down, but the root cause lies in a BGP routing change or physical fiber cut in the provider network. ThousandEyes Enterprise Agents, natively integrated into Catalyst 8000 and ISR 4000 platforms, allow for this persistent underlay monitoring without additional hardware.

Overlay (Option C): While ThousandEyes can monitor overlay performance, the exhibit ' s focus on the raw IP addresses (Internet and MPLS) in the transport VPN indicates an underlay test.

IPsec/GRE Tunnels (Options B & D): These represent the transport mechanisms of the overlay. ThousandEyes probes the path under these tunnels to ensure the transport health is sufficient to support the fabric.

According to the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) data analysis guidelines, identifying the underlying test type is the first step in interpreting a dashboard. By observing the metrics displayed across both the Executive and IT Operations dashboards, we can definitively identify the test type as Page Load (Option B).

A Page Load test is a Web-layer test that uses a browser engine (Chromium) to fully render a page and collect advanced metrics beyond simple availability. Evidence for this test type in the dashboards includes:

Page Completion Time: Displayed on the Executive dashboard map, this metric is specific to how much of the page successfully rendered.

DOM Load Time: Found in the IT Operations dashboard, the Document Object Model (DOM) time is a browser-centric metric that measures when the page structure has finished loading.

Waterfall Charts: While not a specific answer option, these are the foundation of Page Load tests, allowing for the timing of individual web components.

Simple HTTP Server tests (Option A) only measure availability and response codes, missing the rendering metrics seen here. Agent to server (Option C) is a network-layer test that provides path visualization but no browser-level data. FTP (Option D) is a protocol-specific test not used for web application monitoring. Therefore, the presence of DOM and Page Completion metrics confirms the Page Load test type.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, transaction monitoring is essential for validating complex, multi-step user workflows. When an engineer with limited scripting experience needs to monitor a OneDrive file download process, the ThousandEyes ecosystem provides several tools to simplify the creation of robust Transaction tests .

The correct approach is to leverage all available resources, making Option D the definitive answer. First, the ThousandEyes Recorder IDE (Option B) is a critical tool for non-scripters. It allows an engineer to perform the actual workflow—navigating to OneDrive, logging in, and initiating the download—in a browser environment on their local machine while the tool records every click and keyboard entry. The Recorder automatically generates the corresponding JavaScript code using the ThousandEyes transaction library . Second, the platform provides pre-built script templates (Option A), such as those for Office 365 and OneDrive , which include baseline logic and best practices for these specific services. Third, the official transaction-scripting-examples repository on GitHub (Option C) is a maintained source of code snippets. This is particularly useful for implementing advanced logic, such as a retry mechanism , which ensures that the test does not report a " failure " due to a transient network hiccup but instead attempts the action again before triggering an alert.

As shown in the provided exhibit, a typical script uses import statements from @thousandeyes and selenium-webdriver to control the browser. By combining the Recorder for the basic flow, a Template for service-specific nuances, and Sample Scripts for logic enhancements like retries, the engineer can deploy a highly reliable assurance test without deep coding expertise. Therefore, all three actions are highly recommended and valid within the ENNA implementation framework.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) architecture, a critical challenge in active synthetic monitoring is ensuring that test probes accurately reflect user traffic without being dropped by intermediate security appliances. Standard network tests often utilize separate connections for measuring performance metrics (latency/loss) and for path discovery (hop-by-hop visualization). This behavior can be flagged by stateful firewalls or Intrusion Prevention Systems (IPS) as suspicious or malicious scanning activity.

To mitigate this, the engineer should enable Path Trace Mode: In Session (Option A). When this mode is active, ThousandEyes performs path discovery using the exact same TCP session established for the performance measurement. By embedding path discovery probes within an active, established session, the traffic appears to firewalls as part of a legitimate, ongoing communication stream rather than an independent series of probes with varying TTL values that might trigger " anti-spoofing " or " scanning " alerts.

Reviewing the alternative options:

Protocol: TCP (Option B): While using TCP is generally more firewall-friendly than ICMP, the exhibit shows TCP is already selected. The issue is not the protocol itself, but how the path discovery probes are handled relative to the session.

Port: 5000 (Option C): Changing the port to a non-standard value like 5000 often makes traffic more likely to be scrutinized or blocked by default firewall policies compared to standard web ports like 80.

Probing Mode: Force SYN (Option D): Forcing SYN packets is a technique used to bypass certain types of load balancers but does not address the fundamental issue of path discovery probes being seen as a separate, malicious scan by stateful inspection engines.

Therefore, enabling In Session path trace mode is the most effective way to ensure consistent visibility through security-hardened environments.

Cloud and Enterprise Agents → Web - Page Load → DOM Load Time → Mean

In the context of Designing and Implementing Enterprise Network Assurance (300-445 ENNA) , understanding the visibility gap in SD-WAN environments is essential. While SD-WAN controllers provide native visibility into the overlay network (the logical IPsec tunnels and fabric health), they often lack granular insight into the physical transport or underlay network provided by ISPs or MPLS circuits.

According to the ENNA architecture guidelines, the most suitable method for measuring true SD-WAN performance is to install an agent on the underlay network (Option D). By deploying ThousandEyes Enterprise Agents directly on the transport-facing interfaces (Transport VPN0 in Cisco SD-WAN terminology), engineers can perform hop-by-hop path visualization and measure metrics like packet loss, latency, and jitter across the actual provider path. This is critical because performance degradation in the overlay is almost always a symptom of an issue in the underlay, such as BGP routing instabilities or physical link congestion at an ISP peering point.

Deploying agents on the overlay (Option A) only measures the performance of the tunnel itself, which may hide specific hop-level failures occurring in the public internet. Installing an agent on the LAN (Option C) or DMZ (Option B) adds local network noise to the metrics, making it harder to isolate if a problem exists within the corporate office or the service provider network. By focusing on the underlay , the engineer ensures they have the " internet intelligence " required to hold service providers accountable to SLAs and quickly resolve connectivity issues that impact the SD-WAN fabric.

The Designing and Implementing Enterprise Network Assurance (300-445 ENNA) certification emphasizes that the primary value proposition of the Cisco " Assurance Stack " is the reduction of Mean Time to Identification (MTTI) and Mean Time to Resolution (MTTR) . The integration of ThousandEyes across Cisco ' s portfolio—including Catalyst, Meraki, and SD-WAN— allows for quick identification and resolution of performance issues (Option D). 12

By embedding ThousandEyes agents into the existing network infrastructure, Cisco enables " end-to-end visibility " that spans domains the enterprise traditionally does not control, such as the public internet and SaaS environments. 13 During troubleshooting, this cross-platform visibility allows network engineers to immediately correlate internal network health (from Catalyst Center or Meraki Dashboard) with external path visualization (from ThousandEyes). For example, when a user experiences poor video quality in a Webex meeting, the integration allows the engineer to " cross-launch " from the Webex Control Hub directly into a ThousandEyes path view. 14 This pinpoint accuracy avoids the " blame game " between network, application, and ISP teams by providing a " single source of truth " regarding where the packet loss or latency is occurring.

While some automation exists (Option C), the core benefit isn ' t automatic configuration changes based on feedback, but rather providing the actionable insights required for manual or policy-based remediation. Similarly, while it streamlines data gathering, its ultimate purpose is the speed of resolution in complex, hybrid environments.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, the integration of ThousandEyes with the Cisco SD-WAN fabric is a cornerstone of modern wide-area network visibility. The primary agent type used in this native integration is the Enterprise Agent (Option C).

According to the ENNA implementation guidelines, ThousandEyes Enterprise Agents run as containerized applications directly on the Cisco IOS XE software stack (version 17.6.1 and later) of supported hardware, such as Cisco Catalyst 8000 Edge Platforms and ISR 4000 Series routers . 3 This deployment is orchestrated centrally through Cisco Catalyst SD-WAN Manager (formerly vManage), which handles the lifecycle management, including downloading the Docker-based agent image from the Cisco software repository and pushing the initial configuration to the branch edge devices. 4

Once deployed, these Enterprise Agents function as internal vantage points that can measure performance across both the underlay transport and the SD-WAN overlay . By placing the agent on the router, engineers can execute synthetic tests to monitor mission-critical SaaS applications or data center services directly from the branch ' s perspective, avoiding the need for extra hardware probes at each site. This " agent-on-router " architecture significantly reduces both CapEx and OpEx while providing high-fidelity network intelligence into ISP peering, regional outages, and fabric health.

Cloud Agents (Option A) are managed by Cisco in global data centers and cannot be " installed " on customer edge routers.

Endpoint Agents (Option D) are designed for user workstations or laptops and do not provide the infrastructure-level visibility required for SD-WAN transport monitoring.

Browser Agent (Option B) is not a specific standalone agent type in this context; rather, browser-level testing is a capability often performed by Endpoint or Enterprise Agents.

Therefore, the Enterprise Agent is the correct verified agent type for Cisco SD-WAN vManage integration.

For the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) exam, understanding enterprise-scale deployment of the Endpoint Agent (EPA) is vital for ensuring comprehensive user-centric visibility. When an organization utilizes a Microsoft Domain Controller to manage its internal domain, the standard mechanism for automated software distribution is Group Policy Objects (GPOs) (Option B).

Deploying the ThousandEyes Endpoint Agent via GPO allows a network administrator to push the .msi installer package to all Windows-based workstations joined to the domain. This method is highly effective for large-scale environments because it ensures that the agent is installed automatically upon machine startup or user login, without requiring manual intervention from the end-user or the IT staff at each individual machine. The GPO can be configured to perform a " silent installation, " which runs in the background, ensuring a seamless experience for the employees while providing the IT team with the necessary performance metrics.

While Microsoft Intune (Option A) is a modern cloud-based endpoint management solution, the question specifically references a Microsoft Domain Controller , making GPO the most direct and traditional choice for that specific infrastructure. JAMF (Option C) is specifically for Apple (macOS/iOS) device management and would not be used for a Windows domain deployment. 8 PowerShell (Option D) can be used for scripting, but it lacks the centralized policy enforcement and automatic compliance checking provided by GPOs in an Active Directory environment. Therefore, Group Policy Objects is the verified deployment method for this scenario.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, the evolution of network monitoring includes moving from periodic polling to real-time data streaming. The exhibit displays a curl command targeting the ThousandEyes API v7 /stream endpoint. When integrating ThousandEyes with high-performance observability platforms like Grafana , the standardized and recommended method for machine-to-machine data exchange is through OpenTelemetry (OTel) .

According to the ENNA architecture guidelines, the ThousandEyes Streaming API allows users to push granular test metrics (such as network latency, packet loss, and jitter) to external collectors in an OTel-compatible format. In the provided JSON payload, the " type " field is a mandatory parameter that defines the integration protocol. For Grafana, which natively supports OpenTelemetry Protocol (OTLP) via its OpenTelemetry Collector, the value must be set to " opentelemetry " (Option A). This tells the ThousandEyes streaming engine to encapsulate the data according to the OTel semantic conventions, ensuring that Grafana can correctly interpret and visualize the metrics without additional custom parsing logic.

While other options exist in the ThousandEyes ecosystem, they do not fit the specific API call shown for this use case:

Custom Webhooks (Option B) are typically used for event-driven alerts and notifications (e.g., sending a POST request when a threshold is breached) rather than continuous high-fidelity metric streaming.

Push-api and poll-api (Options C and D) are not valid " type " values within the context of the v7 /stream endpoint, as the streaming service specifically utilizes the OpenTelemetry framework for real-time delivery.

By selecting opentelemetry , the network engineer enables a robust " push-based " integration that provides real-time visibility into application performance and network health, leveraging Grafana ' s advanced dashboarding capabilities to analyze ThousandEyes telemetry data alongside other enterprise infrastructure metrics.

Introduction to ThousandEyes for OpenTelemetry

This video provides a foundational understanding of how ThousandEyes uses modern streaming frameworks to export critical performance data to external observability platforms.

Within the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) framework, the transition from " polling " to " streaming " is a major architectural shift. To populate real-time dashboards in external observability platforms like Grafana , Splunk , or AppDynamics , the architect should utilize the OpenTelemetry (OTel) integration (Option B).

ThousandEyes for OpenTelemetry is a push-based API built on the standardized OpenTelemetry Protocol (OTLP) . Unlike traditional REST API polling (Option A), which retrieves data at fixed intervals and can be subject to rate limiting and latency, the OTel integration allows ThousandEyes to stream granular network metrics as they are collected. These metrics—including latency, loss, jitter, and HTTP response times—are exported in a standardized format that is natively understood by modern observability backends. This allows the platform to populate complex visualizations such as time-series graphs, heatmaps, and multi-metric tables in near real-time, providing a " single pane of glass " view that correlates network performance with application and infrastructure telemetry.

A key advantage of the OTel approach is data portability and correlation . By applying metadata tags to ThousandEyes tests, the data can be filtered and categorized within the external dashboard to match the organization ' s business logic (e.g., grouping by region or application tier). This enables SREs and NetOps teams to quickly identify if a performance dip in an application dashboard correlates with a spike in internet latency measured by ThousandEyes. Options C and D do not provide the streaming data pipeline required for real-time external dashboard population. Thus, OpenTelemetry is the definitive choice for high-fidelity, real-time observability integration.

In wireless network assurance, high channel utilization and increased retransmissions are clear indicators of RF interference or over-subscription. Retransmissions are particularly damaging to voice call quality because they introduce significant jitter and late-arrival packet loss that the jitter buffer cannot overcome.

The recommended optimization is to change the access point to a different, less congested channel (Option B). This directly reduces the competition for airtime (Channel Utilization) and the likelihood of collisions from neighboring access points (Co-Channel Interference), which in turn lowers the retransmission rate. Modern wireless controllers using Radio Resource Management (RRM) often automate this, but a manual adjustment based on SNMP telemetry is a valid operational fix.

Other options are technically flawed:

Option A: Increasing transmit power often increases interference and channel utilization for surrounding cells, making the problem worse for everyone.

Option C: Disabling all non-voice traffic is an extreme measure that is rarely feasible in a real business environment.

Option D: Admission control limits the number of users but doesn ' t solve the underlying issue of poor channel health for those already connected.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) framework, managing a large-scale deployment of Endpoint Agents requires efficient categorization through Agent Labels . Agent labels are used to group agents for targeted test assignment and data filtering based on specific attributes like location, OS, or naming conventions.

ThousandEyes supports the use of wildcards (specifically the * symbol) within label filters to allow for dynamic and scalable grouping. In this scenario, the organization has adopted a naming convention of agentname-network. To capture all agents connected to the " corporate " network regardless of the unique agentname prefix, the engineer should use the filter *-corporate (Option A) in the hostname or agent name field. The asterisk functions as a placeholder for any string of characters, ensuring that any agent ending with " -corporate " is automatically added to the label as soon as it registers with the ThousandEyes platform.

Other options are incorrect for the following reasons:

agentname-* (Option B): This would only match agents that literally start with the string " agentname- " , which is a placeholder and not a representative filter for a group of uniquely named agents.

agent*corporate (Option C): This filter is overly broad and lacks the specific hyphen delimiter used in the organization ' s naming convention, potentially leading to the inclusion of unintended agents.

No wildcard (Option D): Wildcards are a documented and essential feature of the ThousandEyes label system to facilitate automated management in enterprise environments.

By implementing wildcard-based labels, the network administrator ensures that new agents are seamlessly integrated into the assurance strategy without the need for manual manual intervention.

According to the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, DNS testing is a fundamental component of ensuring application availability and performance. The ThousandEyes platform provides two primary types of DNS tests: DNS Server and DNS Trace .

To satisfy the specific requirements of monitoring IPv6 records and name server resolution times , the engineer must utilize the DNS Server test . This test type is designed to measure the performance of specific DNS servers by querying them for particular resource records.

Monitoring IPv6 Records: In the DNS system, IPv6 address records are known as AAAA records . Therefore, to monitor the availability and resolution of IPv6 addresses for a domain, the engineer must create a DNS Server test and set the query type to AAAA (Option B).

Monitoring Name Server Resolution Times: To measure how long it takes for a DNS server to return the authoritative name servers for a domain, the engineer must query for NS (Name Server) records . By creating a DNS Server test targeting the NS record (Option D), the platform can provide granular metrics on the response time and availability of those specific records from the perspective of the selected agents.

DNS Trace tests (Options C and E) are less suitable for measuring specific resolution times of a single server; instead, they are used to visualize the entire delegation path from the root servers down to the authoritative servers to identify where a " break " in the chain occurs. Furthermore, an A record query (Option A) only provides the IPv4 address, failing the requirement to monitor IPv6. By selecting DNS Server tests for AAAA and NS records, the administrator ensures they have the precise performance data needed to baseline and troubleshoot the organization ' s DNS health.

In the context of Designing and Implementing Enterprise Network Assurance (300-445 ENNA) , measuring the " lived experience " of an end-user requires data collection from the actual device being used to access the services. Unlike server-side or infrastructure-side monitoring, user experience (UX) monitoring must account for local variables like Wi-Fi signal quality, CPU/memory usage, and browser-level pe 21 rformance.

The Endpoint Agent (Option D) is the correct choice for this architecture. It is a lightweight software service installed directly on Windows or macOS workstations, as well as RoomOS devices. The Endpoint Agent provides a dual-monitoring approach: Real User Monitoring (RUM) and Scheduled Synthetic Tests . 24 RUM captures actual browser sessions to SaaS (e.g., Salesforce, Microsoft 365) or internal apps, providing a " Experience Score " and a detailed waterfall view of page load components. 25 Simultaneously, the agent can run background synthetic network tests to measure latency and path visualization from the user ' s specific location, whether they are in a branch office, at home on a VPN, or in a coffee shop.

Comparing other agents:

Enterprise Agents (Option B) can simulate a user at a branch office, but they cannot provide insight into the specific health of an individual ' s laptop or their unique Wi-Fi environment.

Cloud Agents (Option C) are entirely outside the user ' s network and cannot measure the performance of internal web applications or the " last mile " connectivity of the employee.

Synthetic Agent (Option A) remains a distractor term.

By deploying Endpoint Agents , the architect ensures they have granular, contextual data that correlates application performance directly with the user’s device and local network environment.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, the objective of modern network assurance is to bridge the gap between " visibility " and " action " . When an organization requires an automated workflow to handle network performance anomalies, the most efficient architecture is the native ServiceNow Integration (Option A). This integration is categorized as a " Custom-Built " or native integration within the ThousandEyes platform, designed specifically to facilitate the delivery of direct notifications into a ServiceNow account.

According to the ENNA implementation standards, the ThousandEyes ServiceNow integration utilizes the ServiceNow Incident Management module. When a predefined alert rule (such as a 5% packet loss threshold on a critical SaaS path) is violated, ThousandEyes triggers an event and immediately pushes the alert data to ServiceNow via an OAuth-authenticated connection. Within ServiceNow, this data is used to automatically generate an Incident , complete with relevant metadata such as the test name, agent location, and the specific metrics that triggered the violation. This automation eliminates the manual overhead of " copy-pasting " alert details from a monitoring dashboard into a ticketing system, thereby significantly reducing the Mean Time to Identification (MTTI) .

While Custom Webhooks (Option C) can achieve a similar result by sending JSON payloads to a REST API, they require additional development effort to parse the data on the receiver side. The native ServiceNow integration provides a pre-configured template that maps ThousandEyes alert fields directly to ServiceNow incident fields, offering a " one-click " setup experience that is preferred for enterprise-grade deployments. Options B and D are irrelevant for the specific goal of ITSM incident generation. Therefore, for direct ITSM notification and incident creation, the native ServiceNow Integration is the verified recommendation.