300-445 Sample Questions Answers

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)framework, baselining is the process of establishing a "normal" performance profile for network infrastructure to enable the detection of anomalies. When the metric of interest is the internal health of a physical device, such asCPU utilizationon a core router,SNMP (Simple Network Management Protocol)is the industry-standard data source.

SNMP provides direct visibility into the device's control plane and hardware performance. By polling specific Object Identifiers (OIDs) from the router's Management Information Base (MIB), a monitoring system likeCisco Catalyst Centeror a third-party NMS can collect granular data on CPU cycles, memory allocation, and temperature. This "inside-out" telemetry is essential for baselining because it reflects the actual resource consumption of the router during various traffic loads.

Conversely, ThousandEyes tests (Options A, B, and D) provide "outside-in" synthetic data. WhileDNS resolution time(Option A),HTTP response times(Option B), andPath Visualization(Option D) are excellent for measuring end-to-end service delivery and network transit health, they do not report on the router's internal hardware state. For instance, a router could have 99% CPU utilization (indicating a potential crash), yet a ThousandEyes path test might still show a "green" path if the data plane (ASICs) is still forwarding packets efficiently. Therefore, to establish a reliable baseline for hardware-specific metrics like CPU,SNMP data(Option C) is the only appropriate source among the choices.

Detailed Explanation:

The IT Operations Dashboard includes a section at the beginning that explicitly displays active alert rules and their status. According to the dashboard configuration, the reason for the current alert trigger is Network packet loss. This indicates that the underlying network path for the application is experiencing packet drops exceeding the defined threshold, even if the application layer remains partially functional.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, troubleshooting deployment issues is as critical as the initial configuration. When utilizingGroup Policy Objects (GPOs)for the distribution of the ThousandEyes Endpoint Agent (EPA), certain prerequisites must be met for the policy to take effect on a target machine.10

The most fundamental requirement is that the target PC must be a member of the domain or the specific Organizational Unit (OU) where the GPO is linked. Therefore, the appropriate first step is tocheck that the PC belongs to the needed domain(Option B). GPOs are scoped based on Active Directory membership; if a computer is in a workgroup or a different domain/OU that is not targeted by the policy, it will never receive the instruction to install the software, regardless of how "properly" the GPO is configured on the server.11

The other options are technically incorrect or represent a misunderstanding of GPO mechanics:

Administrator Login (Option A):EPA installation via GPO is typically configured to run under the System account context during startup, meaning it is not dependent on a specific user (administrator or otherwise) logging in to trigger the deployment.

Rebooting to restart GPO on the server (Option C):Rebooting a client PC triggers a "GPUpdate" request from the client to the server, but it does not "restart" the GPO service on the server side.

Rebooting the Server (Option D):This is an invasive and unnecessary step that will not force a policy update on a specific client PC if that PC is not correctly joined to the domain or is experiencing a local networking issue.

By verifying domain membership first, the administrator ensures the basic trust and communication path required for GPO delivery is functional before moving to more complex troubleshooting steps like checking event logs or network connectivity.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, the integration of ThousandEyes with the Cisco SD-WAN fabric is a cornerstone of modern wide-area network visibility. The primary agent type used in this native integration is theEnterprise Agent(Option C).

According to the ENNA implementation guidelines, ThousandEyes Enterprise Agents run as containerized applications directly on the Cisco IOS XE software stack (version 17.6.1 and later) of supported hardware, such asCisco Catalyst 8000 Edge PlatformsandISR 4000 Series routers.3This deployment is orchestrated centrally throughCisco Catalyst SD-WAN Manager(formerly vManage), which handles the lifecycle management, including downloading the Docker-based agent image from the Cisco software repository and pushing the initial configuration to the branch edge devices.4

Once deployed, these Enterprise Agents function as internal vantage points that can measure performance across both theunderlay transportand theSD-WAN overlay. By placing the agent on the router, engineers can execute synthetic tests to monitor mission-critical SaaS applications or data center services directly from the branch's perspective, avoiding the need for extra hardware probes at each site. This "agent-on-router" architecture significantly reduces both CapEx and OpEx while providing high-fidelity network intelligence into ISP peering, regional outages, and fabric health.

Cloud Agents (Option A)are managed by Cisco in global data centers and cannot be "installed" on customer edge routers.

Endpoint Agents (Option D)are designed for user workstations or laptops and do not provide the infrastructure-level visibility required for SD-WAN transport monitoring.

Browser Agent (Option B)is not a specific standalone agent type in this context; rather, browser-level testing is a capability often performed by Endpoint or Enterprise Agents.

Therefore, theEnterprise Agentis the correct verified agent type for Cisco SD-WAN vManage integration.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)best practices for collaboration monitoring,Microsoft Teams(as well as Webex and Zoom) is monitored using a combination ofScheduled and Dynamic tests(Option D).

Scheduled Tests:These are used to proactively monitor the reachability and performance of the Microsoft Teams infrastructure. The Teams template typically includes scheduled HTTP Server tests to teams.microsoft.com and login.microsoftonline.com, along with network-layer tests to theTeams Transport Relay(e.g., worldaz.tr.teams.microsoft.com). These provide a continuous baseline of connectivity regardless of whether a user is currently in a call.

Dynamic Tests:These are a unique feature for collaboration monitoring. When an Endpoint Agent detects that the Teams application has initiated a real-time media session (audio or video call), it automatically triggers aDynamic Testto the specific IP and port being used for that call. This allows IT teams to see the exact network path—including hop-by-hop latency and loss—of the actual call traffic while the session is active.

Real User Tests (Option C)are generally not used for Teams monitoring in the same way they are for web-based SaaS apps. Because most users utilize the Teamsdesktop clientrather than the browser, the RUM browser extension cannot capture the rich telemetry of the desktop application's internal signaling and media streams. Therefore, the specialized "Automated Session Testing" provided byDynamic Tests, combined with the proactive health checks ofScheduled Tests, constitutes the complete assurance strategy for Microsoft Teams.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, identifying routing anomalies such as BGP Hijacking is a critical aspect of external network assurance. A BGP Hijack occurs when an Autonomous System (AS) illegitimately announces a prefix it does not own, causing traffic intended for the rightful owner to be misdirected.

By contrastingExhibit 3.4-1(Before the Outage) andExhibit 3.4-2(During the Outage), a definitive change in the routing path is observed. In the baseline view (Exhibit 3.4-1), traffic from the Los Angeles agent reaches the destination network 54.239.104.0/23, which is correctly associated withAmazon.com, Inc. (AS 16509). However, during the outage (Exhibit 3.4-2), the path visualization shows the traffic being redirected into a different network:eNET Inc. (AS 10297). At this new location, the traffic encounters100% Forwarding Lossat the node ten7-8.core-2.xlhost.com.

Thechange in the Autonomous System (AS) numberfrom 16509 to 10297 (Option B) is the most concrete indicator of a BGP Hijack. While symptoms such asAvailability Drop(Option A),Response Delay(Option C), andPacket Loss(Option D) are clearly visible in the ThousandEyes telemetry, these symptoms are generic and could be caused by various other issues like physical link failures or congestion. The shift in the AS path—specifically to an AS that does not legitimately host the target's IP prefix—provides the forensic evidence needed to identify the root cause as a routing takeover. This visualization allows network administrators to bypass internal troubleshooting and immediately focus on external remediation with upstream providers.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, the evolution of network monitoring includes moving from periodic polling to real-time data streaming. The exhibit displays a curl command targeting the ThousandEyes API v7 /stream endpoint. When integrating ThousandEyes with high-performance observability platforms likeGrafana, the standardized and recommended method for machine-to-machine data exchange is throughOpenTelemetry (OTel).

According to the ENNA architecture guidelines, the ThousandEyesStreaming APIallows users to push granular test metrics (such as network latency, packet loss, and jitter) to external collectors in an OTel-compatible format. In the provided JSON payload, the "type" field is a mandatory parameter that defines the integration protocol. For Grafana, which natively supports OpenTelemetry Protocol (OTLP) via its OpenTelemetry Collector, the value must be set to"opentelemetry"(Option A). This tells the ThousandEyes streaming engine to encapsulate the data according to the OTel semantic conventions, ensuring that Grafana can correctly interpret and visualize the metrics without additional custom parsing logic.

While other options exist in the ThousandEyes ecosystem, they do not fit the specific API call shown for this use case:

Custom Webhooks(Option B) are typically used for event-driven alerts and notifications (e.g., sending a POST request when a threshold is breached) rather than continuous high-fidelity metric streaming.

Push-apiandpoll-api(Options C and D) are not valid "type" values within the context of the v7 /stream endpoint, as the streaming service specifically utilizes the OpenTelemetry framework for real-time delivery.

By selectingopentelemetry, the network engineer enables a robust "push-based" integration that provides real-time visibility into application performance and network health, leveraging Grafana's advanced dashboarding capabilities to analyze ThousandEyes telemetry data alongside other enterprise infrastructure metrics.

Introduction to ThousandEyes for OpenTelemetry

This video provides a foundational understanding of how ThousandEyes uses modern streaming frameworks to export critical performance data to external observability platforms.

InDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), dashboard widgets must be mapped to the correct telemetry data source and statistical measure. When an agent is installed as aLinux packageon an organization's infrastructure, it is classified as anEnterprise Agent.

The correct configuration for this widget isCloud & Enterprise Agents and Mean(Option B).

Data Source:Since the Linux-based agent is an Enterprise Agent, it shares the same data source category as Cloud Agents in the ThousandEyes dashboard configuration menu.

Measure:To display the "average" packet loss as requested, theMean(the arithmetic average) is the appropriate statistical measure.

Other options are unsuitable:

Option A:Endpoint Agentsare those installed on Windows/macOS user devices, not typically a standard Linux server package used for infrastructure monitoring.Medianwould show the middle value, not the average.

Option C:Routingrefers to BGP data, which does not report packet loss in the same way as synthetic network tests.

Option D:Devicesrefers to hardware monitored via SNMP, and annth Percentileis a specific statistical cutoff (like 95th percentile) rather than a simple average.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)implementation guide, the Cisco IOS XEApplication Hostinglifecycle is a critical concept for troubleshooting and configuration management. When an application environment variable—such as proxy settings or account tokens—is modified in the app-hosting configuration, a simple restart of the container is insufficient to apply those changes.

The correct procedure involves moving the application back through its lifecycle states to ensure the new environment variables are injected. This requires executing the full agent lifecycle (Option C):Stop, Deactivate, Activate, and Start.

Stop:Terminates the current running process of the container.

Deactivate:Releases the allocated hardware resources (CPU, Memory) and, most importantly, clears the runtime environment.

Activate:Re-allocates the resources andinjects the updated configuration parametersinto the container's environment variables.

Start:Initiates the container with the newly applied configuration settings.

After the application is up and running, the ThousandEyes-agent process attempts to connect to the controller in the cloud environment. Without thedeactivate/activatesequence, the container continues to use the environment variables present at the time of its initial activation, causing the agent to remain offline as it fails to reach the ThousandEyes portal without the proxy.Reinstalling(Option B) would work but is an unnecessarily lengthy process, whileNo action(Option D) will result in no change to the agent's connectivity status.

Within theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)framework, the transition from "polling" to "streaming" is a major architectural shift. To populate real-time dashboards in external observability platforms likeGrafana,Splunk, orAppDynamics, the architect should utilize theOpenTelemetry (OTel)integration (Option B).

ThousandEyes for OpenTelemetry is a push-based API built on the standardizedOpenTelemetry Protocol (OTLP). Unlike traditional REST API polling (Option A), which retrieves data at fixed intervals and can be subject to rate limiting and latency, the OTel integration allows ThousandEyes to stream granular network metrics as they are collected. These metrics—including latency, loss, jitter, and HTTP response times—are exported in a standardized format that is natively understood by modern observability backends. This allows the platform to populate complex visualizations such as time-series graphs, heatmaps, and multi-metric tables in near real-time, providing a "single pane of glass" view that correlates network performance with application and infrastructure telemetry.

A key advantage of the OTel approach isdata portabilityandcorrelation. By applying metadata tags to ThousandEyes tests, the data can be filtered and categorized within the external dashboard to match the organization's business logic (e.g., grouping by region or application tier). This enables SREs and NetOps teams to quickly identify if a performance dip in an application dashboard correlates with a spike in internet latency measured by ThousandEyes. Options C and D do not provide the streaming data pipeline required for real-time external dashboard population. Thus,OpenTelemetryis the definitive choice for high-fidelity, real-time observability integration.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, the native integration of ThousandEyes within the Meraki portfolio is specifically focused on theMeraki MXsecurity and SD-WAN appliances. This integration allows users to install ThousandEyes Enterprise Agents directly on supported Meraki MX hardware, providing critical visibility into the performance of services that distributed users rely on.4

TheMeraki MX (Option A)supports the ThousandEyes Enterprise Agent as a containerized service that can be activated with a single click within the Meraki Dashboard.5This integration is designed to provide better monitoring and testing capabilities for customers interested in improving the quality of their experience and adding the appropriate SD-WAN policies to optimize network performance. By running the agent natively on the MX, administrators can monitor the performance of external applications and services directly from the SD-WAN sites, bridging the gap between local branch health and global internet performance.6

While Cisco continues to expand its assurance integrations across the portfolio, theMR (Wireless),MS (Switching),MV (Camera), andMG (Cellular)series do not currently support the native, "on-box" execution of the ThousandEyes Enterprise Agent. For these other platforms, visibility is typically achieved through passive monitoring viaMeraki Insight (MI)or by deploying ThousandEyes agents on connected client devices (Endpoint Agents) or nearby infrastructure. Therefore, theMeraki MXis the only verified platform supporting native ThousandEyes agent deployment in this context.

TheDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)framework highlights the integration between ThousandEyes and Cisco Meraki as a solution for "cross-domain assurance".5The primary purpose of this integration is tomonitor external applications and services from SD-WAN sites(Option B).

In a distributed Meraki environment, IT teams often struggle with visibility into the "Internet as a WAN," where performance issues may occur outside the local network perimeter. By embeddingThousandEyes Enterprise Agentsnatively withinMeraki MX appliances, organizations can bridge the gap between internal LAN metrics and external service health.6This integration allows for proactive monitoring of SaaS platforms (like Microsoft 365, Salesforce, and Webex) and other public-facing dependencies using synthetic probes. It complements the nativeMeraki Insight (MI), which provides passive monitoring of real user traffic, by adding active path visualization and hop-by-hop analysis across the Internet.

Key advantages of this integration include:

One-Click Activation:Enabling the ThousandEyes agent directly from the Meraki Dashboard without additional hardware.7

Pre-configured Templates:Using built-in test templates for common SaaS applications to accelerate troubleshooting.8

Isolation of Fault Domains:Quickly determining if a user's lag is caused by a local Wi-Fi issue (via Meraki wireless metrics) or an ISP routing problem (via ThousandEyes path data).9

While ThousandEyes does provide visibility for VPN and security, Options A, C, and D are not theprimaryfocus of the specific Meraki-ThousandEyes integration architecture, which is centered on extending application performance assurance to distributed branch locations.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, the integration between ThousandEyes andWebex Control Hubprovides a streamlined troubleshooting experience for collaboration services. For the VoIP team to access the specific ThousandEyes network telemetry—such as latency, loss, and jitter—they must navigate to theNetwork Path(Option B) section within the Troubleshooting tab of the Control Hub.15

TheNetwork Pathvisualization is a direct result of the ThousandEyes Endpoint Agent data being pulled into the Webex interface.16When a user or RoomOS device experiences poor audio or video quality during a meeting, the Control Hub's troubleshooting view displays a "Network Path" line under the participant's details.17By clicking on this line, the VoIP team can see a hop-by-hop breakdown of the entire route from the collaboration device to the Webex media node. This view highlights specific hops where performance is "Poor" (red), "Fair" (yellow), or "Good" (green) based on predefined thresholds for latency (>400ms) or loss (>5%).

While "Devices" (Option A) is where the agents are activated, and "Users" (Option C) allows for selecting a specific participant, the actualtelemetry metricsand the visualization of the network route are strictly located in theNetwork Pathview. This integration eliminates the need for the VoIP team to leave the Webex environment for initial triage, as they can identify if a problem is local to the branch office or deep within a service provider's network directly from the "Network Path" dashboard.

Detailed Explanation:

In the IT Operations Dashboard, performance metrics are displayed per agent to facilitate granular troubleshooting. By reviewing the latest metrics table, the Mexico City Mexico (TelMex) agent displays a Connect time of 0.51 ms, which is significantly lower (and therefore "better") than the corresponding time for the San Jose CA agent. Connect time measures the duration for the TCP three-way handshake; a lower value indicates faster network-layer establishment.

56

In theDesigning and Implement7ing Enterpr8ise Network Assurance (300-445 ENNA)framework, configuring effective alert rules is critical for distinguishing between standard network noise and actionable application-layer failures. ForWeb - HTTP Servertests, ThousandEyes allows engineers to monitor both network-level metrics (like Connect time) and application-level indicators (like HTTP response codes).

The requirement is to trigger an alert specifically when the HTTP server responds with aserver error. In the HTTP protocol, server errors are categorized as the5XXseries of status codes (e.g., 500 Internal Server Error, 503 Service Unavailable, 504 Gateway Timeout). To meet this requirement, the engineer must configure a location alert condition where theMetricis set toResponse Codeand the condition value isserver error(5XX)(Option D).

Reviewing the other options:

Error type is any (Option A):While this would capture server errors, it would also trigger for 4XX client errors (like 404 Not Found) and network-layer timeouts, making it too broad for a specific "server error" requirement.

Wait Time is Dynamic (Option B):This monitors the time-to-first-byte using statistical baselining. While high wait times oftenprecede5XX errors, this condition only alerts on latency, not on the actual error code itself.

Response Time (Option C):Similar to wait time, this monitors performance speed rather than the logical success or failure of the server's response.

By specifically selectingResponse Code: server error(5XX), the engineer ensures that the operations team is only notified when the application backend is experiencing a functional failure, rather than just a slow response or a client-side misconfiguration.