300-445 Designing and Implementing Enterprise Network Assurance (300-445 ENNA) Questions and Answers

The Designing and Implementing Enterprise Network Assurance (300-445 ENNA) framework emphasizes that the goal of internet intelligence is to enable rapid and accurate escalation to the party responsible for a service degradation. Based on the evidence of a BGP Hijack identified in the previous question, the issue is occurring entirely within the public internet ecosystem.

The most appropriate next step is to reach out to the Internet Service Provider (ISP) to report the suspected BGP hijacking incident (Option B). Since the traffic is being misdirected by an external Autonomous System (AS 10297) before it reaches the intended destination (AS 16509), the fix must occur at the routing policy level of the major transit providers. The network administrator should provide the ISP with the ThousandEyes " Share Link " or screenshots showing the path change and the unauthorized AS announcement, as this data serves as proof to accelerate the ISP ' s mitigation efforts, such as implementing prefix filters or contacting the offending network.

Other options are ineffective for this specific scenario:

Option A: The path visualization shows that traffic is successfully leaving the local network and reaching the public internet; the problem is many hops away from the internal routers.

Option C: Blocking traffic from AS 10297 does not solve the problem of your traffic being attracted to it. The hijack affects how the rest of the world (including your ISP) sees the route to your destination.

Option D: DNS is not the issue; the agent successfully resolved the hostname to the correct IP, but the BGP layer misdirected the packets at the routing level.

By identifying the issue as an external routing event, the administrator avoids wasting internal resources and directly triggers the necessary external remediation.

According to the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) data analysis guidelines, identifying the underlying test type is the first step in interpreting a dashboard. By observing the metrics displayed across both the Executive and IT Operations dashboards, we can definitively identify the test type as Page Load (Option B).

A Page Load test is a Web-layer test that uses a browser engine (Chromium) to fully render a page and collect advanced metrics beyond simple availability. Evidence for this test type in the dashboards includes:

Page Completion Time: Displayed on the Executive dashboard map, this metric is specific to how much of the page successfully rendered.

DOM Load Time: Found in the IT Operations dashboard, the Document Object Model (DOM) time is a browser-centric metric that measures when the page structure has finished loading.

Waterfall Charts: While not a specific answer option, these are the foundation of Page Load tests, allowing for the timing of individual web components.

Simple HTTP Server tests (Option A) only measure availability and response codes, missing the rendering metrics seen here. Agent to server (Option C) is a network-layer test that provides path visualization but no browser-level data. FTP (Option D) is a protocol-specific test not used for web application monitoring. Therefore, the presence of DOM and Page Completion metrics confirms the Page Load test type.

The Designing and Implementing Enterprise Network Assurance (300-445 ENNA) framework highlights the integration between ThousandEyes and Cisco Meraki as a solution for " cross-domain assurance " . 5 The primary purpose of this integration is to monitor external applications and services from SD-WAN sites (Option B).

In a distributed Meraki environment, IT teams often struggle with visibility into the " Internet as a WAN, " where performance issues may occur outside the local network perimeter. By embedding ThousandEyes Enterprise Agents natively within Meraki MX appliances , organizations can bridge the gap between internal LAN metrics and external service health. 6 This integration allows for proactive monitoring of SaaS platforms (like Microsoft 365, Salesforce, and Webex) and other public-facing dependencies using synthetic probes. It complements the native Meraki Insight (MI) , which provides passive monitoring of real user traffic, by adding active path visualization and hop-by-hop analysis across the Internet.

Key advantages of this integration include:

One-Click Activation: Enabling the ThousandEyes agent directly from the Meraki Dashboard without additional hardware. 7

Pre-configured Templates: Using built-in test templates for common SaaS applications to accelerate troubleshooting. 8

Isolation of Fault Domains: Quickly determining if a user ' s lag is caused by a local Wi-Fi issue (via Meraki wireless metrics) or an ISP routing problem (via ThousandEyes path data). 9

While ThousandEyes does provide visibility for VPN and security, Options A, C, and D are not the primary focus of the specific Meraki-ThousandEyes integration architecture, which is centered on extending application performance assurance to distributed branch locations.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, troubleshooting deployment issues is as critical as the initial configuration. When utilizing Group Policy Objects (GPOs) for the distribution of the ThousandEyes Endpoint Agent (EPA), certain prerequisites must be met for the policy to take effect on a target machine. 10

The most fundamental requirement is that the target PC must be a member of the domain or the specific Organizational Unit (OU) where the GPO is linked. Therefore, the appropriate first step is to check that the PC belongs to the needed domain (Option B). GPOs are scoped based on Active Directory membership; if a computer is in a workgroup or a different domain/OU that is not targeted by the policy, it will never receive the instruction to install the software, regardless of how " properly " the GPO is configured on the server. 11

The other options are technically incorrect or represent a misunderstanding of GPO mechanics:

Administrator Login (Option A): EPA installation via GPO is typically configured to run under the System account context during startup, meaning it is not dependent on a specific user (administrator or otherwise) logging in to trigger the deployment.

Rebooting to restart GPO on the server (Option C): Rebooting a client PC triggers a " GPUpdate " request from the client to the server, but it does not " restart " the GPO service on the server side.

Rebooting the Server (Option D): This is an invasive and unnecessary step that will not force a policy update on a specific client PC if that PC is not correctly joined to the domain or is experiencing a local networking issue.

By verifying domain membership first, the administrator ensures the basic trust and communication path required for GPO delivery is functional before moving to more complex troubleshooting steps like checking event logs or network connectivity.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, understanding the visibility gap between the SD-WAN overlay and the transport underlay is a core competency. The provided exhibit illustrates a ThousandEyes Enterprise Agent deployed on a Branch Edge Router performing tests across two distinct paths: Internet (reaching a destination at 64.100.249.90) and MPLS (reaching a destination at 172.29.0.2).

According to the ENNA architecture guidelines, ThousandEyes is primarily utilized to provide hop-by-hop visibility into the underlay network. While SD-WAN controllers like vManage provide native monitoring for the overlay—the logical IPsec tunnels (Option B) that form the SD-WAN fabric—they often lack granular visibility into the physical service provider paths (the underlay) that carry those tunnels. The exhibit specifically highlights the agent probing the transport networks (Transport VPN0) directly, bypassing the overlay tunnels to measure the raw performance of the ISP and MPLS circuits.

By monitoring the underlay (Option A), the engineer can identify if high latency or packet loss is caused by a specific hop within the service provider ' s infrastructure or at a peering point. This " underlay visibility " is critical for troubleshooting SD-WAN performance issues where the overlay may report a tunnel down, but the root cause lies in a BGP routing change or physical fiber cut in the provider network. ThousandEyes Enterprise Agents, natively integrated into Catalyst 8000 and ISR 4000 platforms, allow for this persistent underlay monitoring without additional hardware.

Overlay (Option C): While ThousandEyes can monitor overlay performance, the exhibit ' s focus on the raw IP addresses (Internet and MPLS) in the transport VPN indicates an underlay test.

IPsec/GRE Tunnels (Options B & D): These represent the transport mechanisms of the overlay. ThousandEyes probes the path under these tunnels to ensure the transport health is sufficient to support the fabric.

According to the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, the native integration of ThousandEyes within the Meraki portfolio is specifically focused on the Meraki MX security and SD-WAN appliances. This integration allows users to install ThousandEyes Enterprise Agents directly on supported Meraki MX hardware, providing critical visibility into the performance of services that distributed users rely on. 4

The Meraki MX (Option A) supports the ThousandEyes Enterprise Agent as a containerized service that can be activated with a single click within the Meraki Dashboard. 5 This integration is designed to provide better monitoring and testing capabilities for customers interested in improving the quality of their experience and adding the appropriate SD-WAN policies to optimize network performance. By running the agent natively on the MX, administrators can monitor the performance of external applications and services directly from the SD-WAN sites, bridging the gap between local branch health and global internet performance. 6

While Cisco continues to expand its assurance integrations across the portfolio, the MR (Wireless) , MS (Switching) , MV (Camera) , and MG (Cellular) series do not currently support the native, " on-box " execution of the ThousandEyes Enterprise Agent. For these other platforms, visibility is typically achieved through passive monitoring via Meraki Insight (MI) or by deploying ThousandEyes agents on connected client devices (Endpoint Agents) or nearby infrastructure. Therefore, the Meraki MX is the only verified platform supporting native ThousandEyes agent deployment in this context.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, transaction monitoring is essential for validating complex, multi-step user workflows. When an engineer with limited scripting experience needs to monitor a OneDrive file download process, the ThousandEyes ecosystem provides several tools to simplify the creation of robust Transaction tests .

The correct approach is to leverage all available resources, making Option D the definitive answer. First, the ThousandEyes Recorder IDE (Option B) is a critical tool for non-scripters. It allows an engineer to perform the actual workflow—navigating to OneDrive, logging in, and initiating the download—in a browser environment on their local machine while the tool records every click and keyboard entry. The Recorder automatically generates the corresponding JavaScript code using the ThousandEyes transaction library . Second, the platform provides pre-built script templates (Option A), such as those for Office 365 and OneDrive , which include baseline logic and best practices for these specific services. Third, the official transaction-scripting-examples repository on GitHub (Option C) is a maintained source of code snippets. This is particularly useful for implementing advanced logic, such as a retry mechanism , which ensures that the test does not report a " failure " due to a transient network hiccup but instead attempts the action again before triggering an alert.

As shown in the provided exhibit, a typical script uses import statements from @thousandeyes and selenium-webdriver to control the browser. By combining the Recorder for the basic flow, a Template for service-specific nuances, and Sample Scripts for logic enhancements like retries, the engineer can deploy a highly reliable assurance test without deep coding expertise. Therefore, all three actions are highly recommended and valid within the ENNA implementation framework.

In the context of Designing and Implementing Enterprise Network Assurance (300-445 ENNA) , measuring the " lived experience " of an end-user requires data collection from the actual device being used to access the services. Unlike server-side or infrastructure-side monitoring, user experience (UX) monitoring must account for local variables like Wi-Fi signal quality, CPU/memory usage, and browser-level pe 21 rformance.

The Endpoint Agent (Option D) is the correct choice for this architecture. It is a lightweight software service installed directly on Windows or macOS workstations, as well as RoomOS devices. The Endpoint Agent provides a dual-monitoring approach: Real User Monitoring (RUM) and Scheduled Synthetic Tests . 24 RUM captures actual browser sessions to SaaS (e.g., Salesforce, Microsoft 365) or internal apps, providing a " Experience Score " and a detailed waterfall view of page load components. 25 Simultaneously, the agent can run background synthetic network tests to measure latency and path visualization from the user ' s specific location, whether they are in a branch office, at home on a VPN, or in a coffee shop.

Comparing other agents:

Enterprise Agents (Option B) can simulate a user at a branch office, but they cannot provide insight into the specific health of an individual ' s laptop or their unique Wi-Fi environment.

Cloud Agents (Option C) are entirely outside the user ' s network and cannot measure the performance of internal web applications or the " last mile " connectivity of the employee.

Synthetic Agent (Option A) remains a distractor term.

By deploying Endpoint Agents , the architect ensures they have granular, contextual data that correlates application performance directly with the user’s device and local network environment.

Alert fatigue is a major operational challenge in network assurance. To make a CPU utilization alert for Endpoint Agents less sensitive and reduce " noise, " an engineer must implement statistical filters that ignore transient spikes or isolated events.

The two most effective methods are:

Increase the agent count (Option A): By requiring a higher number or percentage of agents to simultaneously exceed the threshold, the system ensures the alert represents a widespread environmental issue rather than a single user running a CPU-intensive background process.

Require more rounds of data (Option C): Instead of alerting on a single measurement (1 of 1 round), the engineer can configure the rule to require the threshold to be breached for multiple consecutive checks (e.g., 2 of 3 rounds). This filters out brief, non-impactful CPU spikes that occur naturally during OS updates or browser startups.

Other options would have the opposite effect:

Option B: Lowering the percentage threshold (e.g., from 90% to 50%) would cause the alert to trigger much more frequently, increasing noise.

Option D: Enabling the alert on more agents increases the pool of potential triggers, which typically leads to more notifications unless the logic in Option A is also applied.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) architecture, the deployment of ThousandEyes Enterprise Agents on switching infrastructure is designed to be highly flexible, catering to different management styles and network scales. Modern Cisco switches, specifically the Catalyst 9300 and 9400 Series , support the execution of containerized applications directly on the switch ' s hardware through the Cisco IOS XE Application Hosting framework. 1

Application Hosting (Option A) refers to the manual method using the Cisco IOS XE Command Line Interface (CLI). An engineer can use app-hosting commands to install, configure, and manage the Docker-based Enterprise Agent. 2 This provides granular control over resource allocation and networking for the container. Catalyst Center (Option B) provides a GUI-driven, automated workflow to deploy agents at scale across an entire campus fabric. 3 It simplifies the lifecycle management by handling the installation and activation across multiple switches simultaneously. For switches acting as edge devices in an SD-WAN fabric, Catalyst SD-WAN Manager (Option C) orchestrates the deployment through centralized policies and templates, allowing the agent to be pushed as part of a device configuration. Finally, while the ThousandEyes Portal (Option D) is the management plane for tests, it is also where the Docker image and Account Group Token are obtained for any of the aforementioned deployment methods.

Each method provides the same end result: an Enterprise Agent running " on-box " to provide deep visibility into the network path starting directly from the access or core layer. Therefore, All of the above (Option E) is the correct answer as it encompasses the manual, automated, and orchestrated methods available for switch-based deployment as per the 300-445 ENNA official guidelines.

The architecture for Designing and Implementing Enterprise Network Assurance (300-445 ENNA) specifies that ThousandEyes WAN Insights relies on deep integration with the Cisco SD-WAN management stack. To generate its predictive path recommendations, the platform must ingest specific telemetry data that reflects both the network ' s behavior and the applications traversing it.

The first essential data source is historical network performance metrics collected by vAnalytics (Option B). Before WAN Insights can be activated, vAnalytics must be enabled to collect and enrich raw network telemetry from the edge routers. 34 This data includes granular metrics for every SD-WAN tunnel, such as packet loss, latency, and jitter. 35 WAN Insights analyzes these historical trends to forecast future path quality and determine which transport circuits are most likely to meet application SLAs over a long-term period.

The second essential data source is application traffic flow data (Option D). WAN Insights must understand which applications are currently active in the fabric to prioritize recommendations for " business-critical " services like Office 365, Webex, or custom internal apps. 38 This information is ingested as flow records from the SD-WAN data plane and categorized based on the Application Lists defined in Cisco Catalyst SD-WAN Manager (vManage) .

Options A and E are configuration or logging data that, while useful for general management, are not the raw telemetry inputs used by the WAN Insights predictive engine. Option C is incorrect because WAN Insights explicitly uses infrastructure telemetry rather than ThousandEyes agent-based synthetic data for its SD-WAN fabric calculations. By combining vAnalytics performance metrics and application flow data , WAN Insights can provide the " Predictive Path Recommendatio 41 ns " that are a hallmark of modern network assurance.

The Designing and Implementing Enterprise Network Assurance (300-445 ENNA) certification emphasizes that the primary value proposition of the Cisco " Assurance Stack " is the reduction of Mean Time to Identification (MTTI) and Mean Time to Resolution (MTTR) . The integration of ThousandEyes across Cisco ' s portfolio—including Catalyst, Meraki, and SD-WAN— allows for quick identification and resolution of performance issues (Option D). 12

By embedding ThousandEyes agents into the existing network infrastructure, Cisco enables " end-to-end visibility " that spans domains the enterprise traditionally does not control, such as the public internet and SaaS environments. 13 During troubleshooting, this cross-platform visibility allows network engineers to immediately correlate internal network health (from Catalyst Center or Meraki Dashboard) with external path visualization (from ThousandEyes). For example, when a user experiences poor video quality in a Webex meeting, the integration allows the engineer to " cross-launch " from the Webex Control Hub directly into a ThousandEyes path view. 14 This pinpoint accuracy avoids the " blame game " between network, application, and ISP teams by providing a " single source of truth " regarding where the packet loss or latency is occurring.

While some automation exists (Option C), the core benefit isn ' t automatic configuration changes based on feedback, but rather providing the actionable insights required for manual or policy-based remediation. Similarly, while it streamlines data gathering, its ultimate purpose is the speed of resolution in complex, hybrid environments.

Establishing an accurate baseline is a cornerstone of the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) methodology. A baseline must represent the " typical " behavior of the network across its standard operating cycle to be useful for anomaly detection and capacity planning. When monitoring interface utilization on a critical link, it is vital to capture both peak and off-peak traffic patterns (Option C).

Most enterprise networks exhibit cyclical traffic patterns, often referred to as " diurnal " cycles, where utilization spikes during business hours (peak) and drops significantly at night or on weekends (off-peak). If an engineer only collects data during the lowest volume period (Option A), the baseline will be unrealistically low, leading to " false positive " alerts when normal business traffic returns. Conversely, only capturing peak data might hide background synchronization tasks or backup windows that occur during off-hours.

By selecting a representative time period—typically one full week or a month—the engineer ensures the baseline accounts for variations such as Monday morning " logon storms, " mid-week steady states, and weekend maintenance. This comprehensive view allows the assurance platform (such as Cisco Catalyst Center or ThousandEyes ) to calculate a standard deviation and establish dynamic thresholds. If utilization deviates from these historically representative norms, the system can trigger an alert based on a true anomaly rather than a predictable daily surge. Aligning with a financial year (Option B) is irrelevant to technical performance, and limiting the data (Option D) compromises the baseline ' s statistical validity.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) framework, baselining is the process of establishing a " normal " performance profile for network infrastructure to enable the detection of anomalies. When the metric of interest is the internal health of a physical device, such as CPU utilization on a core router, SNMP (Simple Network Management Protocol) is the industry-standard data source.

SNMP provides direct visibility into the device ' s control plane and hardware performance. By polling specific Object Identifiers (OIDs) from the router ' s Management Information Base (MIB), a monitoring system like Cisco Catalyst Center or a third-party NMS can collect granular data on CPU cycles, memory allocation, and temperature. This " inside-out " telemetry is essential for baselining because it reflects the actual resource consumption of the router during various traffic loads.

Conversely, ThousandEyes tests (Options A, B, and D) provide " outside-in " synthetic data. While DNS resolution time (Option A), HTTP response times (Option B), and Path Visualization (Option D) are excellent for measuring end-to-end service delivery and network transit health, they do not report on the router ' s internal hardware state. For instance, a router could have 99% CPU utilization (indicating a potential crash), yet a ThousandEyes path test might still show a " green " path if the data plane (ASICs) is still forwarding packets efficiently. Therefore, to establish a reliable baseline for hardware-specific metrics like CPU, SNMP data (Option C) is the only appropriate source among the choices.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) architecture, a critical challenge in active synthetic monitoring is ensuring that test probes accurately reflect user traffic without being dropped by intermediate security appliances. Standard network tests often utilize separate connections for measuring performance metrics (latency/loss) and for path discovery (hop-by-hop visualization). This behavior can be flagged by stateful firewalls or Intrusion Prevention Systems (IPS) as suspicious or malicious scanning activity.

To mitigate this, the engineer should enable Path Trace Mode: In Session (Option A). When this mode is active, ThousandEyes performs path discovery using the exact same TCP session established for the performance measurement. By embedding path discovery probes within an active, established session, the traffic appears to firewalls as part of a legitimate, ongoing communication stream rather than an independent series of probes with varying TTL values that might trigger " anti-spoofing " or " scanning " alerts.

Reviewing the alternative options:

Protocol: TCP (Option B): While using TCP is generally more firewall-friendly than ICMP, the exhibit shows TCP is already selected. The issue is not the protocol itself, but how the path discovery probes are handled relative to the session.

Port: 5000 (Option C): Changing the port to a non-standard value like 5000 often makes traffic more likely to be scrutinized or blocked by default firewall policies compared to standard web ports like 80.

Probing Mode: Force SYN (Option D): Forcing SYN packets is a technique used to bypass certain types of load balancers but does not address the fundamental issue of path discovery probes being seen as a separate, malicious scan by stateful inspection engines.

Therefore, enabling In Session path trace mode is the most effective way to ensure consistent visibility through security-hardened environments.

According to the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) architecture, monitoring site-to-site connectivity between managed locations requires vantage points at both ends of the connection. In this scenario, the organization needs to measure performance between branch offices (San Francisco and Texas) and a central data center (North Virginia).

The most appropriate combination is using Enterprise Agents with the Agent-to-agent test type (Option C). Enterprise Agents are software probes deployed on infrastructure owned or controlled by the organization, such as switches or routers in the branch offices and servers in the data center. Unlike Agent-to-server tests, which only provide one-way metrics and approximate path data, an Agent-to-agent test provides bi-directional network metrics. This includes detailed throughput, packet loss, latency, and jitter measurements in both directions, which is critical for identifying asymmetric routing or link saturation that might affect application performance.

Alternative options are less suitable for this specific internal monitoring requirement:

Cloud Agents (Options A and B): These are located in global ISP data centers and cannot be placed inside the organization ' s private data center or branch LAN to measure internal path characteristics.

HTTP/DNS Server tests (Options B, D, and E): These target specific services but do not provide the granular, bi-directional network-layer performance data (like throughput or path visualization) that an Agent-to-agent test delivers.

Agent-to-server (Option E): While useful for reaching a target that cannot host an agent, it loses the benefit of the destination agent ' s ability to measure the " return " path independently.

By deploying Enterprise Agents at each site and configuring Agent-to-agent tests, the engineer gains the highest level of visibility into the health of the private WAN or SD-WAN fabric connecting the branches to the data center.

Troubleshooting intermittent performance issues is a core component of the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum. When a transaction test using Basic Authentication fails randomly, the engineer must employ a multi-layered diagnostic approach to determine if the fault lies with the credentials, the network path, or the application server.

The first step is to verify the correctness of credentials (Option B). Because Basic Authentication encodes credentials in the header, any change in user permissions or account lockouts will trigger immediate failures. Performing manual logins from various geographical locations helps rule out location-based access control lists (ACLs) or regional IdP sync issues.

The most data-rich diagnostic step is to analyze the ThousandEyes waterfall charts and HTTP response codes (Option C). The waterfall view allows the engineer to see if the failure happens during the initial 401 Unauthorized challenge or after the credentials are sent. If the charts show high " Wait Time " or 5xx errors, the issue is likely server-side latency or instability. If the " Connect Time " is high, the problem may be network-layer congestion.

Finally, if the telemetry indicates that the network path is healthy but the server is intermittently returning errors or timing out, the engineer should contact the web application vendor (Option D). Providing the vendor with the specific ThousandEyes " Share Link " allows them to see the exact same packet-level and browser-level data, proving that the issue is not with the client ' s network but with the server-side infrastructure. Disabling authentication (Option A) is not a valid troubleshooting step for a test designed specifically to monitor an authenticated workflow.

In the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) implementation guide, the Cisco IOS XE Application Hosting lifecycle is a critical concept for troubleshooting and configuration management. When an application environment variable—such as proxy settings or account tokens—is modified in the app-hosting configuration, a simple restart of the container is insufficient to apply those changes.

The correct procedure involves moving the application back through its lifecycle states to ensure the new environment variables are injected. This requires executing the full agent lifecycle (Option C): Stop, Deactivate, Activate, and Start .

Stop: Terminates the current running process of the container.

Deactivate: Releases the allocated hardware resources (CPU, Memory) and, most importantly, clears the runtime environment.

Activate: Re-allocates the resources and injects the updated configuration parameters into the container ' s environment variables.

Start: Initiates the container with the newly applied configuration settings.

After the application is up and running, the ThousandEyes-agent process attempts to connect to the controller in the cloud environment. Without the deactivate/activate sequence, the container continues to use the environment variables present at the time of its initial activation, causing the agent to remain offline as it fails to reach the ThousandEyes portal without the proxy. Reinstalling (Option B) would work but is an unnecessarily lengthy process, while No action (Option D) will result in no change to the agent ' s connectivity status.