300-445 Designing and Implementing Enterprise Network Assurance(300-445 ENNA) Question and Answers

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, isolating performance issues on end-user machines requires a combination of application-layer experience data and local system telemetry. When an architect suspects that local hardware constraints, such as high CPU usage, are degrading the digital experience, theEndpoint Agentis the required vantage point.

The correct combination isReal User Tests > Endpoint, CPU utilization ≥ %(Option C). This alert configuration is effective for several reasons:

Targeted Visibility:It directly monitors the user's device (Endpoint) where the hardware bottleneck is suspected to reside.

Real-Time Context:By utilizingReal User Tests (RUM), the agent gathers performance data during actual user activity (e.g., browsing the web application). This ensures that the CPU spikes are correlated with active application usage, providing a representative view of the impact on experience.

Threshold Alerting:The condition monitors for CPU utilization exceeding a defined percentage threshold (≥ %). This allows IT teams to be notified only when the CPU load reaches problematic levels that are known to cause application sluggishness or browser "freezing".

Alternative options are less effective for this specific troubleshooting goal:

Option A:Monitors network loss, which would not identify a local CPU bottleneck.

Option B:Monitors path length (hops), which is a routing metric irrelevant to local hardware performance.

Option D:Monitors memory load during scheduled tests. While memory is a factor, the specific suspicion in this scenario is CPU utilization, and scheduled tests do not always capture the same load impact as a real user interacting with the browser.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)best practices for collaboration monitoring,Microsoft Teams(as well as Webex and Zoom) is monitored using a combination ofScheduled and Dynamic tests(Option D).

Scheduled Tests:These are used to proactively monitor the reachability and performance of the Microsoft Teams infrastructure. The Teams template typically includes scheduled HTTP Server tests to teams.microsoft.com and login.microsoftonline.com, along with network-layer tests to theTeams Transport Relay(e.g., worldaz.tr.teams.microsoft.com). These provide a continuous baseline of connectivity regardless of whether a user is currently in a call.

Dynamic Tests:These are a unique feature for collaboration monitoring. When an Endpoint Agent detects that the Teams application has initiated a real-time media session (audio or video call), it automatically triggers aDynamic Testto the specific IP and port being used for that call. This allows IT teams to see the exact network path—including hop-by-hop latency and loss—of the actual call traffic while the session is active.

Real User Tests (Option C)are generally not used for Teams monitoring in the same way they are for web-based SaaS apps. Because most users utilize the Teamsdesktop clientrather than the browser, the RUM browser extension cannot capture the rich telemetry of the desktop application's internal signaling and media streams. Therefore, the specialized "Automated Session Testing" provided byDynamic Tests, combined with the proactive health checks ofScheduled Tests, constitutes the complete assurance strategy for Microsoft Teams.

InDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), dashboard widgets must be mapped to the correct telemetry data source and statistical measure. When an agent is installed as aLinux packageon an organization's infrastructure, it is classified as anEnterprise Agent.

The correct configuration for this widget isCloud & Enterprise Agents and Mean(Option B).

Data Source:Since the Linux-based agent is an Enterprise Agent, it shares the same data source category as Cloud Agents in the ThousandEyes dashboard configuration menu.

Measure:To display the "average" packet loss as requested, theMean(the arithmetic average) is the appropriate statistical measure.

Other options are unsuitable:

Option A:Endpoint Agentsare those installed on Windows/macOS user devices, not typically a standard Linux server package used for infrastructure monitoring.Medianwould show the middle value, not the average.

Option C:Routingrefers to BGP data, which does not report packet loss in the same way as synthetic network tests.

Option D:Devicesrefers to hardware monitored via SNMP, and annth Percentileis a specific statistical cutoff (like 95th percentile) rather than a simple average.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, selecting the appropriate test type is essential for isolating performance bottlenecks in complex web applications. When users report issues with specific multi-step workflows—such as logging into a portal or interacting with a shopping cart—theTransaction test type(Option C) is the most effective tool.

A Transaction test is a specialized Web-layer test that utilizes a script (typically written in JavaScript/TypeScript) to mimic real user interactions with a website. Unlike a simpleHTTP Server test(Option A) that only checks for a 200 OK response from a single URL, or aPage Load test(Option B) that measures the rendering of a single page, a Transaction test follows a predefined user journey. For this retail scenario, the test can be configured to navigate to the homepage, enter credentials, click the login button, search for a product, and add it to the cart.

The primary advantage of this approach is that it provides granular, step-specific timing. It allows the engineer to identify precisely where the latency or failure occurs—for example, if the backend database takes too long to process the login or if an API call fails during the "add to cart" action. WhileAgent-to-server(Option D) andDNS Server(Option E) tests provide valuable network and infrastructure data, they cannot validate the functional logic of a web application.Agent-to-agent(Option F) is used for measuring throughput between two managed points and is irrelevant for public-facing website testing. Therefore, for troubleshooting interactive web processes, theTransaction test typeis the definitive choice for pinpointing the source of the issue.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)implementation guide, the Cisco IOS XEApplication Hostinglifecycle is a critical concept for troubleshooting and configuration management. When an application environment variable—such as proxy settings—is modified in the app-hosting configuration, a simple restart of the container is insufficient.

The correct procedure involves moving the application back to theConfiguredstate before bringing it back toRunning. This requires a four-step lifecycle execution (Option C):

Stop:Terminates the current running instance of the container.

Deactivate:Releases the hardware resources (CPU, Memory, Virtual Interfaces) and, crucially, detaches the previous runtime configuration.

Activate:Re-allocates the resources andinjects the new configuration parameters(including the updated proxy settings) into the container's environment.

Start:Initiates the container with the newly applied configuration.

Without thedeactivate/activatesequence, the container will continue to use the environment variables present at the time of its initial activation, causing the agent to remain offline as it fails to reach the ThousandEyes portal without the proxy.Reinstalling(Option B) is an unnecessary and time-consuming step that involves re-downloading or re-copying the image, whileNo action(Option D) will result in no change to the agent's connectivity status.

As shown inExhibit 4.1-1(image_6e19fb.png), the alert rule is configured for the BGP layer with the name "AS origin AS 1234". The critical logic is defined in theAlert Conditionssection, which specifies: BGP Origin meets all of: ASN not in 1234.

This specific configuration is the standard method used in ThousandEyes to detectBGP hijacking(Option C). BGP hijacking occurs when an unauthorized Autonomous System (AS) announces a network prefix that it does not own, effectively stealing the traffic meant for the legitimate owner. By setting an alert that triggers when a monitored prefix is seen originating from an Autonomous System Number (ASN) that isnotthe expected authorized ASN (in this case, AS 1234), ThousandEyes provides immediate notification of a routing takeover.

Identifying this via BGP Origin alerts is superior to simple connectivity checks because it catches the issue at the routing control plane.

DNS Issues (Options B and D):These involve the translation of names to IPs and would be detected via DNS-specific tests rather than BGP Origin checks.

Route Poisoning (Option A):This is a generic term often referring to the manipulation of distance-vector protocol metrics to make a route unreachable; while related to routing, BGP Origin checks are the specific tool for detecting external prefix hijacks.

By monitoring the ASN origin, network engineers can quickly distinguish between a local ISP outage and a global security event where their traffic is being misdirected to an illegitimate network.

Within the framework ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), network monitoring is categorized into two primary methodologies: active and passive monitoring.1Active monitoring(Option C) is characterized by the generation of synthetic or "probes" traffic specifically designed to measure network performance.2These probes simulate real-world user activity, such as HTTP requests, DNS queries, or ICMP pings, to baseline performance metrics like latency, jitter, and packet loss.

The core benefit of the active approach is its independence from actual user traffic. By sending a continuous ping or synthetic HTTP probe, an engineer can verify path availability and performance even during off-peak hours when no real users are on the network. In the context of Cisco ThousandEyes—a central platform in the ENNA certification—this is the primary mode of operation for Cloud, Enterprise, and Endpoint agents. For instance, a ThousandEyes network test proactively sends packets to a target IP or URL to visualize the hop-by-hop underlay and overlay paths.

Conversely, options A, B, and D representpassive monitoringtechniques. Passive monitoring involves observing and analyzing traffic that is already traversing the network.3Methods such asSNMP(Option A) provide device-level health data like CPU load and interface utilization, whilepacket captures(Option B) andNetFlow(Option D) analyze the characteristics of existing user flows to determine top talkers or traffic patterns. While passive monitoring is excellent for volume and utilization analysis, it lacks the proactive capability to test a path's performance before a user encounters a failure. Therefore, sending a synthetic probe like a continuous ping is the definitive example of active monitoring.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)architecture, ThousandEyes provides a suite of native, "out-of-the-box" integrations specifically designed foralert notifications. These integrations are configured via theManage > IntegrationsorAlert Rules > Notificationstabs and allow the platform to push instant event data to a variety of collaboration, IT operations, and observability tools.

The verified list of native notification integrations includes:

ServiceNow (A):Facilitates direct incident management and automated ticketing workflows.

PagerDuty (B):Allows for automated incident escalation and on-call routing based on ThousandEyes alerts.

MS Teams (C) & Slack (H):Enable real-time chatops by pushing alert details and permalinks directly into specified channels for team collaboration.

Splunk (D):Utilizes theCisco ThousandEyes App for Splunkto ingest alert data for historical analysis and correlation within a SIEM or logging platform.

AppDynamics (F):Sends alert notifications directly into an AppDynamics instance, allowing application owners to correlate network issues with APM metrics.12

Webex (G):Integrates with theWebex Control Huband specific Webex spaces to provide unified visibility for collaboration performance.34

AWS (Option E)is not a nativealert notificationdestination5in this context; instead, ThousandEyes integrates with AWS for "Cloud Insights" (ingesting VPC Flow Logs) and "Test Recommendations" rather than acting as a receiver for event notifications like a chat or ITSM tool. By utilizing these native integrations, enterprise teams ensure that the right stakeholders are notified through their preferred communication channels the moment a performance threshold is breached, drastically improving response times across the organization.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)framework, application health is not just about reachability, but about the functionality of business-critical paths. For an e-commerce checkout process, which involves multiple interactive steps such as "Add to Cart," "Enter Shipping Info," and "Finalize Payment,"Transaction monitoring(Option B) is the most beneficial functionality.

Transaction tests provide a high-level view of application performance by executing a script that simulates a real user's interaction with the site's various components. UnlikeHTTP server monitoring(Option A), which merely verifies that a single URL returns a specific status code (like 200 OK), Transaction monitoring validates that the underlying application logic and database transactions are working as expected across the entire session. If a user can reach the homepage but the "Checkout" button fails due to a slow backend API call or a JavaScript error, only a Transaction test will identify the failure and provide a granular waterfall chart to show exactly where the process broke down.

WhileDNS monitoring(Option C) andRouting visibility(Option D) are crucial for identifying foundational connectivity issues, they are insufficient for monitoring complex transactional workflows. A DNS failure would prevent access to the site entirely, but a "broken" checkout process often occurs while the network and DNS appear perfectly healthy. Transaction monitoring bridges this gap by providing "layer 7" visibility into the end-to-end user experience, making it the definitive choice for e-commerce performance assurance.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)implementation guide, the Cisco IOS XEApplication Hostinglifecycle is a critical concept for troubleshooting and configuration management. When an application environment variable—such as proxy settings or account tokens—is modified in the app-hosting configuration, a simple restart of the container is insufficient to apply those changes.

The correct procedure involves moving the application back through its lifecycle states to ensure the new environment variables are injected. This requires executing the full agent lifecycle (Option C):Stop, Deactivate, Activate, and Start.

Stop:Terminates the current running process of the container.

Deactivate:Releases the allocated hardware resources (CPU, Memory) and, most importantly, clears the runtime environment.

Activate:Re-allocates the resources andinjects the updated configuration parametersinto the container's environment variables.

Start:Initiates the container with the newly applied configuration settings.

After the application is up and running, the ThousandEyes-agent process attempts to connect to the controller in the cloud environment. Without thedeactivate/activatesequence, the container continues to use the environment variables present at the time of its initial activation, causing the agent to remain offline as it fails to reach the ThousandEyes portal without the proxy.Reinstalling(Option B) would work but is an unnecessarily lengthy process, whileNo action(Option D) will result in no change to the agent's connectivity status.

In the context ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), understanding the visibility gap in SD-WAN environments is essential. While SD-WAN controllers provide native visibility into theoverlay network(the logical IPsec tunnels and fabric health), they often lack granular insight into the physical transport orunderlay networkprovided by ISPs or MPLS circuits.

According to the ENNA architecture guidelines, the most suitable method for measuring true SD-WAN performance is to install an agent on theunderlay network(Option D). By deploying ThousandEyes Enterprise Agents directly on the transport-facing interfaces (Transport VPN0 in Cisco SD-WAN terminology), engineers can perform hop-by-hop path visualization and measure metrics like packet loss, latency, and jitter across the actual provider path. This is critical because performance degradation in the overlay is almost always a symptom of an issue in the underlay, such as BGP routing instabilities or physical link congestion at an ISP peering point.

Deploying agents on theoverlay(Option A) only measures the performance of the tunnel itself, which may hide specific hop-level failures occurring in the public internet. Installing an agent on theLAN(Option C) orDMZ(Option B) adds local network noise to the metrics, making it harder to isolate if a problem exists within the corporate office or the service provider network. By focusing on theunderlay, the engineer ensures they have the "internet intelligence" required to hold service providers accountable to SLAs and quickly resolve connectivity issues that impact the SD-WAN fabric.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)best practices, the goal of a successful endpoint assurance rollout is to maximize coverage while minimizing the burden on both IT staff and end-users. The most effective strategy for achieving this is touse a centralized software deployment tool (e.g., GPOs, Intune) that supports silent installation(Option B).

Centralized deployment tools allow administrators to push the ThousandEyes Endpoint Agent to thousands of machines simultaneously from a single management console.12By usingsilent installationparameters (such as /quiet or /qn for MSI packages), the agent is installed in the background without requiring any user interaction or even showing a setup wizard.13This "minimally disruptive" approach ensures that business operations are not interrupted. Furthermore, centralized tools provide a "secure" deployment method because the IT team retains control over the version of the agent being installed and can ensure that the Account Group Token is correctly embedded, which is necessary for the agent to register with the ThousandEyes dashboard.

Contrasting this with other methods:

Manual Installation (Option A):This is not scalable and is highly labor-intensive, making it unsuitable for large enterprises.

Emailing links (Option C) or Web Portals (Option D):These methods rely on the end-user to perform the installation correctly and to have the necessary local administrative privileges. This often leads to low adoption rates, inconsistent configurations, and security risks associated with users running installers manually.

By leveraging existing enterprise infrastructure likeActive Directory GPOsorMicrosoft Intune, organizations can ensure a 100% compliant deployment that immediately begins providing the "user-centric" visibility required for modern network assurance.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, the integration between ThousandEyes andWebex Control Hubprovides a streamlined troubleshooting experience for collaboration services. For the VoIP team to access the specific ThousandEyes network telemetry—such as latency, loss, and jitter—they must navigate to theNetwork Path(Option B) section within the Troubleshooting tab of the Control Hub.15

TheNetwork Pathvisualization is a direct result of the ThousandEyes Endpoint Agent data being pulled into the Webex interface.16When a user or RoomOS device experiences poor audio or video quality during a meeting, the Control Hub's troubleshooting view displays a "Network Path" line under the participant's details.17By clicking on this line, the VoIP team can see a hop-by-hop breakdown of the entire route from the collaboration device to the Webex media node. This view highlights specific hops where performance is "Poor" (red), "Fair" (yellow), or "Good" (green) based on predefined thresholds for latency (>400ms) or loss (>5%).

While "Devices" (Option A) is where the agents are activated, and "Users" (Option C) allows for selecting a specific participant, the actualtelemetry metricsand the visualization of the network route are strictly located in theNetwork Pathview. This integration eliminates the need for the VoIP team to leave the Webex environment for initial triage, as they can identify if a problem is local to the branch office or deep within a service provider's network directly from the "Network Path" dashboard.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, the integration of ThousandEyes with the Cisco SD-WAN fabric is a cornerstone of modern wide-area network visibility. The primary agent type used in this native integration is theEnterprise Agent(Option C).

According to the ENNA implementation guidelines, ThousandEyes Enterprise Agents run as containerized applications directly on the Cisco IOS XE software stack (version 17.6.1 and later) of supported hardware, such asCisco Catalyst 8000 Edge PlatformsandISR 4000 Series routers.3This deployment is orchestrated centrally throughCisco Catalyst SD-WAN Manager(formerly vManage), which handles the lifecycle management, including downloading the Docker-based agent image from the Cisco software repository and pushing the initial configuration to the branch edge devices.4

Once deployed, these Enterprise Agents function as internal vantage points that can measure performance across both theunderlay transportand theSD-WAN overlay. By placing the agent on the router, engineers can execute synthetic tests to monitor mission-critical SaaS applications or data center services directly from the branch's perspective, avoiding the need for extra hardware probes at each site. This "agent-on-router" architecture significantly reduces both CapEx and OpEx while providing high-fidelity network intelligence into ISP peering, regional outages, and fabric health.

Cloud Agents (Option A)are managed by Cisco in global data centers and cannot be "installed" on customer edge routers.

Endpoint Agents (Option D)are designed for user workstations or laptops and do not provide the infrastructure-level visibility required for SD-WAN transport monitoring.

Browser Agent (Option B)is not a specific standalone agent type in this context; rather, browser-level testing is a capability often performed by Endpoint or Enterprise Agents.

Therefore, theEnterprise Agentis the correct verified agent type for Cisco SD-WAN vManage integration.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)guidelines, troubleshooting widespread performance issues for a public or data center-hosted app17lication requires an "outside-in" perspective. When reports are widespread,18the goal is to determine if the issue is global, regional, or specific to certain ISP paths leading to the data center.

TheCloud Agent(Option D) is the most effective tool for this task because these agents are maintained by Cisco ThousandEyes in over 240+ locations worldwide within Tier 1, 2, and 3 ISPs and cloud provider regions.19Because they arepre-deployed and immediately available, a network engineer can instantly run tests from multiple global locations toward the data center-hosted application without having to install any software or manage any infrastructure. This allows the engineer to quickly compare performance metrics (latency, loss, and page load times) across different geographies. If Cloud Agents in London report no issues while those in New York report high packet loss, the engineer can immediately pinpoint the root cause as a regional ISP or peering issue rather than a failure within the data center itself.

Enterprise Agent (Option B):While these could be used if they were already installed in various branch offices, they require ownership of the infrastructure and deployment time. They are better suited for "inside-out" monitoring.

Endpoint Agent (Option C):These are useful for troubleshooting individual user experience but are not the "quickest" way to baseline global performance against a data center application during a widespread event.

Synthetic Agent (Option A):As noted previously, this is a generic term describing the underlying technology used by all ThousandEyes agent types.

Therefore,Cloud Agentsprovide the necessary breadth and immediate availability to perform rapid root cause analysis for widespread application performance issues.