300-445 Designing and Implementing Enterprise Network Assurance(300-445 ENNA) Questions and Answers

TheDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)certification emphasizes that the primary value proposition of the Cisco "Assurance Stack" is the reduction ofMean Time to Identification (MTTI)andMean Time to Resolution (MTTR). The integration of ThousandEyes across Cisco's portfolio—including Catalyst, Meraki, and SD-WAN—allows for quick identification and resolution of performance issues(Option D).12

By embedding ThousandEyes agents into the existing network infrastructure, Cisco enables "end-to-end visibility" that spans domains the enterprise traditionally does not control, such as the public internet and SaaS environments.13During troubleshooting, this cross-platform visibility allows network engineers to immediately correlate internal network health (from Catalyst Center or Meraki Dashboard) with external path visualization (from ThousandEyes). For example, when a user experiences poor video quality in a Webex meeting, the integration allows the engineer to "cross-launch" from the Webex Control Hub directly into a ThousandEyes path view.14This pinpoint accuracy avoids the "blame game" between network, application, and ISP teams by providing a "single source of truth" regarding where the packet loss or latency is occurring.

While some automation exists (Option C), the core benefit isn't automatic configuration changes based on feedback, but rather providing theactionable insightsrequired for manual or policy-based remediation. Similarly, while it streamlines data gathering, its ultimate purpose is thespeed of resolutionin complex, hybrid environments.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)data analysis guidelines, identifying the underlying test type is the first step in interpreting a dashboard. By observing the metrics displayed across both the Executive and IT Operations dashboards, we can definitively identify the test type asPage Load(Option B).

A Page Load test is a Web-layer test that uses a browser engine (Chromium) to fully render a page and collect advanced metrics beyond simple availability. Evidence for this test type in the dashboards includes:

Page Completion Time:Displayed on the Executive dashboard map, this metric is specific to how much of the page successfully rendered.

DOM Load Time:Found in the IT Operations dashboard, the Document Object Model (DOM) time is a browser-centric metric that measures when the page structure has finished loading.

Waterfall Charts:While not a specific answer option, these are the foundation of Page Load tests, allowing for the timing of individual web components.

SimpleHTTP Servertests (Option A) only measure availability and response codes, missing the rendering metrics seen here.Agent to server(Option C) is a network-layer test that provides path visualization but no browser-level data.FTP(Option D) is a protocol-specific test not used for web application monitoring. Therefore, the presence of DOM and Page Completion metrics confirms thePage Loadtest type.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, capacity planning and optimization are driven by telemetry data such as NetFlow. When NetFlow identifies that delay and jitter—metrics highly impactful to real-time traffic—spike during peak hours, it indicates that high-priority packets are competing for resources with bulk data.

The most appropriate recommendation is totune the existing QoS configuration(Option C). This involves adjusting the Queuing and Scheduling policies on the routers to ensure that voice and video traffic (typically marked with EF and AF41/AF42 DSCP values) is serviced before other traffic classes during periods of congestion. This solution is targeted, cost-effective, and directly addresses the observed jitter issues without the need for massive capital expenditure.

Reviewing other options:

Option A:A complete QoS redesign is often unnecessary and too invasive for solving peak-hour jitter if a basic QoS framework is already in place.

Option B:Increasing bandwidth on "all" links is a "brute force" approach that is expensive and fails to address the underlying problem of traffic prioritization.

Option D:Hardware replacement is a last resort and would not resolve delay/jitter if the new hardware still lacks a properly tuned QoS policy.

In the framework ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), selecting the appropriate ThousandEyes agent type is critical to balancing visibility requirements with infrastructure constraints. For Branch A, the primary objective is to gain network-layer metrics (such as latency, packet loss, and jitter) and path visualization for a SaaS application while strictly avoiding any performance impact on employee endpoints.

TheEnterprise Agent(Option C) is the correct choice because it is designed for "inside-out" monitoring from within the corporate network environment. These agents are lightweight software probes that can be deployed on existing network infrastructure, such asCisco Catalyst 9300/9400 switchesorCatalyst 8000 Edge Platforms, using Docker containers or virtual machines. By hosting the agent on the branch router or a dedicated local server, the engineer can execute synthetic tests to the SaaS provider's destination. This approach provides the necessary network vantage point from Branch A without requiring any software installation or resource consumption on the individual employee workstations (endpoints).

Other agent types do not satisfy the specific constraints of this scenario:

Endpoint Agentsare installed directly on user devices (Windows/macOS) to provide "last-mile" visibility. However, they use the endpoint's CPU and memory, which contradicts the requirement to not affect endpoint performance.

Cloud Agentsare maintained by Cisco in global ISP data centers. While they provide "outside-in" visibility, they cannot capture internal branch network characteristics or the specific path from Branch A's internal local area network.

Application Agentis a non-standard term and does not exist as a standalone agent type within the ThousandEyes architecture.

Therefore, deploying anEnterprise Agentwithin the branch infrastructure ensures that the network engineer obtains high-fidelity network metrics while keeping employee devices entirely unburdened.

Introduction to ThousandEyes

This video provides an essential overview of how ThousandEyes agents function within a CCNP-level enterprise network assurance strategy.

In the framework ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), selecting the appropriate agent for specific test types is a critical configuration step. The ThousandEyes platform utilizes different agent binaries and capabilities depending on the underlying hardware and software environment. Specifically,Page Load testsandTransaction testsrequire the agent to have a browser engine (Chromium) installed and functional to render web content and measure DOM-related metrics.

According to the ENNA implementation guidelines, not all Enterprise Agents support these browser-based tests. The exhibit displays a "New Test" configuration screen where the engineer is searching for "east1-agent-1". While other agents like "west-2-ag-1" are visible, the designated agent is missing because itdoes not support Page load tests(Option D). This common occurrence happens when an Enterprise Agent is deployed on resource-constrained hardware—such as certainCisco Catalyst 9000 switchesorCisco ISR 4000 series routers—where the Chromium browser package is either not supported or has not been enabled due to memory and CPU limitations.

When an agent lacks the required capabilities for a specific test layer (e.g., Web layer tests), it is automatically filtered out from the selection list in the ThousandEyes portal to prevent invalid test configurations. To identify compatible agents, an engineer can look for the "Browser" or "Dual Chromium" labels in the agent settings. If the "east1-agent-1" were merely offline (Option A), disabled (Option B), or still registering (Option C), it would typically still appear in the list but with a status indicator showing its unavailability, rather than being entirely hidden from the test assignment menu. Therefore, the absence of the agent in a web-layer test configuration explicitly indicates a lack of functional support for the required browser-based metrics.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, monitoring the digital experience of internal employees requires leveragingThousandEyes Endpoint Agentsto simulate or record traffic from the user's specific vantage point. When an engineer needs to monitor a specific, potentially internal or non-standard web application, they must utilize theCustom Applicationworkflow within the Endpoint Experience settings.

According to the ENNA implementation standards, the first necessary action is toCreate a new custom application monitor(Option A). In the ThousandEyes portal underEndpoint Experience > Test Settings > Synthetic Tests, the "Monitor Application" button provides access to pre-defined templates for popular services like Microsoft 365 or Webex. However, for a unique enterprise application, the engineer must select "Custom Application" to define the application's identity, including its name and the relevant domain or URL.

The second required action is toAdd a new scheduled test to the monitor(Option C). Endpoint Agents performScheduled Testsat regular, predefined intervals—such as every 5 or 10 minutes—to proactively check the application's availability, response time, and network path health without requiring user interaction. By adding a scheduled HTTP Server or Network test to the custom monitor, the engineer ensures a consistent baseline of the application's performance as seen from the employee's machine.

Reviewing the incorrect options:

Google Suite monitor (Option B):This is a specific template for Google Workspace and is not suitable for a custom application.

Dynamic Tests (Option D):These are specifically designed for collaboration tools like Zoom or Microsoft Teams to capture ad-hoc sessions; they are generally not used for baselining a standard custom web application.

Test Template (Option E):While all monitors are based on templates, "adding a new template" is not a configuration action but rather a result of the monitoring setup.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, the integration between ThousandEyes andWebex Control Hubprovides a streamlined troubleshooting experience for collaboration services. For the VoIP team to access the specific ThousandEyes network telemetry—such as latency, loss, and jitter—they must navigate to theNetwork Path(Option B) section within the Troubleshooting tab of the Control Hub.15

TheNetwork Pathvisualization is a direct result of the ThousandEyes Endpoint Agent data being pulled into the Webex interface.16When a user or RoomOS device experiences poor audio or video quality during a meeting, the Control Hub's troubleshooting view displays a "Network Path" line under the participant's details.17By clicking on this line, the VoIP team can see a hop-by-hop breakdown of the entire route from the collaboration device to the Webex media node. This view highlights specific hops where performance is "Poor" (red), "Fair" (yellow), or "Good" (green) based on predefined thresholds for latency (>400ms) or loss (>5%).

While "Devices" (Option A) is where the agents are activated, and "Users" (Option C) allows for selecting a specific participant, the actualtelemetry metricsand the visualization of the network route are strictly located in theNetwork Pathview. This integration eliminates the need for the VoIP team to leave the Webex environment for initial triage, as they can identify if a problem is local to the branch office or deep within a service provider's network directly from the "Network Path" dashboard.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, monitoring modern APIs often requires handling complex authentication flows, such as OAuth 2.0 with specific client credential parameters. The provided exhibit illustrates theHTTP Authenticationoptions available within a standard HTTP Server test: None, Basic, NTLM, Kerberos, and OAuth.

According to the ENNA implementation standards, while the HTTP Server test type supportsOAuth(Option C), its native implementation is limited. Specifically, it is designed to use a pre-existing token or a simple token refresh flow; it does not support the injection of custom parameters in the initial POST request required to obtain a token in many enterprise client-credential scenarios. Basic and NTLM (Options A and B) are legacy protocols that rely on simple username/password headers and cannot facilitate the multi-step token exchange process described.

To fulfill the requirement of a two-step flow (POST for token, followed by GET for resource), engineers must use more flexible test types:

Transaction scripts (Option D):These allow the engineer to write custom JavaScript using the ThousandEyes transaction library to programmatically handle the POST request, parse the resulting JSON token, and then pass that token into the subsequent GET request's header.

API tests (Option E):These are purpose-built for API monitoring and natively support the definition of variables and multi-step requests where the output of one call (the token) serves as the input for the next.

By utilizing these advanced test types, the engineer can successfully navigate complex authentication requirements that the standard HTTP Server test cannot accommodate.

The architecture forDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)specifies that ThousandEyes WAN Insights relies on deep integration with the Cisco SD-WAN management stack. To generate its predictive path recommendations, the platform must ingest specific telemetry data that reflects both the network's behavior and the applications traversing it.

The first essential data source ishistorical network performance metrics collected by vAnalytics(Option B). Before WAN Insights can be activated, vAnalytics must be enabled to collect and enrich raw network telemetry from the edge routers.34This data includes granular metrics for every SD-WAN tunnel, such as packet loss, latency, and jitter.35WAN Insights analyzes these historical trends to forecast future path quality and determine which transport circuits are most likely to meet application SLAs over a long-term period.

The second essential data source isapplication traffic flow data(Option D). WAN Insights must understand which applications are currently active in the fabric to prioritize recommendations for "business-critical" services like Office 365, Webex, or custom internal apps.38This information is ingested as flow records from the SD-WAN data plane and categorized based on theApplication Listsdefined inCisco Catalyst SD-WAN Manager (vManage).

Options A and E are configuration or logging data that, while useful for general management, are not the raw telemetry inputs used by the WAN Insights predictive engine. Option C is incorrect because WAN Insights explicitly uses infrastructure telemetry rather than ThousandEyes agent-based synthetic data for its SD-WAN fabric calculations. By combiningvAnalytics performance metricsandapplication flow data, WAN Insights can provide the "Predictive Path Recommendatio41ns" that are a hallmark of modern network assurance.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)architecture, secure administrative access via Single Sign-On (SSO) is a critical component of platform governance. The exhibit illustrates the ThousandEyes SSO configuration panel being integrated withMicrosoft Entra ID(formerly Azure AD). When configuring SAML-based authentication, the "Identity Provider Issuer" (Option D) is a unique identifier provided by the IdP (Microsoft) that must match exactly between the two systems.

According to ENNA implementation guidelines, ThousandEyes populates default fields based on standard SAML metadata. However, Microsoft Entra ID often utilizes a specific GUID-based format for the Issuer URL (e.g., https://sts.windows.net/tenant-id/) that may differ from the generic URL format expected by the platform's initial auto-fill. To ensure a successful SAML handshake, the engineer must select the "Override"checkbox next to theIdentity Provider Issuerfield. This action unlocks the field, allowing the engineer to manually paste the exact string provided in the Entra ID Federation Metadata document. If this value is not overridden and matched precisely, the SAML assertion will be rejected, resulting in a failed authentication attempt.

While the Login and Logout URLs (Options B and C) are also critical, they are typically correctly identified during the initial setup or metadata import; theIdentity Provider Issueris the most frequent point of mismatch requiring an manual override in Entra ID environments due to its strict "Audience Restriction" requirements. TheService Provider Issuer(Option A) is generally a fixed value (https://app.thousandeyes.com) that rarely requires overriding as it defines ThousandEyes' own identity to the IdP.

Therefore, selecting the override for theIdentity Provider Issueris the necessary step to complete the integration and allow enterprise users to authenticate securely using their corporate credentials.

InDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), dashboard widgets must be mapped to the correct telemetry data source and statistical measure. When an agent is installed as aLinux packageon an organization's infrastructure, it is classified as anEnterprise Agent.

The correct configuration for this widget isCloud & Enterprise Agents and Mean(Option B).

Data Source:Since the Linux-based agent is an Enterprise Agent, it shares the same data source category as Cloud Agents in the ThousandEyes dashboard configuration menu.

Measure:To display the "average" packet loss as requested, theMean(the arithmetic average) is the appropriate statistical measure.

Other options are unsuitable:

Option A:Endpoint Agentsare those installed on Windows/macOS user devices, not typically a standard Linux server package used for infrastructure monitoring.Medianwould show the middle value, not the average.

Option C:Routingrefers to BGP data, which does not report packet loss in the same way as synthetic network tests.

Option D:Devicesrefers to hardware monitored via SNMP, and annth Percentileis a specific statistical cutoff (like 95th percentile) rather than a simple average.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)best practices for collaboration monitoring,Microsoft Teams(as well as Webex and Zoom) is monitored using a combination ofScheduled and Dynamic tests(Option D).

Scheduled Tests:These are used to proactively monitor the reachability and performance of the Microsoft Teams infrastructure. The Teams template typically includes scheduled HTTP Server tests to teams.microsoft.com and login.microsoftonline.com, along with network-layer tests to theTeams Transport Relay(e.g., worldaz.tr.teams.microsoft.com). These provide a continuous baseline of connectivity regardless of whether a user is currently in a call.

Dynamic Tests:These are a unique feature for collaboration monitoring. When an Endpoint Agent detects that the Teams application has initiated a real-time media session (audio or video call), it automatically triggers aDynamic Testto the specific IP and port being used for that call. This allows IT teams to see the exact network path—including hop-by-hop latency and loss—of the actual call traffic while the session is active.

Real User Tests (Option C)are generally not used for Teams monitoring in the same way they are for web-based SaaS apps. Because most users utilize the Teamsdesktop clientrather than the browser, the RUM browser extension cannot capture the rich telemetry of the desktop application's internal signaling and media streams. Therefore, the specialized "Automated Session Testing" provided byDynamic Tests, combined with the proactive health checks ofScheduled Tests, constitutes the complete assurance strategy for Microsoft Teams.

As shown inExhibit 4.1-1(image_6e19fb.png), the alert rule is configured for the BGP layer with the name "AS origin AS 1234". The critical logic is defined in theAlert Conditionssection, which specifies: BGP Origin meets all of: ASN not in 1234.

This specific configuration is the standard method used in ThousandEyes to detectBGP hijacking(Option C). BGP hijacking occurs when an unauthorized Autonomous System (AS) announces a network prefix that it does not own, effectively stealing the traffic meant for the legitimate owner. By setting an alert that triggers when a monitored prefix is seen originating from an Autonomous System Number (ASN) that isnotthe expected authorized ASN (in this case, AS 1234), ThousandEyes provides immediate notification of a routing takeover.

Identifying this via BGP Origin alerts is superior to simple connectivity checks because it catches the issue at the routing control plane.

DNS Issues (Options B and D):These involve the translation of names to IPs and would be detected via DNS-specific tests rather than BGP Origin checks.

Route Poisoning (Option A):This is a generic term often referring to the manipulation of distance-vector protocol metrics to make a route unreachable; while related to routing, BGP Origin checks are the specific tool for detecting external prefix hijacks.

By monitoring the ASN origin, network engineers can quickly distinguish between a local ISP outage and a global security event where their traffic is being misdirected to an illegitimate network.

In the context ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), analyzing page-load metrics within Cisco ThousandEyes requires identifying the primary bottlenecks that contribute to theTotal Page Load Time. The provided screenshot displays a "Page Breakdown" of 7 resources totaling 953 kB. A critical observation of the pie chart reveals thatImages(the teal-colored segment) constitute the vast majority of the page's payload and resource count.

When the goal is to reduce the page-load time from1023 msto below500 ms, the engineer must target the heaviest components.Lazy loadingis a design pattern that defers the initialization of non-critical resources at page load time. Instead of loading all images simultaneously when the userfirst navigates to the URL, lazy loading ensures that images are only downloaded as they are about to enter the viewport. This significantly reduces the initial DOM load time and the total Page Load Time because the browser does not have to wait for large image files to be fully retrieved before declaring the page "loaded."

Alternative options are less effective in this specific scenario based on the data:

AJAX (XHR/Fetch):The chart shows that XHR and Fetch resources represent a negligible sliver of the total weight; optimizing them would yield minimal gains.

Moving IMG elements:While moving scripts to the bottom can help with rendering, moving image elements to the bottom of the body does not stop the browser from initiating the download requests immediately, thus failing to significantly reduce the total load time.

CDN for Fonts:The "Font" category is also a small fraction of the total 953 kB. While a CDN is a best practice for latency, it does not address the primary "weight" issue caused by the images.

Therefore, implementinglazy loading(Option C) is the most impactful recommendation. It directly addresses the largest resource consumer (Images) identified in the ThousandEyes Page Breakdown, allowing the engineer to reach the sub-500 ms performance target.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, understanding the distinction between different monitoring methodologies is fundamental to architecting an effective assurance strategy. When an engineer deploys aThousandEyes Enterprise Agenton a Meraki MX appliance, they are implementingactive monitoring.

Active monitoring, as defined in standard network assurance frameworks like RFC 7799, involves the generation of synthetic traffic or "probes" that are sent across the network to a specific destination. These probes, which can utilize protocols such as ICMP, TCP, or HTTP/S, simulate real user transactions to measure performance metrics including latency, packet loss, jitter, and path visualization. The Enterprise Agent acts as a dedicated vantage point, executing these tests at scheduled intervals to provide a proactive baseline of network and application health. This allows the engineer to identify performance degradation or outages even when no real users are actively using the application, ensuring that issues are detected before they impact the business.

It is important to contrast this withpassive monitoring(Option B). In the Meraki ecosystem,Meraki Insight (MI)natively performs passive monitoring by observing and analyzing actual user traffic flows (HTTP/S data) as they traverse the MX appliance without injecting additional traffic. While passive monitoring is excellent for understanding real-world user experience and server response times, it relies on existing traffic and cannot provide hop-by-hop path visualization across the Internet in the same way active synthetic probing does.

By integrating the ThousandEyes Enterprise Agent—which runs as a containerized service within the MX architecture—the engineer gains the benefits of active monitoring directly from the branch edge. This eliminates the need for separate hardware and provides deep, "outside-in" and "inside-out" visibility into SaaS application performance. Therefore, the deployment of a ThousandEyes agent explicitly enablesactive monitoring(Option A) to supplement the native passive capabilities of the Meraki platform.

Detailed Explanation:

This analysis requires extracting two specific browser-rendering metrics from the IT Operations Dashboard. By placing the cursor over the latest metrics data points:

Page Load time:1479.6 ms.

DOM load time: 1354.3 ms.

By subtracting the DOM time from the Page Load time ($1479.6\text{ ms} - 1354.3\text{ ms} = 125.3\text{ ms}$), the engineer identifies the duration spent rendering the page after the initial document structure was established.