300-445 Designing and Implementing Enterprise Network Assurance(300-445 ENNA) Questions and Answers

In the context ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), understanding the visibility gap in SD-WAN environments is essential. While SD-WAN controllers provide native visibility into theoverlay network(the logical IPsec tunnels and fabric health), they often lack granular insight into the physical transport orunderlay networkprovided by ISPs or MPLS circuits.

According to the ENNA architecture guidelines, the most suitable method for measuring true SD-WAN performance is to install an agent on theunderlay network(Option D). By deploying ThousandEyes Enterprise Agents directly on the transport-facing interfaces (Transport VPN0 in Cisco SD-WAN terminology), engineers can perform hop-by-hop path visualization and measure metrics like packet loss, latency, and jitter across the actual provider path. This is critical because performance degradation in the overlay is almost always a symptom of an issue in the underlay, such as BGP routing instabilities or physical link congestion at an ISP peering point.

Deploying agents on theoverlay(Option A) only measures the performance of the tunnel itself, which may hide specific hop-level failures occurring in the public internet. Installing an agent on theLAN(Option C) orDMZ(Option B) adds local network noise to the metrics, making it harder to isolate if a problem exists within the corporate office or the service provider network. By focusing on theunderlay, the engineer ensures they have the "internet intelligence" required to hold service providers accountable to SLAs and quickly resolve connectivity issues that impact the SD-WAN fabric.

In wireless network assurance, high channel utilization and increased retransmissions are clear indicators of RF interference or over-subscription. Retransmissions are particularly damaging to voice call quality because they introduce significant jitter and late-arrival packet loss that the jitter buffer cannot overcome.

The recommended optimization is tochange the access point to a different, less congested channel(Option B). This directly reduces the competition for airtime (Channel Utilization) and the likelihood of collisions from neighboring access points (Co-Channel Interference), which in turn lowers the retransmission rate. Modern wireless controllers usingRadio Resource Management (RRM)often automate this, but a manual adjustment based on SNMP telemetry is a valid operational fix.

Other options are technically flawed:

Option A:Increasing transmit power oftenincreasesinterference and channel utilization for surrounding cells, making the problem worse for everyone.

Option C:Disabling all non-voice traffic is an extreme measure that is rarely feasible in a real business environment.

Option D:Admission control limits thenumberof users but doesn't solve the underlying issue of poor channel health for those already connected.

Establishing an accurate baseline is a cornerstone of theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)methodology. A baseline must represent the "typical" behavior of the network across its standard operating cycle to be useful for anomaly detection and capacity planning. When monitoring interface utilization on a critical link, it is vital tocapture both peak and off-peak traffic patterns(Option C).

Most enterprise networks exhibit cyclical traffic patterns, often referred to as "diurnal" cycles, where utilization spikes during business hours (peak) and drops significantly at night or on weekends (off-peak). If an engineer only collects data during the lowest volume period (Option A), the baseline will be unrealistically low, leading to "false positive" alerts when normal business traffic returns. Conversely, only capturing peak data might hide background synchronization tasks or backup windows that occur during off-hours.

By selecting a representative time period—typically one full week or a month—the engineer ensures the baseline accounts for variations such as Monday morning "logon storms," mid-week steady states, and weekend maintenance. This comprehensive view allows the assurance platform (such asCisco Catalyst CenterorThousandEyes) to calculate a standard deviation and establish dynamic thresholds. If utilization deviates from these historically representative norms, the system can trigger an alert based on a true anomaly rather than a predictable daily surge. Aligning with a financial year (Option B) is irrelevant to technical performance, and limiting the data (Option D) compromises the baseline's statistical validity.

For theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)exam, monitoring remote workforces requires a strategy that captures both the user's local environment and the regional internet health. In a scenario involving Cisco AnyConnect VPN, the "last mile" connectivity of the employee is often the most significant variable in application performance.

Utilizing the ThousandEyes Endpoint Agent(Option D) is the most effective way to monitor this environment. Because the agent resides directly on the remote employee's machine, it can monitor the performance of the web application both "inside" and "outside" the VPN tunnel. It provides visibility into the local Wi-Fi signal strength, the health of the AnyConnect client, and the latency experienced as traffic traverses the VPN headend. This allows engineers to differentiate between a slow home internet connection and an issue with the VPN concentrator.

Deploying ThousandEyes Cloud Agents(Option A) serves as a critical baseline. By running tests from Cloud Agents in the same regions as the remote employees, the engineer can determine if the "internet" in that region is healthy. If a Cloud Agent in London shows a perfect response time while an Endpoint Agent in London shows high latency, the engineer can immediately isolate the problem to the user's specific setup or the VPN path, rather than a regional ISP outage.

Other options are less suitable for monitoring theremote employee's experience:

AppDynamics (Option B)provides server-side code visibility but cannot see the user's home Wi-Fi or local network path.

Enterprise Agents on the VPN concentrator (Option C)can monitor the pathfromthe data center to the app, but they cannot see the path from theuserto the concentrator.

Enterprise Agents in the data center (Option E)provide an "inside-out" view of the app's health but miss the entire remote access experience.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)guidelines, troubleshooting widespread performance issues for a public or data center-hosted app17lication requires an "outside-in" perspective. When reports are widespread,18the goal is to determine if the issue is global, regional, or specific to certain ISP paths leading to the data center.

TheCloud Agent(Option D) is the most effective tool for this task because these agents are maintained by Cisco ThousandEyes in over 240+ locations worldwide within Tier 1, 2, and 3 ISPs and cloud provider regions.19Because they arepre-deployed and immediately available, a network engineer can instantly run tests from multiple global locations toward the data center-hosted application without having to install any software or manage any infrastructure. This allows the engineer to quickly compare performance metrics (latency, loss, and page load times) across different geographies. If Cloud Agents in London report no issues while those in New York report high packet loss, the engineer can immediately pinpoint the root cause as a regional ISP or peering issue rather than a failure within the data center itself.

Enterprise Agent (Option B):While these could be used if they were already installed in various branch offices, they require ownership of the infrastructure and deployment time. They are better suited for "inside-out" monitoring.

Endpoint Agent (Option C):These are useful for troubleshooting individual user experience but are not the "quickest" way to baseline global performance against a data center application during a widespread event.

Synthetic Agent (Option A):As noted previously, this is a generic term describing the underlying technology used by all ThousandEyes agent types.

Therefore,Cloud Agentsprovide the necessary breadth and immediate availability to perform rapid root cause analysis for widespread application performance issues.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, the native integration of ThousandEyes within the Meraki portfolio is specifically focused on theMeraki MXsecurity and SD-WAN appliances. This integration allows users to install ThousandEyes Enterprise Agents directly on supported Meraki MX hardware, providing critical visibility into the performance of services that distributed users rely on.4

TheMeraki MX (Option A)supports the ThousandEyes Enterprise Agent as a containerized service that can be activated with a single click within the Meraki Dashboard.5This integration is designed to provide better monitoring and testing capabilities for customers interested in improving the quality of their experience and adding the appropriate SD-WAN policies to optimize network performance. By running the agent natively on the MX, administrators can monitor the performance of external applications and services directly from the SD-WAN sites, bridging the gap between local branch health and global internet performance.6

While Cisco continues to expand its assurance integrations across the portfolio, theMR (Wireless),MS (Switching),MV (Camera), andMG (Cellular)series do not currently support the native, "on-box" execution of the ThousandEyes Enterprise Agent. For these other platforms, visibility is typically achieved through passive monitoring viaMeraki Insight (MI)or by deploying ThousandEyes agents on connected client devices (Endpoint Agents) or nearby infrastructure. Therefore, theMeraki MXis the only verified platform supporting native ThousandEyes agent deployment in this context.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, understanding the visibility gap between the SD-WAN overlay and the transport underlay is a core competency. The provided exhibit illustrates a ThousandEyes Enterprise Agent deployed on aBranch Edge Routerperforming tests across two distinct paths:Internet(reaching a destination at 64.100.249.90) andMPLS(reaching a destination at 172.29.0.2).

According to the ENNA architecture guidelines, ThousandEyes is primarily utilized to provide hop-by-hop visibility into theunderlaynetwork. While SD-WAN controllers like vManage provide native monitoring for the overlay—the logical IPsec tunnels (Option B) that form the SD-WAN fabric—they often lack granular visibility into the physical service provider paths (the underlay) that carry those tunnels. The exhibit specifically highlights the agent probing the transport networks (Transport VPN0) directly, bypassing the overlay tunnels to measure the raw performance of the ISP and MPLS circuits.

By monitoring theunderlay(Option A), the engineer can identify if high latency or packet loss is caused by a specific hop within the service provider's infrastructure or at a peering point. This "underlay visibility" is critical for troubleshooting SD-WAN performance issues where the overlay may report a tunnel down, but the root cause lies in a BGP routing change or physical fiber cut in the provider network. ThousandEyes Enterprise Agents, natively integrated into Catalyst 8000 and ISR 4000 platforms, allow for this persistent underlay monitoring without additional hardware.

Overlay (Option C):While ThousandEyes can monitor overlay performance, the exhibit's focus on the raw IP addresses (Internet and MPLS) in the transport VPN indicates an underlay test.

IPsec/GRE Tunnels (Options B & D):These represent the transport mechanisms of the overlay. ThousandEyes probes the pathunderthese tunnels to ensure the transport health is sufficient to support the fabric.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)data analysis guidelines, identifying the underlying test type is the first step in interpreting a dashboard. By observing the metrics displayed across both the Executive and IT Operations dashboards, we can definitively identify the test type asPage Load(Option B).

A Page Load test is a Web-layer test that uses a browser engine (Chromium) to fully render a page and collect advanced metrics beyond simple availability. Evidence for this test type in the dashboards includes:

Page Completion Time:Displayed on the Executive dashboard map, this metric is specific to how much of the page successfully rendered.

DOM Load Time:Found in the IT Operations dashboard, the Document Object Model (DOM) time is a browser-centric metric that measures when the page structure has finished loading.

Waterfall Charts:While not a specific answer option, these are the foundation of Page Load tests, allowing for the timing of individual web components.

SimpleHTTP Servertests (Option A) only measure availability and response codes, missing the rendering metrics seen here.Agent to server(Option C) is a network-layer test that provides path visualization but no browser-level data.FTP(Option D) is a protocol-specific test not used for web application monitoring. Therefore, the presence of DOM and Page Completion metrics confirms thePage Loadtest type.

Within theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)framework, the transition from "polling" to "streaming" is a major architectural shift. To populate real-time dashboards in external observability platforms likeGrafana,Splunk, orAppDynamics, the architect should utilize theOpenTelemetry (OTel)integration (Option B).

ThousandEyes for OpenTelemetry is a push-based API built on the standardizedOpenTelemetry Protocol (OTLP). Unlike traditional REST API polling (Option A), which retrieves data at fixed intervals and can be subject to rate limiting and latency, the OTel integration allows ThousandEyes to stream granular network metrics as they are collected. These metrics—including latency, loss, jitter, and HTTP response times—are exported in a standardized format that is natively understood by modern observability backends. This allows the platform to populate complex visualizations such as time-series graphs, heatmaps, and multi-metric tables in near real-time, providing a "single pane of glass" view that correlates network performance with application and infrastructure telemetry.

A key advantage of the OTel approach isdata portabilityandcorrelation. By applying metadata tags to ThousandEyes tests, the data can be filtered and categorized within the external dashboard to match the organization's business logic (e.g., grouping by region or application tier). This enables SREs and NetOps teams to quickly identify if a performance dip in an application dashboard correlates with a spike in internet latency measured by ThousandEyes. Options C and D do not provide the streaming data pipeline required for real-time external dashboard population. Thus,OpenTelemetryis the definitive choice for high-fidelity, real-time observability integration.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)architecture, the deployment of ThousandEyes Enterprise Agents on switching infrastructure is designed to be highly flexible, catering to different management styles and network scales. Modern Cisco switches, specifically theCatalyst 9300 and 9400 Series, support the execution of containerized applications directly on the switch's hardware through theCisco IOS XE Application Hostingframework.1

Application Hosting (Option A)refers to the manual method using the Cisco IOS XE Command Line Interface (CLI). An engineer can use app-hosting commands to install, configure, and manage the Docker-based Enterprise Agent.2This provides granular control over resource allocation and networking for the container.Catalyst Center (Option B)provides a GUI-driven, automated workflow to deploy agents at scale across an entire campus fabric.3It simplifies the lifecycle management by handling the installation and activation across multiple switches simultaneously. For switches acting as edge devices in an SD-WAN fabric,Catalyst SD-WAN Manager (Option C)orchestrates the deployment through centralized policies and templates, allowing the agent to be pushed as part of a device configuration. Finally, while theThousandEyes Portal (Option D)is the management plane for tests, it is also where the Docker image and Account Group Token are obtained for any of the aforementioned deployment methods.

Each method provides the same end result: an Enterprise Agent running "on-box" to provide deep visibility into the network path starting directly from the access or core layer. Therefore,All of the above(Option E) is the correct answer as it encompasses the manual, automated, and orchestrated methods available for switch-based deployment as per the 300-445 ENNA official guidelines.

Under theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)guidelines, the integration between ThousandEyes andCisco Secure Client(formerly AnyConnect) is designed to provide visibility into the hybrid workforce experience. The integration primarily leveragesnetwork performance data from the user's device(Option C) to diagnose connectivity and application issues.

This data is collected by theThousandEyes Endpoint Agent, which is deployed as a module within the Cisco Secure Client.10The agent captures real-time telemetry from the user's laptop or workstation, includingWi-Fi signal strength,CPU and memory utilization, andlocal network gateway latency. Specifically, for remote users, it monitors the health of the VPN tunnel and the performance of applications as seen from the end-user's vantage point.

When a user reports a "slow application," this integrated telemetry allows IT teams to determine if the root cause is the user's home Wi-Fi, a saturated VPN concentrator, or an issue within the ISP underlay. The agent performsAutomated Session Testing (AST), which maps the network path as soon as a user joins a critical meeting or accesses a SaaS tool, providing a granular view of every hop between the device and the service destination. Unlike hardware configuration data (Option A) or behavioral analytics (Option B), the focus here is strictly on thenetwork performance metricsthat impact digital experience.

Therefore, the collection of device-centric network performance data is the core function of the Cisco Secure Client and ThousandEyes integration.

TheDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)framework highlights the integration between ThousandEyes and Cisco Meraki as a solution for "cross-domain assurance".5The primary purpose of this integration is tomonitor external applications and services from SD-WAN sites(Option B).

In a distributed Meraki environment, IT teams often struggle with visibility into the "Internet as a WAN," where performance issues may occur outside the local network perimeter. By embeddingThousandEyes Enterprise Agentsnatively withinMeraki MX appliances, organizations can bridge the gap between internal LAN metrics and external service health.6This integration allows for proactive monitoring of SaaS platforms (like Microsoft 365, Salesforce, and Webex) and other public-facing dependencies using synthetic probes. It complements the nativeMeraki Insight (MI), which provides passive monitoring of real user traffic, by adding active path visualization and hop-by-hop analysis across the Internet.

Key advantages of this integration include:

One-Click Activation:Enabling the ThousandEyes agent directly from the Meraki Dashboard without additional hardware.7

Pre-configured Templates:Using built-in test templates for common SaaS applications to accelerate troubleshooting.8

Isolation of Fault Domains:Quickly determining if a user's lag is caused by a local Wi-Fi issue (via Meraki wireless metrics) or an ISP routing problem (via ThousandEyes path data).9

While ThousandEyes does provide visibility for VPN and security, Options A, C, and D are not theprimaryfocus of the specific Meraki-ThousandEyes integration architecture, which is centered on extending application performance assurance to distributed branch locations.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)architecture, monitoring site-to-site connectivity between managed locations requires vantage points at both ends of the connection. In this scenario, the organization needs to measure performance between branch offices (San Francisco and Texas) and a central data center (North Virginia).

The most appropriate combination is usingEnterprise Agentswith theAgent-to-agent test type(Option C). Enterprise Agents are software probes deployed on infrastructure owned or controlled by the organization, such as switches or routers in the branch offices and servers in the data center. Unlike Agent-to-server tests, which only provide one-way metrics and approximate path data, anAgent-to-agent testprovides bi-directional network metrics. This includes detailed throughput, packet loss, latency, and jitter measurements in both directions, which is critical for identifying asymmetric routing or link saturation that might affect application performance.

Alternative options are less suitable for this specific internal monitoring requirement:

Cloud Agents (Options A and B):These are located in global ISP data centers and cannot be placed inside the organization's private data center or branch LAN to measure internal path characteristics.

HTTP/DNS Server tests (Options B, D, and E):These target specific services but do not provide the granular, bi-directional network-layer performance data (like throughput or path visualization) that an Agent-to-agent test delivers.

Agent-to-server (Option E):While useful for reaching a target that cannot host an agent, it loses the benefit of the destination agent's ability to measure the "return" path independently.

By deploying Enterprise Agents at each site and configuring Agent-to-agent tests, the engineer gains the highest level of visibility into the health of the private WAN or SD-WAN fabric connecting the branches to the data center.

The architecture forDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)specifies that ThousandEyes WAN Insights relies on deep integration with the Cisco SD-WAN management stack. To generate its predictive path recommendations, the platform must ingest specific telemetry data that reflects both the network's behavior and the applications traversing it.

The first essential data source ishistorical network performance metrics collected by vAnalytics(Option B). Before WAN Insights can be activated, vAnalytics must be enabled to collect and enrich raw network telemetry from the edge routers.34This data includes granular metrics for every SD-WAN tunnel, such as packet loss, latency, and jitter.35WAN Insights analyzes these historical trends to forecast future path quality and determine which transport circuits are most likely to meet application SLAs over a long-term period.

The second essential data source isapplication traffic flow data(Option D). WAN Insights must understand which applications are currently active in the fabric to prioritize recommendations for "business-critical" services like Office 365, Webex, or custom internal apps.38This information is ingested as flow records from the SD-WAN data plane and categorized based on theApplication Listsdefined inCisco Catalyst SD-WAN Manager (vManage).

Options A and E are configuration or logging data that, while useful for general management, are not the raw telemetry inputs used by the WAN Insights predictive engine. Option C is incorrect because WAN Insights explicitly uses infrastructure telemetry rather than ThousandEyes agent-based synthetic data for its SD-WAN fabric calculations. By combiningvAnalytics performance metricsandapplication flow data, WAN Insights can provide the "Predictive Path Recommendatio41ns" that are a hallmark of modern network assurance.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)framework, managing a large-scale deployment of Endpoint Agents requires efficient categorization throughAgent Labels. Agent labels are used to group agents for targeted test assignment and data filtering based on specific attributes like location, OS, or naming conventions.

ThousandEyes supports the use ofwildcards (specifically the * symbol)within label filters to allow for dynamic and scalable grouping. In this scenario, the organization has adopted a naming convention of agentname-network. To capture all agents connected to the "corporate" network regardless of the unique agentname prefix, the engineer should use the filter*-corporate(Option A) in the hostname or agent name field. The asterisk functions as a placeholder for any string of characters, ensuring that any agent ending with "-corporate" is automatically added to the label as soon as it registers with the ThousandEyes platform.

Other options are incorrect for the following reasons:

agentname-* (Option B):This would only match agents that literally start with the string "agentname-", which is a placeholder and not a representative filter for a group of uniquely named agents.

agent*corporate (Option C):This filter is overly broad and lacks the specific hyphen delimiter used in the organization's naming convention, potentially leading to the inclusion of unintended agents.

No wildcard (Option D):Wildcards are a documented and essential feature of the ThousandEyes label system to facilitate automated management in enterprise environments.

By implementing wildcard-based labels, the network administrator ensures that new agents are seamlessly integrated into the assurance strategy without the need for manual manual intervention.