Free 300-445 Practice Test Questions and Answers (2026)

The Enterprise Agent is the most appropriate choice for this task. Enterprise Agents are deployed within an organization's internal network, such as in data centers, branch offices, or at the access layer. They provide a fixed, server-side vantage point to monitor network paths and application performance from inside the corporate perimeter to external services like a cloud-hosted web server. This directly addresses the architect's need to analyze metrics originating from the internal network.

A. "Synthetic Agent" is a descriptive term for the function (synthetic monitoring), not an official ThousandEyes agent type.

C. Cloud Agents are located in the global internet backbone and are used for monitoring from the outside-in, not from a specific internal network location.

D. Endpoint Agents are installed on user devices to measure individual user experience, not for stable, infrastructure-based path analysis from the access layer.

1. Cisco ThousandEyes Documentation, "About Agents". The documentation states, "Enterprise Agents: Deployed within your own network, such as in data centers or branch offices. They provide visibility from within your internal network..."

2. Cisco ThousandEyes Documentation, "When to Use Enterprise Agents". This guide specifies using Enterprise Agents "to measure performance from your locations to external services," which aligns perfectly with the scenario.

Cisco ThousandEyes Page Load and Transaction tests utilize an integrated Chromium-based browser engine to render web pages and measure Document Object Model (DOM) performance. Consequently, they require specific hardware and software capabilities. When an Enterprise Agent is deployed on a resource-constrained platform—such as certain Cisco Catalyst 9000 series switches or ISR 4000 series routers—the Chromium package is either unsupported or left disabled due to CPU and memory limitations. In the test configuration panel, any agent that lacks the required technical capability for the active test layers (in this case, the Web/Browser layer) will have its selection checkbox greyed out to prevent invalid test configurations.

A: If the agent were merely not running (offline), it would show an offline status indicator (such as a red dot) but its selection wouldn't be blocked solely based on test capability.

B: While disabled agents appear grey in the global inventory list, specific capability filtering for new tests is determined by the underlying features (like Browser/Chromium support), not the general enabled state.

C: Agents that are still registering or unverified do not appear as selectable options with specific capability icons in the active test configuration menu.

Cisco ThousandEyes Official Documentation: Page Load Tests Overview & Working with Agent Settings, highlighting Browser Synthetics requirements and platform constraints.

Cisco Exam Blueprints: 300-445 ENNA (Designing and Implementing Enterprise Network Assurance), Section regarding ThousandEyes agent deployment capabilities and test constraints.

The integration between Cisco vManage and ThousandEyes allows for the deployment of ThousandEyes agents directly onto compatible Cisco SD-WAN edge devices (e.g., Catalyst 8000 series, ISRs). The type of agent deployed in this manner is the Enterprise Agent. These agents are installed within an organization's own network infrastructure, providing an internal vantage point for monitoring network performance and application experience. This enables running tests from the SD-WAN branch location to any internal or external destination, giving visibility into the entire service delivery path.

A. Cloud Agents are hosted and managed by Cisco ThousandEyes in data centers globally and are not installed on customer premises equipment.

B. A Browser Agent is not a distinct agent type; browser-based monitoring is a capability of Endpoint Agents or a test type run from Enterprise/Cloud Agents.

D. Endpoint Agents are installed on end-user devices like laptops and desktops to measure performance from the user's perspective, not on network infrastructure devices.

1. Cisco, "Cisco SD-WAN and ThousandEyes Integration Deployment Guide," Document ID: 119865, Updated: August 2023. In the "Deploy the ThousandEyes Enterprise Agent on a Cisco SD-WAN Device" section, it explicitly states, "You can deploy the ThousandEyes Enterprise Agent on a Cisco SD-WAN device that is managed by Cisco vManage."

2. ThousandEyes Documentation, "Enterprise Agents." The documentation defines Enterprise Agents as software that can be deployed on-premises, including "on supported network hardware such as routers and switches," which aligns with the SD-WAN integration.

In network monitoring platforms like Cisco ThousandEyes, alerts are configured to trigger when a specific metric crosses a predefined threshold. "Network packet loss" is a fundamental network-layer metric indicating that data packets are failing to reach their destination. It is a primary and direct indicator of network path degradation or failure, making it a common reason for an alert trigger on an IT operations dashboard focused on network health.

A. Page Load Packet Loss: This is not a standard ThousandEyes metric. Packet loss is a network-layer measurement, not typically scoped exclusively to a page load transaction.

B. Network jitter: While jitter is a valid metric that can trigger alerts, significant packet loss is often considered a more severe and actionable network issue.

D. Page Load Latency: This is a web-layer metric related to application performance. An alert for network packet loss would be distinct from an alert for page load latency.

1. Cisco ThousandEyes Documentation, "Alerts". This document outlines the types of metrics that can be used to trigger alerts, including network-layer metrics like packet loss. (Refer to the section on "Alert Conditions").

2. Cisco ThousandEyes Documentation, "Network Test Metrics". This page defines packet loss as a core metric measured in network tests, forming the basis for alert rules.

To effectively monitor a web application for remote VPN users, a multi-faceted approach is required. The ThousandEyes Endpoint Agent (D) is ideal because it is installed directly on the employees' machines. It captures the true user experience, providing visibility into the local wireless network, the VPN tunnel performance, and the entire network path to the application. Complementing this, deploying ThousandEyes Cloud Agents (A) in the same geographic regions as the users helps to identify broader internet or ISP-related issues that could affect connectivity before traffic even reaches the corporate VPN concentrator. This combination provides both micro (individual user) and macro (regional) visibility.

B. AppDynamics provides server-side application code visibility, which is different from the network path and user experience monitoring requested in the scenario.

C. An agent on the VPN concentrator would miss the critical "first-mile" segment of the path from the remote employee's location to the VPN gateway.

E. Agents in the data center only test paths originating from the data center, failing to capture the perspective and unique network path of a remote VPN user.

1. Cisco ThousandEyes Documentation, "About Endpoint Agents." This document states, "Endpoint Agents provide visibility into the end-user experience of web applications, as well as underlying network performance... from the user's laptop or desktop."

2. Cisco ThousandEyes Documentation, "Working with Cloud and Enterprise Agents." This resource explains that Cloud Agents are "globally distributed vantage points" used to "measure performance from locations that simulate where your customers are."

3. Cisco Live Presentation, BRKENT-2011, "ThousandEyes for the Enterprise Network," 2022. The session covers use cases for Endpoint Agents for monitoring remote worker experience and Cloud Agents for monitoring internet-facing applications.

Catalyst Center (formerly DNA Center) is Cisco's primary network command center, utilizing AI for automated enterprise network operations. AppDynamics is an Application Performance Management (APM) solution specifically designed to monitor application performance and correlate those insights directly with real-time business metrics. ThousandEyes provides Digital Experience Monitoring, delivering end-to-end visibility across the internet and enterprise networks from any user to any hosted application. Cisco Meraki is engineered as a cloud-native platform for the centralized management of distributed networks, handling routing, switching, wireless, and integrated IoT technologies like smart cameras.

This is a drag-and-drop question, so individual options are not "incorrect" in the same way as multiple-choice. Any other combination would be incorrect because it would misalign the platform's core purpose with the business case. For example, using DNA Assurance to monitor SaaS performance would fail as it lacks visibility into the internet path, which is ThousandEyes' strength.

Cisco Systems, Inc. "Cisco Catalyst Center Data Sheet." Section: Product Overview. Details the platform's role as an AI-driven, cloud or on-premises management system for connecting, securing, and automating network operations.

Cisco Systems, Inc. "AppDynamics Application Performance Monitoring (APM)." Section: Business iQ Overview. Corroborates the platform's capability to alert and analyze real-time business impacts from application performance to pinpoint root causes.

Cisco Systems, Inc. "ThousandEyes Platform Overview." Section: Digital Experience Monitoring. Confirms the platform's architectural goal of providing end-to-end visibility from users to applications across any underlying network infrastructure.

Cisco Systems, Inc. "Cisco Meraki Cloud Managed IT." Section: Architecture and IoT Solutions. Validates Meraki as a cloud-based dashboard dedicated to managing distributed enterprise networks and IoT endpoints with unified visibility.

When modifying the configuration of an application deployed via Cisco's app-hosting framework, such as adding proxy settings, the application must be taken through a specific lifecycle sequence to apply the changes. A simple restart is insufficient. The correct procedure is to first stop the running container, then deactivate it to remove the old configuration profile. Afterward, the application is activated again with the new settings (including the proxy), and finally, it is started. This ensures the container launches with the updated environment variables and network settings.

A. A simple stop and start will restart the container with its previously activated configuration, ignoring the new proxy settings.

B. Reinstalling the agent is unnecessary and overly disruptive for a configuration change. The installed package does not need to be replaced.

D. The app-hosting environment does not automatically inject configuration changes into a running container; a defined lifecycle process must be followed.

1. Cisco, "ThousandEyes Enterprise Agent Deployment Using Application Hosting on Catalyst 9300/9400 Switches," Configuration Guide. The guide specifies the procedure for configuration changes: "To modify the configuration, you must first stop and deactivate the application. Then, you can activate and start the application with the new configuration." (Reference: Document ID: C11-744223-00, Section: "Modify the Configuration").

2. Cisco, "Application Hosting on Catalyst 9000 Series Switches," White Paper, 07-Apr-2022. This paper describes the application lifecycle management commands, clarifying the distinct roles of activate/deactivate for configuration and start/stop for execution. (Reference: Section: "Application Lifecycle Management").

The exhibit displays a Cisco ThousandEyes Enterprise Agent hosted on a Branch Edge Router via a Virtual Port Group interface. The monitoring paths originate from this agent, traverse the Service VPN, and route through the Transport VPN (VPN 0) out toward the DC Edge Router.

Crucially, the destination endpoints of these test paths are the physical transport interface IP addresses of the DC Edge Router: 64.100.249.90 via the Internet cloud and 172.29.0.2 via the MPLS cloud. Because the network tests target the raw transport routing infrastructure and physical interfaces directly rather than encapsulating traffic inside the secure software-defined overlay fabric, this deployment explicitly monitors the network underlay performance.

B. IPsec tunnels The probes target the external, raw transport IP addresses directly rather than establishing or verifying paths traversing the encrypted IPsec tunnel endpoints of the SD-WAN fabric.

C. overlay Overlay monitoring requires the agent to send traffic through the established SD-WAN secure fabric (using OMP and TLOC bindings) to service-side destinations, whereas this test targets the transport network directly.

D. GRE tunnels Cisco Catalyst SD-WAN relies primarily on IPsec for fabric encapsulation, and the exhibit shows paths directed at physical underlay interface IPs rather than any GRE tunnel interfaces.

Cisco Catalyst SD-WAN Documentation: Cisco Catalyst SD-WAN Cloud OnRamp Configuration Guide – Section: "ThousandEyes Integration with Cisco Catalyst SD-WAN Edge Routers", detailing underlay vs. overlay path monitoring via Enterprise Agents.

ThousandEyes Official Documentation: ThousandEyes Support Enterprise Agent Deployment Guide for Cisco IOS XE Devices, which outlines path visualization targeting underlay transport IPs (VPN 0) to isolate circuit provider issues.

The waterfall and header exhibits show an HTTP request to https://httpbin.org/basic-auth/user/pass returning a 401 Unauthorized response code. The response headers explicitly include www-authenticate: Basic realm="Fake Realm", which indicates that the server requires HTTP Basic Authentication. A 401 status code signifies that the client request has not been completed because it lacks valid authentication credentials for the requested resource. To successfully access this endpoint and resolve the error, the client must provide a valid Authorization header containing the correct credentials. Therefore, modifying the authentication credentials is the direct and appropriate solution.

A. Modify the firewall rules to allow connections to the target domain A 401 response code confirms that the network connection was successfully established with the destination server; therefore, firewall rules are not blocking the traffic.

C. Change the HTTP request method to PATCH The endpoint /basic-auth/user/pass is a standard test endpoint for HTTP Basic Authentication designed for GET requests; changing the method to PATCH will not address the credential deficiency.

D. Modify the target URL to an available API endpoint The target URL is a valid, existing endpoint specifically designed to test basic authentication; the error is caused by missing credentials, not an invalid endpoint URL.

RFC 9110: HTTP Semantics (Section 15.5.2: 401 Unauthorized): Explicitly defines that a 401 status code indicates the request has not been applied because it lacks valid authentication credentials for the target resource.

RFC 9110: HTTP Semantics (Section 11.6.1: WWW-Authenticate): Outlines that a 401 response MUST contain a WWW-Authenticate header field containing at least one challenge applicable to the target resource.

MDN Web Docs (HTTP Authentication): Details how the 401 Unauthorized status and WWW-Authenticate response header are used to request valid authentication credentials from a client.

Executive and IT Operations dashboards are designed to provide insights into end-user experience and overall service health. Metrics such as page availability, response time, and completion time are critical for this purpose. These are precisely the metrics gathered by a "Page Load" test. This test type uses a real browser (Chromium) to load a webpage, executing JavaScript and rendering all elements, thereby simulating the complete user journey and capturing performance from the end-user's perspective. This makes it the ideal data source for such high-level dashboards.

A. HTTP server: This test checks server availability and response time for a single object but does not render the page or measure the full user experience with all its components.

C. Agent to server: This is a network-layer test that measures metrics like latency, jitter, and packet loss. It does not measure application-layer performance like how long a page takes to load.

D. FTP: This test is specific to the File Transfer Protocol and is irrelevant for monitoring the performance of a web application presented on a dashboard.

1. Cisco ThousandEyes Documentation, "Test Types". The "Page Load Tests" section describes them as measuring "the performance of loading a web page in a browser." It also notes the capture of metrics like "Page Load time" and "DOM Load time."

2. Cisco ThousandEyes Documentation, "Dashboards". This section shows example widgets and dashboards that heavily feature metrics derived from Page Load and Transaction tests to represent user experience.

3. Cisco Live Presentation, BRKOPS-2011, "Mastering Digital Experience Monitoring with ThousandEyes," 2023. This presentation showcases building dashboards for different stakeholders (Executive, IT Ops) using user-centric metrics from Page Load tests.