Cisco 300-445 - Designing and Implementing Enterprise Network Assurance (300-445 ENNA)

According to the Designing and Implementing Enterprise Network Assurance (300-445 ENNA) curriculum, DNS testing is a fundamental component of ensuring application availability and performance. The ThousandEyes platform provides two primary types of DNS tests: DNS Server and DNS Trace .

To satisfy the specific requirements of monitoring IPv6 records and name server resolution times , the engineer must utilize the DNS Server test . This test type is designed to measure the performance of specific DNS servers by querying them for particular resource records.

Monitoring IPv6 Records: In the DNS system, IPv6 address records are known as AAAA records . Therefore, to monitor the availability and resolution of IPv6 addresses for a domain, the engineer must create a DNS Server test and set the query type to AAAA (Option B).

Monitoring Name Server Resolution Times: To measure how long it takes for a DNS server to return the authoritative name servers for a domain, the engineer must query for NS (Name Server) records . By creating a DNS Server test targeting the NS record (Option D), the platform can provide granular metrics on the response time and availability of those specific records from the perspective of the selected agents.

DNS Trace tests (Options C and E) are less suitable for measuring specific resolution times of a single server; instead, they are used to visualize the entire delegation path from the root servers down to the authoritative servers to identify where a " break " in the chain occurs. Furthermore, an A record query (Option A) only provides the IPv4 address, failing the requirement to monitor IPv6. By selecting DNS Server tests for AAAA and NS records, the administrator ensures they have the precise performance data needed to baseline and troubleshoot the organization ' s DNS health.

In the framework of Designing and Implementing En 8 terprise Network Assurance (300-445 ENNA) , selecting the correct agent type depends heavily on the vantage point required for the specific observation. For this scenario, the architect must collect metrics from the internal network access layer —the point closest to where the users or devices reside within the corporate perimeter—towards a cloud-hosted destination.

The Enterprise Agent (Option B) is the most appropriate choice because it is specifically designed to be deployed on infrastructure owned and managed by the organization. These agents are " inside-out " vantage points that can be installed directly on Cisco Catalyst 9300 or 9400 Series switches at the access layer using Docker containers. By deploying an Enterprise Agent at the access layer, the architect gains visibility into the entire network path, starting from the internal LAN, traversing the edge/WAN, and reaching into the cloud-hosted web server. This allows for the identification of issues such as local congestion, ISP peering problems, or cloud provider latency.

Other options do not meet the criteria:

Synthetic Agent (Option A): This is a distractor term. All ThousandEyes agents (Cloud, Enterprise, and Endpoint) are synthetic agents because they all perform active synthetic testing.

Cloud Agent (Option C): These are pre-deployed by Cisco in global ISP data centers and provide an " outside-in " view. 14 While useful for monitoring public-facing availability, they cannot provide visibility into the internal network or the access layer of the organization.

Endpoint Agent (Option D): While these are installed on end-user machines and provide a " user-centric " view, they are generally not used for infrastructure-level path analysis from the access layer switches themselves.

Thus, the Enterprise Agent is the definitive choice for monitoring from the access layer to the cloud.

In the framework of Designing and Implementing Enterprise Network Assurance (300-445 ENNA) , selecting the appropriate agent for specific test types is a critical configuration step. The ThousandEyes platform utilizes different agent binaries and capabilities depending on the underlying hardware and software environment. Specifically, Page Load tests and Transaction tests require the agent to have a browser engine (Chromium) installed and functional to render web content and measure DOM-related metrics.

According to the ENNA implementation guidelines, not all Enterprise Agents support these browser-based tests. The exhibit displays a " New Test " configuration screen where the engineer is searching for " east1-agent-1 " . While other agents like " west-2-ag-1 " are visible, the designated agent is missing because it does not support Page load tests (Option D). This common occurrence happens when an Enterprise Agent is deployed on resource-constrained hardware—such as certain Cisco Catalyst 9000 switches or Cisco ISR 4000 series routers —where the Chromium browser package is either not supported or has not been enabled due to memory and CPU limitations.

When an agent lacks the required capabilities for a specific test layer (e.g., Web layer tests), it is automatically filtered out from the selection list in the ThousandEyes portal to prevent invalid test configurations. To identify compatible agents, an engineer can look for the " Browser " or " Dual Chromium " labels in the agent settings. If the " east1-agent-1 " were merely offline (Option A), disabled (Option B), or still registering (Option C), it would typically still appear in the list but with a status indicator showing its unavailability, rather than being entirely hidden from the test assignment menu. Therefore, the absence of the agent in a web-layer test configuration explicitly indicates a lack of functional support for the required browser-based metrics.

The Designing and Implementing Enterprise Network Assurance (300-445 ENNA) framework emphasizes that the goal of internet intelligence is to enable rapid and accurate escalation to the party responsible for a service degradation. Based on the evidence of a BGP Hijack identified in the previous question, the issue is occurring entirely within the public internet ecosystem.

The most appropriate next step is to reach out to the Internet Service Provider (ISP) to report the suspected BGP hijacking incident (Option B). Since the traffic is being misdirected by an external Autonomous System (AS 10297) before it reaches the intended destination (AS 16509), the fix must occur at the routing policy level of the major transit providers. The network administrator should provide the ISP with the ThousandEyes " Share Link " or screenshots showing the path change and the unauthorized AS announcement, as this data serves as proof to accelerate the ISP ' s mitigation efforts, such as implementing prefix filters or contacting the offending network.

Other options are ineffective for this specific scenario:

Option A: The path visualization shows that traffic is successfully leaving the local network and reaching the public internet; the problem is many hops away from the internal routers.

Option C: Blocking traffic from AS 10297 does not solve the problem of your traffic being attracted to it. The hijack affects how the rest of the world (including your ISP) sees the route to your destination.

Option D: DNS is not the issue; the agent successfully resolved the hostname to the correct IP, but the BGP layer misdirected the packets at the routing level.

By identifying the issue as an external routing event, the administrator avoids wasting internal resources and directly triggers the necessary external remediation.