300-445 Cisco Designing and Implementing Enterprise Network Assurance(300-445 ENNA) Free Practice Exam Questions (2026 Updated)

Establishing an accurate baseline is a cornerstone of theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)methodology. A baseline must represent the "typical" behavior of the network across its standard operating cycle to be useful for anomaly detection and capacity planning. When monitoring interface utilization on a critical link, it is vital tocapture both peak and off-peak traffic patterns(Option C).

Most enterprise networks exhibit cyclical traffic patterns, often referred to as "diurnal" cycles, where utilization spikes during business hours (peak) and drops significantly at night or on weekends (off-peak). If an engineer only collects data during the lowest volume period (Option A), the baseline will be unrealistically low, leading to "false positive" alerts when normal business traffic returns. Conversely, only capturing peak data might hide background synchronization tasks or backup windows that occur during off-hours.

By selecting a representative time period—typically one full week or a month—the engineer ensures the baseline accounts for variations such as Monday morning "logon storms," mid-week steady states, and weekend maintenance. This comprehensive view allows the assurance platform (such asCisco Catalyst CenterorThousandEyes) to calculate a standard deviation and establish dynamic thresholds. If utilization deviates from these historically representative norms, the system can trigger an alert based on a true anomaly rather than a predictable daily surge. Aligning with a financial year (Option B) is irrelevant to technical performance, and limiting the data (Option D) compromises the baseline's statistical validity.

In the context ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), understanding the visibility gap in SD-WAN environments is essential. While SD-WAN controllers provide native visibility into theoverlay network(the logical IPsec tunnels and fabric health), they often lack granular insight into the physical transport orunderlay networkprovided by ISPs or MPLS circuits.

According to the ENNA architecture guidelines, the most suitable method for measuring true SD-WAN performance is to install an agent on theunderlay network(Option D). By deploying ThousandEyes Enterprise Agents directly on the transport-facing interfaces (Transport VPN0 in Cisco SD-WAN terminology), engineers can perform hop-by-hop path visualization and measure metrics like packet loss, latency, and jitter across the actual provider path. This is critical because performance degradation in the overlay is almost always a symptom of an issue in the underlay, such as BGP routing instabilities or physical link congestion at an ISP peering point.

Deploying agents on theoverlay(Option A) only measures the performance of the tunnel itself, which may hide specific hop-level failures occurring in the public internet. Installing an agent on theLAN(Option C) orDMZ(Option B) adds local network noise to the metrics, making it harder to isolate if a problem exists within the corporate office or the service provider network. By focusing on theunderlay, the engineer ensures they have the "internet intelligence" required to hold service providers accountable to SLAs and quickly resolve connectivity issues that impact the SD-WAN fabric.

The architecture forDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)specifies that ThousandEyes WAN Insights relies on deep integration with the Cisco SD-WAN management stack. To generate its predictive path recommendations, the platform must ingest specific telemetry data that reflects both the network's behavior and the applications traversing it.

The first essential data source ishistorical network performance metrics collected by vAnalytics(Option B). Before WAN Insights can be activated, vAnalytics must be enabled to collect and enrich raw network telemetry from the edge routers.34This data includes granular metrics for every SD-WAN tunnel, such as packet loss, latency, and jitter.35WAN Insights analyzes these historical trends to forecast future path quality and determine which transport circuits are most likely to meet application SLAs over a long-term period.

The second essential data source isapplication traffic flow data(Option D). WAN Insights must understand which applications are currently active in the fabric to prioritize recommendations for "business-critical" services like Office 365, Webex, or custom internal apps.38This information is ingested as flow records from the SD-WAN data plane and categorized based on theApplication Listsdefined inCisco Catalyst SD-WAN Manager (vManage).

Options A and E are configuration or logging data that, while useful for general management, are not the raw telemetry inputs used by the WAN Insights predictive engine. Option C is incorrect because WAN Insights explicitly uses infrastructure telemetry rather than ThousandEyes agent-based synthetic data for its SD-WAN fabric calculations. By combiningvAnalytics performance metricsandapplication flow data, WAN Insights can provide the "Predictive Path Recommendatio41ns" that are a hallmark of modern network assurance.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)framework, a common architectural hurdle is monitoring applications protected by Multi-Factor Authentication (MFA). ThousandEyes transaction tests utilize automated browser sessions to simulate user behavior, but they face inherent limitations when interacting with "out-of-band" security mechanisms.

Specifically, ThousandEyes agents cannot natively interact with external hardware tokens, biometric prompts, or mobile-app-based OTP generators (Option A). Since an OTP is dynamic and time-sensitive, manually entering it into a static test configuration (Option B) is impossible for an automated, recurring test. While some complex workhooks (Option C) might theoretically interface with a virtual MFA service, this introduces significant security risks and architectural complexity that is generally discouraged in a standard assurance design.

The verified and most practical approach is toexclude the MFA step from the transaction test and focus only on the SAML login(Option D). For monitoring purposes, IT teams often create a "synthetic user" account within the Identity Provider (IdP) that is specifically exempted from MFA policies when originating from known ThousandEyes Enterprise Agent IP addresses. This allows the transaction script to validate the availability and performance of the SAML-based SSO redirect, the credential challenge, and the final application landing page. This strategy ensures that the network and application health can be baselined without the test being blocked by a security gate it was never intended to pass.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)guidelines, troubleshooting widespread performance issues for a public or data center-hosted app17lication requires an "outside-in" perspective. When reports are widespread,18the goal is to determine if the issue is global, regional, or specific to certain ISP paths leading to the data center.

TheCloud Agent(Option D) is the most effective tool for this task because these agents are maintained by Cisco ThousandEyes in over 240+ locations worldwide within Tier 1, 2, and 3 ISPs and cloud provider regions.19Because they arepre-deployed and immediately available, a network engineer can instantly run tests from multiple global locations toward the data center-hosted application without having to install any software or manage any infrastructure. This allows the engineer to quickly compare performance metrics (latency, loss, and page load times) across different geographies. If Cloud Agents in London report no issues while those in New York report high packet loss, the engineer can immediately pinpoint the root cause as a regional ISP or peering issue rather than a failure within the data center itself.

Enterprise Agent (Option B):While these could be used if they were already installed in various branch offices, they require ownership of the infrastructure and deployment time. They are better suited for "inside-out" monitoring.

Endpoint Agent (Option C):These are useful for troubleshooting individual user experience but are not the "quickest" way to baseline global performance against a data center application during a widespread event.

Synthetic Agent (Option A):As noted previously, this is a generic term describing the underlying technology used by all ThousandEyes agent types.

Therefore,Cloud Agentsprovide the necessary breadth and immediate availability to perform rapid root cause analysis for widespread application performance issues.

Detailed Explanation:

In the IT Operations Dashboard, performance metrics are displayed per agent to facilitate granular troubleshooting. By reviewing the latest metrics table, the Mexico City Mexico (TelMex) agent displays a Connect time of 0.51 ms, which is significantly lower (and therefore "better") than the corresponding time for the San Jose CA agent. Connect time measures the duration for the TCP three-way handshake; a lower value indicates faster network-layer establishment.

In wireless network assurance, high channel utilization and increased retransmissions are clear indicators of RF interference or over-subscription. Retransmissions are particularly damaging to voice call quality because they introduce significant jitter and late-arrival packet loss that the jitter buffer cannot overcome.

The recommended optimization is tochange the access point to a different, less congested channel(Option B). This directly reduces the competition for airtime (Channel Utilization) and the likelihood of collisions from neighboring access points (Co-Channel Interference), which in turn lowers the retransmission rate. Modern wireless controllers usingRadio Resource Management (RRM)often automate this, but a manual adjustment based on SNMP telemetry is a valid operational fix.

Other options are technically flawed:

Option A:Increasing transmit power oftenincreasesinterference and channel utilization for surrounding cells, making the problem worse for everyone.

Option C:Disabling all non-voice traffic is an extreme measure that is rarely feasible in a real business environment.

Option D:Admission control limits thenumberof users but doesn't solve the underlying issue of poor channel health for those already connected.

TheDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)framework highlights the integration between ThousandEyes and Cisco Meraki as a solution for "cross-domain assurance".5The primary purpose of this integration is tomonitor external applications and services from SD-WAN sites(Option B).

In a distributed Meraki environment, IT teams often struggle with visibility into the "Internet as a WAN," where performance issues may occur outside the local network perimeter. By embeddingThousandEyes Enterprise Agentsnatively withinMeraki MX appliances, organizations can bridge the gap between internal LAN metrics and external service health.6This integration allows for proactive monitoring of SaaS platforms (like Microsoft 365, Salesforce, and Webex) and other public-facing dependencies using synthetic probes. It complements the nativeMeraki Insight (MI), which provides passive monitoring of real user traffic, by adding active path visualization and hop-by-hop analysis across the Internet.

Key advantages of this integration include:

One-Click Activation:Enabling the ThousandEyes agent directly from the Meraki Dashboard without additional hardware.7

Pre-configured Templates:Using built-in test templates for common SaaS applications to accelerate troubleshooting.8

Isolation of Fault Domains:Quickly determining if a user's lag is caused by a local Wi-Fi issue (via Meraki wireless metrics) or an ISP routing problem (via ThousandEyes path data).9

While ThousandEyes does provide visibility for VPN and security, Options A, C, and D are not theprimaryfocus of the specific Meraki-ThousandEyes integration architecture, which is centered on extending application performance assurance to distributed branch locations.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, monitoring modern APIs often requires handling complex authentication flows, such as OAuth 2.0 with specific client credential parameters. The provided exhibit illustrates theHTTP Authenticationoptions available within a standard HTTP Server test: None, Basic, NTLM, Kerberos, and OAuth.

According to the ENNA implementation standards, while the HTTP Server test type supportsOAuth(Option C), its native implementation is limited. Specifically, it is designed to use a pre-existing token or a simple token refresh flow; it does not support the injection of custom parameters in the initial POST request required to obtain a token in many enterprise client-credential scenarios. Basic and NTLM (Options A and B) are legacy protocols that rely on simple username/password headers and cannot facilitate the multi-step token exchange process described.

To fulfill the requirement of a two-step flow (POST for token, followed by GET for resource), engineers must use more flexible test types:

Transaction scripts (Option D):These allow the engineer to write custom JavaScript using the ThousandEyes transaction library to programmatically handle the POST request, parse the resulting JSON token, and then pass that token into the subsequent GET request's header.

API tests (Option E):These are purpose-built for API monitoring and natively support the definition of variables and multi-step requests where the output of one call (the token) serves as the input for the next.

By utilizing these advanced test types, the engineer can successfully navigate complex authentication requirements that the standard HTTP Server test cannot accommodate.

Under theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)guidelines, the integration between ThousandEyes andCisco Secure Client(formerly AnyConnect) is designed to provide visibility into the hybrid workforce experience. The integration primarily leveragesnetwork performance data from the user's device(Option C) to diagnose connectivity and application issues.

This data is collected by theThousandEyes Endpoint Agent, which is deployed as a module within the Cisco Secure Client.10The agent captures real-time telemetry from the user's laptop or workstation, includingWi-Fi signal strength,CPU and memory utilization, andlocal network gateway latency. Specifically, for remote users, it monitors the health of the VPN tunnel and the performance of applications as seen from the end-user's vantage point.

When a user reports a "slow application," this integrated telemetry allows IT teams to determine if the root cause is the user's home Wi-Fi, a saturated VPN concentrator, or an issue within the ISP underlay. The agent performsAutomated Session Testing (AST), which maps the network path as soon as a user joins a critical meeting or accesses a SaaS tool, providing a granular view of every hop between the device and the service destination. Unlike hardware configuration data (Option A) or behavioral analytics (Option B), the focus here is strictly on thenetwork performance metricsthat impact digital experience.

Therefore, the collection of device-centric network performance data is the core function of the Cisco Secure Client and ThousandEyes integration.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)framework, managing a large-scale deployment of Endpoint Agents requires efficient categorization throughAgent Labels. Agent labels are used to group agents for targeted test assignment and data filtering based on specific attributes like location, OS, or naming conventions.

ThousandEyes supports the use ofwildcards (specifically the * symbol)within label filters to allow for dynamic and scalable grouping. In this scenario, the organization has adopted a naming convention of agentname-network. To capture all agents connected to the "corporate" network regardless of the unique agentname prefix, the engineer should use the filter*-corporate(Option A) in the hostname or agent name field. The asterisk functions as a placeholder for any string of characters, ensuring that any agent ending with "-corporate" is automatically added to the label as soon as it registers with the ThousandEyes platform.

Other options are incorrect for the following reasons:

agentname-* (Option B):This would only match agents that literally start with the string "agentname-", which is a placeholder and not a representative filter for a group of uniquely named agents.

agent*corporate (Option C):This filter is overly broad and lacks the specific hyphen delimiter used in the organization's naming convention, potentially leading to the inclusion of unintended agents.

No wildcard (Option D):Wildcards are a documented and essential feature of the ThousandEyes label system to facilitate automated management in enterprise environments.

By implementing wildcard-based labels, the network administrator ensures that new agents are seamlessly integrated into the assurance strategy without the need for manual manual intervention.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)best practices for collaboration monitoring,Microsoft Teams(as well as Webex and Zoom) is monitored using a combination ofScheduled and Dynamic tests(Option D).

Scheduled Tests:These are used to proactively monitor the reachability and performance of the Microsoft Teams infrastructure. The Teams template typically includes scheduled HTTP Server tests to teams.microsoft.com and login.microsoftonline.com, along with network-layer tests to theTeams Transport Relay(e.g., worldaz.tr.teams.microsoft.com). These provide a continuous baseline of connectivity regardless of whether a user is currently in a call.

Dynamic Tests:These are a unique feature for collaboration monitoring. When an Endpoint Agent detects that the Teams application has initiated a real-time media session (audio or video call), it automatically triggers aDynamic Testto the specific IP and port being used for that call. This allows IT teams to see the exact network path—including hop-by-hop latency and loss—of the actual call traffic while the session is active.

Real User Tests (Option C)are generally not used for Teams monitoring in the same way they are for web-based SaaS apps. Because most users utilize the Teamsdesktop clientrather than the browser, the RUM browser extension cannot capture the rich telemetry of the desktop application's internal signaling and media streams. Therefore, the specialized "Automated Session Testing" provided byDynamic Tests, combined with the proactive health checks ofScheduled Tests, constitutes the complete assurance strategy for Microsoft Teams.

In the framework ofDesigning and Implementing En8terprise Network Assurance (300-445 ENNA), selecting the correct agent type depends heavily on the vantage point required for the specific observation. For this scenario, the architect must collect metrics from theinternal network access layer—the point closest to where the users or devices reside within the corporate perimeter—towards a cloud-hosted destination.

TheEnterprise Agent(Option B) is the most appropriate choice because it is specifically designed to be deployed on infrastructure owned and managed by the organization. These agents are "inside-out" vantage points that can be installed directly onCisco Catalyst 9300 or 9400 Series switchesat the access layer using Docker containers. By deploying an Enterprise Agent at the access layer, the architect gains visibility into the entire network path, starting from the internal LAN, traversing the edge/WAN, and reaching into the cloud-hosted web server. This allows for the identification of issues such as local congestion, ISP peering problems, or cloud provider latency.

Other options do not meet the criteria:

Synthetic Agent (Option A):This is a distractor term. All ThousandEyes agents (Cloud, Enterprise, and Endpoint) are synthetic agents because they all perform active synthetic testing.

Cloud Agent (Option C):These are pre-deployed by Cisco in global ISP data centers and provide an "outside-in" view.14While useful for monitoring public-facing availability, they cannot provide visibility into the internal network or the access layer of the organization.

Endpoint Agent (Option D):While these are installed on end-user machines and provide a "user-centric" view, they are generally not used for infrastructure-level path analysis from the access layer switches themselves.

Thus, theEnterprise Agentis the definitive choice for monitoring from the access layer to the cloud.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, monitoring the digital experience of internal employees requires leveragingThousandEyes Endpoint Agentsto simulate or record traffic from the user's specific vantage point. When an engineer needs to monitor a specific, potentially internal or non-standard web application, they must utilize theCustom Applicationworkflow within the Endpoint Experience settings.

According to the ENNA implementation standards, the first necessary action is toCreate a new custom application monitor(Option A). In the ThousandEyes portal underEndpoint Experience > Test Settings > Synthetic Tests, the "Monitor Application" button provides access to pre-defined templates for popular services like Microsoft 365 or Webex. However, for a unique enterprise application, the engineer must select "Custom Application" to define the application's identity, including its name and the relevant domain or URL.

The second required action is toAdd a new scheduled test to the monitor(Option C). Endpoint Agents performScheduled Testsat regular, predefined intervals—such as every 5 or 10 minutes—to proactively check the application's availability, response time, and network path health without requiring user interaction. By adding a scheduled HTTP Server or Network test to the custom monitor, the engineer ensures a consistent baseline of the application's performance as seen from the employee's machine.

Reviewing the incorrect options:

Google Suite monitor (Option B):This is a specific template for Google Workspace and is not suitable for a custom application.

Dynamic Tests (Option D):These are specifically designed for collaboration tools like Zoom or Microsoft Teams to capture ad-hoc sessions; they are generally not used for baselining a standard custom web application.

Test Template (Option E):While all monitors are based on templates, "adding a new template" is not a configuration action but rather a result of the monitoring setup.

In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, troubleshooting deployment issues is as critical as the initial configuration. When utilizingGroup Policy Objects (GPOs)for the distribution of the ThousandEyes Endpoint Agent (EPA), certain prerequisites must be met for the policy to take effect on a target machine.10

The most fundamental requirement is that the target PC must be a member of the domain or the specific Organizational Unit (OU) where the GPO is linked. Therefore, the appropriate first step is tocheck that the PC belongs to the needed domain(Option B). GPOs are scoped based on Active Directory membership; if a computer is in a workgroup or a different domain/OU that is not targeted by the policy, it will never receive the instruction to install the software, regardless of how "properly" the GPO is configured on the server.11

The other options are technically incorrect or represent a misunderstanding of GPO mechanics:

Administrator Login (Option A):EPA installation via GPO is typically configured to run under the System account context during startup, meaning it is not dependent on a specific user (administrator or otherwise) logging in to trigger the deployment.

Rebooting to restart GPO on the server (Option C):Rebooting a client PC triggers a "GPUpdate" request from the client to the server, but it does not "restart" the GPO service on the server side.

Rebooting the Server (Option D):This is an invasive and unnecessary step that will not force a policy update on a specific client PC if that PC is not correctly joined to the domain or is experiencing a local networking issue.

By verifying domain membership first, the administrator ensures the basic trust and communication path required for GPO delivery is functional before moving to more complex troubleshooting steps like checking event logs or network connectivity.

In the framework ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), selecting the appropriate ThousandEyes agent type is critical to balancing visibility requirements with infrastructure constraints. For Branch A, the primary objective is to gain network-layer metrics (such as latency, packet loss, and jitter) and path visualization for a SaaS application while strictly avoiding any performance impact on employee endpoints.

TheEnterprise Agent(Option C) is the correct choice because it is designed for "inside-out" monitoring from within the corporate network environment. These agents are lightweight software probes that can be deployed on existing network infrastructure, such asCisco Catalyst 9300/9400 switchesorCatalyst 8000 Edge Platforms, using Docker containers or virtual machines. By hosting the agent on the branch router or a dedicated local server, the engineer can execute synthetic tests to the SaaS provider's destination. This approach provides the necessary network vantage point from Branch A without requiring any software installation or resource consumption on the individual employee workstations (endpoints).

Other agent types do not satisfy the specific constraints of this scenario:

Endpoint Agentsare installed directly on user devices (Windows/macOS) to provide "last-mile" visibility. However, they use the endpoint's CPU and memory, which contradicts the requirement to not affect endpoint performance.

Cloud Agentsare maintained by Cisco in global ISP data centers. While they provide "outside-in" visibility, they cannot capture internal branch network characteristics or the specific path from Branch A's internal local area network.

Application Agentis a non-standard term and does not exist as a standalone agent type within the ThousandEyes architecture.

Therefore, deploying anEnterprise Agentwithin the branch infrastructure ensures that the network engineer obtains high-fidelity network metrics while keeping employee devices entirely unburdened.

Introduction to ThousandEyes

This video provides an essential overview of how ThousandEyes agents function within a CCNP-level enterprise network assurance strategy.

In the framework ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), selecting the appropriate agent for specific test types is a critical configuration step. The ThousandEyes platform utilizes different agent binaries and capabilities depending on the underlying hardware and software environment. Specifically,Page Load testsandTransaction testsrequire the agent to have a browser engine (Chromium) installed and functional to render web content and measure DOM-related metrics.

According to the ENNA implementation guidelines, not all Enterprise Agents support these browser-based tests. The exhibit displays a "New Test" configuration screen where the engineer is searching for "east1-agent-1". While other agents like "west-2-ag-1" are visible, the designated agent is missing because itdoes not support Page load tests(Option D). This common occurrence happens when an Enterprise Agent is deployed on resource-constrained hardware—such as certainCisco Catalyst 9000 switchesorCisco ISR 4000 series routers—where the Chromium browser package is either not supported or has not been enabled due to memory and CPU limitations.

When an agent lacks the required capabilities for a specific test layer (e.g., Web layer tests), it is automatically filtered out from the selection list in the ThousandEyes portal to prevent invalid test configurations. To identify compatible agents, an engineer can look for the "Browser" or "Dual Chromium" labels in the agent settings. If the "east1-agent-1" were merely offline (Option A), disabled (Option B), or still registering (Option C), it would typically still appear in the list but with a status indicator showing its unavailability, rather than being entirely hidden from the test assignment menu. Therefore, the absence of the agent in a web-layer test configuration explicitly indicates a lack of functional support for the required browser-based metrics.

According to theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, DNS testing is a fundamental component of ensuring application availability and performance. The ThousandEyes platform provides two primary types of DNS tests:DNS ServerandDNS Trace.

To satisfy the specific requirements of monitoringIPv6 recordsandname server resolution times, the engineer must utilize theDNS Server test. This test type is designed to measure the performance of specific DNS servers by querying them for particular resource records.

Monitoring IPv6 Records:In the DNS system, IPv6 address records are known asAAAA records. Therefore, to monitor the availability and resolution of IPv6 addresses for a domain, the engineer must create a DNS Server test and set the query type toAAAA(Option B).

Monitoring Name Server Resolution Times:To measure how long it takes for a DNS server to return the authoritative name servers for a domain, the engineer must query forNS (Name Server) records. By creating a DNS Server test targeting theNS record(Option D), the platform can provide granular metrics on the response time and availability of those specific records from the perspective of the selected agents.

DNS Trace tests(Options C and E) are less suitable for measuring specific resolutiontimesof a single server; instead, they are used to visualize the entire delegation path from the root servers down to the authoritative servers to identify where a "break" in the chain occurs. Furthermore, anA recordquery (Option A) only provides the IPv4 address, failing the requirement to monitor IPv6. By selectingDNS Servertests forAAAAandNSrecords, the administrator ensures they have the precise performance data needed to baseline and troubleshoot the organization's DNS health.

In the context ofDesigning and Implementing Enterprise Network Assurance (300-445 ENNA), capacity planning requires accurate baselining of interface bandwidth against its theoretical and provisioned limits. AnalyzingExhibit 4.5 Question 4(image_79d4fc.jpg) reveals a significant discrepancy between the physical reality of the link and its configuration within the monitoring tool.

The exhibit displays a capacity planning dashboard with a calendar heatmap and traffic graphs. The heatmap for February through May shows a high frequency of "Severe" (red) utilization blocks. Looking at theEgressgraph forTue May 07 2024, the traffic spikes clearly exceed 40.0 Mbps. Crucially, the dashboard indicates an "Egress Capacity" of49.5 Mbpsand reports that the "Highest consumption" was 48.0 Mbps, representing97%of the available bandwidth.

However, the question states that the ISP provides a1 Gbps (1000 Mbps) connection. Since the actual traffic being sent is less than 50 Mbps, the link is nowhere near physical saturation. The "Severe" alerts and high utilization percentages are occurring only because the monitoring software (likely ThousandEyes or a similar NMS) is configured with aMaximum Capacityof only 49.5 Mbps for this interface. This misconfiguration causes the tool to calculate utilization based on a much smaller "pipe" than what actually exists, leading to false-positive alerts.

Therefore, the most likely action to fix this observed behavior is toreconfigure maximum capacity for the interface(Option B) to match the 1 Gbps specification.

Option Ais unnecessary because the current link is only being utilized at ~5% of its 1 Gbps potential.

Option Cis a restrictive policy change that is not justified given the actual available headroom.

Option Dmight shift how data is displayed but will not fix the underlying mathematical error in utilization calculations.