Pass the Cisco CCDE v3.0 | CCDE 400-007 Questions and answers with ValidTests

1 - target 4

2 - target 5

3 - target 1

4 - target 6

5 - target 2

6 - target 3

C (QoS policy propagation with BGP - QPPB):Allows QoS policies to be dynamically applied based on BGP routing information, integrating policy control into routing decisions.

D (Remote black-holing trigger):Enables dynamic mitigation of attacks (e.g., DDoS) by injecting blackhole routes through BGP to selectively drop malicious traffic upstream.

Other options explained:

A/B/E: Static policy mechanisms that lack dynamic flexibility and responsiveness in modern service provider designs.

In this scenario, the application itself duplicates data transmission across two separate NICs on Host A, with the intention that at least one copy will reach Host B, regardless of any single path or link failure. While this increases redundancy at the application and host level, the underlying network must also support rapid failure recovery to avoid packet loss during convergence events.

Among the options provided:

A. EIGRP with feasible successors provides pre-computed backup routes but still requires routing protocol convergence upon failure, which could result in millisecond-scale interruption—enough to cause data loss if packets are in transit.

B. BFD (Bidirectional Forwarding Detection) offers rapid detection of link failures, but by itself does not provide traffic redirection or packet protection; it simply informs the routing protocol faster.

D. Static routes lack dynamic convergence capabilities and would not offer high availability across dynamic failure points unless manually configured with tracking—still less responsive and scalable.

C. IP Fast Reroute (IP FRR) is specifically designed to offer sub-50ms convergence time by pre-installing backup paths in the forwarding plane. Upon detecting a failure, traffic is immediately switched to the pre-computed alternate path without waiting for the routing protocol to reconverge. This ensures minimal disruption and best supports lossless delivery for high-availability applications.

IP FRR is consistent with CCDE v3.1 design principles where sub-second convergence and resiliency are critical in mission-critical enterprise and data center architectures.

A: On most hardware platforms, control plane protection is implemented in hardware to safeguard CPU resources from overload due to excessive control traffic.

E: Control plane policing must be carefully sized to allow sufficient protocol traffic (OSPF, BGP, etc.) during normal and convergence periods to ensure stability.

Why other options are incorrect:

B: Policing should be applied universally, not just on external interfaces.

C: False alarms are operational issues but not design considerations.

D: Control plane policers are applied after forwarding decisions for traffic destined to the router CPU.

—

"Fate sharing" refers to multiple services or customers relying on the same physical or logical component. Minimizing fate sharing improves reliability by isolating failures:

Isolating customer services ensures that failure in one domain does not affect others.

Separating critical control and data planes enhances resiliency.

Why other options are incorrect:

A: Bridging may introduce other issues but is not directly tied to fate sharing.

C: Redundancy enhances, not reduces, reliability.

D: Unicast overlay routing is not a fault domain problem in this context.

—

A: FabricPath assigns a specific multicast (S,G) flow to one tree. A single (S,G) does not get load-balanced across multiple trees.

E: Overall multicast traffic across multiple (S,G) groups is distributed across multiple FabricPath trees, providing general load balancing and efficient link utilization across the fabric.

Why other options are incorrect:

B: Traffic load per tree may not be uniform due to different group distributions.

C: The assignment is done by the ingress switch based on hashing, not all leaf nodes assign the same tree.

D: Individual (S,G) flows do not get load-balanced across trees.

—

A picture containing table Description automatically generated

When a service provider does not support multicast over their Layer 3 VPN, the enterprise can useGRE tunnels between Customer Edge (CE) devicesto transport multicast traffic. This method allows the customer to encapsulate multicast packets in unicast GRE packets, which are routable through the provider’s non-multicast core.

In this scenario, the most scalable and immediate solution is to establish a GRE tunnel betweenC2 (in the head office CE router path)andC4 (at the branch office). This setup ensures that multicast traffic originating at the head office is tunneled directly to the multicast receivers, bypassing the service provider’s non-multicast-aware core.

This strategy is directly aligned with CCDE v3.1 principles, which emphasize:

Minimizing service provider dependency

Providing a scalable, customer-controlled overlay solution

Ensuring protocol compatibility across domains

Why other options are incorrect:

A: Tunnel between CE1 and CE2 is less optimal, as it may not originate or terminate at the exact multicast endpoints.

C: Tunnel between C1 and C4 is less aligned with CE-to-CE design expectations and may bypass required edge security/policy controls.

D: 2547oDMVPN is more complex and intended for full-scale VPN overlays, not quick multicast solutions.

E: Draft Rosen requires service provider support, which is currently unavailable, hence not a valid short-term option.

This solution ensures operational simplicity and future scalability with minimal provider dependency, which are core principles outlined in the CCDE v3.1 design methodology.

A (Access):QoS classification and marking should occur as close to the traffic source as possible—at the access layer—so that policies can be consistently applied throughout the network.

Other options explained:

B/D: QoS policies at these layers rely on markings applied earlier.

C: Collapsed core is simply core and distribution merged, but marking should still happen at access.

Comprehensive and Detailed Explanation:

B: Fate sharing refers to a situation where multiple logical or virtual paths depend on a single physical component. If that physical link fails, all virtual tunnels or services carried over it are simultaneously affected—reducing fault isolation and increasing failure impact.

Other options:

A: Tunneling is often needed for overlays; not inherently a drawback.

C: Bandwidth utilization is an efficiency metric, not a drawback in this context.

D: Serialization delay is more relevant to low-speed links or voice/real-time traffic, not virtualized path concerns.

???? QUESTION NO: 338 [Protocol Design Implications]

An engineer must redesign the QoS strategy due to oversubscription and excessive packet drops. What QoS technique should be used to manage traffic leaving the edge router and reduce packet drops?

A. LLQ

B. Traffic shaping

C. Rate-limiting

D. Policing

Answer:B

???? Explanation:

B: Traffic shaping buffers excess traffic and releases it gradually to match the configured rate, preventing congestion and dropped packets on outbound interfaces. It’s ideal for controlling egress traffic to match the service provider's rate.

Other options:

A: LLQ (Low Latency Queueing) provides strict priority queuing but doesn’t control overall rate or prevent oversubscription.

C: Rate-limiting enforces a cap and drops packets exceeding the threshold.

D: Policing drops excess traffic immediately and is more aggressive than shaping.

==========

???? QUESTION NO: 339 [Scenario-Based Design Strategy Guidance]

Refer to the exhibit. The network experiences Stuck-in-Active (SIA) problems due to resource contention. An acquisition will further increase routing demands via R3 and R4.

Which solution best mitigates the SIA issue?

A. Utilize EIGRP unequal cost load-balancing on R5 and R6

B. Implement EIGRP Route Flap Dampening

C. Deploy EIGRP stub on R5 and R6 with connected and summary options

D. Advertise only a default route to R5 and R6

Answer:C

???? Explanation:

C: Configuring R5 and R6 as EIGRP stub routers reduces query scope and prevents SIA conditions. EIGRP stub routers do not forward queries and are ideal for spoke or edge routers.

Other options:

A: Load balancing doesn’t reduce control-plane query overhead.

B: Route Flap Dampening isn’t applicable to EIGRP and won’t solve SIA.

D: Default route advertisement helps simplify routing, but stub configuration is purpose-built to prevent SIA issues.

==========

???? QUESTION NO: 340 [Security, Automation, and Policy Integration in Design]

Which are two benefits of using Layer 2 access control lists (ACLs) for segmentation? (Choose two)

A. Traffic filtering

B. Contextual filtering

C. Containing lateral attacks

D. Reduced load at Layer 2

E. VLAN intercept

Answer:A, C

???? Explanation:

A: Layer 2 ACLs can block or allow specific MAC or IP traffic right at the switchport.

C: Containing lateral attacks—Layer 2 ACLs help block unauthorized east-west traffic between hosts within the same VLAN.

Incorrect options:

B: Contextual filtering is associated with next-gen firewalls or Layer 7 inspection.

D: ACLs add processing load, not reduce it.

E: VLAN intercept is not a valid Cisco term for ACL application.

==========

???? QUESTION NO: 341 [Business-Driven Design Approaches / Agile Frameworks]

In the Scrum Agile framework, who acts as the interface between the business/customers and the team?

A. Product Owner

B. Product Manager

C. Scrum Master

D. Program Manager

Answer:A

???? Explanation:

A: The Product Owner is responsible for defining user stories, maintaining the product backlog, and representing the customer's voice to the development team.

B: Product Manager may define broader strategy but doesn’t manage the backlog directly.

C: Scrum Master ensures the process is followed but doesn’t interface with the business side.

D: Program Manager oversees multiple projects; not Scrum-specific.

==========

???? QUESTION NO: 342 [Security, Automation, and Policy Integration in Design]

Company XYZ must isolate and encrypt production traffic to meet HIPAA compliance. The current WAN includes MPLS and P2P links.

What is the fastest deployment option?

A. IPsec P2P tunnels over MPLS and links

B. GETVPN over MPLS

C. Centralized firewall

D. VRF-Lite with IPsec tunnels

Answer:A

???? Explanation:

A: IPsec point-to-point tunnels provide immediate, well-supported encryption across both MPLS and P2P transports. Quick to implement and doesn’t rely on service provider support.

Other options:

B: GETVPN requires coordination and is more complex to deploy.

C: Central firewalls don’t encrypt traffic over the WAN.

D: VRF-Lite with IPsec is viable but more complex than direct IPsec tunnels.

==========

???? QUESTION NO: 343 [Technology Comparisons and Use Cases]

One of the approaches used in cloud bursting is distributed load-balancing, where workloads operate between a public cloud and a data center.

How can the characteristics of distributed load-balancing be described?

A. Simultaneously provisions cloud resources

B. Usually uses cloud APIs for communication

C. Useful for testing and proof-of-concept projects

D. Useful for large but temporary cloud deployments

Answer:A

???? Explanation:

A: Distributed load-balancing in cloud bursting allows workloads to run simultaneously across on-premises infrastructure and public cloud. Resources are provisioned concurrently to manage increased load or optimize application performance.

Other options:

B: Cloud APIs are widely used, but this is a general trait of cloud integration—not specific to distributed load-balancing.

C: Proof-of-concept projects are more aligned with basic cloud testing or DevOps, not distributed production workloads.

D: Temporary deployments describe elastic scaling, not the permanent load-balancing between environments.

==========

???? QUESTION NO: 344 [Business-Driven Design Approaches]

Which two factors must be considered while calculating the Recovery Time Objective (RTO)? (Choose two)

A. Importance and priority of individual systems

B. Maximum tolerable amount of data loss that the organization can sustain

C. Cost of lost data and operations

D. How often backups are taken and how quickly these can be restored

E. Steps needed to mitigate or recover from a disaster

Answer:A, C

???? Explanation:

A: RTO depends on how critical the system is. More critical systems require shorter recovery times.

C: The business impact of downtime (cost of operational loss) drives the acceptable RTO for systems.

Incorrect options:

B: This refers to Recovery Point Objective (RPO), not RTO.

D: Backup frequency aligns with RPO; restore speed can influence RTO but isn't a direct calculation input.

E: Mitigation steps are part of disaster recovery planning—not direct RTO calculation.

==========

???? QUESTION NO: 345 [Network Architecture Principles]

As more links are added to a network, the control plane slows down due to more data to process. As redundancy increases, MTTR also increases. Which risk increases along with the higher MTTR?

A. Management visibility

B. Slower data plane convergence

C. Overlapping outages

D. Topology change detection

Answer:C

???? Explanation:

C: As MTTR (Mean Time to Repair) increases due to complex topologies and control plane delays, the likelihood of experiencing overlapping outages (i.e., a second failure occurring before the first is resolved) also increases. This can cascade into a wider outage.

Other options:

A: Management visibility isn’t directly affected by MTTR.

B: Data plane convergence is generally fast and not as affected as control plane convergence.

D: Topology changes may still be detected quickly, but the reaction time (recovery) is delayed.

==========

???? QUESTION NO: 346 [Security, Automation, and Policy Integration in Design]

Which layer of the SDN architecture orchestrates how applications receive available network resources?

A. Orchestration layer

B. Southbound API

C. Northbound API

D. Control layer

Answer:A

???? Explanation:

A: The orchestration layer manages global resource allocation, service policies, and end-to-end workflows. It ensures that applications receive the necessary resources through coordination between the control and application layers.

Other options:

B: Southbound APIs connect the control layer to the infrastructure layer.

C: Northbound APIs connect the control layer to applications but don’t handle orchestration.

???? QUESTION NO: 347 [Security, Automation, and Policy Integration in Design]

Company XYZ wants to detect and block known attacks by inspecting every forwarded packet with minimal performance impact. What is the recommended design?

A. Deploy an IPS behind the firewall in promiscuous mode

B. Deploy an IPS in front of the firewall in promiscuous mode

C. Deploy an IPS behind the firewall in in-line mode

D. Deploy an IPS in front of the firewall in in-line mode

Answer: C

???? Explanation:

C: Deploying the IPS behind the firewall in in-line mode ensures that only filtered and relevant traffic is inspected, minimizing performance impact while still allowing the IPS to block malicious packets. Inline mode allows for active blocking based on signature detection.

A and B: Promiscuous mode only detects but does not block traffic.

D: Placing IPS in front of the firewall increases the processing load by exposing it to all traffic, including unwanted or already-blocked connections.

==========

???? QUESTION NO: 348 [Technology Comparisons and Use Cases]

In an SDN architecture, what is present on the switches but not on the centralized controller?

A. Control plane functions

B. A southbound interface

C. Data plane functions

D. A northbound interface

Answer: C

???? Explanation:

C: In SDN, switches retain the data plane functionality—they forward packets based on flow rules received from the controller.

A: Control plane functions are moved to the centralized controller in SDN.

B: Southbound interfaces are present on both controllers and switches for communication.

D: Northbound interfaces exist on controllers to interact with applications—not switches.

==========

???? QUESTION NO: 349 [Technology Comparisons and Use Cases]

What is a connection service that provides direct connectivity to a cloud provider from a data center?

A. Cloud OnRamp

B. Cloud Gateway

C. Cloud Direct Connect

D. Carrier-neutral facility

Answer: C

???? Explanation:

C: Cloud Direct Connect (or equivalent, e.g., AWS Direct Connect, Azure ExpressRoute) provides private, low-latency connectivity between on-prem data centers and public cloud providers.

A: Cloud OnRamp is part of Cisco SD-WAN solutions that optimize SaaS and IaaS access.

B: Cloud Gateway typically refers to a device or service that connects on-prem to cloud, but not necessarily direct, private circuits.

D: Carrier-neutral facilities are physical data centers used for interconnection but not themselves the service.

==========

???? QUESTION NO: 350 [Scenario-Based Design Strategy Guidance]

A customer is designing a network to support video applications with centralized and distributed deployments. The team has reviewed bandwidth, cost, and usage patterns. What additional key information is missing?

A. Video traffic jitter and delay

B. Type of video resources

C. Transport protocol and traffic engineering

D. Network management and monitoring

Answer: B

???? Explanation:

B: The type of video resources (e.g., MCUs, call agents, conferencing servers) significantly affects whether a centralized or distributed deployment is more efficient. This decision impacts call setup, bridging, and media flow.

A: While jitter/delay are QoS concerns, they don’t dictate the resource allocation model by themselves.

C and D: Important for operations and engineering but not the missing business-critical input for resource placement.

B (R1 adjusts to R2’s Required Min RX):In BFD, each side advertises itsDesired Min TX IntervalandRequired Min RX Interval. Each device adjusts its transmission interval to match the remote side’s ability to receive packets (Required Min RX). So R1 reduces its transmission rate to 100 ms to match R2's platform limitations.

Other options explained:

A: R2 does not adjust to R1’s Desired Min TX; it’s the sender who adapts.

C: BFD quickly converges after initial negotiation.

D: P-bit and F-bit are not involved in this specific interval negotiation.

Cisco FabricPath is a Layer 2 multipath technology that blends traditional Layer 2 Ethernet with routing technologies to enable loop-free forwarding and scalability. Two critical mechanisms used to mitigate loops:

C. RPF (Reverse Path Forwarding) Check: FabricPath applies a reverse path forwarding check, similar to multicast, to verify the source of a frame and discard duplicates arriving on unexpected paths.

D. TTL Header: FabricPath adds a Time-To-Live (TTL) field to Layer 2 frames, which is not present in traditional Ethernet. This prevents indefinite circulation of frames by limiting their lifetime in the network—much like in IP.

These elements allow FabricPath to prevent broadcast storms and loops in multipath Layer 2 topologies, addressing legacy STP limitations with efficient loop-avoidance methods.

==========

B (Install firewalls):PCI DSS requires network segmentation, filtering, and perimeter defense via firewalls.

C (Use antivirus software):Malware protection and anti-virus software are mandatory on all systems interacting with cardholder data.

Other options explained:

A/D/E: These are general security best practices but not specific mandatory requirements under PCI DSS control objectives.

For accurate location tracking in wireless networks, signal triangulation methods like RSSI, TDoA, or Angle of Arrival require:

A (Perimeter coverage): Adding APs along the perimeter improves location accuracy by minimizing blind spots and improving triangulation geometry.

B (Higher density, <40 ft spacing): Reducing inter-AP distance increases overlapping coverage, which provides more data points for accurate positioning.

Other options explained:

C: Directional antennas limit overlapping coverage, reducing triangulation accuracy.

D: Monitor mode APs can assist in location services but are secondary to proper placement and density.

E: Increasing transmit power may enlarge cell size but can decrease accuracy by reducing overlapping AP zones.

Comprehensive and Detailed Explanation:

D: The most effective solution is to have Site-X advertise a more specific (longer) prefix (e.g., 100.75.10.0/24), which allows external BGP routers to prefer Site-X over Site-Y. This ensures traffic destined for Site-X flows directly to it, preserving symmetry. Additionally, control plane coordination between R1 and R2 ensures proper routing consistency and minimizes the risk of loops or misdirection.

Other options:

A: Using BGP MED works within the same AS; it is often ignored by external ISPs.

B: Replicating firewall behavior does not address the routing issue.

C: DNS manipulation is a workaround—not a scalable or robust design solution.

This solution is consistent with BGP best practices and CCDE v3.1 guidance on traffic engineering and policy-based routing.