Pass the Cisco CCNP Service Provider 300-540 Questions and answers with ExamsMirror

NETCONF rules state:

A user cannot terminatetheir own active session.

Attempting to kill the same session returnsinvalid-valueerror.

The session continues running normally.

Thus:

No logout

No termination

No configuration impact

Therefore,Ais correct.

In aCisco NFVI C-Series Pod, the Top-of-Rack (ToR) switches are almost always configured as avPC pair.

A vPC domain requiresthree mandatory components:

vPC domain ID

vPC peer-link

vPC peer-keepalive link←ensures dual-active detection

In the exhibit:

The management interfaces areTor-A Mgmt0: 10.10.10.1andTor-B Mgmt0: 10.10.10.2

These IPs are used commonly as thepeer-keepalive endpoints

The physical uplinks to NFVI nodes formPort-Channel110

Since the configuration snippet already includes:

feature vpc

feature lacp

channel-group 110 mode active

Thenext required stepin a Cisco NFVI + vPC configuration is to configure thepeer-keepalivefrom ToR-A toward ToR-B:

vpc domain 1

peer-keepalive destination 10.10.10.2

This ensures:

vPC roles sync

Dual-active prevention

Stable operation for the NFVI C-Series rack

Why the Other Options Are Incorrect

A. vpc peer-linkThis is required but must be configured on the dedicated peer-link interfaces, not on the server-facing port-channel.

C. channel-group 110 mode onThe correct mode is already configured: mode active for LACP. mode on disables LACP.

D. switchport mode accessNFVI ToR links usetrunking, not access mode, because servers carry multiple networks (control, compute, storage, management VLANs).

Comprehensive and Detailed Explanation Based on Designing and Implementing Cisco Service Provider Cloud Network Infrastructure Knowledge

When connectingcarrier-neutral facilities (CNFs)ordata centerswithin the same metropolitan area, service providers typically usehigh-bandwidth, low-latency optical transport methods. The most appropriate and commonly deployed interconnection technology is:

DWDM (Dense Wavelength Division Multiplexing) ring, which provides:

High capacity (10G, 40G, 100G, 400G)

Low latency

Redundancy through ring or mesh topologies

Multi-wavelength multiplexing for cost efficiency

Carrier-grade reliability for metro interconnect services

This aligns with cloud interconnect and metro transport design used in service provider environments.

Evaluation of the Options

A. OSPF backbone area adjacency

This is a routing protocol adjacency, not a physical connection method. It requires a transport link underneath but does not represent the physical interconnect itself.

B. Private wireless connection

Not suitable for CNF or metro DC interconnect because it lacks the bandwidth, reliability, and deterministic performance required for large-scale carrier-grade interconnects.

C. DWDM ring

This is the correct method. DWDM-based metro fiber rings are the standard for connecting carrier-neutral facilities in the same metro region.

D. CAT6e connection

This is limited to short-distance copper Ethernet (tens of meters). It is not used for metro-scale interconnects or between CNFs.

RouterR2is insideAS 100and has three iBGP paths (via R3, R4, R5) toward AS 101. To performiBGP multipathacross these three equal-cost paths, BGP must:

Run the correct BGP process forAS 100

Allow installation of multiple iBGP paths in the routing table

This is done with:

router bgp 100

maximum-paths ibgp 3

router bgp 100– enters the BGP process for AS 100 (correct AS per diagram).

maximum-paths ibgp 3– tells BGP to keep up to 3 iBGP paths to the same destination, enabling CEF to load-share across them.

Other options:

ip load-sharing ibgp 3– not a valid command.

router bgp 101– wrong AS number.

ip load-sharing per-destination– controls CEF hashing but does not enable BGP to install multiple iBGP paths by itself.

In Cisco SD-WAN,vSmart controllers must be assigned to controller groupsso that edge routers can form redundant control-plane connections. Each data center in the diagram has its own group:

New York DC → Controller group-ID 1(vSmart1, vSmart2, vSmart3)

Los Angeles DC → Controller group-ID 2(vSmart4, vSmart5, vSmart6)

To configure the controllers correctly:

vSmart1

It resides in theNew York DC, so it must be assigned tocontroller-group 1.

Required command:

system controller-group-id 1

This corresponds toOption D.

vSmart4

It resides in theLos Angeles DC, so it must be assigned tocontroller-group 2.

Required command:

system controller-group-id 2

This corresponds toOption C.

Why Other Options Are Incorrect

A and B:The command max-control-connections is configured onedge routers, not vSmart controllers.

E:Controller-group-id 4 does not exist in this design; only group 1 and group 2 are shown.

Comprehensive and Detailed Explanation

Cisco NFVIS logging levels (from lowest to highest):

critical

error

warning

info

debug←highest verbosity

To capture maximum diagnostic detail, engineers must enabledebuglogging on theoperational log type, which records system activity and runtime behavior.

Thus the correct command is:

system set-log logtype operational level debug

This provides the deepest troubleshooting visibility.

Comprehensive and Detailed Explanation

AWSSecurity Groupsact as the primary stateful firewalls for EC2 instances.

To restrict SSH (TCP/22) to a single host (20.20.20.20/32), aSecurity Groupmust be configured with:

Inbound rule: TCP 22

Source: 20.20.20.20/32

ACLs operate at the subnet level but are not used for instance-specific SSH restrictions.

WAF controls HTTP/HTTPS traffic, not SSH.

Resource groups only organize cloud assets.

Thus,Bis the correct solution.

Cisco NFVIS follows strict security controls. After a fresh deployment:

Thedefault admin credentials are considered insecure.

NFVIS requires the administrator toreset the default password on first login(typically via console or SSH).

Until the password is changed,REST API and web-portal access are denied, and attempts to access the portal or API returnHTTP 401 Unauthorized, even if the default credentials are provided.

This mechanism prevents use of factory-default passwords in production and is explicitly documented as a mandatory post-install step.

The other options are not the cause of a 401 error:

Enabling portal via SSH (B) is not required; HTTPS access is enabled by default once credentials are valid.

Restarting Tomcat (C) would address service availability issues (e.g., 5xx errors), not authentication.

Browser certificates (D) affect trust warnings (e.g., HTTPS certificate errors), not 401 Unauthorized.

Comprehensive and Detailed Explanation

AnAPI logic flawis a weakness in the API’sbusiness logic— not in encryption or transport security. It occurs when:

API functions are misused

Business rules are bypassed

Security validation is missing

Workflow logic is incorrect

These issues cannot be solved through encryption (at rest or in transit). They require:

✔Vulnerability remediation

✔Fixing API code logic

✔Updating API validation, flow control, and authentication logic

Thus the correct answer isC. Remediation of vulnerabilities.

Comprehensive and Detailed Explanation

Cisco Container Platform (CCP), built on Kubernetes orchestration, usesYAMLfiles for:

Cluster configuration

Pod definitions

Network settings

Storage mappings

YAML is the industry-standard declarative syntax for Kubernetes and container orchestration platforms.

HTML, XHTML, and XML are not used for CCP configuration.