Pass the Cisco CCDE v3.0 400-007 Questions and answers with ExamsMirror

To support high-bandwidth, low-latency Layer 2 communication between DB Server 1 and DB Server 2, you must create a direct Layer 2 path between SW1 and SW2. Using REP (Resilient Ethernet Protocol) segments ensures loop-free Layer 2 operation without the drawbacks of STP convergence delays.

Option C is correct: Adding a third REP segment (Segment 3) directly between SW1 and SW2 isolates the traffic between the two DB servers and ensures deterministic behavior with fast convergence.

Option A (LACP with STP) introduces STP blocking and doesn’t align well with REP's control plane.

Option B and D: Overloading existing segments or splitting new links into existing REP segments does not offer the same direct path, bandwidth, or deterministic behavior.

==========

iBGP’s full mesh requirement refers to logical BGP session establishment, not physical network design. As long as reachability exists between iBGP peers (through an IGP like OSPF or IS-IS), iBGP sessions can be established regardless of physical topology (ring, star, partial mesh, etc.).

Key CCDE v3.1 design principles:

Logical iBGP mesh ≠ physical mesh requirement.

Physical topologies can be optimized independently of iBGP peering structure.

Control plane designs like route reflectors or confederations further optimize scalability without changing physical topology.

Why other options are incorrect:

B: iBGP works on any topology where IP reachability exists.

C: Physical full mesh is unnecessary for iBGP.

D: iBGP functions over any IGP-provided reachability domain, including rings.

Comprehensive and Detailed Explanation:

CAPEX (Capital Expenditures) focuses on up-front hardware investments, like routers, switches, and appliances.

A: Scalability directly impacts CAPEX—network designs that require fewer or more scalable hardware components reduce capital investment costs.

B and D are more influenced by OPEX (operational expenditures).

C (complexity) is a broader design challenge, not directly tied to CAPEX.

==========

In the topology shown, the 10.10.0.0/16 network is redistributed into two different OSPF processes—OSPF 1 and OSPF 2—from router R3. The redistribution uses the external route types:

Into OSPF 1 as an E1 route with a metric of 100

Into OSPF 2 as an E2 route with a metric of 100

When redistribution occurs in OSPF, two types of external routes can be injected:

Type E1: Adds the internal OSPF cost to the external cost (total path cost = external metric + internal OSPF path)

Type E2: Considers only the external cost and ignores internal path cost (default behavior)

In this case:

The path via R2–R3 (E1) includes both the external cost and the internal cost from R1 to R2 to R3. That is: 10 (R1–R2) + 10 (R2–R3) + 100 (external) = 120.

The path via R4–R5–R3 (E2) will show a constant metric of 100 regardless of the internal OSPF path (10 + 10 = ignored).

So when the link between R2 and R3 fails, the path R1–R4–R5–R3 (E2 route with constant metric 100) becomes the preferred route.

However, when the link between R2 and R3 is restored, the E1 route will be recalculated as:

Internal cost (R1–R2–R3) = 10 + 10 = 20

External metric = 100

Total = 120

OSPF always prefers E1 routes over E2 routes when both are available, even if the E2 route appears to have a better metric. This is because E1 routes provide more accurate end-to-end cost calculation.

Therefore, upon restoration, the routing table reverts to the E1 route via R1–R2–R3.

This behavior is aligned with OSPF protocol standards and is emphasized in CCDE v3.1 under the “Protocol Design Implications” domain, which focuses on redistribution behaviors, route-type preferences, and convergence consistency in multi-domain IGP designs.

D (EoMPLS - Ethernet over MPLS):EoMPLS allows Layer 2 extension across MPLS without IP addressing or routing changes, preserving VLANs and broadcast domains — ideal for extending CCTV networks transparently.

Other options explained:

A: GRE encapsulates Layer 3, requiring IP configurations.

B: L2TPv3 is possible but not common over MPLS SP networks.

C: VXLAN is more suited for data center overlays, not WAN/MPLS integration.

Bidirectional Forwarding Detection (BFD) provides fast failure detection independent of routing protocols. It can be integrated with multiple protocols to accelerate convergence:

A: IS-IS supports BFD for fast hello processing.

B: BFD can track static routes via routing tracking features.

D: EIGRP supports BFD for link failure detection.

E: BGP supports BFD for rapid session teardown.

Why option C is incorrect:

C: RIP does not natively support BFD integration.

—

B (Strategic planning): Long-term business-aligned decisions that shape future infrastructure needs.

D (Tactical planning): Short-to-mid-term activities that adjust design based on evolving operational realities, constraints, and priorities.

Why other options are incorrect:

A & E: While cost and business optimization are goals, they are not defined planning approaches.

C: Modular is a design methodology, not a planning approach.

—

C (Lack of visibility and tracking): In cloud-native environments, organizations often struggle with monitoring and tracking workloads across dynamic, distributed, and multi-tenant architectures. Traditional visibility tools may not fully cover cloud-native assets like containers, serverless functions, or microservices, making it harder to detect threats and enforce policies.

D (Increased attack surface): Cloud-native architectures introduce many additional components—APIs, microservices, third-party integrations, and distributed data—which all expand the organization's overall attack surface. More entry points for attackers create additional security challenges compared to traditional on-prem environments.

Other options explained:

A: User roles can be managed with proper IAM systems.

B: Polymorphism refers to code behavior in programming, not a core security challenge in cloud-native design.

E: Credential validation is part of basic access control but not a top cloud-native challenge compared to visibility and attack surface expansion.

C: GLOP addressing is defined in RFC 2770, assigning a portion of the 233.0.0.0/8 range for each AS based on their 16-bit ASN. This allows each AS to use a /24 of globally unique multicast addresses without coordination from IANA.

Other options:

A: 239.0.0.0/8 is the administratively scoped multicast address space.

B: 224.0.0.0/24 is reserved for local link-scoped protocols (e.g., OSPF, RIP).

D: 232.0.0.0/8 is the Source-Specific Multicast (SSM) range.

==========

B (Control plane is unavailable):In centralized SDN models where the controller has full exclusive configuration authority (lock), controller failure results in loss of control-plane functionality. No new flows can be programmed, and dynamic traffic adjustments cannot occur until the controller is restored.

Other options explained:

A: Devices typically continue forwarding existing flows but are not in read-only config mode.

C: Backups may still be available independently.

D: Manual changes are often restricted to preserve state consistency.

D (Root Guard): Prevents unauthorized devices from becoming the STP root by blocking superior BPDUs on access ports.

E (BPDU Guard): Immediately shuts down ports that receive unexpected BPDUs, protecting against accidental or malicious connection of switches to access ports.

Why other options are incorrect:

A: Loop Guard protects against unidirectional link failures but not unauthorized devices.

B: PortFast speeds up STP convergence on access ports but does not provide security.

C: DTF (Dynamic Trunking Protocol) is not a security feature.

—

C (Faster convergence): 802.1s (Multiple Spanning Tree Protocol – MSTP) improves convergence times over legacy 802.1D (STP) and PVST+ by leveraging the rapid convergence benefits of 802.1w (RSTP).

E (Maps multiple VLANs): MST allows multiple VLANs to share the same spanning-tree instance, reducing the overall number of instances required and improving scalability.

Other options explained:

A: The standard supports 64 MST instances, not 1024.

B: 802.1w (RSTP) is the basis for 802.1s; Cisco’s proprietary enhancement was originally PVST+.

D: MST actually reduces CPU/memory compared to running multiple instances of PVST+.

In a standard 3-tier data center architecture (access, aggregation, core), the Layer 2-to-Layer 3 boundary typically resides at the aggregation layer. When extending VLANs between data centers using a Layer 2 interconnection, the most optimal and scalable termination point is at the aggregation layer because:

It naturally handles VLAN demarcation and Layer 3 boundary.

Spanning Tree Protocol (STP) domains remain contained within local aggregation blocks.

The core remains Layer 3-only, ensuring scalability, stability, and no STP involvement.

Simplifies traffic engineering, FHRP operations, and minimizes control-plane complexity across sites.

This design is consistent with CCDE v3.1 best practice where VLAN extension is isolated to aggregation to avoid STP scaling issues and maintain hierarchical design principles.

Why other options are incorrect:

A: STP isolation can still be achieved at aggregation while keeping the core Layer 3.

C: Access layer extensions would increase STP scope and complexity unnecessarily.

D: Core termination violates Layer 3 core design, bringing STP into the core, which is not scalable.

A (BPDU Guard on access ports): Prevents accidental connection of switches or bridging devices on access ports, which could cause unexpected topology changes or loops.

C (Root Guard on aggregation switch downlinks): Ensures access switches cannot send superior BPDUs to challenge aggregation switch root status, maintaining predictable STP root placement.

Why other options are incorrect:

B: Aggregation downlinks are not normally configured with BPDU Guard (since they expect BPDUs from access switches).

D: Root guard on access ports is unnecessary as those ports should not participate in STP.

E: Edge port (Rapid STP concept) is good for faster convergence but doesn't address stability.

F: STP root and backup root election is important but not a specific STP feature — this is a design decision, not a stability feature.