400-007 Cisco Certified Design Expert V3.0 Practice Questions

On Cisco IOS switches, logical Layer 3 interfaces for VLANs are called Switched Virtual Interfaces (SVIs). The default management SVI is typically associated with VLAN 1. The command interface Vlan1 is used to enter the configuration mode for this SVI, where the IP address can then be assigned.

This statement is false. A single OSPF area design does not scale well to 500 routers. In OSPF, all routers within an area must maintain an identical Link-State Database (LSDB). A large number of routers and links in one area leads to a large LSDB, high CPU utilization during SPF calculations, and increased routing protocol overhead. Best practice is to use a hierarchical, multi-area design to segment the network, summarize routes at Area Border Routers (ABRs), and limit the scope of link-state changes, thereby improving stability and scalability.

An agile methodology demands flexibility and rapid adaptation to change. A WAN design that is highly programmable and automated (such as one based on SD-WAN) allows network policies, like QoS and traffic steering, to be changed and deployed quickly from a central controller. This enables the network team to keep pace with the fast-changing requirements of agile application development sprints. Fixed contracts and static configurations are antithetical to agility, and while low latency is desirable, it is the ability to rapidly change policy that is most critical.

Cisco TrustSec is a technology designed for micro-segmentation. It decouples access control from network topology (IP addresses and VLANs). When a user or device authenticates, it is assigned a Security Group Tag (SGT). This tag is carried with the traffic (e.g., in a special header) and used by network devices to enforce policies defined in a central matrix. This allows for dynamic, attribute-based policy enforcement, which is a cornerstone of zero-trust and micro-segmentation. VRF-Lite provides macro-segmentation at Layer 3, and ACLs are static and difficult to manage at scale for this purpose.

VXLAN EVPN Multi-Site is the standard architecture for interconnecting separate VXLAN EVPN fabrics. It introduces a new component, the Border Gateway (BGW), which connects to the DCI. The BGWs use EVPN to exchange reachability information between sites, effectively extending the L2/L3 overlay. This design maintains separate underlay and control planes for each site, creating distinct failure domains, while providing active/active forwarding and loop prevention for stretched segments. Stretching the underlay or using back-to-back vPC would merge the failure domains and is not a recommended scalable design.

To provide shared L3Out services while maintaining tenant isolation, the L3Out is configured in the 'common' tenant. The key step is to define the external network (External EPG) subnets with the scope set to 'Shared between VRFs'. This allows routes to be leaked from the common VRF to tenant VRFs without merging the VRFs themselves, thus maintaining routing table isolation. The other options either fail to share the L3Out, merge routing tables, or are not standard ACI practice.

This design requires two policies. First, a centralized control policy is used to influence the routing path, setting a higher preference for TLOCs at DC1 for the specific application prefixes. This handles the primary path selection. Second, an application-aware routing (AAR) policy is needed to monitor path performance. This policy defines an SLA class (e.g., loss > 20%) and specifies that if the preferred path (to DC1) violates this SLA, traffic should be moved to an alternate path (to DC2). Data policies are for packet manipulation, and localized policies would not be efficient for this global requirement.

This statement is true. LISP is the fundamental control plane protocol in the SD-Access fabric. It separates the endpoint identity (EID), which is the IP or MAC address, from its location (RLOC), which is the loopback address of the fabric edge switch where the endpoint is connected. The LISP Map-Server/Map-Resolver functionality, running on the control plane nodes, maintains this dynamic EID-to-RLOC mapping database.

In an SD-Access solution, Cisco Identity Services Engine (ISE) is the component responsible for device profiling, authentication, and authorization. Upon successful authentication, ISE assigns a Security Group Tag (SGT) to the endpoint (e.g., SGT for IoT_Devices). Cisco TrustSec technology, which is integrated into the fabric, uses these SGTs to enforce security policies. A matrix-based policy in ISE/DNA Center would define that the 'IoT_Devices' SGT can only talk to the 'Video_Server' SGT, and this policy is enforced at the ingress fabric edge node. LISP/VXLAN are control/data plane protocols, while DNA Center is the orchestrator; they are part of the solution but not the primary components for dynamic policy assignment and enforcement.

Local Preference is the correct attribute for influencing outbound traffic path selection within an autonomous system. It is a well-known, discretionary attribute that is exchanged between iBGP peers. By setting a higher Local Preference (default is 100) on routes learned from the primary provider (AS 65100), all routers within AS 65300 will prefer that path to exit the network. AS-Path prepending influences inbound traffic, and MED is considered after Local Preference and is typically used to influence how a neighboring AS enters your network.