300-540 Exam Dumps - Cisco CCNP Service Provider Questions and Answers

In an NFV environment following Cisco NFV Infrastructure and ETSI MANO architecture, the onboarding workflow for VNF deployment follows this high-level order:

Define VNF descriptors (VNFD and NSD)– Includes implementation details and service definitions.

Prepare virtual machine resources– Flavor, image, CPU/memory/storage, and placement.

Define the NFV network– This step builds the underlay/overlay connectivity needed for the VNF.– It includes virtual network creation, interfaces, VLs (Virtual Links), connection points, and mapping into OpenStack (Neutron networks, subnets, ports).– No VNF can be deployed until the NFV service networks (management, control, data, HA) are defined.

Apply Day-0 configuration– Bootstrapping/initial config.

Apply Day-1 operational characteristics– Routing, services, policies.

Configure operational monitoring (KPIs)– Performance and fault measurements.

Since the question states“after the VM resources are prepared”, the next mandatory stage is defining the virtual network connectivity on which the VNFs will operate.

In Cisco data center and cloud-scale designs, adouble-sided vPC(also called vPC-to-vPC) is used when both ends of a Layer 2 port channel are formed by a pair of switches that operate as vPC peers. In this model:

On the aggregation or leaf side, two switches (in this case,LEAF1 and LEAF2) form a vPC domain with a vPC peer-link and keepalive.

On the access or ToR side, two switches (in this case,TOR1 and TOR2) must also form their ownvPC domainwith a peer-link and vPC keepalive.

The port-channel that interconnects the two vPC domains is then configured as a vPC on both sides, creating a vPC-to-vPC topology.

The problem statement specifies thatLEAF1 and LEAF2 are already configured as vPC peers. For a double-sided vPC to work, the other side (TOR1 and TOR2) must also behave as a single logical entity for the downstream Cisco UCS server and for the upstream vPC connection towards LEAF1 and LEAF2. This is only achieved when TOR1 and TOR2 are configured as vPC peers with:

A vPC domain ID

A vPC peer-link between TOR1 and TOR2

vPC member port-channels towards LEAF1 and LEAF2 and towards the Cisco UCS server

Therefore, the next required step is to configure avPC between TOR1 and TOR2.

Evaluation of the options:

Option A, “Add all the switches to the fabric,” is generic and not specific to vPC configuration. It does not address the technical requirement to form a vPC domain on the ToR side.

Option B, “Configure peering between LEAF1 and LEAF2 and TOR1 and TOR2,” is incorrect because vPC peering is only configured between the two switches that form each vPC domain (LEAF1–LEAF2 and TOR1–TOR2), not across all four switches together.

Option C, “Configure MSTP between TOR1 and TOR2,” is not required for establishing a double-sided vPC. vPC designs rely on the vPC control plane and the peer-link, not on spanning-tree between the vPC peers for normal operation.

Option D, “Configure a vPC between TOR1 and TOR2,” correctly describes configuring TOR1 and TOR2 as a vPC pair (vPC domain with peer-link), which is the mandatory step to create a double-sided vPC topology with LEAF1 and LEAF2.

Comprehensive and Detailed Explanation

SNMP traps in Cisco NFVIS (and in SNMP generally):

Areunsolicited notifications

Sent from the NFVIS deviceto the SNMP manager

Indicate alarms, changes, or significant operational events

Donotrequire polling

Examples:

Disk failures

VM crashes

Host status changes

Resource alarms

Why the others are wrong:

Adescribes SNMP monitoring (done by the manager with GET requests)

BSNMP cannotcontrolhost activities

DSNMP GET retrieves a variable, but traps sendunsolicitednotifications

Thus, the correct answer isC.

Comprehensive and Detailed Explanation

In Cisco NFVI security architecture, the primary defense againstlateral movement(an attacker moving from one compromised node to another) isnetwork segmentation.

Segmentation:

Separates workloads (compute, storage, management, tenant networks)

Prevents attackers from pivoting inside the NFVI

Reduces blast radius during breaches

Enforces micro-segmented virtual network boundaries

WPA protects Wi-Fi, not NFVI.

WAF protects web apps, not internal movement.

Data encryption protects confidentiality, not lateral movement control.

Thus,network segmentationis the correct solution.

Comprehensive and Detailed Explanation From Cisco SP Cloud Network Infrastructure Security Knowledge

Cloud security compliance frameworks (such as ISO 27001, PCI-DSS, GDPR, SOC 2, HIPAA) require:

Evidence of security events

Retention of logs for audit periods

Ability to generate compliance reports

Traceability and accountability

Incident investigation support

Effective log management enables:

Centralized collection of application, network, and system logs

Storage of logs for mandated retention periods

Generation ofaudit-ready reports

Documentation required for compliance assessments

Demonstration that monitoring and security controls are active and functioning

Therefore, the role of log management in regulatory compliance is primarily aboutdocumentation, traceability, auditing, and reporting, which aligns only with Option A.

The other options do not directly serve regulatory compliance requirements:

Brelates to resource optimization, not compliance.

Crefers to interoperability, which is unrelated to regulatory auditing.

Dimproves security but does not directly address compliance documentation.

For asite-to-site IPsec VPN, each peer must point to thereachable IP address of the remote VPN endpoint—that is, the IP address on the WAN/Internet-facing interface of the remote router.

From the diagram:

R1 outside (toward Internet):192.168.10.1

R2 outside (toward Internet):192.168.20.2

Inside LANs:

Site 1:10.1.0.0/24

Site 2:10.2.0.0/24

The crypto map on R1 uses:

crypto map mymap 10 ipsec-isakmp

set transform-set myset

match address 101

set peer

The must be the IP address where R1 can actually reach the IPsec peer, which is R2’s Internet-facing interface192.168.20.2.

If the peer were configured with a LAN IP such as 10.2.0.1 (site 2’s internal gateway), IKE packets would never reach the remote router because that address is not routable over the Internet.

Therefore, the correct command to bring up the VPN is:

set peer 192.168.20.2

Option A (10.1.0.1)– local LAN IP (R1’s side), not the remote endpoint.

Option C (192.168.10.1)– R1’s own WAN IP, not the remote peer.

Option D (10.2.0.1)– remote LAN IP, not reachable directly over the Internet.

Phase 1 of an IPsec tunnel (ISAKMP/IKE) must havematching proposalson both peers for:

Encryption algorithm

Hash (integrity) algorithm

Authentication method

DH group

The requirement states thatAESandSHA-256must be used. The current configuration uses:

encryption 3des → incorrect (must be AES)

hash md5 → incorrect (must be SHA-256)

To meet the requirement, we must modify the ISAKMP policy:

crypto isakmp policy 10

encryption aes ← change 3DES to AES

hash sha256 ← change MD5 to SHA-256

authentication pre-share

group 12

Therefore, the necessary commands on PE1 are:

encryption aes→ optionB

hash sha256→ optionE

Options C and D are invalid syntax (encryption sha256 and hash aes are not supported). Changing the DH group (A) is not required by the problem statement and would not by itself fix the mismatch related to encryption and hash algorithms.

Comprehensive and Detailed Explanation

Cisco NFVIS logging levels (from lowest to highest):

critical

error

warning

info

debug←highest verbosity

To capture maximum diagnostic detail, engineers must enabledebuglogging on theoperational log type, which records system activity and runtime behavior.

Thus the correct command is:

system set-log logtype operational level debug

This provides the deepest troubleshooting visibility.

Cisco Umbrella DNS-layer security:

Blocks malicious domains used inphishing,malware,C2 communications, andransomware

Stops threatsbeforeconnections are made

Uses DNS-based filtering and threat intelligence

It doesnotmitigate:

DDoS (needs scrubbing centers)

Brute force login attempts

Zero-day exploits directly

Thus,Ais correct.

In a BGP EVPN VXLAN multi-homing design, Ethernet Segment Identifiers (ESIs) are used to represent a set of links from one or more leaf switches to the same downstream device (such as a CE, firewall, or aggregation switch). By default, when multiple leafs share the same ESI, the EVPN design supportsall-activeredundancy, where all participating leafs can forward traffic for that Ethernet segment simultaneously.

However, some use cases—like connecting to devices that do not support multipath forwarding or for strict active/standby redundancy—requiresingle-activemulti-homing. In single-active mode, only one leaf in the Ethernet segment forwards traffic at any time; the other leaf(s) act as standby and only take over if the active node fails. This behavior is explicitly controlled in the EVPN Ethernet-segment configuration.

On Cisco platforms for EVPN VXLAN fabrics, this is configured under thel2vpn evpn ethernet-segmentstanza using the command:

l2vpn evpn ethernet-segment 1

identifier type 0 01.01.01.10.10.10.10.10.10.10

redundancy single-active

identifier type 0 ... defines the ESI for the multi-homed connection.

redundancy single-active specifies that only one leaf in that ESI is allowed to be active at a time, thus enablingdual-homing with single-active redundancy.

The other options do not relate to Ethernet-segment redundancy mode:

B. default-gateway advertiseis used in EVPN anycast gateway configurations to advertise the default gateway MAC/IP, not for ESI redundancy.

C. replication-type staticis associated with multicast or ingress replication behavior for VXLAN VTEPs, not Ethernet-segment redundancy.

D. vlan configuration 101is a VLAN configuration context command and has no effect on EVPN ESI redundancy.