400-007 Exam Dumps - Cisco CCDE v3.0 Questions and Answers

D (Queue thresholding on the host subinterface):Protects CPU resources by limiting the amount of control plane traffic destined to the router itself.

E (Port filtering on the host subinterface):Allows fine-grained filtering of control plane traffic based on specific protocols or ports, protecting sensitive processes like routing protocols or management access.

Other options explained:

A, B, C: Transit subinterfaces protect forwarding plane transit traffic, not traffic destined to the control plane.

A (EoMPLS): Ethernet over MPLS can operate at Layer 2, and MACsec can encrypt traffic before entering the MPLS core.

E (KVPLS): Supports MACsec encryption for Layer 2 DCI services over VPLS solutions.

Why other options are incorrect:

B: MPLS L3 VPN operates at Layer 3, not suitable for MACsec (L2 encryption).

C: DMVPN uses IPsec, not MACsec.

D: GET VPN uses IPsec for L3 traffic encryption.

—

SNMPv1 and SNMPv2c use plaintext community strings and lack built-in encryption or authentication, making them vulnerable to various attacks, including spoofing and message tampering. SNMPv3 addresses these weaknesses by introducing:

Authentication (to prevent impersonation or "masquerade")

Encryption (privacy)

Message integrity

“Masquerade threats” involve an attacker pretending to be a trusted source, which SNMPv3 can prevent via cryptographic authentication mechanisms.

Although SNMPv3 does provide improved security features like integrity and privacy, it is not specifically designed to mitigate volumetric attacks like DDoS or dictionary brute-force. SNMPv3 does not inherently stop man-in-the-middle attacks unless secure key exchanges and trusted paths are fully enforced, which may require additional protocols.

==========

Table Description automatically generated

The Host Subinterface in Control Plane Protection (CPPr) protects traffic destined to the router itself (e.g., routing protocols, management traffic).

This is critical in preventing DoS or CPU exhaustion attacks targeting control plane services directly.

Why other options are incorrect:

B: Main interface refers to the global control plane policy but lacks the granularity.

C: Transit subinterface protects transit traffic handled by the forwarding plane.

D: CEF-exception handles non-IP or exception traffic, not regular control plane IP traffic.

—

The SD-WAN architecture separates roles by function:

Orchestration Plane: Handles device lifecycle functions such as zero-touch provisioning (ZTP) and certificate distribution. It facilitates onboarding into the overlay securely and automatically.

Control Plane: Makes forwarding decisions and shares route and policy information.

Data Plane: Forwards packets.

Management Plane: Provides visibility, analytics, and template-based policy configuration.

Option A correctly identifies orchestration as the ZTP and bootstrapping component.

B (Strong cryptography for cardholder data):PCI DSS requires strong cryptographic protocols (e.g. TLS 1.2 or higher) to protect sensitive data during processing and storage.

C (Strong encryption for transmission):Data-in-transit across public or untrusted networks must be encrypted using strong protocols to comply with PCI DSS.

Other options explained:

A/D/E: These are general security best practices but not directly tied to TLS upgrade compliance for cardholder data under PCI DSS.

Automation: The execution of individual tasks or configurations without manual intervention.

Orchestration: The coordination and sequencing of multiple automation tasks into structured workflows to achieve complex operational goals.

Why other options are incorrect:

B, C, D: They incorrectly define orchestration as either partially manual, parallel execution, or limited to commercial tools, which is not accurate in design principles.

—

Interface dampening is primarily designed to suppress rapid, repetitive interface flaps (high-frequency short-duration flaps), which can cause instability in routing protocols and excessive reconvergence events.

When many brief interface failures happen, dampening delays the routing protocol’s reaction until the interface remains stable.

This helps prevent control-plane churn in fast-converging designs.

This approach is emphasized in CCDE v3.1 design principles where balance between stability and convergence is required.

Why other options are incorrect:

A: Occasional long-duration flaps don’t require dampening.

C & D: Hardware speed mismatches are better handled by carrier-delay or debounce-timer mechanisms, not dampening.

B (OpenFlow):OpenFlow is a widely used SDN southbound protocol that enables controllers to directly manage forwarding tables of switches.

D (Open vSwitch Database - OVSDB):OVSDB is used by SDN controllers (especially in virtualized environments) to manage configuration state and flow entries on Open vSwitch instances.

Other options explained:

A/C: Non-existent protocols.

E: NetFlow is a traffic monitoring protocol, not a control interface for SDN controllers.