400-007 Exam Dumps - Cisco CCDE v3.0 Questions and Answers

???? Explanation:

B: To prefer ISP 1 for outbound traffic, advertise a longer AS path to ISP 2 (so it ' s used as backup). To prefer ISP 1 for inbound traffic, you want ISP 2 to receive a higher MED, making it less preferred. These changes signal to both ISPs and remote ASes to prioritize the ISP 1 path.

Other options:

A: Local preference is set inbound by your own routers, not outbound to ISPs.

C: Local preference affects only your own AS, and more specific routes are better advertised on primary links, not secondary.

D: Advertising less specific routes does not help establish control over preference cleanly.

==========

???? QUESTION NO: 387 [Security, Automation, and Policy Integration in Design]

Which three components support enforcing security policy compliance for devices attempting network access? (Choose three)

A. Posture agent

B. Audit and decision point servers

C. Management and reporting tools

D. Endpoint security application

E. Network access devices

F. Web filtering devices

Answer: A, B, E

???? Explanation:

A: Posture agents assess the health of endpoints (e.g., antivirus status, OS patching).

B: Decision servers (e.g., Cisco ISE) enforce access decisions based on posture and policies.

E: Network access devices (e.g., switches, WLCs, routers) apply access controls based on server instructions (802.1X, NAC).

Other options:

C: Management tools are for visibility—not enforcement.

D: While useful, endpoint AV/firewalls act independently—not part of policy enforcement infrastructure.

F: Web filters do not participate in initial access decisions.

==========

???? QUESTION NO: 388 [Security, Automation, and Policy Integration in Design]

When are Network Behavior Anomaly Detection (NBAD) systems better than signature-based systems? (Choose two)

A. Malware detection

B. Encrypted threat traffic

C. Spyware detection

D. Intrusion threat detection

E. New zero-day attacks

Answer: B, E

???? Explanation:

B: Signature-based systems cannot inspect encrypted payloads effectively, whereas NBAD relies on traffic behavior.

E: NBAD identifies deviations from known good behavior, allowing detection of previously unknown (zero-day) threats.

Incorrect Options:

A, C, D: These are often more accurately detected using signature-based approaches where known

???? QUESTION NO: 389

[Main Topic: Security, Automation, and Policy Integration in Design]

A company is adopting IPv6 in a dual-stack campus network. The first IPv6-only application is now hosted in the data center. To prevent a malicious user from masquerading as the IPv6 default gateway, which two mechanisms should be used? (Choose two)

A. IPv6 RA guard

B. IPv6 snooping

C. IPv6 device tracking

D. IPv6 address glean

E. port ACLs

Answer: A, E

???? Comprehensive and Detailed Explanation (CCDE v3.1 aligned):

A. IPv6 RA Guard:This feature helps mitigate rogue router advertisements (RAs), which attackers can use to spoof the default gateway in an IPv6 environment. RA Guard drops unauthorized or unexpected RAs at the access layer switch ports, preventing malicious devices from advertising themselves as routers.

E. Port ACLs (PACLs):Port-based ACLs can restrict which devices are allowed to send or receive RA packets on switch ports. By tightly controlling which sources can send traffic (including RA messages), port ACLs help prevent spoofing attempts.

Other Options:

❌ B. IPv6 Snooping:Not a standard or widely supported security feature; it is sometimes used synonymously with device tracking but is not a direct mitigation for spoofed RAs.

❌ C. IPv6 Device Tracking:Useful for monitoring IP-to-MAC bindings, but it does not prevent spoofing or gateway impersonation.

❌ D. IPv6 Address Glean:Primarily used for learning IPv6 addresses from traffic for things like DHCPv6 relay; not a security feature.

CCDE Blueprint Alignment:

Topic: Security, automation, and policy integration in design

Subdomain: IPv6 security, access control, rogue device prevention.

Let me know if you ' d like the next question explained!

—

In this scenario, the application itself duplicates data transmission across two separate NICs on Host A, with the intention that at least one copy will reach Host B, regardless of any single path or link failure. While this increases redundancy at the application and host level, the underlying network must also support rapid failure recovery to avoid packet loss during convergence events.

Among the options provided:

A. EIGRP with feasible successors provides pre-computed backup routes but still requires routing protocol convergence upon failure, which could result in millisecond-scale interruption—enough to cause data loss if packets are in transit.

B. BFD (Bidirectional Forwarding Detection) offers rapid detection of link failures, but by itself does not provide traffic redirection or packet protection; it simply informs the routing protocol faster.

D. Static routes lack dynamic convergence capabilities and would not offer high availability across dynamic failure points unless manually configured with tracking—still less responsive and scalable.

C. IP Fast Reroute (IP FRR) is specifically designed to offer sub-50ms convergence time by pre-installing backup paths in the forwarding plane. Upon detecting a failure, traffic is immediately switched to the pre-computed alternate path without waiting for the routing protocol to reconverge. This ensures minimal disruption and best supports lossless delivery for high-availability applications.

IP FRR is consistent with CCDE v3.1 design principles where sub-second convergence and resiliency are critical in mission-critical enterprise and data center architectures.

In IPv6, routers advertise prefixes via Router Advertisement (RA) messages. An attacker could inject rogue RAs to manipulate the IPv6 configuration of endpoints.

Router Advertisement Guard (RA Guard) blocks unauthorized RA messages from being received on access ports, preventing endpoints from receiving incorrect IPv6 prefixes from malicious or misconfigured devices.

This security feature is crucial when devices have IPv6 enabled but the network is IPv4-only.

Other options explained:

A: Source Guard and Prefix Guard enforce valid address and prefix assignment but do not prevent RA spoofing directly.

C: Prefix Guard focuses on controlling prefixes being assigned, not blocking RA messages.

D: Secure Neighbor Discovery (SEND) provides cryptographic protection but is rarely deployed due to complexity.

The hierarchical LAN design model — access, distribution, core — provides:

Scalability through structured hierarchy (A).

Easier change management and staged deployments since functions are isolated at each layer (E).

CCDE v3.1 emphasizes hierarchy for long-term scalability, manageability, and operational stability.

Why other options are incorrect:

B: Modern data centers favor spine-leaf over traditional hierarchy.

C: The model simplifies rather than complicates.

D: Simplification is not its primary advantage — scalability and modularity are.

—

In a standard 3-tier data center architecture (access, aggregation, core), the Layer 2-to-Layer 3 boundary typically resides at the aggregation layer. When extending VLANs between data centers using a Layer 2 interconnection, the most optimal and scalable termination point is at the aggregation layer because:

It naturally handles VLAN demarcation and Layer 3 boundary.

Spanning Tree Protocol (STP) domains remain contained within local aggregation blocks.

The core remains Layer 3-only, ensuring scalability, stability, and no STP involvement.

Simplifies traffic engineering, FHRP operations, and minimizes control-plane complexity across sites.

This design is consistent with CCDE v3.1 best practice where VLAN extension is isolated to aggregation to avoid STP scaling issues and maintain hierarchical design principles.

Why other options are incorrect:

A: STP isolation can still be achieved at aggregation while keeping the core Layer 3.

C: Access layer extensions would increase STP scope and complexity unnecessarily.

D: Core termination violates Layer 3 core design, bringing STP into the core, which is not scalable.

The scenario prioritizes:

In-house management (not managed services)

Scalability (exponential branch growth)

OPEX reduction (low operational cost)

SD-WAN over L3VPN offers a balance of:

Mid-level ISP cost (leveraging L3VPN as transport)

Centralized management and automation (ZTP, templates)

Support for segmentation, application-aware routing, and path control

Lower OPEX due to simplified configuration and monitoring

Managed SD-WAN has higher ISP and OPEX cost, and DMVPN is more manual and complex to scale. SD-WAN over L2VPN might reduce ISP cost but is less common and not optimal for rapid scalability.

In modern network architectures, particularly those using NFV (Network Function Virtualization),Service Chainingis used to direct traffic through a sequence of virtualized network functions (VNFs)—such as firewalls, load balancers, NAT devices, etc.—based on service requirements.

Service chaining allows:

Dynamic or policy-based redirection of traffic through VNFs

Simplified orchestration of network services

Scalability and flexibility across multi-tenant or virtualized environments

CCDE v3.1 emphasizes service chaining as a key enabler in cloud-native and virtualized architectures, ensuring services are efficiently composed based on application or security needs.

Why other options are incorrect:

A and E (Bridging/Switching): Refer to traditional Layer 2 forwarding and do not provide VNF sequencing logic.

C and D: “Linking” and “Daisy chaining” are not standard or scalable methods in NFV environments.