400-007 Exam Dumps - Cisco CCDE v3.0 Questions and Answers

This scenario describes a centralized control mechanism where:

The SDN controller learns the network topology using BGP Link-State (BGP-LS).

The controller installs control-plane policies using protocols like PCEP or BGP.

Policies are pushed centrally and result in new RIB entries at the routers.

This is the hallmark of a centralized SDN architecture:

The controller has a global view and decision-making logic.

Routers remain relatively simple in the control plane and act on instructions.

This aligns with CCDE v3.1 under the “Technology Comparisons and Use Cases” topic, where SDN models are compared:

Centralized SDN (controller-driven)

Distributed SDN (traditional)

Hybrid (a blend of both, which is not represented here)

==========

Text Description automatically generated

C (Both modes use control packets):Regardless of whether echo packets are used, BFD asynchronous mode always relies on periodic transmission of control packets to verify session liveliness.

E (Echo mode uses separate packets):When echo is enabled, the echo packets are transmitted in addition to control packets, providing even faster failure detection by relying on data plane processing.

Other options explained:

A: Control and echo packets are never combined into a single packet.

B: Both modes always use control packets; echo packets are optional.

D: BFD echo packets are locally looped, not reflected back from the remote device.

B (BFD Echo):BFD Echo mode uses local hardware-based loopback mechanisms for even faster fault detection than regular BFD asynchronous mode, significantly reducing failure detection time and thus convergence delay.

Other options explained:

A/D: OSPF fast hellos improve OSPF detection but are still control-plane driven and slower than hardware-based BFD Echo.

C: BGP is slower to converge than OSPF, especially for IGP-like designs.

???? QUESTION NO: 382 [Protocol Design Implications]

During IPv6 deployment in a legacy network, what must be considered for older Layer 2 switches? (Choose two)

A. If IPv6 anycast deployment is planned, then make sure that Layer 2 switches support DHCPv6 snooping

B. If IPv6 anycast deployment is planned then make sure that Layer 2 switches support ND snooping

C. IPv6 is transparent on Layer 2 switches so no changes are needed to the Layer 2 switches

D. If IPv6 multicast deployment is planned, then make sure that Layer 2 switches support MLD snooping

E. If IPv6 anycast deployment is planned, then make sure that Layer 2 switches support ICMPv6 snooping

Answer: C, D

???? Explanation:

C: IPv6 functions at Layer 3, and Layer 2 switches (which do not inspect or modify Layer 3 headers) typically forward IPv6 frames transparently just like IPv4—unless enhanced services are needed.

D: For efficient IPv6 multicast handling (e.g., neighbor discovery, multicast services), switches should support MLD snooping (equivalent to IGMP snooping for IPv4).

Incorrect options:

A, B, E: DHCPv6 snooping, ND snooping, and ICMPv6 snooping are not standard or widely implemented features in Layer 2 devices. They ' re also unnecessary for basic IPv6 forwarding.

==========

???? QUESTION NO: 383 [Business-Driven Design Approaches]

Which two business areas support continuity during emergencies by understanding data flows and business processes? (Choose two)

A. Decentralized device management

B. BYOD policy

C. Disaster recovery

D. Centralized device management

E. Business continuity

Answer: C, E

???? Explanation:

C: Disaster Recovery focuses on restoring services and data after a catastrophic event.

E: Business Continuity is a broader framework ensuring operations can continue despite disruptions. Both require knowledge of critical data flows and dependencies.

Other options:

A and D: Device management is operational—not directly focused on emergency business continuity.

B: BYOD is a policy concern related to access and security, not continuity.

==========

???? QUESTION NO: 384 [Security, Automation, and Policy Integration in Design]

Two companies want a VPN tunnel to exchange HTTP REST APIs. Only data integrity (not confidentiality) is required. Devices have limited resources.

A. GRE tunnel

B. GRE over IPsec

C. IPsec ESP

D. IPsec AH

Answer: D

???? Explanation:

D: IPsec Authentication Header (AH) provides integrity and authentication, but not encryption. It’s ideal when data confidentiality is handled at the application layer and minimal overhead is desired.

Incorrect options:

A: GRE is a tunneling protocol, but it does not provide integrity or security.

B: GRE over IPsec is more complex and includes encryption (not needed here).

C: IPsec ESP provides encryption and integrity—overkill for this use case.

==========

???? QUESTION NO: 385 [Security, Automation, and Policy Integration in Design]

What is a key benefit of Infrastructure as Code (IaC)?

A. Declarative pipelines

B. Configuration drift

C. Agent monitoring

D. Repeatable deployments

Answer: D

???? Explanation:

D: Repeatable deployments are one of the core benefits of IaC. It allows infrastructure to be provisioned consistently every time using version-controlled templates.

Incorrect options:

A: Declarative pipelines relate more to CI/CD processes than directly to IaC.

B: IaC helps prevent configuration drift, but drift itself is a problem—not a benefit.

C: Agent monitoring is a function of monitoring tools, not IaC.

C: MPLS TE (Traffic Engineering) is designed to optimize IP traffic flow by considering bandwidth constraints, delay sensitivity, and administrative policy. It enables operators to steer traffic based on defined metrics rather than pure shortest-path IGP routes.

Other options:

A: MPLS TE can coexist with LDP and still rely on IGP for link-state info; it does not replace LDP.

B: MPLS TE by itself doesn’t provide protection; it requires Fast Reroute (FRR) mechanisms like link/node protection extensions.

D: MPLS TE is independent of VPN topology; it can operate without requiring a full-mesh of Layer 3 VPNs.

==========

A (Device resiliency):Hardware redundancy (dual power supplies, supervisor modules, etc.) ensures device uptime.

D (Network resiliency):Redundant links, fast failover mechanisms, and loop-free designs ensure the overall network remains operational during failures.

Other options explained:

B: Device type is secondary if resiliency features are built-in.

C: Network type is not directly related to resiliency.

E: Network size influences scale, not availability.

Comprehensive and Detailed Explanation:

C: Moving workloads or backup/recovery functions to cloud platforms reduces capital expenditure by avoiding the cost of physical infrastructure, data centers, and maintenance. Cloud-based DRaaS (Disaster Recovery as a Service) offers scalability, resilience, and cost efficiency aligned with an OPEX model.

Other options:

A and B are security and software lifecycle tasks, not cost-effective DR strategies.

D increases CAPEX by building and maintaining additional infrastructure.

==========