400-007 Sample Questions & Answers

AWS Direct Connect provides a dedicated, private network connection from on-premises to AWS, which bypasses the public internet. This directly addresses the requirements for privacy, low latency, and consistent performance. Using a private Virtual Interface (VIF) connects to the VPC. To meet the encryption requirement for PCI, MACsec can be enabled on the Direct Connect link (for 10Gbps and higher connections) to provide Layer 2 encryption. This combination is superior to a VPN over the internet, which would have variable performance and higher latency, and is more direct than solutions involving SD-WAN or transit gateways for this point-to-point requirement.

RTO (Recovery Time Objective) is the target time within which a business process must be restored after a disaster or disruption to avoid unacceptable consequences associated with a break in business continuity. An RTO of 15 minutes means the network must be operational within that timeframe. RPO (Recovery Point Objective) is the maximum targeted period in which data might be lost from an IT service due to a major incident. An RPO of 1 hour means that backups or replications must be frequent enough that no more than one hour of data is lost.

In PIM-SM, the Rendezvous Point (RP) serves as a shared root for a shared multicast distribution tree (*,G). New multicast sources register with the RP, and new receivers send their IGMP joins towards the RP. This allows receivers to learn about active sources without the sources needing to know about all receivers, which is the core principle of sparse mode. Once a receiver begins pulling a stream from a source via the RP, its local router may switch to a source-based Shortest Path Tree (SPT) for a more optimal path.

Cisco's QoS best practice recommends marking voice bearer traffic (RTP) with DSCP 46, which corresponds to the Expedited Forwarding (EF) Per-Hop Behavior. The EF PHB is designed for low-loss, low-latency, low-jitter traffic and is typically serviced by a priority queue (LLQ) across the network. AF41 is commonly used for interactive video, CS3 for call signaling, and BE (or CS0) for default data traffic.

Operational Expenditure (OPEX) refers to the ongoing costs required for the day-to-day functioning of a business. In network design, this includes recurring costs like monthly circuit fees and annual support contracts. Capital Expenditure (CAPEX) refers to one-time purchases of physical goods or services, such as the initial purchase price of a router and the one-time installation fee.

IEEE 802.1X is the standard for port-based Network Access Control (NAC). It provides a framework for authenticating devices as they connect. A RADIUS server, such as Cisco Identity Services Engine (ISE), acts as the authentication server. ISE can be configured with complex policy sets that differentiate devices based on various attributes (e.g., certificate presence, user group) and enforce different EAP methods (EAP-TLS for corporate, PEAP for BYOD) accordingly. This provides the granular control needed for HIPAA compliance. WPA2-Personal and MAC filtering are not secure enough for this environment.

The primary purpose of the Route Distinguisher (RD) is to make a customer's non-unique IPv4 prefix (like 192.168.1.0/24) unique within the service provider's BGP table. The RD is a 64-bit value that is prepended to the customer's 32-bit IPv4 prefix, creating a unique 96-bit VPNv4 prefix. This allows the provider to carry routes for multiple customers who might be using the same private IP address space, without conflicts. Route Targets (RTs) are used to control the import/export of routes between VRFs.

VXLAN is an overlay technology that allows for the extension of Layer 2 segments over a Layer 3 underlay network. It encapsulates Layer 2 frames in UDP packets, effectively tunneling them across the IP fabric. This avoids STP by relying on the underlay's L3 routing (like ECMP) for loop-free paths. VXLAN supports up to 16 million logical networks (using the 24-bit VNI), making it highly scalable and ideal for multi-tenancy. vPC provides device-level redundancy but doesn't solve the larger STP scaling issue. FabricPath is an older L2 multipathing technology that has largely been superseded by VXLAN EVPN.

Of the options listed, only VRRP is an open IETF standard (RFC 5798). HSRP and GLBP are Cisco proprietary. While GLBP provides active-active forwarding, it is not an open standard. HSRP operates in an active-standby model. VRRP operates in an active-standby model per group, but you can configure multiple VRRP groups with different masters to achieve load balancing (an active-active design from the hosts' perspective). VRRP version 3 supports IPv4 and IPv6 and can achieve sub-second failover with aggressive timer tuning. Therefore, it is the only option that meets all criteria: active-active (via multiple groups), sub-second failover, and open standard.

L2TPv3 is an IETF standard specifically designed to tunnel various Layer 2 protocols (like Ethernet) over an IP network. It can encapsulate entire Ethernet frames, including broadcast frames, and transport them across a Layer 3 infrastructure. This makes it ideal for extending a Layer 2 domain for legacy applications. While GRE can tunnel IP packets and IPsec provides encryption, neither is purpose-built for transparently extending a Layer 2 broadcast domain in the way L2TPv3 is. OTV is a more complex data center interconnect technology.