Free Practice Questions for Cisco 300-540 Exam

Comprehensive and Detailed Explanation

In Cisco high-availability LAN gateway designs, the requirement is:

Multiple L3 gateways sharing avirtual MAC and virtual IP

Ability toload balanceacross multiple active gateways

Capability toseamlessly take overgateway forwarding during a failure

Among Cisco First Hop Redundancy Protocols (FHRPs):

HSRP→ Active/standby only

VRRP→ Active/standby only

GLBP (Gateway Load Balancing Protocol)→The only FHRP providing active/active load balancing

GLBP allows multiple routers to share:

Acommon virtual IP

Multiplevirtual MAC addresses

Multipleactive forwardersthat load-balance end hosts

Automatic failover if any gateway fails

Thus, GLBP is the only correct protocol matching the requirement forredundant default gateways with load balancing and shared MAC addressing.

Comprehensive and Detailed Explanation

AnAPI logic flawis a weakness in the API’sbusiness logic— not in encryption or transport security. It occurs when:

API functions are misused

Business rules are bypassed

Security validation is missing

Workflow logic is incorrect

These issues cannot be solved through encryption (at rest or in transit). They require:

✔Vulnerability remediation

✔Fixing API code logic

✔Updating API validation, flow control, and authentication logic

Thus the correct answer isC. Remediation of vulnerabilities.

In an NFV environment following Cisco NFV Infrastructure and ETSI MANO architecture, the onboarding workflow for VNF deployment follows this high-level order:

Define VNF descriptors (VNFD and NSD)– Includes implementation details and service definitions.

Prepare virtual machine resources– Flavor, image, CPU/memory/storage, and placement.

Define the NFV network– This step builds the underlay/overlay connectivity needed for the VNF.– It includes virtual network creation, interfaces, VLs (Virtual Links), connection points, and mapping into OpenStack (Neutron networks, subnets, ports).– No VNF can be deployed until the NFV service networks (management, control, data, HA) are defined.

Apply Day-0 configuration– Bootstrapping/initial config.

Apply Day-1 operational characteristics– Routing, services, policies.

Configure operational monitoring (KPIs)– Performance and fault measurements.

Since the question states“after the VM resources are prepared”, the next mandatory stage is defining the virtual network connectivity on which the VNFs will operate.

Cisco NFVIS follows strict security controls. After a fresh deployment:

Thedefault admin credentials are considered insecure.

NFVIS requires the administrator toreset the default password on first login(typically via console or SSH).

Until the password is changed,REST API and web-portal access are denied, and attempts to access the portal or API returnHTTP 401 Unauthorized, even if the default credentials are provided.

This mechanism prevents use of factory-default passwords in production and is explicitly documented as a mandatory post-install step.

The other options are not the cause of a 401 error:

Enabling portal via SSH (B) is not required; HTTPS access is enabled by default once credentials are valid.

Restarting Tomcat (C) would address service availability issues (e.g., 5xx errors), not authentication.

Browser certificates (D) affect trust warnings (e.g., HTTPS certificate errors), not 401 Unauthorized.

On R1 the configuration (simplified) is:

ip domain lookup

ip domain name ccnp.test

ip host www.ccnp.test 10.1.1.1 10.2.1.1 10.3.1.1

The ip host command statically maps the hostname www.ccnp.test

to three IP addresses. By default, Cisco IOS will always return these IP addresses to DNS queries in the same order they are configured (10.1.1.1, then 10.2.1.1, then 10.3.1.1). This means that clients will always attempt 10.1.1.1 first and will not achieve per-query load balancing across all three servers.

To enable DNS-based load balancing so that each successive query rotates the order of the addresses, Cisco IOS provides the command:

ip domain round-robin

This command enables round-robin rotation of multiple A records associated with a single hostname defined by ip host. With this feature enabled:

1st query: response order 10.1.1.1, 10.2.1.1, 10.3.1.1

2nd query: response order 10.2.1.1, 10.3.1.1, 10.1.1.1

3rd query: response order 10.3.1.1, 10.1.1.1, 10.2.1.1

Clients will typically try the first IP address in the list and use the others if the first one fails, exactly matching the requirement.

Why other options are incorrect:

A. ip domain retry 3 controls how many times the router retries DNS queries to a server; it does not control the order of multiple A records.

C. ip dns server turns the router into a DNS server but does not itself provide round-robin behavior for statically defined hosts.

D. maximum-paths 3 is a routing (IP forwarding) parameter for equal-cost multipath, unrelated to DNS resolution.

In the diagram, thePE and R2, R3, R4, R5belong toAS 100. The PE router runs BGP processAS 100, so its BGP configuration must start with:

router bgp 100

To performiBGP multipath load sharingacross three equal-cost internal BGP paths, BGP must be instructed to keep and use multiple iBGP paths in the routing table. This is done with:

router bgp 100

maximum-paths ibgp 3

maximum-paths ibgp 3 tells BGP to install up tothreeiBGP paths to the same prefix, enabling CEF to load-share across those paths.

router bgp 100 is required because the PE is inAS 100, not 101.

Other options:

ip load-sharing per-destination affects CEF behavior but does not enable BGP iBGP multipath by itself and is not specific to three iBGP paths.

ip load-sharing ibgp 3 is not a valid IOS BGP command.

router bgp 101 would configure the wrong AS and break the iBGP relationships shown in AS-100.

Thus, the correct commands on the PE to achieve iBGP multipath load sharing over the three internal paths aremaximum-paths ibgp 3androuter bgp 100, corresponding toA and E.

Comprehensive and Detailed Explanation

SNMP traps in Cisco NFVIS (and in SNMP generally):

Areunsolicited notifications

Sent from the NFVIS deviceto the SNMP manager

Indicate alarms, changes, or significant operational events

Donotrequire polling

Examples:

Disk failures

VM crashes

Host status changes

Resource alarms

Why the others are wrong:

Adescribes SNMP monitoring (done by the manager with GET requests)

BSNMP cannotcontrolhost activities

DSNMP GET retrieves a variable, but traps sendunsolicitednotifications

Thus, the correct answer isC.

In Cisco NFVI, themanagement noderelies heavily on Docker containers for:

NFVIS management functions

VIM services

Orchestration components

If the management node fails to start and the system shows:

docker.service: inactive (dead)

…then all Docker-based platform services also fail to start.

The correct recovery action is torestart the Docker engine:

systemctl restart docker

This brings up:

All NFVI-required Docker containers

Management services

REST APIs and cluster components

Why other answers are incorrect:

docker-kibana→ Only affects Kibana logging container

docker-cobbler→ Used for provisioning, not core NFVI management

kube-apiserver→ Part of Kubernetes cluster, but relies on Docker; restarting it won’t help until Docker is running

Thus, the correct answer isB. docker.