Free Practice Questions for Cisco 400-007 Exam

When unmanaged switches are connected to access ports, there's a risk that they may start participating in Spanning Tree Protocol (STP) or introduce loops. BPDU Guard is the most effective mechanism to mitigate this risk:

BPDU Guard disables a port immediately upon receiving any BPDU, ensuring that only end hosts (non-switch devices) are connected to access ports.

This protects the stability of the STP topology by preventing accidental or malicious introduction of switches into the Layer 2 domain.

Other options explained:

A (PortFast): Accelerates port transition to forwarding state but does not protect against loops caused by BPDUs.

B (UDLD): Detects unidirectional physical link failures but not STP participation.

C (Root guard): Prevents the connected device from becoming a root bridge but still allows BPDUs.

—

The hierarchical LAN design model — access, distribution, core — provides:

Scalability through structured hierarchy (A).

Easier change management and staged deployments since functions are isolated at each layer (E).

CCDE v3.1 emphasizes hierarchy for long-term scalability, manageability, and operational stability.

Why other options are incorrect:

B: Modern data centers favor spine-leaf over traditional hierarchy.

C: The model simplifies rather than complicates.

D: Simplification is not its primary advantage — scalability and modularity are.

—

A (VXLAN offers native loop avoidance): VXLAN uses Layer 3 underlay with encapsulation, inherently avoiding Layer 2 loops common in traditional Layer 2 fabrics.

Why other options are incorrect:

B: Storm control mitigates broadcast storms but doesn't prevent loops.

C: vPC+ helps but doesn’t replace VXLAN's loop-free architecture.

D: BPDU Guard helps protect edge ports, but loop prevention in VXLAN is primarily handled by its Layer 3 foundation.

The design requires scalability, centralized credential management, device independence, and role-based access:

B (Central authentication directory): A centralized directory (such as Active Directory, RADIUS, or LDAP) allows the VPN solution to leverage existing user credentials, support role-based access control, and scale easily.

F (SSL VPN): Provides remote access VPN services that support a variety of client devices, including unmanaged or personal devices, without requiring device certificates. SSL VPN is well-suited for scenarios where users may not always use the same device.

Other options explained:

A: Local usernames/passwords do not scale to thousands of users and lack centralized policy control.

C/E: Certificates would require device management and may not be feasible if users switch devices.

D: IPsec VPN can work, but typically requires more complex client configuration and may not support flexible device usage as well as SSL VPN.

—

Application performance depends on the end-to-end delay experienced by the traffic, which includes:

Queuing delay at each device.

Serialization delay based on link speed and packet size.

Propagation delay.

For the application to meet its performance SLA, the total of all delays (queuing + serialization + propagation) must remain within the application's maximum tolerable delay budget. This is critical for delay-sensitive applications such as voice or real-time video.

This directly aligns with CCDE v3.1 business-driven design, where application requirements dictate network performance guarantees.

Why other options are incorrect:

A: Focusing on individual devices ignores cumulative delay.

B: Uniform queuing delay isn’t practical or necessary.

C: Default queue sizes are not always suitable for real-time applications.

—

DTLS (Datagram Transport Layer Security) is the most optimized overlay protocol for SDWAN deployments over public internet, especially when NAT traversal is required.

It combines security similar to TLS while using UDP, which handles packet loss, jitter, and reordering better than TCP-based TLS.

DTLS is natively supported in most SDWAN solutions for encrypted transport across NAT environments without complex configurations.

It allows optimal performance on unreliable or high-latency networks while maintaining strong security standards.

Why other options are incorrect:

A (TLS): Uses TCP, less suited for networks with packet loss or reordering.

C (IPsec): Requires additional NAT traversal mechanisms like NAT-T and may not handle unreliable underlay as effectively as DTLS.

D (GRE): Tunneling protocol without native encryption.

—

BGP-LS (BGP Link-State) distributes IGP topology information using BGP. When used in multi-area or multi-domain networks, BGP-LS allows for a centralized controller to receive topology information in a scalable way. BGP inherently runs over TCP, which provides reliable, ordered delivery using built-in flow control mechanisms.

The use ofTCP-based flow controlensures that even in large-scale networks where significant link-state information is exchanged, the flow of data between BGP peers remains efficient, controlled, and buffered according to the receiver's capacity. This makes it ideal for transporting massive amounts of LS data across wide areas and into SDN controllers for applications like traffic engineering or path computation.

Why other options are incorrect:

A, B, and C refer to mechanisms that are not implemented or leveraged by BGP.

TCP-based flow control is the only valid flow-control mechanism used in BGP sessions.

==========

To achieve sub-50ms protection against both link and node failures, MPLS TE Fast Reroute (FRR) with Next-Next-Hop (NNHop) protection is used:

Next-Next-Hop tunnels provide node protection by pre-establishing a detour that bypasses not only the immediate next-hop link but also the entire next node.

This ensures protection for both link and node failures, matching SONET/SDH resiliency targets.

Other options explained:

A & C: TE backup and FRR backup tunnels may only provide link protection depending on deployment.

B: Next-Hop tunnels address only link failures, not node failures.

D (Python):Python is widely used for network automation, configuration management, and scripting tasks. It simplifies repeatable network changes, validation, and integration with controllers and APIs, reducing deployment time.

Other options explained:

A: LISP is a routing protocol, not an automation tool.

B: Java is a general-purpose language but not commonly used for network automation.

C: "Conclusion" is not a tool.

B (OTV — Overlay Transport Virtualization): Allows Layer 2 extension across data centers while maintaining fault isolation by not extending STP across the WAN. Control plane handles MAC learning, which provides stability and loop avoidance between data centers.

Why other options are incorrect:

A: FabricPath is mainly for intra-data center Layer 2 fabric.

C: Advanced VPLS extends Layer 2 but carries STP across the WAN.

D: LISP operates at Layer 3, not for Layer 2 extension.

E: TRILL also focuses on intra-DC Layer 2 but not DCI fault isolation.

—