Free Cisco 400-007 Practice Exam with Questions & Answers | Set: 10

Because asymmetric routing is occurring, strict uRPF (which requires the return path match) would block legitimate traffic. In this scenario, deploying uRPF loose mode is optimal:

Loose mode checks only for the existence of the source IP in the routing table, not the exact interface.

It provides protection against spoofed IP packets even if asymmetric routing occurs.

Why other options are incorrect:

A: Null0 static routes do not prevent spoofed source addresses.

B: Strict mode would incorrectly drop valid traffic due to asymmetry.

C: ACLs could help but may not scale or adapt dynamically to traffic patterns.

—

C (Class-Based Weighted Fair Queuing - CBWFQ): CBWFQ allows assigning bandwidth limits (in this case, 2 Mbps) to specific traffic classes, effectively controlling scavenger traffic without dropping excess packets unnecessarily.

Other options explained:

A: Policing drops excess traffic immediately rather than queuing.

B: LLQ is for delay-sensitive traffic, not scavenger control.

D: Shaping is useful but typically applied at interface level, not specific traffic classes.

B (Control plane is unavailable):In centralized SDN models where the controller has full exclusive configuration authority (lock), controller failure results in loss of control-plane functionality. No new flows can be programmed, and dynamic traffic adjustments cannot occur until the controller is restored.

Other options explained:

A: Devices typically continue forwarding existing flows but are not in read-only config mode.

C: Backups may still be available independently.

D: Manual changes are often restricted to preserve state consistency.

Comprehensive and Detailed Explanation:

Central command and control refers to a unified, centralized security policy and management platform that integrates and coordinates all security components—regardless of physical location or form factor (virtual, physical, cloud). It streamlines operations, reduces overhead, and improves visibility and control.

D is correct because central control simplifies policy enforcement and visibility.

A (threat-centric protection) focuses more on response and defense rather than architecture.

B (integrated actionable intelligence) refers to threat feeds, not central management.

C (distributed enforcement) is an implementation strategy, not a management component.

==========

B (Hybrid cloud): Combines private infrastructure with public cloud capabilities, offering flexibility for changing technology requirements while controlling operational expenses. The enterprise can invest CapEx in private resources while using public cloud elasticity for dynamic bandwidth or compute needs.

Hybrid solutions allow gradual migration and innovation while maintaining control and compliance over sensitive workloads.

Other options explained:

A: Private cloud limits flexibility and increases CapEx.

C: Public cloud minimizes CapEx but may increase OpEx for unpredictable workloads.

D: Multicloud adds complexity and often increases OpEx and operational management overhead.

—

The issue described is classic route flapping, where a single unstable prefix (10.1.5.0/24) causes repeated route withdrawals and advertisements, triggering churn in the BGP control plane across the entire network. This behavior can be mitigated using the following scalable and non-disruptive design approach:

D. Route Aggregation: Aggregating routes at the edge router (in this case, the LA router) means that multiple more specific prefixes (such as 10.1.4.0/24 through 10.1.7.0/24) are advertised as a single summarized prefix (e.g., 10.1.4.0/22). As a result, the instability of 10.1.5.0/24 will not affect upstream routers (Chicago and New York), as they will only see the aggregated route.

Key benefits aligned with CCDE v3.1 design guidance:

Isolates flapping to the edge while maintaining reachability

Reduces control plane churn in BGP

Preserves scalability and simplifies the routing table in upstream routers

Why other options are incorrect:

A (Route dampening): While effective, route dampening is less favored today due to convergence delay and side effects; it’s also a reactive measure versus a design-based solution.

B and C (Filtering): Filtering the route prevents reachability to that subnet, which violates availability requirements and causes data black-holing.

Thus, aggregation is the most scalable, nondisruptive, and design-aligned choice in this context.

Zero Trust principles cover multiple domains:

A (Workload): Securing application workloads regardless of location.

C (Workplace): Securing user access to services across office, remote, or hybrid work models.

Zero Trust design ensures authentication, authorization, and policy enforcement at every access point for both users and applications.

Why other options are incorrect:

B, D, E: These terms are not recognized Zero Trust domains in CCDE or industry frameworks.

—

A (Change OSPF reference bandwidth): OSPF calculates path cost based on interface bandwidth using a formula where cost = reference bandwidth / interface bandwidth. The default OSPF reference bandwidth is 100 Mbps, which causes all faster links (1 Gbps and above) to appear with the same minimum cost.

Updating the reference bandwidth (e.g., to 10000 or higher) allows OSPF to assign accurate costs to faster links, enabling proper path selection that reflects real link capacities.

Other options explained:

B: Filtering is not the correct method for path optimization.

C: Changing interface bandwidth values is a workaround but not scalable or recommended compared to updating the reference bandwidth globally.

D: Summarization addresses prefix aggregation, not cost calculation.

—