Free Cisco 400-007 Practice Exam with Questions & Answers | Set: 14

Virtual Private LAN Service (VPLS) provides Layer 2 VPN connectivity over MPLS. Each Provider Edge (PE) device must learn and maintain MAC addresses per virtual instance.

PE Scalability is the primary concern: With 2000 VLANs, each PE participating in those instances must maintain a large forwarding table and handle associated control-plane activity.

MAC learning and aging, along with full-mesh label-switched paths (LSPs), place a heavy burden on CPU and memory.

Flooding (A) is expected but not the primary concern; it’s a symptom of scale.

The underlying transport (C) and VLAN ID limits (D) are important but not as critical in the context of PE resource scalability.

==========

B (OSPF Type 1 external):Type 1 external routes include both the external cost (from redistribution) and the internal OSPF cost to the ASBR. This ensures accurate end-to-end metric calculation across domains.

Other options explained:

A: Type 2 external ignores internal OSPF cost, potentially creating suboptimal routing.

C/D: EIGRP doesn’t use OSPF metric types; redistribution into EIGRP uses EIGRP metrics.

QoS queuing mechanisms such as LLQ (Low Latency Queuing), PQ (Priority Queuing), and CQ (Custom Queuing) operate at the interface level and are protocol-independent. Both IPv4 and IPv6 packets can be classified, queued, and scheduled using these mechanisms.

Why other options are incorrect:

B: Modern platforms support classification for IPv6 with hardware-based CEF.

C: Separate class-maps are typically required for IPv4 and IPv6.

D: The same queuing/congestion mechanisms apply to both IPv4 and IPv6.

—

D (SAML2.0):SAML2.0 is widely used for federated identity management in enterprise environments, supporting Single Sign-On (SSO) across multiple applications and domains.

Other options explained:

A: OAuth2 is primarily for authorization, not identity federation.

B: OpenID Connect extends OAuth2 for authentication but is more common for consumer web apps than enterprise SSO.

C: OpenID is older and largely replaced by OpenID Connect.

Private cloud architecture provides:

On-demand provisioning and decoupling from hardware

Security controls under enterprise ownership

Strong isolation — comparable to an air-gapped model if fully controlled on-premises or in a dedicated hosted environment

While public or hybrid clouds offer flexibility, they cannot guarantee security parity with air-gapped systems unless significant additional controls are implemented. Private cloud supports containerized architectures and modern DevOps pipelines, while keeping the data plane within enterprise boundaries.

This aligns with CCDE’s cloud design principles — balancing modernization goals with strict compliance and cybersecurity mandates.

==========

—

C (Layer 2 switches unaffected):IPv6 operates at Layer 3, so pure Layer 2 switches forward frames without needing IPv6 awareness. As long as switches can transparently forward Ethernet frames, IPv6 functionality will be preserved, minimizing unnecessary hardware upgrades.

Other options explained:

A/B/D: These unnecessarily increase cost and complexity for basic Layer 2 functionality where IPv6 awareness is not mandatory.