Free Cisco 400-007 Practice Exam with Questions & Answers | Set: 2

Let’s calculate the total cost for each solution based on the most likely maximum duration (20 + 10 = 30 months) to ensure conservative, flexible planning.

—

DWDM over dark fiber:

CAPEX = $200,000

OPEX (annual): $100,000⇒for 30 months = (2.5 × $100,000) = $250,000

Installation fee = $30,000

Total = $200,000 + $250,000 + $30,000 = $480,000

CWDM over dark fiber:

CAPEX = $150,000

OPEX (annual): $100,000⇒for 30 months = (2.5 × $100,000) = $250,000

Installation fee = $25,000

Total = $150,000 + $250,000 + $25,000 = $425,000

MPLS wires only:

CAPEX = $50,000

OPEX (annual): $180,000⇒for 30 months = (2.5 × $180,000) = $450,000

Installation fee = $5,000

Total = $50,000 + $450,000 + $5,000 = $505,000

Metro Ethernet:

CAPEX = $65,000

OPEX (annual): $100,000⇒for 30 months = (2.5 × $100,000) = $250,000

Installation fee = $5,000

Total = $65,000 + $250,000 + $5,000 = $320,000

—

Analysis:

Metro Ethernet has the lowest overall cost at $320,000 and provides sufficient flexibility for workload migration since "all connectivity options meet technical requirements."

Metro Ethernet is typically more flexible than DWDM/CWDM for temporary or dynamic migration projects because it does not require optical expertise or complex dark fiber management.

MPLS is more expensive here and less flexible for large-scale Layer 2 migrations.

CWDM/DWDM are suitable for permanent solutions where long-term investment is justified, but not optimal here due to cost.

Therefore, best ROI and flexibility: Metro Ethernet

Final correct answer: D

Cloud Bursting is the process by which applications or workloads that run in a private cloud or data center environment are "bursted" into a public cloud infrastructure during high-demand periods. This prevents service degradation and ensures performance continuity without manual intervention.

In CCDE design strategy terms, this enables:

Elastic scalability

Cost-effective use of public infrastructure on-demand

Seamless service delivery to end users

Options like “cloud policing” and “cloud shaping” are not standard terms, and “cloud spill” is not an established mechanism. “Cloud bursting” is the correct architectural mechanism that addresses this overflow requirement.

==========

????Explanation:

B: To prefer ISP 1 for outbound traffic, advertise a longer AS path to ISP 2 (so it's used as backup). To prefer ISP 1 for inbound traffic, you want ISP 2 to receive a higher MED, making it less preferred. These changes signal to both ISPs and remote ASes to prioritize the ISP 1 path.

Other options:

A: Local preference is set inbound by your own routers, not outbound to ISPs.

C: Local preference affects only your own AS, and more specific routes are better advertised on primary links, not secondary.

D: Advertising less specific routes does not help establish control over preference cleanly.

==========

???? QUESTION NO: 387 [Security, Automation, and Policy Integration in Design]

Which three components support enforcing security policy compliance for devices attempting network access? (Choose three)

A. Posture agent

B. Audit and decision point servers

C. Management and reporting tools

D. Endpoint security application

E. Network access devices

F. Web filtering devices

Answer: A, B, E

????Explanation:

A: Posture agents assess the health of endpoints (e.g., antivirus status, OS patching).

B: Decision servers (e.g., Cisco ISE) enforce access decisions based on posture and policies.

E: Network access devices (e.g., switches, WLCs, routers) apply access controls based on server instructions (802.1X, NAC).

Other options:

C: Management tools are for visibility—not enforcement.

D: While useful, endpoint AV/firewalls act independently—not part of policy enforcement infrastructure.

F: Web filters do not participate in initial access decisions.

==========

???? QUESTION NO: 388 [Security, Automation, and Policy Integration in Design]

When are Network Behavior Anomaly Detection (NBAD) systems better than signature-based systems? (Choose two)

A. Malware detection

B. Encrypted threat traffic

C. Spyware detection

D. Intrusion threat detection

E. New zero-day attacks

Answer: B, E

????Explanation:

B: Signature-based systems cannot inspect encrypted payloads effectively, whereas NBAD relies on traffic behavior.

E: NBAD identifies deviations from known good behavior, allowing detection of previously unknown (zero-day) threats.

Incorrect Options:

A, C, D: These are often more accurately detected using signature-based approaches where known

????QUESTION NO: 389

[Main Topic: Security, Automation, and Policy Integration in Design]

A company is adopting IPv6 in a dual-stack campus network. The first IPv6-only application is now hosted in the data center. To prevent a malicious user from masquerading as the IPv6 default gateway, which two mechanisms should be used? (Choose two)

A. IPv6 RA guard

B. IPv6 snooping

C. IPv6 device tracking

D. IPv6 address glean

E. port ACLs

Answer: A, E

????Comprehensive and Detailed Explanation (CCDE v3.1 aligned):

A. IPv6 RA Guard:This feature helps mitigate rogue router advertisements (RAs), which attackers can use to spoof the default gateway in an IPv6 environment. RA Guard drops unauthorized or unexpected RAs at the access layer switch ports, preventing malicious devices from advertising themselves as routers.

E. Port ACLs (PACLs):Port-based ACLs can restrict which devices are allowed to send or receive RA packets on switch ports. By tightly controlling which sources can send traffic (including RA messages), port ACLs help prevent spoofing attempts.

Other Options:

❌B. IPv6 Snooping:Not a standard or widely supported security feature; it is sometimes used synonymously with device tracking but is not a direct mitigation for spoofed RAs.

❌C. IPv6 Device Tracking:Useful for monitoring IP-to-MAC bindings, but it does not prevent spoofing or gateway impersonation.

❌D. IPv6 Address Glean:Primarily used for learning IPv6 addresses from traffic for things like DHCPv6 relay; not a security feature.

CCDE Blueprint Alignment:

Topic: Security, automation, and policy integration in design

Subdomain: IPv6 security, access control, rogue device prevention.

Let me know if you'd like the next question explained!

B (IPsec): Provides encryption over the public Internet for secure data transfer.

C (DMVPN): Creates a dynamic, scalable private WAN overlay across the Internet allowing direct site-to-site connectivity.

Why other options are incorrect:

A: S-VTI requires more static configuration and lacks DMVPN’s scalability.

D: GET VPN is best for MPLS/private WAN, not Internet underlays.

E: PPTP is outdated and insecure.

—

D (Fate sharing):Fate sharing refers to a design where multiple dependent states fail together (i.e., when physical link fails, BGP session and its routes fail too).

Other options explained:

A: Fault isolation refers to containing failures, not dependent failure.

B: Resiliency is the ability to recover, not simultaneous failure.

C: Redundancy would prevent total loss if implemented.

A (Distinguishing between config and operational data):NETCONF was designed to provide structured data models (such as YANG), clearly separating configuration from operational state data. SNMP lacks this built-in distinction and generally treats all data as MIB objects.

Other options explained:

B/C/D: Both protocols can perform actions and retrieve or modify data, but only NETCONF natively differentiates config vs. operational state.

Comprehensive and Detailed Explanation:

B: Modular network design allows the network to be broken into independent functional units (modules) such as access, distribution, data center, WAN, and edge. When divesting part of a business, modularity allows specific segments (like a business unit or site) to be isolated and removed with minimal impact on other components.

Other options:

A (Redundant design): Enhances high availability but doesn't address separation or detachment flexibility.

C (Less complex design): While simpler, it may not provide the isolation necessary to enable selective detachment.

D (Routed access): Refers to Layer 3 access layer designs, useful in access control but not focused on business separation scenarios.

IPv6 multicast supports two key mechanisms for Rendezvous Point (RP) discovery:

A. Embedded RP: The RP address is embedded within the multicast group address (ff70::/12). This allows automatic RP discovery by routers and eliminates the need for signaling protocols.

C. BSR (Bootstrap Router): Used in IPv6 as a replacement for Auto-RP (which is IPv4-specific), BSR dynamically announces the RP to multicast routers in the domain.

Other options:

B. MSDP: Not supported in IPv6 multicast since source registration and discovery are handled differently.

D. Auto-RP: IPv4-specific and not supported in IPv6.

E. MLD: Manages listener (receiver) membership, not RP discovery.

B (Configure VXLAN VNID): Each VLAN being migrated must be mapped to a VXLAN VNID for integration into the EVPN fabric. This allows the legacy VLAN to participate in the VXLAN-based Layer 2 overlay and support host mobility.

Other options explained:

A: Pruning is not directly related to migration activation.

C/D: Type 2 routes (MAC/IP routes) and BGP advertisements happen automatically after proper VNID configuration.

B (Transport Mode in IPsec Phase II):When GRE is running over IPsec,IPsec Transport Modeis often preferred. In Transport Mode, only the payload (GRE encapsulated packet) is encrypted and authenticated, while the original IP header remains untouched. This eliminates redundant IP headers, avoiding duplicate addressing and reducing overhead — optimizing bandwidth efficiency across the Internet VPN.

GRE provides the tunneling function, while IPsec in Transport Mode secures the GRE-encapsulated traffic. Transport Mode is negotiated duringIPsec Phase II (Quick Mode), where actual data protection parameters are established.

Other options explained:

A:Phase I is for establishing secure channels, not for data encapsulation.

C:Tunnel Mode would encapsulate the entire packet (including GRE header), adding unnecessary additional IP headers in this GRE over IPsec design.

D:Tunnel Mode does not apply at Phase I — Phase I is only for IKE negotiation.