Free Cisco 400-007 Practice Exam with Questions & Answers | Set: 3

In an IS-IS design, placing the Level-1/Level-2 (L1/L2) boundary at the core limits the extent of the flooding domain, improving scalability and stability.

By limiting Level-2 flooding to the core, instability or frequent changes in the access/distribution layers (typically Level-1) do not impact the core.

The core remains stable, while routing changes are isolated within the Level-1 domains.

Other options explained:

A: Overlapping domains are not a design objective.

B: This has no direct impact on Layer 1 complexity.

C: IS-IS design must match topology hierarchy; this is not universally applicable.

—

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection at the control plane level, making it the fastest convergence mechanism for Layer 3 routing protocols.

Fiber Ethernet typically offers higher reliability and lower latency than copper.

When combined, Fiber with BFD provides the most robust and quickest convergence for unidirectional failures in a routed data center environment.

Why other options are incorrect:

A & B: Copper adds more physical susceptibility to errors.

B & D: UDLD is a Layer 2 unidirectional detection mechanism, not optimized for Layer 3 convergence.

—

Automation: The execution of individual tasks or configurations without manual intervention.

Orchestration: The coordination and sequencing of multiple automation tasks into structured workflows to achieve complex operational goals.

Why other options are incorrect:

B, C, D: They incorrectly define orchestration as either partially manual, parallel execution, or limited to commercial tools, which is not accurate in design principles.

—

Control plane hardening is a critical aspect of securing infrastructure devices. Recommended measures include:

A. Routing protocol authentication: Prevents unauthorized devices from injecting false routes by requiring secure key-based authentication (e.g., MD5 or SHA for OSPF/BGP).

B. SNMPv3: Provides secure management through authentication and encryption, preventing interception or modification of SNMP traffic.

C. Control Plane Policing (CoPP): Enforces rate limits and filtering for traffic directed to the device's CPU, protecting against DoS and control plane overloads.

Why other options are incorrect:

D. Redundant AAA servers support authentication resilience but are more about access control than direct control plane protection.

E. Warning banners are a legal and administrative best practice, not a technical control plane defense.

F. Enabling unused services is the opposite of best practices and increases the attack surface.

These control-plane protections are emphasized in CCDE v3.1 design guidance for resilient and secure infrastructure designs.

While the Agile Manifesto itself is not a network-specific construct, its values are relevant to business-driven network design approaches outlined in CCDE v3.1—especially when designing flexible and adaptive systems. One of the core values of Agile is:

→ “Individuals and interactions over processes and tools”

This emphasizes that communication and collaboration among people are more crucial than relying solely on formal tools or rigid processes. For network architects and designers, this translates into focusing on team collaboration and business alignment during iterative design cycles.

Incorrect Options:

A, B, and D are all reversed versions of Agile’s actual values; they incorrectly prioritize the right-hand side.

==========

B (Install firewalls):PCI DSS requires network segmentation, filtering, and perimeter defense via firewalls.

C (Use antivirus software):Malware protection and anti-virus software are mandatory on all systems interacting with cardholder data.

Other options explained:

A/D/E: These are general security best practices but not specific mandatory requirements under PCI DSS control objectives.

D (Enables innovation):SDN allows new services, business models, and automation capabilities.

E (OpEx/CapEx reduction):Automation reduces operational effort, and commodity hardware reduces CapEx.

Other options explained:

A: Redundancy depends on physical design.

B: SDN centralizes management.

C/F: SDN doesn't directly impact latency or capacity.

???? QUESTION NO: 352 [Business-Driven Design Approaches]

Creating a network that functions as a strategic business enabler starts with understanding business requirements. What specific type of knowledge helps create high-level LAN, WAN, and data center designs that support the business?

A. Risk assessment

B. Monitoring and management of data

C. Understanding of data flows

D. Recovery time of the system’s functionality

Answer: C

???? Explanation:

C: Understanding how data flows between users, applications, and services is essential to designing LAN, WAN, and data center architectures that align with business workflows. This helps ensure that the network supports critical paths, minimizes latency, and enhances availability.

Other options:

A: Risk assessment supports security planning, not primary network architecture.

B: Monitoring/management occurs after deployment, not during high-level design.

D: Recovery time (RTO) is part of disaster recovery, not initial network architecture.

==========

???? QUESTION NO: 353 [Security, Automation, and Policy Integration in Design]

A banking customer using mobile token authentication suffers unauthorized access through phishing. Which policy change helps prevent this in the future?

A. Monitor connections to unknown cloud instances using SSL decryption

B. Monitor all API interfacing to the storage platform for suspicious activity

C. Monitor any access from the outside except for expected operational areas

D. Monitor the privileges for users making firewall configuration changes

Answer: A

???? Explanation:

A: Phishing attacks often spoof SSL/TLS sessions or redirect traffic to rogue endpoints. Monitoring connections to unknown cloud instances—especially with SSL decryption—can detect traffic to phishing sites or unauthorized resources.

Other options:

B: Monitoring APIs helps but doesn't directly address phishing-based redirection.

C: Blanket outside access restrictions are impractical and not effective against token hijacking.

D: Firewall config changes are administrative-level concerns, unrelated to app-level token misuse.

==========

???? QUESTION NO: 354 [Technology Comparisons and Use Cases]

Which two constraints of REST are important when building cloud-based solutions? (Choose two)

A. Separation of resources from representation

B. Migration of resources by representations

C. Distribution of resources through platforms

D. Hyper-scale as the engine of application state

E. Self-descriptive messages

Answer: A, E

???? Explanation:

A: REST separates the resource (URI) from its representation (JSON, XML, etc.), allowing for flexible interfaces and abstraction in distributed systems like the cloud.

E: RESTful communication relies on self-descriptive messages, enabling stateless communication—critical for scalable and resilient cloud-native design.

Other options:

B, C, and D are not part of REST’s formal constraints and misrepresent architectural principles.

Comprehensive and Detailed Explanation:

CAPEX (Capital Expenditures) focuses on up-front hardware investments, like routers, switches, and appliances.

A: Scalability directly impacts CAPEX—network designs that require fewer or more scalable hardware components reduce capital investment costs.

B and D are more influenced by OPEX (operational expenditures).

C (complexity) is a broader design challenge, not directly tied to CAPEX.

==========

A (Evaluate bandwidth utilization and connection quality):Before VoIP deployment, a readiness assessment must include bandwidth analysis, latency, jitter, and packet loss to ensure call quality.

Other options explained:

B: DID lines relate to telephony features but not network readiness.

C: Session table limits are unrelated to VoIP readiness.

D: Anomaly detection is security-related, not core network readiness.