Free Cisco 400-007 Practice Exam with Questions & Answers | Set: 4

B (IGMPv3 with PIM-SSM):Source-Specific Multicast (SSM) significantly reduces multicast state in the network by eliminating shared trees and (*,G) state, requiring only (S,G) entries. With IGMPv3 receivers specify both the group and source, which reduces unnecessary group membership and simplifies multicast forwarding state.

Other options explained:

A: IGMP filtering controls receiver access but does not reduce core multicast state.

C: Multiple multicast domains complicate rather than simplify state.

D: Using one multicast group is not scalable or practical for multiple services.

B (IP Source Guard):IP Source Guard prevents IP address spoofing at Layer 2 by binding IP-to-MAC addresses and filtering unauthorized source IPs. It operates independently of encryption, so it has no impact on encryption performance.

Other options explained:

A: MACsec adds encryption and has performance implications.

C: DHCP snooping with DAI focuses on ARP spoofing, not IP address antispoofing specifically.

D: IPsec handles encryption, which directly impacts performance.

B (Minimize operational costs): A common business goal to reduce long-term operating expenses.

E (Reduce complexity): Simplifying designs reduces operational overhead, risk, and failure domains.

Why other options are incorrect:

A: Resiliency is a design goal, but not a business objective itself.

C: Endpoint posture is a technical security feature.

D: Faster obsolescence contradicts business optimization.

C (PIM Sparse Mode with RP located at the hub):DMVPN networks typically leverage sparse mode multicast due to their efficiency in dynamic topologies. Locating the Rendezvous Point (RP) at the hub simplifies multicast state management, since the hub serves as the central aggregation point and ensures optimal rendezvous functionality without requiring complex RP placement across spokes.

Other options explained:

A: Dense mode is inefficient and generates unnecessary flooding, especially in WAN environments.

B/D: Placing RPs at remote sites introduces unnecessary complexity and operational challenges.

iBGP’s full mesh requirement refers to logical BGP session establishment, not physical network design. As long as reachability exists between iBGP peers (through an IGP like OSPF or IS-IS), iBGP sessions can be established regardless of physical topology (ring, star, partial mesh, etc.).

Key CCDE v3.1 design principles:

Logical iBGP mesh ≠ physical mesh requirement.

Physical topologies can be optimized independently of iBGP peering structure.

Control plane designs like route reflectors or confederations further optimize scalability without changing physical topology.

Why other options are incorrect:

B: iBGP works on any topology where IP reachability exists.

C: Physical full mesh is unnecessary for iBGP.

D: iBGP functions over any IGP-provided reachability domain, including rings.

Data governance, especially for a national bank under EU regulations, is the most critical factor.

Regulations like GDPR restrict where and how sensitive data, particularly financial data, can be stored and processed.

Migrating data outside of EU jurisdictions without compliance could result in legal violations.

Why other options are incorrect:

B: Latency is important but secondary to regulatory compliance.

C: Security is always important but not the unique issue here.

D: Cloud connectivity is technical, not the primary legal concern.

—

B (OpenConfig):OpenConfig YANG models are vendor-neutral, community-driven standards designed to simplify multi-vendor network automation and interoperability — ideal for heterogeneous SDN fabrics.

Other options explained:

A: Proprietary models limit flexibility and interoperability.

C: Native models are vendor-specific.

D: IETF YANG models exist but are not as comprehensive for full operational SDN automation as OpenConfig.

BGP-LS (BGP Link-State) distributes IGP topology information using BGP. When used in multi-area or multi-domain networks, BGP-LS allows for a centralized controller to receive topology information in a scalable way. BGP inherently runs over TCP, which provides reliable, ordered delivery using built-in flow control mechanisms.

The use ofTCP-based flow controlensures that even in large-scale networks where significant link-state information is exchanged, the flow of data between BGP peers remains efficient, controlled, and buffered according to the receiver's capacity. This makes it ideal for transporting massive amounts of LS data across wide areas and into SDN controllers for applications like traffic engineering or path computation.

Why other options are incorrect:

A, B, and C refer to mechanisms that are not implemented or leveraged by BGP.

TCP-based flow control is the only valid flow-control mechanism used in BGP sessions.

==========

C (QoS policy propagation with BGP - QPPB):Allows QoS policies to be dynamically applied based on BGP routing information, integrating policy control into routing decisions.

D (Remote black-holing trigger):Enables dynamic mitigation of attacks (e.g., DDoS) by injecting blackhole routes through BGP to selectively drop malicious traffic upstream.

Other options explained:

A/B/E: Static policy mechanisms that lack dynamic flexibility and responsiveness in modern service provider designs.

A (Posture assessment with remediation VLAN):Posture assessment checks endpoint compliance (such as AV definitions). Non-compliant devices are placed into a remediation VLAN where they can update before regaining normal network access.

Other options explained:

B: SGTs provide segmentation but are not posture-specific.

C: dACLs with SGTs handle policy enforcement, but posture control is required for AV compliance.

D: Quarantine VLAN isolates devices but doesn’t automate remediation.