Free Cisco 400-007 Practice Exam with Questions & Answers | Set: 5

—

In Cisco SD-Access architecture, fabric-enabled wireless APs connect to the network usingCAPWAPfor control, but their data plane is integrated into thefabric overlayusingVXLAN (Virtual Extensible LAN).

VXLANis the data plane encapsulation used between fabric nodes, including wireless APs that are part of the SD-Access fabric.

WhileCAPWAP (E)remains in use for management and control communication between the AP and wireless LAN controller (WLC), actual user traffic is encapsulated in VXLAN for fabric forwarding.

This separation of control and data plane ensures seamless mobility, segmentation, and policy enforcement within the SD-Access fabric.

The SDN architecture separates the control plane from the data plane. In this model, the SDN controller is the central element responsible for:

Receiving application intent via northbound APIs

Translating intent into traffic policies

Communicating with infrastructure devices using southbound APIs

The SDN controller enforces policies such as path selection, QoS, and access control rules across the network fabric, ensuring traffic flows align with administrator-defined logic. Neither northbound nor southbound APIs enforce policy themselves; they serve as communication interfaces.

The packet forwarding engine (Option A) simply performs data-plane functions based on instructions, but does not interpret or apply policies.

==========

D (Lifecycle model):The lifecycle model aligns directly with traditional project management (such as Waterfall). It follows a sequential, phase-driven process: requirement gathering, design, implementation, testing, and maintenance. Each phase must be completed before moving to the next, with defined milestones and documentation.

Other options explained:

A: " Static model " is not a standard recognized development model.

B: Agile is iterative and adaptive, opposite of traditional models.

C: Evolutionary delivery is more incremental, not fully aligned with traditional models.

B (IP Source Guard):IP Source Guard prevents IP address spoofing at Layer 2 by binding IP-to-MAC addresses and filtering unauthorized source IPs. It operates independently of encryption, so it has no impact on encryption performance.

Other options explained:

A: MACsec adds encryption and has performance implications.

C: DHCP snooping with DAI focuses on ARP spoofing, not IP address antispoofing specifically.

D: IPsec handles encryption, which directly impacts performance.

Text Description automatically generated

SDN controller — Maintains a complete view of everything that is happening in the network; Manifested as either a physical or virtual component

Southbound interface — Communicates with network devices to program the data plane; Provides access to the network to configure or to retrieve information from it

Northbound interface — Exposes access to the controller; Characterized as a software interface

D (Route maps with tags): When redistributing between OSPF domains at multiple locations (mutual redistribution), route tagging is a key technique to prevent routing loops. Each ASBR applies route tags on incoming routes, and redistribution policies check these tags to prevent re-advertising routes that originated from the other domain.

Other options explained:

A: Virtual links are for connecting discontiguous OSPF areas, not preventing redistribution loops.

B: Router ID uniqueness is required but does not prevent loops.

C: External type 2 redistribution doesn ' t inherently prevent loops.

The hub CE router is receiving IP SLA probes from all spokes, processing and responding to every request. As more spokes are added, the CPU workload on the hub increases exponentially due to:

Processing incoming IP SLA packets.

Generating and transmitting responses.

Monitoring CPU utilization at the hub ensures early detection of processing bottlenecks that could impact SLA accuracy and overall performance — a core CCDE v3.1 business-driven design consideration in centralized measurement architectures.

Why other options are incorrect:

A and B: Spoke resources are minimally taxed.

D: Buffer usage isn ' t the main limiting factor for IP SLA responsiveness.

Switch clustering (VSS, StackWise, MLAG, MC-LAG, vPC) at the distribution/core layer eliminates the need for STP convergence by creating a logical single switch for Layer 2 and Layer 3 functions.

This design provides active-active uplinks, faster convergence, and loop-free operation, directly addressing STP and FHRP limitations.

Why other options are incorrect:

A: Access layer clustering is less common and doesn’t address core convergence delays.

C: PortFast improves convergence on edge ports but not in the core/distribution path.

D: BFD enhances Layer 3 failure detection but not Layer 2 loop prevention or STP convergence.