Free 400-007 sample questions

Correct answer: True

This statement is true. LISP is the fundamental control plane protocol in the SD-Access fabric. It separates the endpoint identity (EID), which is the IP or MAC address, from its location (RLOC), which is the loopback address of the fabric edge switch where the endpoint is connected. The LISP Map-Server/Map-Resolver functionality, running on the control plane nodes, maintains this dynamic EID-to-RLOC mapping database.

Correct answer: Cisco ISE for profiling and assigning SGTs, and TrustSec for policy enforcement within the fabric.

In an SD-Access solution, Cisco Identity Services Engine (ISE) is the component responsible for device profiling, authentication, and authorization. Upon successful authentication, ISE assigns a Security Group Tag (SGT) to the endpoint (e.g., SGT for IoT_Devices). Cisco TrustSec technology, which is integrated into the fabric, uses these SGTs to enforce security policies. A matrix-based policy in ISE/DNA Center would define that the 'IoT_Devices' SGT can only talk to the 'Video_Server' SGT, and this policy is enforced at the ingress fabric edge node. LISP/VXLAN are control/data plane protocols, while DNA Center is the orchestrator; they are part of the solution but not the primary components for dynamic policy assignment and enforcement.

Correct answer: Setting a higher Local Preference value on routes received from AS 65100.

Local Preference is the correct attribute for influencing outbound traffic path selection within an autonomous system. It is a well-known, discretionary attribute that is exchanged between iBGP peers. By setting a higher Local Preference (default is 100) on routes learned from the primary provider (AS 65100), all routers within AS 65300 will prefer that path to exit the network. AS-Path prepending influences inbound traffic, and MED is considered after Local Preference and is typically used to influence how a neighboring AS enters your network.

Correct answer: AWS Direct Connect with a private VIF and MACsec encryption.

AWS Direct Connect provides a dedicated, private network connection from on-premises to AWS, which bypasses the public internet. This directly addresses the requirements for privacy, low latency, and consistent performance. Using a private Virtual Interface (VIF) connects to the VPC. To meet the encryption requirement for PCI, MACsec can be enabled on the Direct Connect link (for 10Gbps and higher connections) to provide Layer 2 encryption. This combination is superior to a VPN over the internet, which would have variable performance and higher latency, and is more direct than solutions involving SD-WAN or transit gateways for this point-to-point requirement.

Correct answer: The network must be fully operational within 15 minutes of a failure, and up to 1 hour of data loss is acceptable.

RTO (Recovery Time Objective) is the target time within which a business process must be restored after a disaster or disruption to avoid unacceptable consequences associated with a break in business continuity. An RTO of 15 minutes means the network must be operational within that timeframe. RPO (Recovery Point Objective) is the maximum targeted period in which data might be lost from an IT service due to a major incident. An RPO of 1 hour means that backups or replications must be frequent enough that no more than one hour of data is lost.

Correct answer: To act as a well-known meeting point for multicast sources and receivers.

In PIM-SM, the Rendezvous Point (RP) serves as a shared root for a shared multicast distribution tree (*,G). New multicast sources register with the RP, and new receivers send their IGMP joins towards the RP. This allows receivers to learn about active sources without the sources needing to know about all receivers, which is the core principle of sparse mode. Once a receiver begins pulling a stream from a source via the RP, its local router may switch to a source-based Shortest Path Tree (SPT) for a more optimal path.

Correct answer: Expedited Forwarding (EF), DSCP 46

Cisco's QoS best practice recommends marking voice bearer traffic (RTP) with DSCP 46, which corresponds to the Expedited Forwarding (EF) Per-Hop Behavior. The EF PHB is designed for low-loss, low-latency, low-jitter traffic and is typically serviced by a priority queue (LLQ) across the network. AF41 is commonly used for interactive video, CS3 for call signaling, and BE (or CS0) for default data traffic.

Correct answers: The monthly recurring cost for the MPLS circuit.; The annual cost of the support contract for the network equipment.

Operational Expenditure (OPEX) refers to the ongoing costs required for the day-to-day functioning of a business. In network design, this includes recurring costs like monthly circuit fees and annual support contracts. Capital Expenditure (CAPEX) refers to one-time purchases of physical goods or services, such as the initial purchase price of a router and the one-time installation fee.

Correct answer: IEEE 802.1X with a RADIUS server like Cisco ISE.

IEEE 802.1X is the standard for port-based Network Access Control (NAC). It provides a framework for authenticating devices as they connect. A RADIUS server, such as Cisco Identity Services Engine (ISE), acts as the authentication server. ISE can be configured with complex policy sets that differentiate devices based on various attributes (e.g., certificate presence, user group) and enforce different EAP methods (EAP-TLS for corporate, PEAP for BYOD) accordingly. This provides the granular control needed for HIPAA compliance. WPA2-Personal and MAC filtering are not secure enough for this environment.

Correct answer: To make customer IPv4 prefixes globally unique within the BGP table.

The primary purpose of the Route Distinguisher (RD) is to make a customer's non-unique IPv4 prefix (like 192.168.1.0/24) unique within the service provider's BGP table. The RD is a 64-bit value that is prepended to the customer's 32-bit IPv4 prefix, creating a unique 96-bit VPNv4 prefix. This allows the provider to carry routes for multiple customers who might be using the same private IP address space, without conflicts. Route Targets (RTs) are used to control the import/export of routes between VRFs.