300-540 Exam Dumps : Designing and Implementing Cisco Service Provider Cloud Network Infrastructure (SPCNI v1.0)

Phase 1 of an IPsec tunnel (ISAKMP/IKE) must havematching proposalson both peers for:

Encryption algorithm

Hash (integrity) algorithm

Authentication method

DH group

The requirement states thatAESandSHA-256must be used. The current configuration uses:

encryption 3des → incorrect (must be AES)

hash md5 → incorrect (must be SHA-256)

To meet the requirement, we must modify the ISAKMP policy:

crypto isakmp policy 10

encryption aes ← change 3DES to AES

hash sha256 ← change MD5 to SHA-256

authentication pre-share

group 12

Therefore, the necessary commands on PE1 are:

encryption aes→ optionB

hash sha256→ optionE

Options C and D are invalid syntax (encryption sha256 and hash aes are not supported). Changing the DH group (A) is not required by the problem statement and would not by itself fix the mismatch related to encryption and hash algorithms.

From Cisco’s EVPN VXLAN multihoming design requirements,port-active multihominguses asingle LAG (EtherChannel / Bundle-Ether)between the host/router and the pair of leaf switches. All physical interfaces participating in that bundle must be configured with:

bundle id mode active

This command:

Associates the physical interfaces (g1/0 and g1/1) withBundle-Ether1.

UsesLACP activemode, which is required for EVPN port-active multihoming.

Enables the host-facing port-channel required to support EVPN multihomed connectivity.

In the exhibit, R1 already has:

interface Bundle-Ether1

description "Bundle to Leaf-1"

interface Bundle-Ether1.10

ip address 192.168.10.1 255.255.255.0

This confirms that the engineer intends to bundleg1/0andg1/1together intoBundle-Ether1, and the missing step is adding the interfaces into that bundle.

The correct configuration is:

interface g1/0

bundle id 1 mode active

interface g1/1

bundle id 1 mode active

Why the other options are incorrect

A. evpn ethernet-segment 1This command is used on EVPN leaf switches (not R1) to define an ESI for multihoming. R1 is not an EVPN VTEP.

B. switchport mode trunkR1 is a router, not a switch. L3 interfaces do not use switchport.

C. encapsulation dot1q 1This applies only to subinterfaces, not physical interfaces, and is unrelated to building a LAG for port-active multihoming.

In Cisco Catalyst SD-WAN cloud integration, when the requirement is:

Automatically discovering AWSVPCs

Automatically identifying AWSservices

Allowing the user to choose whichprivate SD-WAN networkconnects to the cloud

UsingAWS credentials(Access Key / Secret Key) for automatic provisioning

…the Cisco-supported mechanism is theCisco SD-WAN Transit VPC solution.

Why Transit VPC is the correct answer:

It is specifically designed to integrateCisco SD-WANwith AWS environments.

Uses AWS APIs and user credentials to automatically discover:

VPC IDs

Subnets

Regions

Routing tables

Automatically deploys and configures CSR1000v or Catalyst 8000V routers into the VPC.

Provides a centralized “hub” in AWS to interconnect multiple SD-WAN sites.

Enables the user to choose which SD-WAN segments connect to which VPCs.

This matches the requirement ofautomatic cloud resource identification based on user credentials.

Why the other options are incorrect

A. AWS Direct Connect

This is a physical/private Layer 2 cloud connection.

It doesnotauto-discover VPCs or integrate through credentials.

It does not provide automated SD-WAN service provisioning.

C. IPsec VPN

Works for connectivity but ismanual, not automated.

Does not identify AWS cloud resources via credentials.

D. Segment routing

A transport technology used inside SP networks, irrelevant to AWS API-based VPC discovery.

Thus, onlyTransit VPCprovides automatic AWS cloud discovery and integration with SD-WAN.