300-540 Exam Dumps : Designing and Implementing Cisco Service Provider Cloud Network Infrastructure (SPCNI v1.0)

Phase 1 of an IPsec tunnel (ISAKMP/IKE) must havematching proposalson both peers for:

Encryption algorithm

Hash (integrity) algorithm

Authentication method

DH group

The requirement states thatAESandSHA-256must be used. The current configuration uses:

encryption 3des → incorrect (must be AES)

hash md5 → incorrect (must be SHA-256)

To meet the requirement, we must modify the ISAKMP policy:

crypto isakmp policy 10

encryption aes ← change 3DES to AES

hash sha256 ← change MD5 to SHA-256

authentication pre-share

group 12

Therefore, the necessary commands on PE1 are:

encryption aes→ optionB

hash sha256→ optionE

Options C and D are invalid syntax (encryption sha256 and hash aes are not supported). Changing the DH group (A) is not required by the problem statement and would not by itself fix the mismatch related to encryption and hash algorithms.

In a VXLAN BGP EVPNMulti-Siteenvironment:

DCI trackingmonitors the health of the DCI links. If all DCI-tracking interfaces go down, the leaf can incorrectly keep advertising or learning remote MAC/IP reachability, leading to packet loss and sub-optimal forwarding for servers in that VLAN/L2VNI.

For proper operation, eachDCI-facing interfacemust be enabled with evpn multisite dci-tracking so that the Multi-Site border leaf tracks reachability over that link.

When using EVPN Multi-Site, BUM (broadcast, unknown unicast, multicast) traffic toward remote sites is typically handled viaingress replication, not multicast groups, for each L2VNI participating in Multi-Site. The configuration snippet shows an L2VNI (vn-segment 16535) still mapped to mcast-group 239.1.1.0, which is inconsistent with Multi-Site recommendations and contributes to packet loss.

Therefore, to fix the problem:

Enable DCI tracking on the uplink:

interface Ethernet1/1

evpn multisite dci-tracking

This restores proper DCI-link state monitoring for Multi-Site. →Option C

Change the L2VNI behavior from multicast to Multi-Site ingress replication:

Under the VNI for VLAN 11, configure:

evpn

vni 16535 l2

multisite ingress-replication

or the equivalent command for the specific NX-OS release, thereby aligning the L2VNI with EVPN Multi-Site design and eliminating packet loss. →Option D

Options A and B are ELAM (embedded logic analyzer) filters used only for packet capture and do not resolve the forwarding issue.

Option E is an ACL line unrelated to EVPN VXLAN or DCI tracking and does not address the underlying problem.

InCisco Enterprise NFVIS, time synchronization is configured using thesystem time ntpcommand structure. NFVIS requires a primary and optionally a backup NTP server to maintain accurate system time for the hypervisor and guest VMs.

Correct NFVIS command syntax for NTP configuration:

system time ntp preferred_server This command configures thepreferred (primary)NTP server used for system clock synchronization.

system time ntp backup_server This command configures thebackupNTP server, which the system uses if the primary becomes unreachable.

These two commands match Cisco NFVIS time-configuration behavior described in NFV infrastructure design and implementation guidelines.

Why the Correct Answers Are A and E

Option A: system time ntp preferred_server 192.168.1.1

This properly configures the primary NTP server in NFVIS. The preferred server is always the first choice for time synchronization.

Option E: system time ntp backup_server 192.168.2.1

This correctly configures the backup NTP server. If the preferred server fails, NFVIS automatically falls back to the backup server.

Both commands directly match NFVIS’s NTP command hierarchy and are the only ones that correctly apply to NFVIS.

Why the Other Options Are Not Correct

Option Buses utils ntp, which is not an NFVIS command.

Option Csets manual time and does not configure NTP servers.

Option Dalso uses the utils ntp syntax, which applies to other Cisco platforms but not NFVIS.