CCDE 400-007 Exam Dumps

B (IP Source Guard):IP Source Guard prevents IP address spoofing at Layer 2 by binding IP-to-MAC addresses and filtering unauthorized source IPs. It operates independently of encryption, so it has no impact on encryption performance.

Other options explained:

A: MACsec adds encryption and has performance implications.

C: DHCP snooping with DAI focuses on ARP spoofing, not IP address antispoofing specifically.

D: IPsec handles encryption, which directly impacts performance.

In a standard 3-tier data center architecture (access, aggregation, core), the Layer 2-to-Layer 3 boundary typically resides at the aggregation layer. When extending VLANs between data centers using a Layer 2 interconnection, the most optimal and scalable termination point is at the aggregation layer because:

It naturally handles VLAN demarcation and Layer 3 boundary.

Spanning Tree Protocol (STP) domains remain contained within local aggregation blocks.

The core remains Layer 3-only, ensuring scalability, stability, and no STP involvement.

Simplifies traffic engineering, FHRP operations, and minimizes control-plane complexity across sites.

This design is consistent with CCDE v3.1 best practice where VLAN extension is isolated to aggregation to avoid STP scaling issues and maintain hierarchical design principles.

Why other options are incorrect:

A: STP isolation can still be achieved at aggregation while keeping the core Layer 3.

C: Access layer extensions would increase STP scope and complexity unnecessarily.

D: Core termination violates Layer 3 core design, bringing STP into the core, which is not scalable.

SD-WAN integrates multiple underlay transport options (Internet, MPLS, LTE) while delivering advanced features like DPI (Deep Packet Inspection), SLA monitoring, QoS, encryption, scalability, and centralized management.

It provides policy-based path selection, cost optimization, and rapid deployment.

SD-WAN is widely regarded as a modern WAN design solution fully aligned with CCDE v3.1 design principles for cost-effective and flexible WAN architectures.

Why other options are incorrect:

B: Internet alone cannot deliver consistent SLA or QoS guarantees.

C: Hybrid MPLS + Internet may work but is more complex and costly; SD-WAN natively supports such hybrid models.

D: MPLS offers SLAs but lacks flexibility, DPI, and cost-effectiveness compared to SD-WAN.

—