CCDE 400-007 Passing Score

Security design must be aligned with:

Business objectives (A): Security design must meet business needs without hindering operations.

Security policies and standards (B): Compliance with internal and external regulations is mandatory.

CCDE v3.1 teaches that security design always starts from business intent and policy compliance, not purely technical or scope-based factors.

Why other options are incorrect:

C & D: Security design applies to all environments, not just multi-site or new deployments.

—

The SDN architecture separates the control plane from the data plane. In this model, the SDN controller is the central element responsible for:

Receiving application intent via northbound APIs

Translating intent into traffic policies

Communicating with infrastructure devices using southbound APIs

The SDN controller enforces policies such as path selection, QoS, and access control rules across the network fabric, ensuring traffic flows align with administrator-defined logic. Neither northbound nor southbound APIs enforce policy themselves; they serve as communication interfaces.

The packet forwarding engine (Option A) simply performs data-plane functions based on instructions, but does not interpret or apply policies.

==========

B (Encrypt data when it is at rest and in motion): In hybrid cloud deployments, encryption is one of the most critical mechanisms to protect sensitive enterprise data both during storage (at rest) and while being transmitted (in motion). This ensures confidentiality and integrity across both private and public cloud environments.

Other options explained:

A: Using standard protocols is a general best practice but insufficient without encryption.

C: Communication of risks is part of compliance but does not enforce technical security.

D: Using standard protocols without encryption exposes data to risks.

—

A picture containing table Description automatically generated

IPv4:

Host Registration - IGMP

Router Registration - PIM-DM, PIM-SM, SSM, BIDIR

Inter-Domain Source Discovery - MSDP

IPv6:

Host Registration - MLD

Router Registration - PIM-SM, SSM, BIDIR