CCDE 400-007 Syllabus Exam Questions Answers

When an ACL is applied inbound on the Internet gateway interface facing the internal (trusted) network, the source IP address seen in the ACL will be the address after NAT translation has been applied to outbound traffic. This is called the inside global address:

Inside global = Public IP assigned by NAT to inside traffic for external use.

Inside local = Internal IP address prior to NAT.

Why other options are incorrect:

B, D: Outside addresses refer to external devices, not internal traffic.

C: Inside local is seen before NAT, not after.

—

D (Group Encrypted Transport VPN - GET VPN):GET VPN encrypts traffic across private WANs like MPLS while maintaining full-mesh routing visibility and offering centralized key management with minimal encapsulation overhead.

Other options explained:

A: S-VTI is used for point-to-point IPsec tunnels.

B: DMVPN is used for dynamic multipoint Internet-based VPNs.

C: MGRE is a tunneling protocol but lacks security features.

A modular, scalable network design aims to:

Localize faults

Reduce impact radius of failures

Enable automated fault detection and recovery

The primary operational driver is to reduce the need for manual intervention during failures, which translates to:

Faster recovery times

Consistency in troubleshooting

Improved service reliability

While minimizing app downtime (B) is a goal, it is a result of reducing human-required failure recovery. Option C is a business process goal, and D is an architectural challenge, not an operational driver.

This aligns with CCDE v3.1's “Network Architecture Principles” for building operationally resilient networks.

The question describes a network that requires virtualization at both control and data plane levels using VLANs and VRFs. This architecture aligns with:

Path isolation (A): Achieved using VRFs and VLANs, ensuring traffic separation at Layer 2 and Layer 3 across the entire network.

Group virtualization (C): Refers to grouping users or resources (such as departments or tenants) into isolated segments that remain logically separated throughout the campus fabric.

Other options explained:

B (Session isolation): More aligned with application or session-layer security, not data/control plane virtualization.

D (Services virtualization): Typically related to virtualizing network services (firewalls, load balancers).

E (Edge isolation): Not a standard design term in CCDE.

—