Cisco 400-007 Actual Questions

When unmanaged switches are connected to access ports, there ' s a risk that they may start participating in Spanning Tree Protocol (STP) or introduce loops. BPDU Guard is the most effective mechanism to mitigate this risk:

BPDU Guard disables a port immediately upon receiving any BPDU, ensuring that only end hosts (non-switch devices) are connected to access ports.

This protects the stability of the STP topology by preventing accidental or malicious introduction of switches into the Layer 2 domain.

Other options explained:

A (PortFast): Accelerates port transition to forwarding state but does not protect against loops caused by BPDUs.

B (UDLD): Detects unidirectional physical link failures but not STP participation.

C (Root guard): Prevents the connected device from becoming a root bridge but still allows BPDUs.

—

In this case, the bank seeks a solution that addresses scalability, manageability, application visibility, security (encryption and segmentation), and operational simplicity while aiming to reduce capital expenses. All these characteristics point directly to an SD-WAN architecture.

A non-managed (self-hosted) SD-WAN deployment:

Supports Zero Touch Provisioning (ZTP), reducing deployment time and operational burden.

Provides application-level visibility and intelligent path control.

Enables strong segmentation and end-to-end encryption via templates and policy engines.

Helps reduce CAPEX through the use of lower-cost broadband and centralized management.

While a “managed SD-WAN” solution (Option C) might be suitable in some cases, it typically involves higher OPEX. The question emphasizes CAPEX reduction, favoring an in-house SD-WAN solution.

This approach aligns with CCDE v3.1 ' s “Scenario-based Design Strategy Guidance” and “Technology Comparisons and Use Cases” topics that emphasize selecting technologies aligned to business objectives and architectural scalability.

==========