Download Full Version 400-007 Cisco Exam

D: Traditional three-tier architectures (access, distribution, and core layers) require that east-west traffic (between servers or pods in different access layers) traverse up to the distribution or core and then back down—introducing unnecessary hops and latency. This is a key design limitation addressed by spine-leaf and fabric architectures.

Other options:

A: Bandwidth may be sufficient but not optimally utilized due to suboptimal pathing.

B: Security is not inherently compromised by architecture, although microsegmentation is harder.

C: Three-tier architectures can scale, but less efficiently and not without trade-offs like latency and complexity.

==========

???? QUESTION NO: 382 [Protocol Design Implications]

During IPv6 deployment in a legacy network, what must be considered for older Layer 2 switches? (Choose two)

A. If IPv6 anycast deployment is planned, then make sure that Layer 2 switches support DHCPv6 snooping

B. If IPv6 anycast deployment is planned then make sure that Layer 2 switches support ND snooping

C. IPv6 is transparent on Layer 2 switches so no changes are needed to the Layer 2 switches

D. If IPv6 multicast deployment is planned, then make sure that Layer 2 switches support MLD snooping

E. If IPv6 anycast deployment is planned, then make sure that Layer 2 switches support ICMPv6 snooping

Answer: C, D

???? Explanation:

C: IPv6 functions at Layer 3, and Layer 2 switches (which do not inspect or modify Layer 3 headers) typically forward IPv6 frames transparently just like IPv4—unless enhanced services are needed.

D: For efficient IPv6 multicast handling (e.g., neighbor discovery, multicast services), switches should support MLD snooping (equivalent to IGMP snooping for IPv4).

Incorrect options:

A, B, E: DHCPv6 snooping, ND snooping, and ICMPv6 snooping are not standard or widely implemented features in Layer 2 devices. They ' re also unnecessary for basic IPv6 forwarding.

==========

???? QUESTION NO: 383 [Business-Driven Design Approaches]

Which two business areas support continuity during emergencies by understanding data flows and business processes? (Choose two)

A. Decentralized device management

B. BYOD policy

C. Disaster recovery

D. Centralized device management

E. Business continuity

Answer: C, E

???? Explanation:

C: Disaster Recovery focuses on restoring services and data after a catastrophic event.

E: Business Continuity is a broader framework ensuring operations can continue despite disruptions. Both require knowledge of critical data flows and dependencies.

Other options:

A and D: Device management is operational—not directly focused on emergency business continuity.

B: BYOD is a policy concern related to access and security, not continuity.

==========

???? QUESTION NO: 384 [Security, Automation, and Policy Integration in Design]

Two companies want a VPN tunnel to exchange HTTP REST APIs. Only data integrity (not confidentiality) is required. Devices have limited resources.

A. GRE tunnel

B. GRE over IPsec

C. IPsec ESP

D. IPsec AH

Answer: D

???? Explanation:

D: IPsec Authentication Header (AH) provides integrity and authentication, but not encryption. It’s ideal when data confidentiality is handled at the application layer and minimal overhead is desired.

Incorrect options:

A: GRE is a tunneling protocol, but it does not provide integrity or security.

B: GRE over IPsec is more complex and includes encryption (not needed here).

C: IPsec ESP provides encryption and integrity—overkill for this use case.

==========

???? QUESTION NO: 385 [Security, Automation, and Policy Integration in Design]

What is a key benefit of Infrastructure as Code (IaC)?

A. Declarative pipelines

B. Configuration drift

C. Agent monitoring

D. Repeatable deployments

Answer: D

???? Explanation:

D: Repeatable deployments are one of the core benefits of IaC. It allows infrastructure to be provisioned consistently every time using version-controlled templates.

Incorrect options:

A: Declarative pipelines relate more to CI/CD processes than directly to IaC.

B: IaC helps prevent configuration drift, but drift itself is a problem—not a benefit.

C: Agent monitoring is a function of monitoring tools, not IaC.

To achieve sub-50 millisecond convergence after a link or node failure, the design must rely on precomputed protection paths and local repair mechanisms in the data plane. The following mechanisms meet this requirement:

B. Ti-LFA (Topology Independent Loop-Free Alternate): A next-generation fast reroute method used in Segment Routing. It offers local protection by computing loop-free backup paths that are independent of the specific failure type (node or link). It ' s capable of sub-50 ms convergence by rerouting traffic immediately on failure.

D. MPLS-FRR (Fast Reroute): A traditional mechanism in MPLS networks that provides pre-signaled backup Label Switched Paths (LSPs). It enables fast switchover upon failure detection—also under 50 ms.

Other options:

A. BFD: Provides fast failure detection, but does not provide the actual traffic reroute mechanism.

C. Minimal BGP scan time: Impacts control plane responsiveness but not sub-50 ms convergence.

E. IGP fast hello: Improves failure detection but alone doesn’t guarantee traffic reroute under 50 ms.

==========