Legit 400-007 Exam Download

A (BGP PIC — Prefix Independent Convergence) enables BGP to rapidly converge during link or node failures by pre-installing backup forwarding paths in the FIB.

BGP PIC minimizes traffic loss during failover, improving resiliency in both edge and core environments, and is a key recommendation for scalable and high-availability BGP design in CCDE v3.1.

Why other options are incorrect:

B: BGP-EVPN is used for L2VPN services, not for fast convergence.

C: BGP FlowSpec is used for DDoS mitigation and traffic filtering.

D: BGP-LS (Link-State) provides topology distribution for controllers, not convergence.

D (Deploy SD-WAN edge routers in data center, then controllers, then branches):This allows the SD-WAN fabric to be built and stabilized centrally first, then controllers are brought online for policy orchestration, and finally, branch migrations happen gradually without impacting existing traffic paths.

Other options explained:

A/B/C: These approaches risk service disruption or poor controller orchestration readiness during branch migrations.

Control plane hardening is a critical aspect of securing infrastructure devices. Recommended measures include:

A. Routing protocol authentication: Prevents unauthorized devices from injecting false routes by requiring secure key-based authentication (e.g., MD5 or SHA for OSPF/BGP).

B. SNMPv3: Provides secure management through authentication and encryption, preventing interception or modification of SNMP traffic.

C. Control Plane Policing (CoPP): Enforces rate limits and filtering for traffic directed to the device ' s CPU, protecting against DoS and control plane overloads.

Why other options are incorrect:

D. Redundant AAA servers support authentication resilience but are more about access control than direct control plane protection.

E. Warning banners are a legal and administrative best practice, not a technical control plane defense.

F. Enabling unused services is the opposite of best practices and increases the attack surface.

These control-plane protections are emphasized in CCDE v3.1 design guidance for resilient and secure infrastructure designs.