400-007: Cisco Certified Design ExpertDemo

Standards-based Differentiated Services Code Point (DSCP) per-hop behavior (PHB) markings provide a common QoS classification language across administrative domains, allowing traffic to receive consistent treatment and supporting scalable expansion.

EIGRP stub routing on edge routers limits the EIGRP query domain, so upstream routers do not query R5 and R6 for routes that those routers cannot provide. Advertising only connected and summary routes preserves advertisement of the edge routers’ local routes while preventing them from being transit points and reducing query-related congestion that can cause stuck-in-active conditions.

A route reflector removes the requirement for a full iBGP mesh while distributing BGP routes among its clients. R1 and R2 are the Internet-facing routers that learn routes through eBGP, so redistributing those routes into OSPF at R1 and R2 advertises them throughout the OSPF domain without first relying on redistribution of iBGP-learned routes. Cisco documents that iBGP-learned routes are not redistributed into an IGP by default, making redistribution at the eBGP ingress routers the appropriate design.

PCI DSS requires network security controls to protect cardholder data and requires anti-malware protections to be deployed and kept current on systems commonly affected by malware. These correspond to installing firewalls and using antivirus software.

Control-plane hardening protects the traffic and protocols that keep the network infrastructure running. Routing protocol authentication (C, using MD5/SHA) prevents rogue devices from injecting false routing information, and Control Plane Policing (F) rate-limits and filters traffic destined to the route processor to prevent CPU/DoS exhaustion — both are core control-plane protections. SNMPv3 (A) is the accepted third measure because it authenticates and encrypts device management/monitoring access. Warning banners (B) are an administrative/legal control, not a technical hardening measure, and "enable unused services" (E) increases attack surface (you disable them), so both are wrong; redundant AAA (D) is an availability/management-plane item. The existing key (ABF) incorrectly included warning banners instead of routing protocol authentication.

OSPF fast hello packets transmit Hellos at subsecond intervals and use the minimal dead interval of one second, enabling rapid detection of a lost OSPF neighbor when BFD is unavailable. Cisco documents this as the OSPF fast-hello mechanism for faster convergence.

In legacy 802.1D STP, the maximum-age timer controls how long received BPDU information is retained before it expires, and the forward-delay timer controls the listening and learning time before a port begins forwarding. Adjusting these timers, consistently with the network diameter and timer constraints, can reduce failure-detection and port-transition time.

VoIP and the revenue-critical trading application require distinct low-latency treatment. Assigning each to its own priority queue prevents bursts from one application from adding delay or jitter to the other and permits separate priority and bandwidth controls. Cisco IOS XE multilevel priority queuing supports multiple priority queues for separate traffic classes.

DWDM increases fiber capacity by carrying multiple wavelength channels over the same installed optical fiber, allowing bandwidth and services to be added without deploying additional fiber infrastructure. DWDM networks also support flexible topologies and built-in optical transport protection mechanisms.

Policy-based routing can override normal routing-table forwarding during a topology change. Transient inconsistencies between policy-selected paths and reconverging routing information can create microloops.

The firewalls inject a default route (0.0.0.0) down toward the collapsed distribution/core, so by default all user traffic egresses through the NGFW. To force only web traffic to the proxy while everything else still passes the NGFW/IPS, the traffic must be split at the users' first Layer 3 hop: policy-based routing on the collapsed core matches HTTP/HTTPS and sets the next hop to the proxy appliance, while all remaining traffic follows the default route to the firewalls. The proxy appliance then needs static routing so it knows where to forward the inspected web traffic onward. PBR at the internet edge (C) would only act after traffic already reached the edge and would not cleanly steer client browsing to the appliance, and constraint-based OSPF (A) is not a mechanism for selective redirection.

Automating individual activities removes repeated manual steps from routine operational changes, such as applying configuration, policy, traffic-flow, or security updates. This directly reduces the ongoing manual effort required for everyday network administration.

A hierarchical LAN design divides the network into modular layers with defined roles. This modularity supports scalable growth and allows changes, upgrades, and new services to be introduced in a controlled, staged way.

Application firewalls can enforce security zones by separating resources with different trust levels and applying distinct traffic-control policies between those groups. This implements network segmentation based on security and trust requirements.

Standard Layer 2 switches forward Ethernet frames without needing to understand whether the Layer 3 payload is IPv4 or IPv6. Therefore, existing access-layer Layer 2 switches can remain in service while IPv6 routing is provided by the supported core and distribution switches.

Data stewardship is a data-governance use case because it assigns accountability and responsibility for data and for the processes that ensure its appropriate use.

OSPF point-to-multipoint operation on a DMVPN interface can add host routes to spoke routing tables. These routes may send traffic for networks behind another spoke through the hub rather than directly through a spoke-to-spoke tunnel. Cisco documents this as a reason to use OSPF broadcast network type for this design.

Software-defined network segmentation creates isolated virtual network zones and enables granular, policy-based control of workload traffic. This is a foundational security technique for virtualized cloud data centers and supports scalable cloud security architecture.

A public cloud suits mainstream business processes with light data volumes and low regulatory or compliance requirements. It offers cost-effective shared infrastructure without the dedicated isolation and additional control typically needed for heavily regulated workloads.

EIGRP route summarization creates query boundaries that limit the number of routers involved in DUAL query and reply processing after a route loss. Bounding that query domain reduces convergence time and makes it more predictable. Cisco documents that summarization toward the core bounds EIGRP queries and, together with stub routing, can keep convergence bounded for access-uplink failures.

IP SLA performs active reachability monitoring of remote peer endpoints and can be used with tracking to detect failures. GRE provides the tunneling mechanism for DMVPN, whereas VPLS and L2TPv3 are unrelated Layer 2 VPN technologies.

After all hosts in a migrated VLAN have moved to the VXLAN EVPN fabric, that VLAN should be removed from the Layer 2 interconnect. This eliminates the no-longer-needed legacy extension and helps prevent Layer 2 loop exposure. Cisco’s migration guidance describes removing legacy interconnection configuration after migrated VLANs and workloads operate entirely in the VXLAN fabric.