300-540 Designing and Implementing Cisco Service Provider Cloud Network Infrastructure (SPCNI v1.0) Question and Answers

Comprehensive and Detailed Explanation (Cisco NFVI / Virtualization Knowledge)

SR-IOV (Single Root I/O Virtualization)allows a VM to access the network interface hardwaredirectly, without going through the hypervisor’s virtual switch.

This is achieved by:

Assigning Virtual Functions (VFs) directly to VMs

Allowing high-performance, low-latency packet I/O

Bypassing the hypervisor datapath

Therefore, SR-IOV doesnotbypass the guest OS; it bypasses thehypervisor I/O virtualization layer, delivering near-native performance.

Thus the correct answer isC.

InCisco Enterprise NFVIS, time synchronization is configured using thesystem time ntpcommand structure. NFVIS requires a primary and optionally a backup NTP server to maintain accurate system time for the hypervisor and guest VMs.

Correct NFVIS command syntax for NTP configuration:

system time ntp preferred_server This command configures thepreferred (primary)NTP server used for system clock synchronization.

system time ntp backup_server This command configures thebackupNTP server, which the system uses if the primary becomes unreachable.

These two commands match Cisco NFVIS time-configuration behavior described in NFV infrastructure design and implementation guidelines.

Why the Correct Answers Are A and E

Option A: system time ntp preferred_server 192.168.1.1

This properly configures the primary NTP server in NFVIS. The preferred server is always the first choice for time synchronization.

Option E: system time ntp backup_server 192.168.2.1

This correctly configures the backup NTP server. If the preferred server fails, NFVIS automatically falls back to the backup server.

Both commands directly match NFVIS’s NTP command hierarchy and are the only ones that correctly apply to NFVIS.

Why the Other Options Are Not Correct

Option Buses utils ntp, which is not an NFVIS command.

Option Csets manual time and does not configure NTP servers.

Option Dalso uses the utils ntp syntax, which applies to other Cisco platforms but not NFVIS.

Comprehensive and Detailed Explanation From Cisco NFVI + VIM Architecture

Cisco VIM (Virtual Infrastructure Manager) operates as part of Cisco NFVI and requiresspecific mandatory network segmentsto deploy OpenStack-based NFVI environments.

The essential required networks for Cisco VIM include:

✔Provisioning network

Used during bare-metal install of compute and controller nodes

Handles PXE boot, image deployment, and VIM’s management reachability

✔Storage network

Used for Cinder, Swift, Ceph, and Glance back-end storage replication

Ensures predictable latency and bandwidth for NFVI workloads

Other networks exist in VIM (Management, API, Tenant, External), but the question asks for the required foundational segments.

Why the other options are incorrect:

Data plane(B) – used inside NFV workloads but not a required VIM infrastructure network.

Heartbeat(C) – not a defined VIM network segment.

Host network(D) – not a Cisco VIM terminology; provisioning network handles host onboarding.

Comprehensive and Detailed Explanation

AWSSecurity Groupsact as the primary stateful firewalls for EC2 instances.

To restrict SSH (TCP/22) to a single host (20.20.20.20/32), aSecurity Groupmust be configured with:

Inbound rule: TCP 22

Source: 20.20.20.20/32

ACLs operate at the subnet level but are not used for instance-specific SSH restrictions.

WAF controls HTTP/HTTPS traffic, not SSH.

Resource groups only organize cloud assets.

Thus,Bis the correct solution.

In Cisco Catalyst SD-WAN cloud integration, when the requirement is:

Automatically discovering AWSVPCs

Automatically identifying AWSservices

Allowing the user to choose whichprivate SD-WAN networkconnects to the cloud

UsingAWS credentials(Access Key / Secret Key) for automatic provisioning

…the Cisco-supported mechanism is theCisco SD-WAN Transit VPC solution.

Why Transit VPC is the correct answer:

It is specifically designed to integrateCisco SD-WANwith AWS environments.

Uses AWS APIs and user credentials to automatically discover:

VPC IDs

Subnets

Regions

Routing tables

Automatically deploys and configures CSR1000v or Catalyst 8000V routers into the VPC.

Provides a centralized “hub” in AWS to interconnect multiple SD-WAN sites.

Enables the user to choose which SD-WAN segments connect to which VPCs.

This matches the requirement ofautomatic cloud resource identification based on user credentials.

Why the other options are incorrect

A. AWS Direct Connect

This is a physical/private Layer 2 cloud connection.

It doesnotauto-discover VPCs or integrate through credentials.

It does not provide automated SD-WAN service provisioning.

C. IPsec VPN

Works for connectivity but ismanual, not automated.

Does not identify AWS cloud resources via credentials.

D. Segment routing

A transport technology used inside SP networks, irrelevant to AWS API-based VPC discovery.

Thus, onlyTransit VPCprovides automatic AWS cloud discovery and integration with SD-WAN.

Phase 1 of an IPsec tunnel (ISAKMP/IKE) must havematching proposalson both peers for:

Encryption algorithm

Hash (integrity) algorithm

Authentication method

DH group

The requirement states thatAESandSHA-256must be used. The current configuration uses:

encryption 3des → incorrect (must be AES)

hash md5 → incorrect (must be SHA-256)

To meet the requirement, we must modify the ISAKMP policy:

crypto isakmp policy 10

encryption aes ← change 3DES to AES

hash sha256 ← change MD5 to SHA-256

authentication pre-share

group 12

Therefore, the necessary commands on PE1 are:

encryption aes→ optionB

hash sha256→ optionE

Options C and D are invalid syntax (encryption sha256 and hash aes are not supported). Changing the DH group (A) is not required by the problem statement and would not by itself fix the mismatch related to encryption and hash algorithms.

Comprehensive and Detailed Explanation

In Cisco high-availability LAN gateway designs, the requirement is:

Multiple L3 gateways sharing avirtual MAC and virtual IP

Ability toload balanceacross multiple active gateways

Capability toseamlessly take overgateway forwarding during a failure

Among Cisco First Hop Redundancy Protocols (FHRPs):

HSRP→ Active/standby only

VRRP→ Active/standby only

GLBP (Gateway Load Balancing Protocol)→The only FHRP providing active/active load balancing

GLBP allows multiple routers to share:

Acommon virtual IP

Multiplevirtual MAC addresses

Multipleactive forwardersthat load-balance end hosts

Automatic failover if any gateway fails

Thus, GLBP is the only correct protocol matching the requirement forredundant default gateways with load balancing and shared MAC addressing.

Comprehensive and Detailed Explanation

Cisco Container Platform (CCP), built on Kubernetes orchestration, usesYAMLfiles for:

Cluster configuration

Pod definitions

Network settings

Storage mappings

YAML is the industry-standard declarative syntax for Kubernetes and container orchestration platforms.

HTML, XHTML, and XML are not used for CCP configuration.

Comprehensive and Detailed Explanation (Cisco NFVI / Virtualization Knowledge)

SR-IOV (Single Root I/O Virtualization)allows a VM to access the network interface hardwaredirectly, without going through the hypervisor’s virtual switch.

This is achieved by:

Assigning Virtual Functions (VFs) directly to VMs

Allowing high-performance, low-latency packet I/O

Bypassing the hypervisor datapath

Therefore, SR-IOV doesnotbypass the guest OS; it bypasses thehypervisor I/O virtualization layer, delivering near-native performance.

Thus the correct answer isC.

Comprehensive and Detailed Explanation Based on Designing and Implementing Cisco Service Provider Cloud Network Infrastructure Knowledge

When connectingcarrier-neutral facilities (CNFs)ordata centerswithin the same metropolitan area, service providers typically usehigh-bandwidth, low-latency optical transport methods. The most appropriate and commonly deployed interconnection technology is:

DWDM (Dense Wavelength Division Multiplexing) ring, which provides:

High capacity (10G, 40G, 100G, 400G)

Low latency

Redundancy through ring or mesh topologies

Multi-wavelength multiplexing for cost efficiency

Carrier-grade reliability for metro interconnect services

This aligns with cloud interconnect and metro transport design used in service provider environments.

Evaluation of the Options

A. OSPF backbone area adjacency

This is a routing protocol adjacency, not a physical connection method. It requires a transport link underneath but does not represent the physical interconnect itself.

B. Private wireless connection

Not suitable for CNF or metro DC interconnect because it lacks the bandwidth, reliability, and deterministic performance required for large-scale carrier-grade interconnects.

C. DWDM ring

This is the correct method. DWDM-based metro fiber rings are the standard for connecting carrier-neutral facilities in the same metro region.

D. CAT6e connection

This is limited to short-distance copper Ethernet (tens of meters). It is not used for metro-scale interconnects or between CNFs.

Comprehensive and Detailed Explanation

SNMP traps in Cisco NFVIS (and in SNMP generally):

Areunsolicited notifications

Sent from the NFVIS deviceto the SNMP manager

Indicate alarms, changes, or significant operational events

Donotrequire polling

Examples:

Disk failures

VM crashes

Host status changes

Resource alarms

Why the others are wrong:

Adescribes SNMP monitoring (done by the manager with GET requests)

BSNMP cannotcontrolhost activities

DSNMP GET retrieves a variable, but traps sendunsolicitednotifications

Thus, the correct answer isC.

Comprehensive and Detailed Explanation From Exact Extract from my knowledge of Designing and Implementing Cisco Service Provider Cloud Network Infrastructure Outlines without Any External URL or Links:

Cisco+ Hybrid Cloud is Cisco’s as-a-service consumption model that offers pay-as-you-go infrastructure. For ahybrid workplace, the focus is on giving users secure desktop environments from anywhere, with the ability torapidly deployandscale up or downbased on the number of users or partners.

Cisco+Hybrid Cloud for Virtual Desktop Infrastructure (VDI)specifically delivers desktop and app workspaces as an on-demand service. It allows partners to consume desktops elastically, paying for capacity as needed and scaling the underlying compute, storage, and networking without rebuilding the environment.

Bare Metal Compute and Virtualization offers flexible infrastructure but are aimed at app/workload hosting rather than user desktop workspaces.

Service Provider Networking addresses network services, not end-user hybrid workplace desktops.Therefore, for a pay-as-you-go, rapidly deployable, elastic solution in a hybrid workplace,Cisco+ Hybrid Cloud for Virtual Desktop Infrastructureis the correct choice.

The attacker’s IP is:

10.10.10.2

The servers under attack are:

Web Server:10.20.10.2

Mail Server:10.30.10.2

We must denytraffic from attacker → servers.

Correct ACL format useshost wildcards (0.0.0.0):

deny ip 10.10.10.2 0.0.0.0 10.20.10.2 0.0.0.0

deny ip 10.10.10.2 0.0.0.0 10.30.10.2 0.0.0.0

These matchD and E.

Comprehensive and Detailed Explanation From Cisco SP Core Optimization Knowledge

Cisco IOS supportsBGP Multipathfor installing multiple equal-cost BGP routes (both iBGP and eBGP) into the routing table. The correct global BGP command syntax to set the number of allowable parallel BGP paths is:

maximum-paths

For BGP specifically, the form is:

maximum-paths bgp

This enables the router to install up to the specified number of equal-cost BGP routes (iBGP and eBGP) into the RIB and then potentially into the FIB.

Setting:

maximum-paths bgp 6

allowssixparallel ECMP paths learned via BGP—this matches the requirement in the question.

Why the other options are incorrect

B. multipath eibgp 6Not a valid Cisco IOS command.

C. maximum paths bgp routers 6Invalid syntax.

D. maximum-paths eibgp 6The correct keyword isbgp, noteibgp.Cisco does not use “eibgp” in this context; IOS supports BGP multipath across iBGP/eBGP automatically when configured under maximum-paths bgp.

Comprehensive and Detailed Explanation

For distancesgreater than 20 miles, valid inter-facility transport options must support:

Metro-scale connectivity

High bandwidth

Low latency

Carrier-grade reliability

Acarrier access Ethernet ring (MEN / Metro Ethernet)is designed for:

Interconnecting data centers or meet-me rooms

Distances far exceeding 20 miles

High-availability layer-2 or layer-3 transport

Why the others are invalid:

CAT6e→ maximum ~100 meters

Multimode fiber→ typically <2 km (~1.25 miles)

Private wireless→ not used for high-capacity DC interconnects, unreliable for core transport

Thus, the only correct carrier-grade method isCarrier access Ethernet ring.