400-007 Questions and Answers
Question # 1
Enterprise XYZ wants to implement fast convergence on their network and optimize timers for OSPF. However, they also want to prevent excess flooding of LSAs if there is a constantly flapping link on the network. Which timers can help prevent excess flooding of LSAs for OSPF?
A.
OSPF propagation timers
B.
OSPF throttling timers
C.
OSPF delay timers
D.
OSPF flooding timers
Answer:
B
Explanation:
OSPF throttling timers control the pacing and frequency of SPF calculations and LSA generation. They help strike a balance between fast convergence and control-plane stability. The key timers include:
LSA generation throttling (min/max interval between LSA originations)
SPF calculation throttling (delays between consecutive SPF runs)
By tuning these timers, network designers can:
Prevent CPU overload caused by rapid or repeated LSA updates due to flapping links
Smooth out instability while still enabling responsive convergence
This approach aligns with CCDE v3.1 under “Protocol Design Implications†for optimizing IGP behavior in large, dynamic topologies.
==========
Question # 2
The line between security and compliance is easily blurred and is, to a large extent, a moving target Drag and drop each of the requirements on the left to the appropriate section on the right
Answer:
Answer: 
Explanation:
🟦QUESTION NO: 374 [Business-Driven Design Approaches]
Organic growth or decline affects network demands over time. Which tool helps in designing and operationalizing networks under changing conditions?
A. Change management
B. Modularity
C. Mobility
D. Monitoring
Answer: B
ðŸ”Explanation:
B: Modularity is a core principle of scalable network design. It allows the network to grow or shrink in response to organic changes in business demand, supporting agility, easier management, and minimal disruption during change.
Other options:
A: Change management is about documenting and approving changes—not a design principle.
C: Mobility refers to user/device flexibility, not structural adaptability.
D: Monitoring detects changes but doesn’t help design the network.
==========
🟦 QUESTION NO: 375 [Protocol Design Implications]
Company XYZ uses OSPF over redundant paths. What effect does BFD have during a link failure?
A. It would drop the dead peer detection time to a single hello
B. It would keep an alternate path ready in case of a link failure
C. It would optimize the route summarization feature of OSPF
D. It would detect that the neighbor is down in a subsecond manner
Answer: D
ðŸ”Explanation:
D: BFD (Bidirectional Forwarding Detection) provides subsecond failure detection that is significantly faster than standard OSPF dead timers. When integrated with OSPF, it enables rapid neighbor failure detection, thus speeding up convergence.
Other options:
A: “Single hello†is not a valid BFD metric.
B: BFD does not influence path availability—it only detects failures quickly.
C: BFD doesn’t interact with summarization.
🟦QUESTION NO: 376 [Security, Automation, and Policy Integration in Design]
What two elements are critical for security and compliance in hybrid cloud environments? (Choose two)
A. Cloud integration and data security
B. Tighter controls based on dynamic policy enforcement
C. Security event and data interoperability
D. Flexible controls based on policy application
E. Orchestration and cross-cloud access security
Answer: C, E
ðŸ”Explanation:
C: Security event and data interoperability ensures that logs, alerts, and policies can be analyzed across different platforms (private and public clouds), which is vital for compliance and response.
E: Hybrid clouds require secure orchestration across multiple cloud domains, including federated identity, access control, and monitoring across cloud boundaries.
Other options:
A: Too broad; integration is not specific to security/compliance.
B and D: These relate to policy enforcement but don’t directly address interoperability or compliance across multiple clouds.
==========
🟦 QUESTION NO: 377 [Security, Automation, and Policy Integration in Design]
To protect against future perimeter breaches, which two design options can help? (Choose two)
A. Microzoning
B. Segmentation
C. Domain fencing
D. Virtualization
E. Microperimeters
Answer: B, E
ðŸ”Explanation:
B: Segmentation isolates network zones (e.g., separating finance from guest access), limiting lateral movement after a breach.
E: Microperimeters apply security controls closer to the application or workload, providing granular control and defense in depth.
Other options:
A: Microzoning is not a widely defined or standard practice in network security.
C: Domain fencing is not a standard security term or methodology.
D: Virtualization is a technology, not a security architecture.
🟦QUESTION NO: 378 [Network Architecture Principles]
A customer is migrating from a traditional Layer 2 data center to a VXLAN spine-leaf SDN architecture. Applications cannot be readdressed, and migration must occur incrementally. How should the legacy and new networks be connected?
A. via Layer 3 links to border leaf switches
B. via a Layer 2 trunk and Layer 3 routed links to border leaf switches
C. via a Layer 2 trunk and Layer 3 routed links to spine switches
D. via a Layer 2 trunk to border leaf switches
Answer: D
ðŸ”Explanation:
D: A Layer 2 trunk to the border leaf allows seamless VLAN extension between the legacy Layer 2 domain and the VXLAN-based fabric. This supports application migration without readdressing. Border leaf switches are used to bridge the traditional and VXLAN segments while maintaining MAC learning and VLAN consistency.
Incorrect Options:
A & B: Layer 3 links alone would require readdressing or routing, violating the constraint.
C: Spine switches typically do not handle VLAN bridging or policy enforcement directly.
==========
🟦 QUESTION NO: 379 [Business-Driven Design Approaches]
Scrum and Kanban are Agile methodologies. In which two scenarios is Kanban more appropriate? (Choose two)
A. acquisition of automation tools
B. carrier lead times
C. network configuration design
D. physical hardware deployment
E. logical topology deployment
Answer: B, D
ðŸ”Explanation:
B: Kanban is suited for environments with variable lead times, such as carrier provisioning, where tasks arrive irregularly and are processed continuously.
D: Physical hardware deployment is dependent on availability and external logistics—Kanban helps manage such workflows where task durations are less predictable.
Incorrect Options:
A: Tool acquisition is typically a one-off project rather than a workflow suited for Kanban.
C & E: These are better suited for Scrum when planning sprints and structured deployments.
==========
🟦 QUESTION NO: 380 [Security, Automation, and Policy Integration in Design]
The network has high CPU usage due to excessive inbound traffic impacting the control and management planes. What should be implemented?
A. control plane policing
B. deep interface buffers
C. TCAM carving
D. modular QoS
Answer: A
ðŸ”Explanation:
A: Control Plane Policing (CoPP) protects the control plane by rate-limiting or dropping unnecessary or malicious traffic destined for the CPU. This is essential in preventing routing and management plane starvation under high traffic conditions.
Incorrect Options:
B: Deep buffers help in data plane congestion, not control plane CPU usage.
C: TCAM carving relates to hardware forwarding table allocations, not CPU protection.
D: Modular QoS is valuable for traffic shaping but not specific to control plane protection.
Question # 3
What is the most important operational driver when building a resilient and secure modular network design?
A.
Reduce the frequency of failures requiring human intervention
B.
Minimize app downtime
C.
Increase time spent on developing new features
D.
Dependencies on hardware or software that is difficult to scale
Answer:
A
Explanation:
A modular, scalable network design aims to:
Localize faults
Reduce impact radius of failures
Enable automated fault detection and recovery
The primary operational driver is to reduce the need for manual intervention during failures, which translates to:
Faster recovery times
Consistency in troubleshooting
Improved service reliability
While minimizing app downtime (B) is a goal, it is a result of reducing human-required failure recovery. Option C is a business process goal, and D is an architectural challenge, not an operational driver.
This aligns with CCDE v3.1's “Network Architecture Principles†for building operationally resilient networks.
