Cisco Certified Design Expert V3.0 Free Sample Questions

To provide shared L3Out services while maintaining tenant isolation, the L3Out is configured in the 'common' tenant. The key step is to define the external network (External EPG) subnets with the scope set to 'Shared between VRFs'. This allows routes to be leaked from the common VRF to tenant VRFs without merging the VRFs themselves, thus maintaining routing table isolation. The other options either fail to share the L3Out, merge routing tables, or are not standard ACI practice.

This design requires two policies. First, a centralized control policy is used to influence the routing path, setting a higher preference for TLOCs at DC1 for the specific application prefixes. This handles the primary path selection. Second, an application-aware routing (AAR) policy is needed to monitor path performance. This policy defines an SLA class (e.g., loss > 20%) and specifies that if the preferred path (to DC1) violates this SLA, traffic should be moved to an alternate path (to DC2). Data policies are for packet manipulation, and localized policies would not be efficient for this global requirement.

This statement is true. LISP is the fundamental control plane protocol in the SD-Access fabric. It separates the endpoint identity (EID), which is the IP or MAC address, from its location (RLOC), which is the loopback address of the fabric edge switch where the endpoint is connected. The LISP Map-Server/Map-Resolver functionality, running on the control plane nodes, maintains this dynamic EID-to-RLOC mapping database.

In an SD-Access solution, Cisco Identity Services Engine (ISE) is the component responsible for device profiling, authentication, and authorization. Upon successful authentication, ISE assigns a Security Group Tag (SGT) to the endpoint (e.g., SGT for IoT_Devices). Cisco TrustSec technology, which is integrated into the fabric, uses these SGTs to enforce security policies. A matrix-based policy in ISE/DNA Center would define that the 'IoT_Devices' SGT can only talk to the 'Video_Server' SGT, and this policy is enforced at the ingress fabric edge node. LISP/VXLAN are control/data plane protocols, while DNA Center is the orchestrator; they are part of the solution but not the primary components for dynamic policy assignment and enforcement.

Local Preference is the correct attribute for influencing outbound traffic path selection within an autonomous system. It is a well-known, discretionary attribute that is exchanged between iBGP peers. By setting a higher Local Preference (default is 100) on routes learned from the primary provider (AS 65100), all routers within AS 65300 will prefer that path to exit the network. AS-Path prepending influences inbound traffic, and MED is considered after Local Preference and is typically used to influence how a neighboring AS enters your network.

AWS Direct Connect provides a dedicated, private network connection from on-premises to AWS, which bypasses the public internet. This directly addresses the requirements for privacy, low latency, and consistent performance. Using a private Virtual Interface (VIF) connects to the VPC. To meet the encryption requirement for PCI, MACsec can be enabled on the Direct Connect link (for 10Gbps and higher connections) to provide Layer 2 encryption. This combination is superior to a VPN over the internet, which would have variable performance and higher latency, and is more direct than solutions involving SD-WAN or transit gateways for this point-to-point requirement.

RTO (Recovery Time Objective) is the target time within which a business process must be restored after a disaster or disruption to avoid unacceptable consequences associated with a break in business continuity. An RTO of 15 minutes means the network must be operational within that timeframe. RPO (Recovery Point Objective) is the maximum targeted period in which data might be lost from an IT service due to a major incident. An RPO of 1 hour means that backups or replications must be frequent enough that no more than one hour of data is lost.

In PIM-SM, the Rendezvous Point (RP) serves as a shared root for a shared multicast distribution tree (*,G). New multicast sources register with the RP, and new receivers send their IGMP joins towards the RP. This allows receivers to learn about active sources without the sources needing to know about all receivers, which is the core principle of sparse mode. Once a receiver begins pulling a stream from a source via the RP, its local router may switch to a source-based Shortest Path Tree (SPT) for a more optimal path.

Cisco's QoS best practice recommends marking voice bearer traffic (RTP) with DSCP 46, which corresponds to the Expedited Forwarding (EF) Per-Hop Behavior. The EF PHB is designed for low-loss, low-latency, low-jitter traffic and is typically serviced by a priority queue (LLQ) across the network. AF41 is commonly used for interactive video, CS3 for call signaling, and BE (or CS0) for default data traffic.

Operational Expenditure (OPEX) refers to the ongoing costs required for the day-to-day functioning of a business. In network design, this includes recurring costs like monthly circuit fees and annual support contracts. Capital Expenditure (CAPEX) refers to one-time purchases of physical goods or services, such as the initial purchase price of a router and the one-time installation fee.