300-540 Sample Questions Answers

Comprehensive and Detailed Explanation From Exact Extract from my knowledge of Designing and Implementing Cisco Service Provider Cloud Network Infrastructure Outlines without Any External URL or Links:

Container orchestration is the automated management of container lifecycle tasks such as deployment, scaling, failover, and updates. In Cisco cloud and NFV design guidance, typical orchestration platforms includeDocker (with Swarm)andKubernetes, which integrate with Cisco networking and security for cloud-native workloads.

Dockerprovides the container runtime and can also perform basic orchestration through Docker Swarm mode, managing multi-container, multi-host deployments.

Kubernetesis a full-featured orchestration system that automates deployment, scaling, and operations of application containers across clusters. It is the de-facto standard used with Cisco Container Platform and other Cisco cloud solutions.

VMware vCenter, Cisco vManage, and Cisco vSmart focus on virtual machines or SD-WAN control, not container orchestration. Therefore, the correct tools areDocker and Kubernetes (A, D).

Comprehensive and Detailed Explanation From Cisco SP Security Knowledge

Cisco Always-On Cloud DDoS Protection is a cloud-based, carrier-grade security service used by service providers to protect customers from volumetric and application-layer DDoS attacks.

Its core protection mechanism is the use ofglobal scrubbing centers, which:

Receive diverted attack traffic

Scrub (clean) malicious packets

Forward clean traffic back to the customer

Use behavioral analysis and real-time detection

Protect against volumetric, TCP state-exhaustion, and application-layer attacks

Why other answers are incorrect:

Load balancing (A)doesnotmitigate DDoS attacks; it distributes traffic across servers.

Botnet zombies (B)aresourcesof DDoS attacks, not protection.

Traffic mirroring (C)is used for analysis and monitoring, not active DDoS protection.

Comprehensive and Detailed Explanation From Cisco SP Core Optimization Knowledge

Cisco IOS supportsBGP Multipathfor installing multiple equal-cost BGP routes (both iBGP and eBGP) into the routing table. The correct global BGP command syntax to set the number of allowable parallel BGP paths is:

maximum-paths

For BGP specifically, the form is:

maximum-paths bgp

This enables the router to install up to the specified number of equal-cost BGP routes (iBGP and eBGP) into the RIB and then potentially into the FIB.

Setting:

maximum-paths bgp 6

allowssixparallel ECMP paths learned via BGP—this matches the requirement in the question.

Why the other options are incorrect

B. multipath eibgp 6Not a valid Cisco IOS command.

C. maximum paths bgp routers 6Invalid syntax.

D. maximum-paths eibgp 6The correct keyword isbgp, noteibgp.Cisco does not use “eibgp” in this context; IOS supports BGP multipath across iBGP/eBGP automatically when configured under maximum-paths bgp.

Comprehensive and Detailed Explanation

AnAPI logic flawis a weakness in the API’sbusiness logic— not in encryption or transport security. It occurs when:

API functions are misused

Business rules are bypassed

Security validation is missing

Workflow logic is incorrect

These issues cannot be solved through encryption (at rest or in transit). They require:

✔Vulnerability remediation

✔Fixing API code logic

✔Updating API validation, flow control, and authentication logic

Thus the correct answer isC. Remediation of vulnerabilities.

Comprehensive and Detailed Explanation

In Cisco Secure Endpoint Private Cloud AirGap mode, Internet access is disabled. Updates must be uploaded manually and then triggered inside the Secure Endpoint console.

The commandforce update -yinitiates the update of the manually uploaded Secure Endpoint package.

Other commands are not used for Secure Endpoint updates:

rpm -qa→ Lists Linux packages only

jamf-sync all→ Used for Apple JAMF integrations

genisoimage→ Used to create ISO files, irrelevant to Secure Endpoint

Therefore,Ais correct.

Comprehensive and Detailed Explanation

In Cisco NFVI security architecture, the primary defense againstlateral movement(an attacker moving from one compromised node to another) isnetwork segmentation.

Segmentation:

Separates workloads (compute, storage, management, tenant networks)

Prevents attackers from pivoting inside the NFVI

Reduces blast radius during breaches

Enforces micro-segmented virtual network boundaries

WPA protects Wi-Fi, not NFVI.

WAF protects web apps, not internal movement.

Data encryption protects confidentiality, not lateral movement control.

Thus,network segmentationis the correct solution.

From the RAID controller output:

TheRAID1virtual drive is shown as“Dgrd” (degraded)with a note:“RAID 1 in degraded state.”

In thePD LIST, one disk (slot 2) is marked“UGood – active disk in slot 2 disconnected from drive group 0”, while the other (slot 3) is“Onln 0”(online and part of drive group 0).

This means:

In aRAID 1mirror, onlyone diskmay fail while the array remains available.

Here,one disk has failed/disconnected, the other is still online → the array isdegraded but operational.

Therefore:

B. One RAID 1 disk failed– correct.

C. The node is still functional– correct; RAID1 can tolerate a single disk failure.

The other options are incorrect:

A and Esuggest two disk failures, which is not indicated.

Dwould be true only if both disks failed; with one disk still online, the node continues to function, though in a degraded state.

In Cisco SD-WAN,vSmart controllers must be assigned to controller groupsso that edge routers can form redundant control-plane connections. Each data center in the diagram has its own group:

New York DC → Controller group-ID 1(vSmart1, vSmart2, vSmart3)

Los Angeles DC → Controller group-ID 2(vSmart4, vSmart5, vSmart6)

To configure the controllers correctly:

vSmart1

It resides in theNew York DC, so it must be assigned tocontroller-group 1.

Required command:

system controller-group-id 1

This corresponds toOption D.

vSmart4

It resides in theLos Angeles DC, so it must be assigned tocontroller-group 2.

Required command:

system controller-group-id 2

This corresponds toOption C.

Why Other Options Are Incorrect

A and B:The command max-control-connections is configured onedge routers, not vSmart controllers.

E:Controller-group-id 4 does not exist in this design; only group 1 and group 2 are shown.

Comprehensive and Detailed Explanation Based on Designing and Implementing Cisco Service Provider Cloud Network Infrastructure Knowledge

When connectingcarrier-neutral facilities (CNFs)ordata centerswithin the same metropolitan area, service providers typically usehigh-bandwidth, low-latency optical transport methods. The most appropriate and commonly deployed interconnection technology is:

DWDM (Dense Wavelength Division Multiplexing) ring, which provides:

High capacity (10G, 40G, 100G, 400G)

Low latency

Redundancy through ring or mesh topologies

Multi-wavelength multiplexing for cost efficiency

Carrier-grade reliability for metro interconnect services

This aligns with cloud interconnect and metro transport design used in service provider environments.

Evaluation of the Options

A. OSPF backbone area adjacency

This is a routing protocol adjacency, not a physical connection method. It requires a transport link underneath but does not represent the physical interconnect itself.

B. Private wireless connection

Not suitable for CNF or metro DC interconnect because it lacks the bandwidth, reliability, and deterministic performance required for large-scale carrier-grade interconnects.

C. DWDM ring

This is the correct method. DWDM-based metro fiber rings are the standard for connecting carrier-neutral facilities in the same metro region.

D. CAT6e connection

This is limited to short-distance copper Ethernet (tens of meters). It is not used for metro-scale interconnects or between CNFs.

Comprehensive and Detailed Explanation

AWSSecurity Groupsact as the primary stateful firewalls for EC2 instances.

To restrict SSH (TCP/22) to a single host (20.20.20.20/32), aSecurity Groupmust be configured with:

Inbound rule: TCP 22

Source: 20.20.20.20/32

ACLs operate at the subnet level but are not used for instance-specific SSH restrictions.

WAF controls HTTP/HTTPS traffic, not SSH.

Resource groups only organize cloud assets.

Thus,Bis the correct solution.

NETCONF rules state:

A user cannot terminatetheir own active session.

Attempting to kill the same session returnsinvalid-valueerror.

The session continues running normally.

Thus:

No logout

No termination

No configuration impact

Therefore,Ais correct.

Comprehensive and Detailed Explanation From Cisco NFVI + VIM Architecture

Cisco VIM (Virtual Infrastructure Manager) operates as part of Cisco NFVI and requiresspecific mandatory network segmentsto deploy OpenStack-based NFVI environments.

The essential required networks for Cisco VIM include:

✔Provisioning network

Used during bare-metal install of compute and controller nodes

Handles PXE boot, image deployment, and VIM’s management reachability

✔Storage network

Used for Cinder, Swift, Ceph, and Glance back-end storage replication

Ensures predictable latency and bandwidth for NFVI workloads

Other networks exist in VIM (Management, API, Tenant, External), but the question asks for the required foundational segments.

Why the other options are incorrect:

Data plane(B) – used inside NFV workloads but not a required VIM infrastructure network.

Heartbeat(C) – not a defined VIM network segment.

Host network(D) – not a Cisco VIM terminology; provisioning network handles host onboarding.

In Cisco NFVI, themanagement noderelies heavily on Docker containers for:

NFVIS management functions

VIM services

Orchestration components

If the management node fails to start and the system shows:

docker.service: inactive (dead)

…then all Docker-based platform services also fail to start.

The correct recovery action is torestart the Docker engine:

systemctl restart docker

This brings up:

All NFVI-required Docker containers

Management services

REST APIs and cluster components

Why other answers are incorrect:

docker-kibana→ Only affects Kibana logging container

docker-cobbler→ Used for provisioning, not core NFVI management

kube-apiserver→ Part of Kubernetes cluster, but relies on Docker; restarting it won’t help until Docker is running

Thus, the correct answer isB. docker.

In a VXLAN BGP EVPNMulti-Siteenvironment:

DCI trackingmonitors the health of the DCI links. If all DCI-tracking interfaces go down, the leaf can incorrectly keep advertising or learning remote MAC/IP reachability, leading to packet loss and sub-optimal forwarding for servers in that VLAN/L2VNI.

For proper operation, eachDCI-facing interfacemust be enabled with evpn multisite dci-tracking so that the Multi-Site border leaf tracks reachability over that link.

When using EVPN Multi-Site, BUM (broadcast, unknown unicast, multicast) traffic toward remote sites is typically handled viaingress replication, not multicast groups, for each L2VNI participating in Multi-Site. The configuration snippet shows an L2VNI (vn-segment 16535) still mapped to mcast-group 239.1.1.0, which is inconsistent with Multi-Site recommendations and contributes to packet loss.

Therefore, to fix the problem:

Enable DCI tracking on the uplink:

interface Ethernet1/1

evpn multisite dci-tracking

This restores proper DCI-link state monitoring for Multi-Site. →Option C

Change the L2VNI behavior from multicast to Multi-Site ingress replication:

Under the VNI for VLAN 11, configure:

evpn

vni 16535 l2

multisite ingress-replication

or the equivalent command for the specific NX-OS release, thereby aligning the L2VNI with EVPN Multi-Site design and eliminating packet loss. →Option D

Options A and B are ELAM (embedded logic analyzer) filters used only for packet capture and do not resolve the forwarding issue.

Option E is an ACL line unrelated to EVPN VXLAN or DCI tracking and does not address the underlying problem.

Comprehensive and Detailed Explanation From Cisco SP Core Optimization Knowledge

Cisco IOS supportsBGP Multipathfor installing multiple equal-cost BGP routes (both iBGP and eBGP) into the routing table. The correct global BGP command syntax to set the number of allowable parallel BGP paths is:

maximum-paths

For BGP specifically, the form is:

maximum-paths bgp

This enables the router to install up to the specified number of equal-cost BGP routes (iBGP and eBGP) into the RIB and then potentially into the FIB.

Setting:

maximum-paths bgp 6

allowssixparallel ECMP paths learned via BGP—this matches the requirement in the question.

Why the other options are incorrect

B. multipath eibgp 6Not a valid Cisco IOS command.

C. maximum paths bgp routers 6Invalid syntax.

D. maximum-paths eibgp 6The correct keyword isbgp, noteibgp.Cisco does not use “eibgp” in this context; IOS supports BGP multipath across iBGP/eBGP automatically when configured under maximum-paths bgp.