Cisco 400-007 - Cisco Certified Design Expert (CCDE v3.1)

B (Encrypt data when it is at rest and in motion): In hybrid cloud deployments, encryption is one of the most critical mechanisms to protect sensitive enterprise data both during storage (at rest) and while being transmitted (in motion). This ensures confidentiality and integrity across both private and public cloud environments.

Other options explained:

A: Using standard protocols is a general best practice but insufficient without encryption.

C: Communication of risks is part of compliance but does not enforce technical security.

D: Using standard protocols without encryption exposes data to risks.

—

Control plane hardening is a critical aspect of securing infrastructure devices. Recommended measures include:

A. Routing protocol authentication: Prevents unauthorized devices from injecting false routes by requiring secure key-based authentication (e.g., MD5 or SHA for OSPF/BGP).

B. SNMPv3: Provides secure management through authentication and encryption, preventing interception or modification of SNMP traffic.

C. Control Plane Policing (CoPP): Enforces rate limits and filtering for traffic directed to the device ' s CPU, protecting against DoS and control plane overloads.

Why other options are incorrect:

D. Redundant AAA servers support authentication resilience but are more about access control than direct control plane protection.

E. Warning banners are a legal and administrative best practice, not a technical control plane defense.

F. Enabling unused services is the opposite of best practices and increases the attack surface.

These control-plane protections are emphasized in CCDE v3.1 design guidance for resilient and secure infrastructure designs.

In most Cisco NAT implementations:

Local-to-global NAT translations occur before policy-based routing (PBR), meaning that NAT happens first, and then PBR decisions are made based on the translated addresses.

This sequence is important when designing overlapping address spaces, as NAT must be applied before routing policies can correctly forward traffic based on global addresses.

Other options explained:

A: Incorrect sequence.

B/D: Global-to-local translations occur during inbound processing but not in the order described relative to PBR.

—

Comprehensive and Detailed Explanation:

B: Augmented SDN allows external applications or controllers to interact with the traditional control plane (e.g., RIB or FIB) via APIs, without fully replacing it.

A (replace) removes traditional control protocols entirely.

C (hybrid) uses both SDN and legacy control planes, but without deep integration.

D (distributed) refers to traditional decentralized control planes.

Augmented SDN enhances traditional routing with programmable control, offering near real-time visibility and dynamic response without disrupting the existing control architecture.

C (Service orchestration platform):As branch scale increases, orchestration platforms automate multi-site deployment, configuration, and policy management. They integrate with controllers and external systems to reduce manual intervention, improve scalability, and enforce service consistency across thousands of locations.

Other options explained:

A: Management systems assist monitoring but don’t address provisioning complexity.

B: Lifecycle models guide processes but are not technical automation solutions.

D: Manual teams are not scalable for high-volume growth.

C (Class-Based Weighted Fair Queuing - CBWFQ): CBWFQ allows assigning bandwidth limits (in this case, 2 Mbps) to specific traffic classes, effectively controlling scavenger traffic without dropping excess packets unnecessarily.

Other options explained:

A: Policing drops excess traffic immediately rather than queuing.

B: LLQ is for delay-sensitive traffic, not scavenger control.

D: Shaping is useful but typically applied at interface level, not specific traffic classes.