Cisco 400-007 - Cisco Certified Design Expert (CCDE v3.1)

B (Strategic planning): Long-term business-aligned decisions that shape future infrastructure needs.

D (Tactical planning): Short-to-mid-term activities that adjust design based on evolving operational realities, constraints, and priorities.

Why other options are incorrect:

A & E: While cost and business optimization are goals, they are not defined planning approaches.

C: Modular is a design methodology, not a planning approach.

—

C (Faster convergence): 802.1s (Multiple Spanning Tree Protocol – MSTP) improves convergence times over legacy 802.1D (STP) and PVST+ by leveraging the rapid convergence benefits of 802.1w (RSTP).

E (Maps multiple VLANs): MST allows multiple VLANs to share the same spanning-tree instance, reducing the overall number of instances required and improving scalability.

Other options explained:

A: The standard supports 64 MST instances, not 1024.

B: 802.1w (RSTP) is the basis for 802.1s; Cisco’s proprietary enhancement was originally PVST+.

D: MST actually reduces CPU/memory compared to running multiple instances of PVST+.

B (BFD Echo):BFD Echo mode uses local hardware-based loopback mechanisms for even faster fault detection than regular BFD asynchronous mode, significantly reducing failure detection time and thus convergence delay.

Other options explained:

A/D: OSPF fast hellos improve OSPF detection but are still control-plane driven and slower than hardware-based BFD Echo.

C: BGP is slower to converge than OSPF, especially for IGP-like designs.

For EIGRP to maintain loop-free alternate paths, the feasibility condition must be met:

A. The Reported Distance (RD) must be lower than the router's Feasible Distance (FD).

E. A feasible successor must exist (i.e., an alternate next-hop satisfying the feasibility condition).

This design allows immediate failover without recomputation, ensuring fast convergence — a critical CCDE v3.1 protocol design principle.

Why other options are incorrect:

B, C, D: Misstate the feasibility condition or confuse RD and FD relationships.

—

In a standard 3-tier data center architecture (access, aggregation, core), the Layer 2-to-Layer 3 boundary typically resides at the aggregation layer. When extending VLANs between data centers using a Layer 2 interconnection, the most optimal and scalable termination point is at the aggregation layer because:

It naturally handles VLAN demarcation and Layer 3 boundary.

Spanning Tree Protocol (STP) domains remain contained within local aggregation blocks.

The core remains Layer 3-only, ensuring scalability, stability, and no STP involvement.

Simplifies traffic engineering, FHRP operations, and minimizes control-plane complexity across sites.

This design is consistent with CCDE v3.1 best practice where VLAN extension is isolated to aggregation to avoid STP scaling issues and maintain hierarchical design principles.

Why other options are incorrect:

A: STP isolation can still be achieved at aggregation while keeping the core Layer 3.

C: Access layer extensions would increase STP scope and complexity unnecessarily.

D: Core termination violates Layer 3 core design, bringing STP into the core, which is not scalable.

STP Bridge Assuranceis a mechanism used to protect againstunidirectional link failureson point-to-point STP connections in environments likeRapid PVST+ and MST. When Bridge Assurance is enabled, BPDUs are expected on all BPDUs-capable interfaces. If a switch stops receiving BPDUs on a point-to-point link where Bridge Assurance is enabled, it assumes the link has failed and transitions the port to blocking to prevent a loop.

This is especially useful in high-availability enterprise designs that require protection from unexpected switch behavior or partial link failures.

Why other options are incorrect:

A. BPDU Guard: Protects access ports by placing them in an err-disabled state if BPDUs are received—useful at the edge, not for core loop protection.

C. MSTP: Refers to the protocol itself but does not solve the unidirectional link issue on its own.

D. TRILL: A different architecture (layer 2 routing) and not applicable to Rapid PVST+ or MST-specific protection.

In a full-mesh iBGP design, every router must establish and maintain a BGP session with every other router. As the number of routers increases, the number of BGP sessions and the amount of BGP processing increases exponentially. This leads to high CPU utilization, especially in devices with limited processing capabilities, such as distribution routers.

Themost cost-effectiveandscalablesolution in this scenario is toimplement route reflectors (RRs)on the two core routers. Route reflectors significantly reduce the number of iBGP peerings required, eliminating the full mesh requirement by allowing the distribution routers (RR clients) to establish a single iBGP session with the route reflector. The route reflector handles route advertisement to other RR clients, thereby reducing overhead on the distribution routers.

This solution adheres to CCDE v3.1 design principles for:

Optimizing control plane scalability

Reducing unnecessary CPU load from control protocols

Ensuring a maintainable and scalable enterprise BGP deployment

Why the other options are incorrect:

BandD(Increasing memory): Addresses only hardware capacity without solving the root cause (BGP scaling issue).

C(Using eBGP): Misaligned with enterprise internal network design; eBGP adds complexity in route policy and administrative boundaries.

E(Increasing bandwidth): Bandwidth does not alleviate CPU overhead caused by BGP processing.

Implementing route reflectors aligns with both scalability and cost-efficiency goals as prescribed in the CCDE v3.1 methodology.

B (Cloud OnRamp for IaaS):This allows certain applications to have direct optimized access to public cloud resources while other enterprise traffic remains centralized. OnRamp for IaaS provides dynamic path selection and policy control based on application behavior and performance.

Other options explained:

A: MPLS L3VPN does not offer cloud-optimized direct access.

C: SaaS OnRamp is for SaaS applications, not IaaS workloads.

D: Direct Connect links to the cloud but lacks policy-driven traffic engineering.

Loop Guardis designed to protect againstSTP loop conditionsthat may occur whenBPDUs are unexpectedly missingon a point-to-point link. This is especially relevant in cases where UDLD (Unidirectional Link Detection) might not detect the problem quickly enough. When BPDUs are absent, a switch might erroneously assume that the link is safe to forward, potentially leading to atemporary Layer 2 loop.

UsingLoop Guardensures that a port moves into aloop-inconsistentstate instead of forwarding traffic if BPDUs are missing, effectively stopping a loop before it forms. This makes it acomplementary mechanism to UDLD, which focuses on detecting unidirectional links at the physical layer, not STP control plane failures.

This recommendation aligns with CCDE v3.1 best practices forresilient Layer 2 designs, which emphasize using multiple mechanisms in tandem to proactively prevent failure conditions before traffic is impacted.

Why other options are incorrect:

A. Root Guard: Prevents an unauthorized switch from becoming the root bridge but doesn't protect against missing BPDUs.

B. BPDU Guard: Used mainly on access ports to prevent BPDU reception; not intended for core loop prevention.

D. BPDU Filtering: Suppresses BPDU exchange entirely, which increases loop risk and is not suited for loop mitigation.