300-540 Practice Questions

The question requires a pay-as-you-go solution tailored for a hybrid workplace, emphasizing flexibility and scalability for partners. Cisco+ Hybrid Cloud for Virtual Desktop Infrastructure (VDI) is specifically designed to meet these needs. VDI provides users with secure, on-demand access to their desktops and applications from any device, anywhere, which is the core requirement of a hybrid work model. The Cisco+ offering delivers this as a service, aligning with the pay-as-you-go, rapid deployment, and scalability criteria mentioned in the scenario.

A. Cisco+ Hybrid Cloud for Bare Metal Compute: This provides raw server infrastructure as a service. It is a foundational component, not the specific end-user solution required for a hybrid workplace.

C. Cisco+ Hybrid Cloud for Virtualization: This is a broader infrastructure-as-a-service offering. While VDI runs on virtualization, this option is less specific and does not directly address the end-user desktop access needs of a hybrid workplace.

D. Cisco+ Hybrid Cloud for Service Provider Networking: This solution is focused on the networking infrastructure for service providers (e.g., routing, automation) and is not relevant to providing end-user desktop services.

1. Cisco, "Cisco+ Hybrid Cloud for Virtual Desktop Infrastructure At-a-Glance" (2022). This document explicitly states the solution's purpose: "Enable your hybrid workforce with secure, on-demand access to applications and data from any device, anywhere." It also highlights the "Consumption-based model" which directly corresponds to the "pay-as-you-go" requirement. (Reference found on Page 1, under "Benefits").

2. Cisco, "Cisco+ Hybrid Cloud At-a-Glance" (2022). This overview document describes the entire Cisco+ portfolio as delivering "flexible consumption models" and the ability to "scale services up or down." This supports the general characteristics mentioned in the question that apply to the specific VDI solution. (Reference found on Page 1, under "Cisco+ Hybrid Cloud").

3. Cisco, "Cisco+ Hybrid Cloud for Bare Metal At-a-Glance" (2022). This document clarifies the use case for the Bare Metal offering: "Run your performance-intensive and specialized workloads on dedicated, high-performance Cisco UCS servers..." This confirms it is an infrastructure service, not an end-user hybrid work solution, making option A incorrect. (Reference found on Page 1, under "Benefits").

A Carrier access Ethernet ring, a type of Metro Ethernet or Carrier Ethernet service, is a standard method for interconnecting geographically dispersed facilities like data centers. Service providers leverage extensive single-mode fiber optic networks, often with Dense Wavelength-Division Multiplexing (DWDM) technology, to offer high-bandwidth, resilient connections over metropolitan and wide areas. These services are specifically designed to span distances far exceeding 20 miles, making them a valid and common solution for Data Center Interconnect (DCI) between carrier-neutral facilities.

B. Private wireless connection: While microwave links can span long distances, they require a clear line of sight and are susceptible to atmospheric conditions, making them less reliable than fiber for primary DCI.

C. CAT6e connection: Category 6e copper cabling is restricted by the TIA/EIA-568 standard to a maximum length of 100 meters (328 feet), making it unsuitable for a 20-mile distance.

D. Multimode fiber connection: Multimode fiber is intended for short-reach applications, such as within a data center or campus, with maximum distances typically limited to a few hundred meters.

1. Cisco Systems, "Data Center Interconnect Solution Overview" (White Paper). This document discusses various DCI technologies. It explicitly mentions "Carrier Ethernet services (also known as Metro Ethernet)" as a primary transport option for connecting data centers over a metro area network, which aligns with the scenario of facilities being more than 20 miles apart. (Reference: See sections on "DCI Transport Options" and "Layer 2 DCI Technologies").

2. Cisco Systems, "Cisco Nexus 7000 Series NX-OS OTV Configuration Guide, Release 5.x". In the "Overlay Transport Virtualization Overview" chapter, the guide describes the underlying transport infrastructure required for DCI technologies like OTV. It lists "Layer 2-switched (Ethernet)" and "Layer 3-routed" infrastructures provided by service providers, which includes Metro Ethernet services capable of spanning long distances. (Reference: Chapter 1, "Information About OTV," section "OTV and the Underlying Transport Infrastructure").

3. Cisco Systems, "10-Gigabit Ethernet over Multimode Fiber: A Migration Brief" (White Paper). This document details the distance limitations of various multimode fiber types for 10GbE. It confirms that even the highest grade (OM4) is limited to 400 meters, demonstrating its unsuitability for a 20-mile connection. (Reference: Table 1, "10GBASE-SR Reach over Multimode Fiber Grades").

4. TIA-568-C.2, "Balanced Twisted-Pair Telecommunications Cabling and Components Standard". This industry standard, frequently cited in Cisco documentation, defines the physical and transmission characteristics for twisted-pair cabling. It specifies a maximum channel length of 100 meters for CAT6 and its variants, confirming the severe distance limitation. (Reference: Section 5, "Channel performance requirements").

Software as a Service (SaaS) delivers complete, ready-to-use applications that run on the provider’s cloud infrastructure. The provider operates and maintains the entire application stack—servers, OSs, middleware, and the application itself—so the customer no longer installs, patches, or manages any software or underlying infrastructure. This exactly matches the requirement to “place all infrastructure and end-user applications in the cloud, eliminating the need for software application management and maintenance.”

B. PaaS – Off-loads infrastructure and middleware, but customer still builds, deploys, and maintains the application code.

C. IaaS – Only virtualized hardware is provided; OS, middleware, and applications remain the customer’s responsibility.

D. FaaS – Event-driven code snippets run in the cloud; does not provide full-stack applications or relieve customers of application lifecycle management.

1. Cisco Press, Understanding Cisco Cloud Fundamentals (CLDFND 210-451 Official Cert Guide), Ch. 2 “Cloud Service Models,” pp. 26-28: describes SaaS as provider-managed full application stack eliminating customer maintenance.

2. Cisco Systems, “Cisco Cloud Computing – Data Center Strategy, Architecture, and Solutions,” White Paper, Section 2.2, pp. 42-43: defines SaaS and contrasts it with PaaS and IaaS responsibilities.

3. NIST Special Publication 800-145, “The NIST Definition of Cloud Computing,” p. 2: SaaS definition—consumer uses provider’s applications running on a cloud infrastructure and manages neither infrastructure nor application platform.

Destination-based Remotely Triggered Black Hole (RTBH) routing mitigates Denial of Service (DoS) attacks by dropping malicious traffic at the network edge before it consumes vital bandwidth or device resources. In a destination-based black hole setup, traffic destined for the victim's IP address is routed to the Null0 interface (a virtual interface that acts as a discard route). According to the exhibit, the victims are the Web Server (10.20.10.2) and the Mail Server (10.30.10.2). To stop the attack at the ingress point (R1), strict /32 host routes for these specific server IPs must be statically routed to Null0.

B: Removing a route to 10.20.10.0 via the attacker's IP (10.10.10.2) is syntactically irrelevant to RTBH and does not blackhole traffic destined to the victim servers.

D: Similar to B, removing a route to the mail server subnet via the attacker's IP does not implement a destination-based drop and will not stop the attack.

E: This command routes traffic destined for R2's interface (10.20.10.1) to Null0, which leaves the actual Web Server (10.20.10.2) exposed to the attack.

Cisco Systems. "Remotely Triggered Black Hole Filtering—Destination Based and Source Based." Cisco IOS Security Configuration Guide, Securing the Data Plane. (Section: Destination-Based RTBH Filtering).

Internet Engineering Task Force (IETF). "RFC 5635: Remote Triggered Black Hole Filtering with Unicast Reverse Path Forwarding (uRPF)." (Section 3: Destination-Based RTBH). DOI: 10.17487/RFC5635.

For an IPsec VPN tunnel to establish successfully using pre-shared keys, the crypto isakmp key command on the local router must specify the exact IP address of the remote IPsec peer. In the exhibit, router R1 is incorrectly configured with an ISAKMP peer address of 192.168.10.2, which is its local next-hop gateway rather than the remote VPN peer. The remote peer is router R2, which terminates the tunnel on its outside interface IP address of 192.168.20.2. Executing crypto isakmp key vpnuser address 192.168.20.2 maps the pre-shared authentication key to the correct remote endpoint, allowing IKE Phase 1 negotiation to succeed.

A: This command misconfigures the default route to point toward an internal network address (10.1.1.2), which will break outbound internet connectivity and prevent reaching the remote peer.

C: Setting the default route's next-hop directly to the remote peer's public IP (192.168.20.2) breaks routing, as it is not a directly connected gateway for R1.

D: This incorrectly configures the ISAKMP authentication key for an internal IP address (10.1.1.2) instead of the remote IPsec peer's public-facing address.

Cisco Systems. "Cisco IOS Security Command Reference: Commands A to C." Section: crypto isakmp key. (Published/Updated: 2024/26). Document ID: 13752-14.

Cisco Systems. "Security Configuration Guide: Secure Connectivity, Cisco IOS Release 15M&T." Chapter: Configuring Internet Key Exchange for IPsec VPNs. (Published/Updated: 2024/26). Document ID: 45012-32.

The command maximum-paths eibgp 6 is used within the BGP routing process on Cisco IOS XE devices to enable equal-cost multipathing (ECMP) for up to six parallel paths. This specific command variant allows the router to install multiple routes for the same destination prefix into the Routing Information Base (RIB), including a mix of paths learned from both internal BGP (iBGP) and external BGP (eBGP) peers. It is the single command that directly satisfies the requirement to load-balance across both iBGP and eBGP routes simultaneously.

A. The syntax is incorrect; the command is maximum-paths, and bgp is not part of the command itself. The closest valid command, maximum-paths 6, only enables multipathing for eBGP routes by default.

B. The command keyword multipath is incorrect for configuring BGP ECMP in this context on Cisco IOS devices; the correct keyword is maximum-paths.

C. The syntax is incorrect. The keyword routers is not a valid argument for the maximum-paths command in the BGP configuration context.

1. Cisco IOS XE Fuji 16.9.x BGP Command Reference, "BGP Commands: M to N":

Section: maximum-paths eibgp

Content: "To control the maximum number of parallel Interior Border Gateway Protocol (iBGP) and external BGP (eBGP) routes that can be installed in a routing table, use the maximum-paths eibgp command in router configuration mode." This directly confirms that option D is the correct single command for both iBGP and eBGP multipathing.

2. Cisco IOS IP Routing: BGP Configuration Guide, "BGP Multipath":

Section: "BGP Multipath Load Sharing for Both eBGP and iBGP in an L3VPN"

Content: This guide explains that without the eibgp keyword, separate commands are needed: maximum-paths for eBGP and maximum-paths ibgp for iBGP. This demonstrates that option A, even if syntactically corrected to maximum-paths 6, would be incomplete as it only addresses eBGP paths.

Cisco Virtualized Infrastructure Manager (Cisco VIM) must always have a Provisioning network so that servers can be discovered, PXE-booted, and imaged, and it must have a dedicated Storage network to interconnect the integrated Ceph cluster that stores OpenStack images, volumes, and back-end data. All other segments (Data-plane/Tenant, Host/OAM, or Heartbeat/Cluster) are optional or can be collapsed onto another VLAN in small or brown-field deployments; therefore only Provisioning and Storage are strictly required to support (i.e., bring-up and operate) Cisco VIM itself.

B. Data plane – Carries tenant VM traffic; optional and not required for Cisco VIM installation/operation.

C. Heartbeat – Cluster/HA VLAN can reuse Storage or OAM; not classed as mandatory.

D. Host – Management/OAM VLAN may be combined with Provisioning or omitted in minimal designs; not always mandatory.

1. Cisco Virtualized Infrastructure Manager (CVIM) Installation Guide 4.2, “Network Requirements”, Table 2 Mandatory VLANs: Provision (PXE) and Storage; other VLANs marked ‘optional’.

2. Cisco NFV Infrastructure Solution Reference Architecture 5.0, Sec. 3.2 “Network Segmentation”—lists Provision and Storage as “required”, others “optional/conditional”.

3. Cisco Live BRKSPM-1268, slide 25 “CVIM Required Networks” – shows only Provision and Storage in the Required column.

4. R. Kumar et al., “Design and Deployment of Cisco CVIM for NFVI,” IEEE/IFIP NOMS 2018 Workshops, pp. 1-3—identifies PXE/Provision and Ceph Storage as essential back-plane networks.

Lateral movement describes the techniques attackers use to move through a network after gaining initial access to a single host. Network segmentation is a fundamental security control designed to counter this threat. By dividing the network into smaller, isolated segments (or micro-segments for individual workloads), it contains a breach within its zone of origin. All traffic attempting to cross a segment boundary must pass through a security enforcement point, such as a firewall, where it can be inspected and blocked. This directly hinders an attacker's ability to pivot from a compromised system to other critical assets within the Cisco NFV Infrastructure (NFVI).

A. Wi-Fi Protected Access: This is a security protocol for wireless (802.11) networks. It is irrelevant to preventing lateral movement within a wired and virtualized NFVI data center environment.

B. Web application firewall: A WAF protects web applications from Layer 7 attacks (e.g., SQL injection) originating from external users (north-south traffic), not internal lateral movement between servers (east-west traffic).

D. Data encryption: Encryption protects the confidentiality of data at rest and in transit. While critical, it does not prevent an attacker from compromising a host and using it to move to other systems.

1. Cisco Systems, Inc. (2016). Cisco NFV Infrastructure Security. White Paper, Page 10.

"Segmentation is a key security control to prevent lateral movement of threats within the data center. In a virtualized environment, segmentation can be implemented at a very granular level, a concept known as microsegmentation. With microsegmentation, security policies can be applied between individual workloads..." This document directly links segmentation and micro-segmentation to the prevention of lateral movement within an NFVI context.

2. Cisco Systems, Inc. (2017). SAFE Reference Guide. Cisco Validated Design (CVD), Page 11.

In the "Threats" section, under "Malware," it states: "Once inside, it can propagate through lateral movement... The Places in the Network (PINs) are segmented from each other to limit the scope of a breach." This establishes segmentation as a core SAFE architecture principle for limiting lateral movement.

3. Gill, S., & Tredan, G. (2020). Security for Virtualized Networks. In Network and System Security (pp. 1-15). Springer, Cham. DOI: https://doi.org/10.1007/978-3-030-64302-01

This academic publication discusses security in virtualized environments, stating, "Micro-segmentation is a security technique that enables fine-grained security policies to be assigned to individual workloads... This helps in preventing the lateral movement of threats within the data center." This corroborates the industry best practice with peer-reviewed research.

In Cisco Nexus vPC architecture, the physical links directly connecting the two vPC peer switches form the vPC peer link. According to the exhibit, interfaces eth1/1 and eth1/2 connect ToR-A and ToR-B. The provided configuration bundles these interfaces into port-channel 110. To finalize this setup, the administrator is currently in the interface port-channel110 configuration mode. The required command here is vpc peer-link, which explicitly designates this port-channel as the vPC peer link responsible for carrying control plane traffic, BPDUs, and flooded traffic between the two vPC peers.

B. peer-keepalive destination 10.10.10.2: This command configures the out-of-band keepalive link, but it must be executed within the vpc domain configuration mode, not under the port-channel interface mode.

C. channel-group 110 mode on: The physical interfaces are already configured for LACP (mode active). Applying mode on creates a configuration conflict and applies to physical interfaces, not the port-channel itself.

D. switchport mode access: A vPC peer link requires an 802.1Q trunk port to carry multiple VLANs across the inter-switch link. Configuring it as an access port will break the vPC topology.

Cisco Systems, Inc. "Cisco Nexus 9000 Series NX-OS Interfaces Configuration Guide, Release 9.3(x)." Chapter: Configuring vPCs, Section: Configuring vPC Peer Links. Document ID: cisco_nexus_9000_interfaces_cg.

Cisco Systems, Inc. "Design and Configuration Guide: Best Practices for Virtual Port Channels (vPC) on Cisco Nexus 7000 Series Switches." Section: vPC Peer-Link Configuration. Document ID: 118933-technote-vpc-00.

Based on the provided network topology exhibit, Router R2 is located within Autonomous System (AS) 100. To configure BGP parameters on this device, the administrator must first enter the BGP routing process mode using the router bgp 100 command. By default, the BGP path selection algorithm chooses only a single best path for a given destination. To instruct the BGP process to install multiple iBGP paths into the routing table to achieve load sharing, the maximum-paths ibgp <number> command must be issued. Since the engineer needs to distribute traffic across exactly three paths (towards R3, R4, and R5), the specific command required is maximum-paths ibgp 3.

B: The command ip load-sharing ibgp 3 is syntactically invalid in Cisco IOS for configuring BGP multipath capabilities.

D: The command router bgp 101 is incorrect because the exhibit explicitly illustrates Router R2 residing in AS 100, whereas AS 101 belongs to the remote eBGP domain.

E: ip load-sharing per-destination is an interface-level command used to dictate Cisco Express Forwarding (CEF) packet forwarding behavior, not the BGP routing process command required to install multiple routes.

Cisco Systems. (2020). Cisco IOS IP Routing: BGP Command Reference. "maximum-paths ibgp" command documentation. (Details the syntax and requirement of entering router bgp configuration mode followed by the maximum-paths directive to enable iBGP multipath).

Cisco Systems. (2018). BGP Configuration Guide, Cisco IOS XE Release 3S. Chapter: "BGP Multipath Load Sharing for Both eBGP and iBGP in an IPv4 or IPv6 Network". Section: "Configuring Multipath Load Sharing for Both eBGP and iBGP". (Provides step-by-step verification that maximum-paths ibgp must be configured under the router bgp process).