300-540 Designing and Implementing Cisco Service Provider Cloud Network Infrastructure (SPCNI v1.0) Questions and Answers

NETCONF rules state:

A user cannot terminatetheir own active session.

Attempting to kill the same session returnsinvalid-valueerror.

The session continues running normally.

Thus:

No logout

No termination

No configuration impact

Therefore,Ais correct.

Comprehensive and Detailed Explanation

In Cisco NFVI security architecture, the primary defense againstlateral movement(an attacker moving from one compromised node to another) isnetwork segmentation.

Segmentation:

Separates workloads (compute, storage, management, tenant networks)

Prevents attackers from pivoting inside the NFVI

Reduces blast radius during breaches

Enforces micro-segmented virtual network boundaries

WPA protects Wi-Fi, not NFVI.

WAF protects web apps, not internal movement.

Data encryption protects confidentiality, not lateral movement control.

Thus,network segmentationis the correct solution.

Comprehensive and Detailed Explanation

For distancesgreater than 20 miles, valid inter-facility transport options must support:

Metro-scale connectivity

High bandwidth

Low latency

Carrier-grade reliability

Acarrier access Ethernet ring (MEN / Metro Ethernet)is designed for:

Interconnecting data centers or meet-me rooms

Distances far exceeding 20 miles

High-availability layer-2 or layer-3 transport

Why the others are invalid:

CAT6e→ maximum ~100 meters

Multimode fiber→ typically <2 km (~1.25 miles)

Private wireless→ not used for high-capacity DC interconnects, unreliable for core transport

Thus, the only correct carrier-grade method isCarrier access Ethernet ring.

R1 (AS 200) is multihomed to:

SP-1 in AS 300 via neighbor172.16.1.1

SP-2 in AS 400 via neighbor172.16.2.1

R1 must:

Advertiseonly locally originated prefixes(its own network 10.10.0.0/24).

NOTbecome atransit AS—i.e., R1 mustnotadvertise routes learned from one provider to the other.

The configuration includes AS-path access-lists:

ip as-path access-list 1 permit ^$

ip as-path access-list 200 permit ^200

ip as-path access-list 300 permit ^300

ip as-path access-list 400 permit ^400

^$ in AS-path ACL1matcheslocally originated routes(empty AS-path).

ACLs 200, 300, and 400 match routes whose first AS in the path is 200, 300, or 400 respectively (used if we needed to match those provider or customer routes).

To ensure each upstream provider only receiveslocally originatedroutes, we apply AS-path ACL1as anoutbound filter-liston each external BGP neighbor:

router bgp 200

neighbor 172.16.1.1 remote-as 300

neighbor 172.16.1.1 filter-list 1 out ← only advertise local prefixes to SP-1

neighbor 172.16.2.1 remote-as 400

neighbor 172.16.2.1 filter-list 1 out ← only advertise local prefixes to SP-2

This way:

Routes learned from SP-1 (AS 300) willnotbe advertised to SP-2 (AS 400) because their AS-path will begin with 300, not empty, so they fail ACL 1.

Similarly, routes from SP-2 will not be sent to SP-1.

Only R1’s own prefixes are exported, preventing AS 200 from becoming a transit network.

Comprehensive and Detailed Explanation

For virtualization functions and operational reliability, the architecture must leverageCisco NSO (Network Services Orchestrator)capabilities. NSO provides:

Transactional service modeling

Automatic rollbackwhen any step of a transactional deployment fails

Real-time network-state visibilityvia NSO CLI and live device synchronization

End-to-end service lifecycle automation

Among the options:

Why B is correct

"Virtualization service modeling" fits NSO’s core design principle: model the service, not individual devices.

NSO’s CLI providesstate visibility, operational introspection, transaction logs, and commit details.

NSO’s transactional engine providesautomatic rollbackupon any device or service failure.

This option capturesfull lifecycle automation,real-time state visibility, andreliability, exactly as required.

Why others are incorrect

A: CLI NED alone does not provide real-time state visibility or automated rollback; manual rollback contradicts requirements.

C: Only focuses on service modeling + CLI, but doesnotinclude rollback or lifecycle automation.

D: Templates alone do not ensure rollback or real-time operational state.

Cisco NSO-based orchestration principles in a multi-vendor environment require:

Service modeling using flexible, reusable YANG models

Abstraction of vendor-specific device differences

Transaction-safe configuration validation and execution

End-to-end automation across lifecycle stages (Day-0, Day-1, Day-N)

Scalability and adaptability for evolving requirements

Option C aligns perfectly with NSO service-modeling approaches:

Service models must be flexible, not rigid, enabling changes as technologies and needs evolve.

The architecture must support continuous refinement, enabling multi-vendor abstraction and lifecycle automation.

This ensures the network evolves seamlessly while remaining stable and automated.

Why the Other Options Are Incorrect

A – Simplified monitoring and post-deployment adjustments do not meet the core need for full lifecycle service modeling and abstraction.

B – Configuring devices individually contradicts the entire purpose of orchestration and abstraction.

D – A static YANG model cannot accommodate multi-vendor environments or future scalability.

Thus, only Option C matches full NSO-capable service modeling requirements.

Comprehensive and Detailed Explanation

BGP Flowspec allows routers to distributetraffic-filtering rulesusing BGP NLRI.

To enable Flowspec, after neighbors are configured, the essential next step is:

✔Activate the Flowspec address-family under BGP

Example:

router bgp 65000

address-family ipv4 flowspec

neighbor X.X.X.X activate

exit-address-family

This enables:

FlowSpec NLRI exchange

Distribution of drop rules (rate-limit, redirect, null route, etc.)

Automatic ACL/class-map/policy-map generation on edge routers

Why the other options are incorrect:

B. Set BGP routing process→ already done when neighbors were configured

C. Activate neighbors→ only makes senseinsidean address-family; flowspec AF must be enabled first

D. Configure route reflector→ optional and not required for Flowspec to operate

Thus, the correct next step isA. Configure Flowspec for the BGP address-family.

For asite-to-site IPsec VPN, each peer must point to thereachable IP address of the remote VPN endpoint—that is, the IP address on the WAN/Internet-facing interface of the remote router.

From the diagram:

R1 outside (toward Internet):192.168.10.1

R2 outside (toward Internet):192.168.20.2

Inside LANs:

Site 1:10.1.0.0/24

Site 2:10.2.0.0/24

The crypto map on R1 uses:

crypto map mymap 10 ipsec-isakmp

set transform-set myset

match address 101

set peer

The must be the IP address where R1 can actually reach the IPsec peer, which is R2’s Internet-facing interface192.168.20.2.

If the peer were configured with a LAN IP such as 10.2.0.1 (site 2’s internal gateway), IKE packets would never reach the remote router because that address is not routable over the Internet.

Therefore, the correct command to bring up the VPN is:

set peer 192.168.20.2

Option A (10.1.0.1)– local LAN IP (R1’s side), not the remote endpoint.

Option C (192.168.10.1)– R1’s own WAN IP, not the remote peer.

Option D (10.2.0.1)– remote LAN IP, not reachable directly over the Internet.

The attacker’s IP is:

10.10.10.2

The servers under attack are:

Web Server:10.20.10.2

Mail Server:10.30.10.2

We must denytraffic from attacker → servers.

Correct ACL format useshost wildcards (0.0.0.0):

deny ip 10.10.10.2 0.0.0.0 10.20.10.2 0.0.0.0

deny ip 10.10.10.2 0.0.0.0 10.30.10.2 0.0.0.0

These matchD and E.

Comprehensive and Detailed Explanation (Cisco NFVI / Virtualization Knowledge)

SR-IOV (Single Root I/O Virtualization)allows a VM to access the network interface hardwaredirectly, without going through the hypervisor’s virtual switch.

This is achieved by:

Assigning Virtual Functions (VFs) directly to VMs

Allowing high-performance, low-latency packet I/O

Bypassing the hypervisor datapath

Therefore, SR-IOV doesnotbypass the guest OS; it bypasses thehypervisor I/O virtualization layer, delivering near-native performance.

Thus the correct answer isC.

Comprehensive and Detailed Explanation From Cisco SP Cloud Network Infrastructure Security Knowledge

Cloud security compliance frameworks (such as ISO 27001, PCI-DSS, GDPR, SOC 2, HIPAA) require:

Evidence of security events

Retention of logs for audit periods

Ability to generate compliance reports

Traceability and accountability

Incident investigation support

Effective log management enables:

Centralized collection of application, network, and system logs

Storage of logs for mandated retention periods

Generation ofaudit-ready reports

Documentation required for compliance assessments

Demonstration that monitoring and security controls are active and functioning

Therefore, the role of log management in regulatory compliance is primarily aboutdocumentation, traceability, auditing, and reporting, which aligns only with Option A.

The other options do not directly serve regulatory compliance requirements:

Brelates to resource optimization, not compliance.

Crefers to interoperability, which is unrelated to regulatory auditing.

Dimproves security but does not directly address compliance documentation.

Cisco NFVIS follows strict security controls. After a fresh deployment:

Thedefault admin credentials are considered insecure.

NFVIS requires the administrator toreset the default password on first login(typically via console or SSH).

Until the password is changed,REST API and web-portal access are denied, and attempts to access the portal or API returnHTTP 401 Unauthorized, even if the default credentials are provided.

This mechanism prevents use of factory-default passwords in production and is explicitly documented as a mandatory post-install step.

The other options are not the cause of a 401 error:

Enabling portal via SSH (B) is not required; HTTPS access is enabled by default once credentials are valid.

Restarting Tomcat (C) would address service availability issues (e.g., 5xx errors), not authentication.

Browser certificates (D) affect trust warnings (e.g., HTTPS certificate errors), not 401 Unauthorized.

Comprehensive and Detailed Explanation

In Cisco Secure Endpoint Private Cloud AirGap mode, Internet access is disabled. Updates must be uploaded manually and then triggered inside the Secure Endpoint console.

The commandforce update -yinitiates the update of the manually uploaded Secure Endpoint package.

Other commands are not used for Secure Endpoint updates:

rpm -qa→ Lists Linux packages only

jamf-sync all→ Used for Apple JAMF integrations

genisoimage→ Used to create ISO files, irrelevant to Secure Endpoint

Therefore,Ais correct.

Comprehensive and Detailed Explanation From Exact Extract from my knowledge of Designing and Implementing Cisco Service Provider Cloud Network Infrastructure Outlines without Any External URL or Links:

Cisco+ Hybrid Cloud is Cisco’s as-a-service consumption model that offers pay-as-you-go infrastructure. For ahybrid workplace, the focus is on giving users secure desktop environments from anywhere, with the ability torapidly deployandscale up or downbased on the number of users or partners.

Cisco+Hybrid Cloud for Virtual Desktop Infrastructure (VDI)specifically delivers desktop and app workspaces as an on-demand service. It allows partners to consume desktops elastically, paying for capacity as needed and scaling the underlying compute, storage, and networking without rebuilding the environment.

Bare Metal Compute and Virtualization offers flexible infrastructure but are aimed at app/workload hosting rather than user desktop workspaces.

Service Provider Networking addresses network services, not end-user hybrid workplace desktops.Therefore, for a pay-as-you-go, rapidly deployable, elastic solution in a hybrid workplace,Cisco+ Hybrid Cloud for Virtual Desktop Infrastructureis the correct choice.

Comprehensive and Detailed Explanation From Cisco SP Core Optimization Knowledge

Cisco IOS supportsBGP Multipathfor installing multiple equal-cost BGP routes (both iBGP and eBGP) into the routing table. The correct global BGP command syntax to set the number of allowable parallel BGP paths is:

maximum-paths

For BGP specifically, the form is:

maximum-paths bgp

This enables the router to install up to the specified number of equal-cost BGP routes (iBGP and eBGP) into the RIB and then potentially into the FIB.

Setting:

maximum-paths bgp 6

allowssixparallel ECMP paths learned via BGP—this matches the requirement in the question.

Why the other options are incorrect

B. multipath eibgp 6Not a valid Cisco IOS command.

C. maximum paths bgp routers 6Invalid syntax.

D. maximum-paths eibgp 6The correct keyword isbgp, noteibgp.Cisco does not use “eibgp” in this context; IOS supports BGP multipath across iBGP/eBGP automatically when configured under maximum-paths bgp.