400-007 Cisco Certified Design Expert (CCDE v3.1) Free Practice Exam Questions (2026 Updated)

Cisco NFVi (Network Function Virtualization Infrastructure) solutions integrate with Red Hat’s virtualization stack using:

C. Cisco Nexus switches: Provide data center network fabric.

D. Cisco UCS: Provides the compute platform for NFV workloads.

F. Cisco Virtual Network Functions: The software-based network functions running on NFVi (e.g. virtual routers, firewalls, etc.).

Why other options are incorrect:

A: Cisco Prime Service Catalog is a management tool, not part of NFVi infrastructure.

B: Cisco Open vSwitch is not a Cisco product (Open vSwitch is open-source).

E: Cisco Open Container Platform is not part of the NFVi reference solution in conjunction with Red Hat.

—

D (Lifecycle model):The lifecycle model aligns directly with traditional project management (such as Waterfall). It follows a sequential, phase-driven process: requirement gathering, design, implementation, testing, and maintenance. Each phase must be completed before moving to the next, with defined milestones and documentation.

Other options explained:

A: " Static model " is not a standard recognized development model.

B: Agile is iterative and adaptive, opposite of traditional models.

C: Evolutionary delivery is more incremental, not fully aligned with traditional models.

A (EoMPLS): Ethernet over MPLS can operate at Layer 2, and MACsec can encrypt traffic before entering the MPLS core.

E (KVPLS): Supports MACsec encryption for Layer 2 DCI services over VPLS solutions.

Why other options are incorrect:

B: MPLS L3 VPN operates at Layer 3, not suitable for MACsec (L2 encryption).

C: DMVPN uses IPsec, not MACsec.

D: GET VPN uses IPsec for L3 traffic encryption.

—

In data center migration scenarios, when legacy and VXLAN EVPN networks are connected for host mobility, a critical step is to ensure a seamless Layer 3 gateway handoff. This is typically achieved using VRRP (or HSRP) where both the old and new gateways share the same virtual IP.

The final step involves:

Increasing the VRRP priority on the new VXLAN-enabled infrastructure to make it the active default gateway.

Ensuring that hosts retain their original default gateway (no reconfiguration required).

Only after the new gateway is active, the legacy SVIs can be gracefully shut down.

This method ensures no packet loss or disruption to host connectivity during or after migration.

It aligns with CCDE v3.1 under the “Network Architecture Principles” domain, particularly for data center transformation, operational consistency, and seamless L2–L3 handoff design patterns.

D (Group Encrypted Transport VPN - GET VPN):GET VPN encrypts traffic across private WANs like MPLS while maintaining full-mesh routing visibility and offering centralized key management with minimal encapsulation overhead.

Other options explained:

A: S-VTI is used for point-to-point IPsec tunnels.

B: DMVPN is used for dynamic multipoint Internet-based VPNs.

C: MGRE is a tunneling protocol but lacks security features.

B (IPFIX telemetry data):IPFIX provides detailed flow-level visibility, enabling identification of traffic patterns, data flows, and destinations. This data is critical for understanding current traffic behavior to identify governance gaps and improve policy compliance.

Other options explained:

A: Secure tunnels protect traffic but do not identify governance gaps.

C: Firewalls provide limited flow visibility compared to telemetry.

D: Workload policies enforce security but do not aid initial visibility analysis.

NETCONF (Network Configuration Protocol) is a standardized protocol used for automating configuration and management of network devices. According to IETF standards (RFC 6241), the required encoding for NETCONF is:

XML (Extensible Markup Language)

Cisco IOS XE supports NETCONF over SSH and uses XML to structure both configuration data and RPC messages. XML allows strict schema validation (via YANG models), extensibility, and rich hierarchical structure required for modern network automation.

Other formats:

HTML is not a data encoding method.

YAML is typically used with configuration management tools, not NETCONF.

JSON is supported in RESTCONF, not in traditional NETCONF.

==========

B (Added redundancy): Redundancy ensures alternate paths or systems are available if a failure occurs, which is the primary design principle behind resiliency. Redundancy directly contributes to higher network availability and fault tolerance.

Why other options are incorrect:

A: Load-balancing optimizes performance but doesn’t inherently improve resiliency.

C: Confidentiality addresses security, not resiliency.

D: Reliability is an outcome, not a design principle itself.

—

Switch clustering (VSS, StackWise, MLAG, MC-LAG, vPC) at the distribution/core layer eliminates the need for STP convergence by creating a logical single switch for Layer 2 and Layer 3 functions.

This design provides active-active uplinks, faster convergence, and loop-free operation, directly addressing STP and FHRP limitations.

Why other options are incorrect:

A: Access layer clustering is less common and doesn’t address core convergence delays.

C: PortFast improves convergence on edge ports but not in the core/distribution path.

D: BFD enhances Layer 3 failure detection but not Layer 2 loop prevention or STP convergence.

The SDN architecture separates the control plane from the data plane. In this model, the SDN controller is the central element responsible for:

Receiving application intent via northbound APIs

Translating intent into traffic policies

Communicating with infrastructure devices using southbound APIs

The SDN controller enforces policies such as path selection, QoS, and access control rules across the network fabric, ensuring traffic flows align with administrator-defined logic. Neither northbound nor southbound APIs enforce policy themselves; they serve as communication interfaces.

The packet forwarding engine (Option A) simply performs data-plane functions based on instructions, but does not interpret or apply policies.

==========

When both networks use overlapping private IP addresses, a single Cisco IOS NAT router can handle bidirectional NAT with dynamic NAT (overload). However, it requires careful configuration using:

Two distinct NAT pools: One for traffic sourced from side A, and one for traffic sourced from side B.

ip nat inside source and ip nat outside source commands with the overload keyword.

Interfaces must be properly defined with ip nat inside and ip nat outside to reflect traffic directionality.

Option D is correct because it explicitly reflects the requirement to use two different NAT pools for overload in both directions, which ensures proper address translation and session tracking.

==========

PIM-SSM (Source-Specific Multicast) is optimized for multicast delivery directly via Shortest Path Tree (SPT) only.

SSM eliminates the need for shared trees (RPs), simplifies the control plane, and avoids rendezvous points altogether.

This design is highly scalable in multidomain and IPv6 environments, fully aligned with CCDE v3.1 best practices for modern multicast deployments.

Why other options are incorrect:

A: PIM-DM floods traffic initially, not SPT-based.

B: PIM-SM uses shared trees first and may switch to SPT later.

D: Bidir-PIM uses shared trees exclusively, not SPT.

—

A (Distinguishing between config and operational data):NETCONF was designed to provide structured data models (such as YANG), clearly separating configuration from operational state data. SNMP lacks this built-in distinction and generally treats all data as MIB objects.

Other options explained:

B/C/D: Both protocols can perform actions and retrieve or modify data, but only NETCONF natively differentiates config vs. operational state.

A (Financial and governance models): In the Define Strategy step, it ' s crucial to establish financial frameworks and governance structures that will guide the use of cloud services. This includes determining budgeting approaches (CapEx vs. OpEx), compliance, policy enforcement, risk management, and ownership of IT resources.

Governance models also define roles, responsibilities, and accountability for managing cloud services across the organization.

Other options explained:

B: Business alignment is important but comes after strategic governance and financial planning.

C: Due diligence is typically performed during vendor selection or migration readiness.

D: Contingency planning is part of exit or risk management phases, not the initial strategy step.

—