400-007 Cisco Certified Design Expert (CCDE v3.1) Free Practice Exam Questions (2026 Updated)

Let’s calculate the total cost for each solution based on the most likely maximum duration (20 + 10 = 30 months) to ensure conservative, flexible planning.

—

DWDM over dark fiber:

CAPEX = $200,000

OPEX (annual): $100,000 ⇒ for 30 months = (2.5 × $100,000) = $250,000

Installation fee = $30,000

Total = $200,000 + $250,000 + $30,000 = $480,000

CWDM over dark fiber:

CAPEX = $150,000

OPEX (annual): $100,000 ⇒ for 30 months = (2.5 × $100,000) = $250,000

Installation fee = $25,000

Total = $150,000 + $250,000 + $25,000 = $425,000

MPLS wires only:

CAPEX = $50,000

OPEX (annual): $180,000 ⇒ for 30 months = (2.5 × $180,000) = $450,000

Installation fee = $5,000

Total = $50,000 + $450,000 + $5,000 = $505,000

Metro Ethernet:

CAPEX = $65,000

OPEX (annual): $100,000 ⇒ for 30 months = (2.5 × $100,000) = $250,000

Installation fee = $5,000

Total = $65,000 + $250,000 + $5,000 = $320,000

—

Analysis:

Metro Ethernet has the lowest overall cost at $320,000 and provides sufficient flexibility for workload migration since " all connectivity options meet technical requirements. "

Metro Ethernet is typically more flexible than DWDM/CWDM for temporary or dynamic migration projects because it does not require optical expertise or complex dark fiber management.

MPLS is more expensive here and less flexible for large-scale Layer 2 migrations.

CWDM/DWDM are suitable for permanent solutions where long-term investment is justified, but not optimal here due to cost.

Therefore, best ROI and flexibility: Metro Ethernet

Final correct answer: D

A (Confidentiality): Protects information from unauthorized access.

D (Availability): Ensures resources are accessible when needed.

E (Integrity): Ensures data is not tampered with or altered improperly.

These three form the core of information security design principles known as the CIA triad (Confidentiality, Integrity, Availability), directly referenced in CCDE v3.1 security design sections.

Why other options are incorrect:

B, C, F: While important for network design, they are not part of the core security protection objectives.

—

C (Synchronous replication over Metro Ethernet) provides real-time replication with zero data loss (RPO = 0) and minimal recovery time (RTO ≈ 0).

Metro Ethernet offers low-latency, high-bandwidth, and deterministic connectivity between closely located data centers, ideal for synchronous replication.

Why other options are incorrect:

A and D: Asynchronous replication cannot guarantee zero RPO/RTO.

B: MPLS introduces variable latency unsuitable for synchronous replication.

—

To conserve IPv4 addresses and achieve fast convergence:

B: Using /31 subnets for point-to-point (P2P) links enables each link to consume only two IP addresses. This is widely supported and conserves address space.

C: A hub-and-spoke design with P2P links minimizes the number of neighbor relationships and simplifies routing convergence.

Other options:

A: Multipoint Metro-E introduces neighbor adjacency complexity and DR/BDR elections, which delay convergence.

D: Aggregation is more applicable to prefix summarization, not address conservation per link.

E: DR/BDR roles apply only in broadcast/multicast environments, not P2P links.

==========

A (Establish visibility and behavior modeling):After discovering applications, Zero Trust design requires baseline visibility into traffic flows, system behavior, and interaction patterns. This modeling allows for the design of effective microsegmentation and policy enforcement.

Other options explained:

B: Policy enforcement comes after visibility and modeling.

C: Health assessment is a continuous activity but not the next step.

D: Trust assessment is part of the initial Zero Trust design, not specifically after discovery.

Table Description automatically generated

B (Cloud OnRamp):Cloud OnRamp extends SD-WAN capabilities to optimize SaaS and IaaS connectivity, offering dynamic path selection, performance monitoring, and improved user experience when migrating to cloud services.

Other options explained:

A: Describes general cloud architecture, not an SD-WAN feature.

C: Cloud registry is not an SD-WAN feature.

D: Microservices are an application architecture, not a WAN migration tool.

Comprehensive and Detailed Explanation:

C: Moving workloads or backup/recovery functions to cloud platforms reduces capital expenditure by avoiding the cost of physical infrastructure, data centers, and maintenance. Cloud-based DRaaS (Disaster Recovery as a Service) offers scalability, resilience, and cost efficiency aligned with an OPEX model.

Other options:

A and B are security and software lifecycle tasks, not cost-effective DR strategies.

D increases CAPEX by building and maintaining additional infrastructure.

==========

When Bidirectional Forwarding Detection (BFD) is not available, OSPF can still achieve subsecond convergence using the OSPF fast hello feature.

Fast hello allows the configuration of OSPF hello/dead intervals to subsecond values (e.g., hello = 100ms, dead = 300ms).

This accelerates OSPF’s ability to detect neighbor failures based on missed hello packets without relying on external mechanisms like BFD.

Why other options are incorrect:

A. STP (Spanning Tree Protocol) is unrelated to OSPF and is used at Layer 2.

C. LFA (Loop-Free Alternate) is a fast reroute technique but does not affect neighbor failure detection.

D. DPD (Dead Peer Detection) is used in VPN technologies (e.g., IPsec) and not applicable in OSPF.

Fast hello is fully aligned with CCDE v3.1 under “Protocol Design Implications” and is a commonly recommended method for improving IGP convergence performance when BFD is not an option.

==========

Loop Guardis designed to protect againstSTP loop conditionsthat may occur whenBPDUs are unexpectedly missingon a point-to-point link. This is especially relevant in cases where UDLD (Unidirectional Link Detection) might not detect the problem quickly enough. When BPDUs are absent, a switch might erroneously assume that the link is safe to forward, potentially leading to atemporary Layer 2 loop.

UsingLoop Guardensures that a port moves into aloop-inconsistentstate instead of forwarding traffic if BPDUs are missing, effectively stopping a loop before it forms. This makes it acomplementary mechanism to UDLD, which focuses on detecting unidirectional links at the physical layer, not STP control plane failures.

This recommendation aligns with CCDE v3.1 best practices forresilient Layer 2 designs, which emphasize using multiple mechanisms in tandem to proactively prevent failure conditions before traffic is impacted.

Why other options are incorrect:

A. Root Guard: Prevents an unauthorized switch from becoming the root bridge but doesn ' t protect against missing BPDUs.

B. BPDU Guard: Used mainly on access ports to prevent BPDU reception; not intended for core loop prevention.

D. BPDU Filtering: Suppresses BPDU exchange entirely, which increases loop risk and is not suited for loop mitigation.

Table Description automatically generated with medium confidence

The scenario requires controlling how AS 111 sends its outbound traffic (egress traffic). BGP policy control for outbound traffic is best handled via manipulating the BGP Local Preference attribute, as:

Local Preference (LocalPref) influences path selection for outbound traffic by setting a preference for one path over another.

It is evaluated within the AS and does not require coordination with external autonomous systems.

LocalPref changes are fully contained inside AS 111 and satisfy the requirement to only affect AS 111.

A higher Local Preference value is preferred, thus you set higher values for routes learned via AS 100.

Why other options are incorrect:

A (community): Typically influences inbound traffic or interacts with upstream providers.

B (MED): Influences inbound traffic for external neighbors, not outbound.

D (AS Path): Also primarily influences inbound traffic selection by remote ASes.

The IS-IS Overload Bit allows a router to signal to its peers that it should be temporarily excluded from SPF calculations for transit traffic:

A: The Overload Bit can be automatically set at startup (known as " startup overload " ) to allow the router sufficient time to converge IGP, BGP, and stabilize protocols before accepting transit traffic.

D: The bit can remain set until all dependent protocols have converged and the router is fully operational.

Why other options are incorrect:

B: The router’s directly connected prefixes remain reachable; only transit path calculations exclude the overloaded node.

C: MPLS-TE does not automatically reoptimize tunnels based on the Overload Bit.

E: There is no specific restriction preventing Overload Bit usage on Route Reflectors.

OSPF uses pacing timers to control how quickly it sends LSAs to neighbors to prevent network flooding and CPU spikes:

C. Retransmission-pacing timer: Controls spacing between retransmitted LSAs queued after a lost or unacknowledged transmission.

E. Flood-pacing timer: Controls spacing between consecutive LSAs when flooding new information to peers.

These timers are critical in scaling OSPF in dense or unstable topologies and are key to tuning control plane convergence performance without destabilizing routers.

The issue described is classic route flapping, where a single unstable prefix (10.1.5.0/24) causes repeated route withdrawals and advertisements, triggering churn in the BGP control plane across the entire network. This behavior can be mitigated using the following scalable and non-disruptive design approach:

D. Route Aggregation: Aggregating routes at the edge router (in this case, the LA router) means that multiple more specific prefixes (such as 10.1.4.0/24 through 10.1.7.0/24) are advertised as a single summarized prefix (e.g., 10.1.4.0/22). As a result, the instability of 10.1.5.0/24 will not affect upstream routers (Chicago and New York), as they will only see the aggregated route.

Key benefits aligned with CCDE v3.1 design guidance:

Isolates flapping to the edge while maintaining reachability

Reduces control plane churn in BGP

Preserves scalability and simplifies the routing table in upstream routers

Why other options are incorrect:

A (Route dampening): While effective, route dampening is less favored today due to convergence delay and side effects; it’s also a reactive measure versus a design-based solution.

B and C (Filtering): Filtering the route prevents reachability to that subnet, which violates availability requirements and causes data black-holing.

Thus, aggregation is the most scalable, nondisruptive, and design-aligned choice in this context.

B (MST — Multiple Spanning Tree): Bundles multiple VLANs into fewer STP instances, minimizing the scope of TCN propagation, which helps reduce MAC table flushing and unicast flooding.

Why other options are incorrect:

A: PVRSTP still processes TCNs per VLAN, increasing flooding.

C: Legacy STP behaves similarly but is not optimized for multiple VLANs.

D: PVSTP+ generates TCNs per VLAN like PVRSTP.

—