Cisco Designing and Implementing Cisco Service Provider Cloud Network Infrastructure v1.0 300-540 SPCNI Exam Questions

Answer :

In Cisco SD-WAN, vSmart controllers must be assigned to controller groups so that edge routers can form redundant control-plane connections. Each data center in the diagram has its own group:

New York DC Controller group-ID 1 (vSmart1, vSmart2, vSmart3)

Los Angeles DC Controller group-ID 2 (vSmart4, vSmart5, vSmart6)

To configure the controllers correctly:

vSmart1

It resides in the New York DC, so it must be assigned to controller-group 1. Required command: system controller-group-id 1 This corresponds to Option D.

vSmart4

It resides in the Los Angeles DC, so it must be assigned to controller-group 2. Required command: system controller-group-id 2 This corresponds to Option C.

Why Other Options Are Incorrect

A and B: The command max-control-connections is configured on edge routers, not vSmart controllers.

E: Controller-group-id 4 does not exist in this design; only group 1 and group 2 are shown.

Answer : B

Carrier-neutral facilities allow customers to connect to multiple telecom carriers, providing:

Physical path diversity

Redundancy

Competitive options

High availability for interconnects

Thus, path diversity on multiple carriers is the primary benefit.

Answer : A

Comprehensive and Detailed Explanation From Cisco SP Cloud & AFM Knowledge

Cisco AFM (Active Fault Manager), part of Cisco Crosswork, uses machine learning algorithms to:

Analyze large volumes of telemetry

Detect anomalies

Identify abnormal behavior patterns

Predict potential service-impacting faults before they occur

This predictive analytics capability is one of AFM's core advantages, enabling proactive fault avoidance rather than reactive troubleshooting.

The other options do not represent AFM functionality:

AFM does not require offline operation (B).

It does not upgrade hardware (C).

ML does not reduce resource usage (D); it increases analytical capability.

Thus, A is correct.

Answer : C, D

In a VXLAN BGP EVPN Multi-Site environment:

DCI tracking monitors the health of the DCI links. If all DCI-tracking interfaces go down, the leaf can incorrectly keep advertising or learning remote MAC/IP reachability, leading to packet loss and sub-optimal forwarding for servers in that VLAN/L2VNI.

For proper operation, each DCI-facing interface must be enabled with evpn multisite dci-tracking so that the Multi-Site border leaf tracks reachability over that link.

When using EVPN Multi-Site, BUM (broadcast, unknown unicast, multicast) traffic toward remote sites is typically handled via ingress replication, not multicast groups, for each L2VNI participating in Multi-Site. The configuration snippet shows an L2VNI (vn-segment 16535) still mapped to mcast-group 239.1.1.0, which is inconsistent with Multi-Site recommendations and contributes to packet loss.

Therefore, to fix the problem:

Enable DCI tracking on the uplink:

interface Ethernet1/1

evpn multisite dci-tracking

This restores proper DCI-link state monitoring for Multi-Site. Option C

Change the L2VNI behavior from multicast to Multi-Site ingress replication:

Under the VNI for VLAN 11, configure:

evpn

vni 16535 l2

multisite ingress-replication

or the equivalent command for the specific NX-OS release, thereby aligning the L2VNI with EVPN Multi-Site design and eliminating packet loss. Option D

Options A and B are ELAM (embedded logic analyzer) filters used only for packet capture and do not resolve the forwarding issue. Option E is an ACL line unrelated to EVPN VXLAN or DCI tracking and does not address the underlying problem.

Answer : A

The requirements in the scenario match the capabilities of Segment Routing (SR-MPLS) combined with MPLS Performance Measurement (MPM):

1. Low-latency slice creation

Segment Routing allows deterministic paths using:

SR-TE (Traffic Engineering)

Colored or intent-based policies

Path selection based on link latency, loss, bandwidth, or utilization

MPLS Performance Measurement supplies real-time data such as:

One-way delay

Round-trip delay

Loss metrics

This allows SR-TE to compute paths with minimum latency.

2. Secure slice with minimized transport cost

Segment Routing supports:

Slicing through SR Policies

Steering encrypted traffic (IPsec/GETVPN) through specific SR tunnels

Traffic separation without requiring additional MPLS LSP state in the core

Optimizing transport cost via constraint-based TE computations

3. Transport SLA enforcement beyond best effort

SR-TE + MPM provides:

SLA-aware intent routing

Guaranteed performance paths

Automatic re-optimization if links violate latency or loss SLAs

Why the other options are incorrect

B . IPsec VPN

Provides encryption but does not offer latency-aware or SLA-based path selection. Not a slicing mechanism.

C . AWS Direct Connect

Cloud connectivity service. Not related to MPLS performance monitoring or transport slicing.

D . Transit VPC for AWS

Used for SD-WAN cloud integration. Does not support SR-TE slicing or MPLS SLAs.

Therefore, only Segment Routing provides latency-based path computation, slicing, SLA guarantees, and cost optimization.

Answer : A, E

In Cisco Enterprise NFVIS, time synchronization is configured using the system time ntp command structure. NFVIS requires a primary and optionally a backup NTP server to maintain accurate system time for the hypervisor and guest VMs.

Correct NFVIS command syntax for NTP configuration:

system time ntp preferred_server <IP>

This command configures the preferred (primary) NTP server used for system clock synchronization.

system time ntp backup_server <IP>

This command configures the backup NTP server, which the system uses if the primary becomes unreachable.

These two commands match Cisco NFVIS time-configuration behavior described in NFV infrastructure design and implementation guidelines.

Why the Correct Answers Are A and E

Option A: system time ntp preferred_server 192.168.1.1

This properly configures the primary NTP server in NFVIS. The preferred server is always the first choice for time synchronization.

Option E: system time ntp backup_server 192.168.2.1

This correctly configures the backup NTP server. If the preferred server fails, NFVIS automatically falls back to the backup server.

Both commands directly match NFVIS's NTP command hierarchy and are the only ones that correctly apply to NFVIS.

Why the Other Options Are Not Correct

Option B uses utils ntp, which is not an NFVIS command.

Option C sets manual time and does not configure NTP servers.

Option D also uses the utils ntp syntax, which applies to other Cisco platforms but not NFVIS.

Answer : D

Comprehensive and Detailed Explanation From Cisco SP Security Knowledge

Cisco Always-On Cloud DDoS Protection is a cloud-based, carrier-grade security service used by service providers to protect customers from volumetric and application-layer DDoS attacks.

Its core protection mechanism is the use of global scrubbing centers, which:

Receive diverted attack traffic

Scrub (clean) malicious packets

Forward clean traffic back to the customer

Use behavioral analysis and real-time detection

Protect against volumetric, TCP state-exhaustion, and application-layer attacks

Why other answers are incorrect:

Load balancing (A) does not mitigate DDoS attacks; it distributes traffic across servers.

Botnet zombies (B) are sources of DDoS attacks, not protection.

Traffic mirroring (C) is used for analysis and monitoring, not active DDoS protection.