Quiz 400-007: Certified Design Expert CCDE v3.1

The correct answer is B. Enable a GRE tunnel between nodes C2 and C4
The key requirements in the question are:
- One-way video from head office to eight branch offices
- Use multicast
- The service provider offers a Layer 3 VPN
- The provider manages the CE routers
- The provider does not support multicast today
- The solution should work quickly and scale for future growth
Why B is correct
A GRE tunnel between C2 and C4 creates a point-to-point tunnel across the provider network, allowing multicast traffic to be carried even though the underlying Layer 3 VPN does not support multicast natively.
In this kind of design:
- Multicast can be encapsulated inside GRE
- The provider’s network sees only unicast GRE traffic
- The enterprise can extend multicast communication between the sites without waiting for the provider to add multicast support
- GRE is simple to deploy and is a common workaround when multicast must traverse a non-multicast service provider network
Since the provider manages the CE routers, the tunnel endpoints are placed on the customer edge devices, which is the appropriate place for an overlay solution.
Why the other options are wrong
A. Enable a GRE tunnel between nodes CE1 and CE2
This would only create a tunnel between two customer edge routers, but the question is about connecting the head office video stream to multiple branch offices. The selected nodes do not match the intended scalable hub-to-spoke or site-to-site multicast transport design shown in the exhibit.
C. Enable a GRE tunnel between nodes C1 and C4
This does not fit the most practical multicast transport solution for the topology in the exhibit. It is not the correct pair of endpoints for the overlay that would efficiently support the required branch connectivity.
D. Implement hub and spoke MPLS VPN over DMVPN (also known as 2547o DMVPN) between CE1 and CE2
This is not appropriate here because the provider already gives a Layer 3 VPN and the goal is to quickly enable multicast without waiting for provider support. Also, DMVPN is typically a customer-controlled overlay design, and this option does not directly address the actual multicast transport issue in the given provider-managed CE environment.
E. The service provider must provide a Draft Rosen solution to enable a GRE tunnel between nodes PE1 and PE2
Draft Rosen is an older MPLS multicast VPN solution, but the question states the provider does not currently support multicast. Also, this would require the provider to implement multicast support in the core, which contradicts the requirement for a quick customer-side solution.
Why GRE solves the problem
GRE is useful because it can carry multicast packets inside a unicast tunnel. That means:
- The multicast source sends traffic into the GRE tunnel
- The tunnel encapsulates the multicast traffic
- The provider network forwards the encapsulated packet as normal unicast traffic
- The receiving site decapsulates it and delivers the multicast traffic locally
This avoids the need for native multicast support in the service provider’s MPLS Layer 3 VPN.
Why it is scalable
Although a single GRE tunnel is a basic solution, it is a fast way to make multicast work immediately. It also provides a foundation for scaling into a broader overlay design if needed later, such as:
- Multiple GRE tunnels
- GRE plus routing protocol support
- More advanced multicast overlay solutions
So, in the context of the question, B is the best quick and scalable workaround.
Summary
- The provider does not support multicast natively
- The enterprise needs multicast between sites
- GRE tunnels can carry multicast over a unicast-only network
- The correct answer is B: Enable a GRE tunnel between nodes C2 and C4

The correct answer is A. Implement route reflectors on the two core routers.
The main problem in this scenario is not bandwidth or memory; it is the CPU overhead caused by a full-mesh IBGP design across 200 distribution routers.
Why the CPU is high:
- In a full-mesh IBGP topology, every router must maintain BGP sessions with every other IBGP router.
- This creates a large number of BGP peering relationships.
- The routers must process many BGP updates, keepalive messages, and route advertisements.
- As the number of routers grows, the configuration and processing burden increases significantly.
- The distribution routers are spending too much CPU handling BGP activity.
Why route reflectors solve the problem:
- A route reflector reduces the need for full-mesh IBGP.
- Instead of every distribution router peering with every other router, routers peer with a route reflector.
- In this case, the two core routers can act as route reflectors for the distribution routers.
- This dramatically reduces the number of BGP sessions and the amount of BGP processing on the distribution routers.
- It is also cost effective because it uses the existing core routers rather than requiring new hardware.
Why the other options are not correct:
B. Increase the memory on the core routers
- The issue is CPU utilization on the distribution routers, not memory on the core routers.
- More memory does not reduce BGP session overhead.
C. Implement eBGP between the core and distribution routers
- eBGP could be used in some designs, but it would require major routing design changes and is not the most cost-effective solution here.
- It is more disruptive than using route reflectors.
D. Increase the memory on the distribution routers
- The problem is CPU, not memory.
- Adding memory will not meaningfully reduce BGP processing load.
E. Increase bandwidth between the core routers
- The issue is not link bandwidth between the core routers.
- BGP processing overhead is caused by the number of peering relationships, not insufficient link capacity.
Conclusion:
Using route reflectors on the two core routers reduces the IBGP full-mesh requirement, lowers BGP processing overhead, and is the most cost-effective solution.

The correct answer is C. Loop guard.
UDLD, or Unidirectional Link Detection, is designed to detect unidirectional link failures, especially on fiber links. However, there can be situations where a Layer 2 loop or spanning tree problem happens before UDLD has time to detect the issue, or where a switch stops receiving BPDUs from a neighbor because the neighbor is no longer sending them. In those cases, UDLD alone is not enough to protect the network.
Loop guard is used as a companion to STP and UDLD to prevent a blocked port from accidentally transitioning to forwarding when BPDUs stop arriving. If a switch port that should be receiving BPDUs stops receiving them, loop guard keeps the port in a loop-inconsistent state instead of allowing it to go active. This helps prevent STP loops caused by one-way link failures or a device that stops sending BPDUs.
Why the other options are incorrect:
A. Root guard
Root guard protects the network from an unexpected switch becoming the root bridge. It is used to enforce root bridge placement, not to prevent loops caused by missing BPDUs.
B. BPDU guard
BPDU guard disables a port if it receives a BPDU, typically on portfast access ports. It protects edge ports from unauthorized switches, but it does not address the problem described.
D. BPDU filtering
BPDU filtering prevents BPDU transmission or reception on a port. This can actually increase the risk of loops because it suppresses STP participation, so it is not used to mitigate the described failures.
In summary, loop guard is the correct mechanism to use with UDLD when you want additional protection against STP-related failures caused by missing BPDUs or loop conditions before UDLD can detect the fault.

Https://community.cisco.com/t5/networking-knowledge-base/rp-redundancy-with-pim-bidir-
phantom-rp/ta-p/3117191

The correct answer is A. first-hop router registration to the RP
In IPv6 multicast service designs, a dynamically created tunnel interface is typically used by the first-hop router to build a temporary path toward the Rendezvous Point (RP). This tunnel allows multicast control information to be sent to the RP so that multicast groups can be established and maintained efficiently.
Why A is correct:
- The first-hop router is the device directly connected to multicast sources or receivers.
- In PIM-based multicast designs, when the RP must be reached over a unicast path, a tunnel interface may be created dynamically.
- This tunnel is used for registration of multicast traffic from the first-hop router to the RP, ensuring the RP learns about active sources.
Why the other options are incorrect:
- B. multicast client registration to the RP
- Receivers do not usually register directly to the RP in this way. Receiver participation is handled through join messages, not RP registration.
- C. multicast source registration to the RP
- This is close in concept, but the dynamically created tunnel interface is associated with the first-hop router's registration function rather than a direct source-only registration process.
- D. transport of all IPv6 multicast traffic
- A tunnel interface is not used to carry all multicast traffic. It is used for specific control and registration purposes.
In summary:
The dynamically created tunnel interface exists to let the first-hop router register multicast activity with the RP, which is why option A is the best answer.

The correct answer is D. Cape Town and Mumbai.
Here is how to reason through it.
The application has two requirements for the cluster heartbeat:
1. Bandwidth requirement: 2 Mb/s continuous
2. One-way latency requirement: maximum 100 ms
Because the data centers are connected by a full-mesh 400 Mb/s EVPL, bandwidth is available on all links, so the deciding factor is latency.
For a cluster to work between two sites, the one-way latency between them must be 100 ms or less. In practice, if only ping results are shown, the ping value represents round-trip time, so the one-way latency is roughly half of the ping time. The question, however, is asking you to use the exhibited test results to identify the pair that meets the requirement.
From the provided ping results, the only pair that satisfies the latency limit for the heartbeat is Cape Town and Mumbai.
Why the others do not qualify:
- Santiago and Cape Town: latency is too high
- Santiago and Mumbai: latency is too high
- Mumbai and Beijing: latency is too high
- Cape Town and Beijing: latency is too high
- Santiago and Beijing: latency is too high
So even though all sites have sufficient bandwidth, only Cape Town and Mumbai can meet the 100 ms one-way latency requirement for the mission-critical clustered application.
Answer: D. Cape Town and Mumbai

The correct answer is D. Limit the query domain by use of summarization.
EIGRP converges fastest when a failure affects as small a portion of the network as possible. In EIGRP, when a route is lost, routers may send queries to find alternate paths. If those queries have to travel far across the network, convergence slows down significantly and can even cause stuck-in-active problems.
Summarization helps because it reduces the size of the query domain. When routes are summarized, routers beyond the summary boundary do not need to be queried about every specific lost route. This confines the search for alternatives to a smaller area, allowing the network to reconverge more quickly after a point-to-point link failure.
Why the other options are incorrect:
A. Limit the query domain by use of distribute lists.
Distribute lists control which routes are accepted or advertised, but they do not directly define or reduce the EIGRP query domain in the way summarization does.
B. Build neighbor adjacencies in a triangulated fashion.
Triangulation can provide redundancy, but it does not specifically optimize EIGRP query containment. It may even increase complexity.
C. Build neighbor adjacencies in squared fashion.
This is not a standard EIGRP design recommendation for faster convergence.
E. Limit the query domain by use of default routes.
Default routes can reduce routing table complexity, but they are not the primary mechanism for limiting EIGRP queries after a link failure.
Summary:
To make EIGRP converge as quickly as possible after a point-to-point link failure, the best design is to use route summarization so that EIGRP queries stay within a small, well-defined area.

The correct answer is B. It protects the network infrastructure against spoofed DDoS attacks.
Ingress filtering is a security technique applied at the edge of a network to verify that incoming packets have source IP addresses that are valid for that source network. If a packet arrives with a spoofed or unauthorized source address, it is dropped.
This helps against spoofed DDoS attacks because many reflection and amplification attacks rely on falsified source IP addresses. By blocking spoofed traffic at the network edge, ingress filtering reduces the ability of attackers to hide their true origin and use fake source addresses to launch or amplify attacks.
Why the other options are incorrect:
A. It reduces the effectiveness of DDoS attacks when associated with DSCP remarking to Scavenger.
This describes QoS behavior, not ingress filtering. DSCP remarking to Scavenger is about deprioritizing traffic, not preventing spoofed addresses.
C. It classifies bogon traffic and remarks it with DSCP bulk.
Bogon traffic refers to packets with addresses that should not be seen on the public Internet, but ingress filtering is not primarily about DSCP classification or remarking.
D. It filters RFC 1918 IP addresses.
RFC 1918 addresses are private address ranges. While some ingress filters may block them from entering the public Internet, ingress filtering is broader than just filtering RFC 1918 space. Its main purpose is to stop packets with source addresses that do not belong on the incoming interface, including spoofed addresses.
In summary:
Ingress filtering is used to stop source IP spoofing, which helps protect the network infrastructure from spoofed DDoS attacks.

IBGP peers can be multiple hops away. not like eBGP that needs direct connection (or ebgp-multihop
defined). thus, only IP connectivity between two peers is required for an adjacency to form.

Assuming routers R1-R5, R1 is elected DR, R2 BDR. Fully established neighborships only occur to DR
and BDR, all other neighbors are in 2Way DR other state. DR|BDRFull relationships:
R2-R1
R3-R1
R3-R2
R4-R1
R4-R2
R5-R1
R5-R2