300-540 Designing and Implementing Cisco Service Provider Cloud Network Infrastructure (SPCNI v1.0) Questions and Answers

For a site-to-site IPsec VPN, each peer must configure apre-shared keytied to thepublic IP address of the remote VPN peer:

crypto isakmp key address

From the diagram:

R1 outside IP:192.168.10.1/24

R2 outside IP:192.168.20.2/24← remote peer for R1

In the current R1 configuration, the ISAKMP key is incorrectly bound to192.168.10.2, which is a local next-hop/ISP address on R1’s own subnet, not the R2 public IP. Because the pre-shared-key address does not match the source IP of R2’s IKE packets, phase 1 negotiation fails and the tunnel never comes up.

The correct configuration on R1 must therefore be:

crypto isakmp key vpnuser address 192.168.20.2

Options A and C incorrectly change the default route (next hop must be the local ISP router, not R2’s public IP or a LAN address). Option D uses an internal address (10.1.1.2), which is not the IP used for IKE on the Internet.

In Cisco Catalyst SD-WAN cloud integration, when the requirement is:

Automatically discovering AWSVPCs

Automatically identifying AWSservices

Allowing the user to choose whichprivate SD-WAN networkconnects to the cloud

UsingAWS credentials(Access Key / Secret Key) for automatic provisioning

…the Cisco-supported mechanism is theCisco SD-WAN Transit VPC solution.

Why Transit VPC is the correct answer:

It is specifically designed to integrateCisco SD-WANwith AWS environments.

Uses AWS APIs and user credentials to automatically discover:

VPC IDs

Subnets

Regions

Routing tables

Automatically deploys and configures CSR1000v or Catalyst 8000V routers into the VPC.

Provides a centralized “hub” in AWS to interconnect multiple SD-WAN sites.

Enables the user to choose which SD-WAN segments connect to which VPCs.

This matches the requirement ofautomatic cloud resource identification based on user credentials.

Why the other options are incorrect

A. AWS Direct Connect

This is a physical/private Layer 2 cloud connection.

It doesnotauto-discover VPCs or integrate through credentials.

It does not provide automated SD-WAN service provisioning.

C. IPsec VPN

Works for connectivity but ismanual, not automated.

Does not identify AWS cloud resources via credentials.

D. Segment routing

A transport technology used inside SP networks, irrelevant to AWS API-based VPC discovery.

Thus, onlyTransit VPCprovides automatic AWS cloud discovery and integration with SD-WAN.

Comprehensive and Detailed Explanation From Exact Extract from my knowledge of Designing and Implementing Cisco Service Provider Cloud Network Infrastructure Outlines without Any External URL or Links:

Cisco+ Hybrid Cloud is Cisco’s as-a-service consumption model that offers pay-as-you-go infrastructure. For ahybrid workplace, the focus is on giving users secure desktop environments from anywhere, with the ability torapidly deployandscale up or downbased on the number of users or partners.

Cisco+Hybrid Cloud for Virtual Desktop Infrastructure (VDI)specifically delivers desktop and app workspaces as an on-demand service. It allows partners to consume desktops elastically, paying for capacity as needed and scaling the underlying compute, storage, and networking without rebuilding the environment.

Bare Metal Compute and Virtualization offers flexible infrastructure but are aimed at app/workload hosting rather than user desktop workspaces.

Service Provider Networking addresses network services, not end-user hybrid workplace desktops.Therefore, for a pay-as-you-go, rapidly deployable, elastic solution in a hybrid workplace,Cisco+ Hybrid Cloud for Virtual Desktop Infrastructureis the correct choice.

Cisco NFVIS follows strict security controls. After a fresh deployment:

Thedefault admin credentials are considered insecure.

NFVIS requires the administrator toreset the default password on first login(typically via console or SSH).

Until the password is changed,REST API and web-portal access are denied, and attempts to access the portal or API returnHTTP 401 Unauthorized, even if the default credentials are provided.

This mechanism prevents use of factory-default passwords in production and is explicitly documented as a mandatory post-install step.

The other options are not the cause of a 401 error:

Enabling portal via SSH (B) is not required; HTTPS access is enabled by default once credentials are valid.

Restarting Tomcat (C) would address service availability issues (e.g., 5xx errors), not authentication.

Browser certificates (D) affect trust warnings (e.g., HTTPS certificate errors), not 401 Unauthorized.

NETCONF rules state:

A user cannot terminatetheir own active session.

Attempting to kill the same session returnsinvalid-valueerror.

The session continues running normally.

Thus:

No logout

No termination

No configuration impact

Therefore,Ais correct.

Comprehensive and Detailed Explanation

SNMP traps in Cisco NFVIS (and in SNMP generally):

Areunsolicited notifications

Sent from the NFVIS deviceto the SNMP manager

Indicate alarms, changes, or significant operational events

Donotrequire polling

Examples:

Disk failures

VM crashes

Host status changes

Resource alarms

Why the others are wrong:

Adescribes SNMP monitoring (done by the manager with GET requests)

BSNMP cannotcontrolhost activities

DSNMP GET retrieves a variable, but traps sendunsolicitednotifications

Thus, the correct answer isC.

Comprehensive and Detailed Explanation

For distancesgreater than 20 miles, valid inter-facility transport options must support:

Metro-scale connectivity

High bandwidth

Low latency

Carrier-grade reliability

Acarrier access Ethernet ring (MEN / Metro Ethernet)is designed for:

Interconnecting data centers or meet-me rooms

Distances far exceeding 20 miles

High-availability layer-2 or layer-3 transport

Why the others are invalid:

CAT6e→ maximum ~100 meters

Multimode fiber→ typically <2 km (~1.25 miles)

Private wireless→ not used for high-capacity DC interconnects, unreliable for core transport

Thus, the only correct carrier-grade method isCarrier access Ethernet ring.

Comprehensive and Detailed Explanation (Cisco NFVI / Virtualization Knowledge)

SR-IOV (Single Root I/O Virtualization)allows a VM to access the network interface hardwaredirectly, without going through the hypervisor’s virtual switch.

This is achieved by:

Assigning Virtual Functions (VFs) directly to VMs

Allowing high-performance, low-latency packet I/O

Bypassing the hypervisor datapath

Therefore, SR-IOV doesnotbypass the guest OS; it bypasses thehypervisor I/O virtualization layer, delivering near-native performance.

Thus the correct answer isC.

Comprehensive and Detailed Explanation

AnAPI logic flawis a weakness in the API’sbusiness logic— not in encryption or transport security. It occurs when:

API functions are misused

Business rules are bypassed

Security validation is missing

Workflow logic is incorrect

These issues cannot be solved through encryption (at rest or in transit). They require:

✔Vulnerability remediation

✔Fixing API code logic

✔Updating API validation, flow control, and authentication logic

Thus the correct answer isC. Remediation of vulnerabilities.

In aCisco NFVI C-Series Pod, the Top-of-Rack (ToR) switches are almost always configured as avPC pair.

A vPC domain requiresthree mandatory components:

vPC domain ID

vPC peer-link

vPC peer-keepalive link←ensures dual-active detection

In the exhibit:

The management interfaces areTor-A Mgmt0: 10.10.10.1andTor-B Mgmt0: 10.10.10.2

These IPs are used commonly as thepeer-keepalive endpoints

The physical uplinks to NFVI nodes formPort-Channel110

Since the configuration snippet already includes:

feature vpc

feature lacp

channel-group 110 mode active

Thenext required stepin a Cisco NFVI + vPC configuration is to configure thepeer-keepalivefrom ToR-A toward ToR-B:

vpc domain 1

peer-keepalive destination 10.10.10.2

This ensures:

vPC roles sync

Dual-active prevention

Stable operation for the NFVI C-Series rack

Why the Other Options Are Incorrect

A. vpc peer-linkThis is required but must be configured on the dedicated peer-link interfaces, not on the server-facing port-channel.

C. channel-group 110 mode onThe correct mode is already configured: mode active for LACP. mode on disables LACP.

D. switchport mode accessNFVI ToR links usetrunking, not access mode, because servers carry multiple networks (control, compute, storage, management VLANs).

In the diagram, thePE and R2, R3, R4, R5belong toAS 100. The PE router runs BGP processAS 100, so its BGP configuration must start with:

router bgp 100

To performiBGP multipath load sharingacross three equal-cost internal BGP paths, BGP must be instructed to keep and use multiple iBGP paths in the routing table. This is done with:

router bgp 100

maximum-paths ibgp 3

maximum-paths ibgp 3 tells BGP to install up tothreeiBGP paths to the same prefix, enabling CEF to load-share across those paths.

router bgp 100 is required because the PE is inAS 100, not 101.

Other options:

ip load-sharing per-destination affects CEF behavior but does not enable BGP iBGP multipath by itself and is not specific to three iBGP paths.

ip load-sharing ibgp 3 is not a valid IOS BGP command.

router bgp 101 would configure the wrong AS and break the iBGP relationships shown in AS-100.

Thus, the correct commands on the PE to achieve iBGP multipath load sharing over the three internal paths aremaximum-paths ibgp 3androuter bgp 100, corresponding toA and E.

Comprehensive and Detailed Explanation

In Cisco NFV Infrastructure (NFVI) Assurance and Monitoring, enabling gRPC activates the device’s ability to support model-driven telemetry streaming.

Key points from Cisco SP Cloud/NFVI design principles:

gRPC is used as the transport protocol for model-driven telemetry.

Telemetry replaces traditional polling methods (SNMP, CLI scraping) with continuous, push-based updates.

It allows NFVI components to stream real-time operational data (CPU, memory, interfaces, VM metrics, fabric state) to collectors such as Cisco Crosswork, InfluxDB, Prometheus, or other analytic systems.

gRPC does not provide NetFlow/IPFIX export or syslog itself; those are separate subsystems.

Evaluation of options:

A. telemetry streaming — Correct. gRPC enables model-driven streaming telemetry.

B. IPFIX monitoring — Incorrect; IPFIX uses UDP exports, not gRPC.

C. Cisco IOS NetFlow monitoring — Incorrect; uses NetFlow export protocols.

D. system logging — Incorrect; syslog uses UDP/TCP, not gRPC.

In a cloud-scale or data center–scale environment,Virtual Extensible LAN (VXLAN)is used as anoverlay technologyto transportLayer 2 segments over a Layer 3 underlay network. VXLAN encapsulates Layer 2 Ethernet frames inside UDP/IP packets, allowing broadcast, unknown unicast, and multicast (BUM) traffic and tenant Layer 2 domains to be extended across a routed IP fabric.

Key points aligned with Cisco Service Provider Cloud Infrastructure design principles:

VXLAN creates aLayer 2 overlay on top of a Layer 3 underlay.

TheVXLAN Network Identifier (VNI)provides a much larger segmentation space than traditional VLANs, enabling multi-tenancy at cloud scale.

Because the underlay is pure Layer 3 (IP routed fabric), VXLAN allows you tointerconnect Layer 2 segments between leaf switches or data centers over an IP/MPLS backbonewithout relying on large Layer 2 domains in the physical network.

Why the options evaluate as follows:

Option A: extends Layer 2 segments across the underlying Layer 3 infrastructure✅This is the core benefit of VXLAN in cloud-scale designs. VXLAN encapsulates Layer 2 frames intoIP/UDP headers, allowing isolated Layer 2 segments (per VNI) to be stretched across a routed IP network. This enables:

Multi-tenant Layer 2 connectivity across a distributed cloud fabric

Mobility of virtual machines or containers while keeping same IP/MAC addressing

Use of an IP-based leaf–spine or service provider underlay for scalability and resiliency

Option B: extends Layer 3 segments across the underlying Layer 2 infrastructure❌This is the opposite of what VXLAN does. VXLAN is explicitlyL2-over-L3, not L3-over-L2. Extending pure Layer 3 segments over Layer 2 is not the VXLAN use case.

Option C: reduces spanning-tree complexity across the Layer 2 infrastructure⚠️(Partially related but not the primary or direct benefit)In modern designs, the underlay isLayer 3 routed, and VXLAN overlays provide logical Layer 2 segments. This designavoids dependence on spanning tree in the fabric, whichindirectlyreduces STP complexity. However, the fundamental, exam-relevant benefit isL2 extension over L3, so C is not the best or most accurate answer compared to A.

Option D: eliminates the need for a Layer 3 underlay in the service provider infrastructure❌VXLAN absolutelyrequiresan IP (Layer 3) underlay for transport. VXLAN tunnels are built over a routed infrastructure (leaf–spine, MPLS/IP core, etc.). It does not remove the need for Layer 3; it depends on it.

InCisco Enterprise NFVIS, time synchronization is configured using thesystem time ntpcommand structure. NFVIS requires a primary and optionally a backup NTP server to maintain accurate system time for the hypervisor and guest VMs.

Correct NFVIS command syntax for NTP configuration:

system time ntp preferred_server This command configures thepreferred (primary)NTP server used for system clock synchronization.

system time ntp backup_server This command configures thebackupNTP server, which the system uses if the primary becomes unreachable.

These two commands match Cisco NFVIS time-configuration behavior described in NFV infrastructure design and implementation guidelines.

Why the Correct Answers Are A and E

Option A: system time ntp preferred_server 192.168.1.1

This properly configures the primary NTP server in NFVIS. The preferred server is always the first choice for time synchronization.

Option E: system time ntp backup_server 192.168.2.1

This correctly configures the backup NTP server. If the preferred server fails, NFVIS automatically falls back to the backup server.

Both commands directly match NFVIS’s NTP command hierarchy and are the only ones that correctly apply to NFVIS.

Why the Other Options Are Not Correct

Option Buses utils ntp, which is not an NFVIS command.

Option Csets manual time and does not configure NTP servers.

Option Dalso uses the utils ntp syntax, which applies to other Cisco platforms but not NFVIS.

Comprehensive and Detailed Explanation (Cisco NFVI / Virtualization Knowledge)

SR-IOV (Single Root I/O Virtualization)allows a VM to access the network interface hardwaredirectly, without going through the hypervisor’s virtual switch.

This is achieved by:

Assigning Virtual Functions (VFs) directly to VMs

Allowing high-performance, low-latency packet I/O

Bypassing the hypervisor datapath

Therefore, SR-IOV doesnotbypass the guest OS; it bypasses thehypervisor I/O virtualization layer, delivering near-native performance.

Thus the correct answer isC.