300-540 Designing and Implementing Cisco Service Provider Cloud Network Infrastructure (SPCNI v1.0) Questions and Answers

In Cisco data center and cloud-scale designs, a double-sided vPC (also called vPC-to-vPC) is used when both ends of a Layer 2 port channel are formed by a pair of switches that operate as vPC peers. In this model:

On the aggregation or leaf side, two switches (in this case, LEAF1 and LEAF2 ) form a vPC domain with a vPC peer-link and keepalive.

On the access or ToR side, two switches (in this case, TOR1 and TOR2 ) must also form their own vPC domain with a peer-link and vPC keepalive.

The port-channel that interconnects the two vPC domains is then configured as a vPC on both sides, creating a vPC-to-vPC topology.

The problem statement specifies that LEAF1 and LEAF2 are already configured as vPC peers . For a double-sided vPC to work, the other side (TOR1 and TOR2) must also behave as a single logical entity for the downstream Cisco UCS server and for the upstream vPC connection towards LEAF1 and LEAF2. This is only achieved when TOR1 and TOR2 are configured as vPC peers with:

A vPC domain ID

A vPC peer-link between TOR1 and TOR2

vPC member port-channels towards LEAF1 and LEAF2 and towards the Cisco UCS server

Therefore, the next required step is to configure a vPC between TOR1 and TOR2 .

Evaluation of the options:

Option A, “Add all the switches to the fabric,” is generic and not specific to vPC configuration. It does not address the technical requirement to form a vPC domain on the ToR side.

Option B, “Configure peering between LEAF1 and LEAF2 and TOR1 and TOR2,” is incorrect because vPC peering is only configured between the two switches that form each vPC domain (LEAF1–LEAF2 and TOR1–TOR2), not across all four switches together.

Option C, “Configure MSTP between TOR1 and TOR2,” is not required for establishing a double-sided vPC. vPC designs rely on the vPC control plane and the peer-link, not on spanning-tree between the vPC peers for normal operation.

Option D, “Configure a vPC between TOR1 and TOR2,” correctly describes configuring TOR1 and TOR2 as a vPC pair (vPC domain with peer-link), which is the mandatory step to create a double-sided vPC topology with LEAF1 and LEAF2.

Comprehensive and Detailed Explanation

SNMP traps in Cisco NFVIS (and in SNMP generally):

Are unsolicited notifications

Sent from the NFVIS device to the SNMP manager

Indicate alarms, changes, or significant operational events

Do not require polling

Examples:

Disk failures

VM crashes

Host status changes

Resource alarms

Why the others are wrong:

A describes SNMP monitoring (done by the manager with GET requests)

B SNMP cannot control host activities

D SNMP GET retrieves a variable, but traps send unsolicited notifications

Thus, the correct answer is C .

Destination-based Remote Triggered Black Hole (RTBH) routing is a DDoS mitigation technique where traffic to a victim’s IP address is intentionally routed to a special next hop (usually Null0) so that the traffic is dropped as close to the source as possible.

On the edge router (R1 in the figure), this is accomplished by installing /32 static routes for the victim endpoints, pointing to the null interface. When these routes are installed (often triggered via BGP in larger deployments), any traffic destined to those exact IP addresses is discarded.

In the topology:

Web server IP: 10.20.10.2

Mail server IP: 10.30.10.2

To perform destination-based RTBH at R1, we must configure static /32 routes to Null0 for each victim IP:

ip route 10.20.10.2 255.255.255.255 Null0

ip route 10.30.10.2 255.255.255.255 Null0

These correspond to:

Option C for the web server (10.20.10.2)

Option A for the mail server (10.30.10.2)

The other options are incorrect for RTBH:

B and D remove /24 routes via 10.10.10.2; they do not implement black-holing and would break normal routing rather than selectively drop attack traffic.

E black-holes 10.20.10.1, which is the default gateway on R2, not the victim server; that would impact overall connectivity instead of just dropping traffic to the attacked host.

Comprehensive and Detailed Explanation

Cisco NFVIS logging levels (from lowest to highest):

critical

error

warning

info

debug ← highest verbosity

To capture maximum diagnostic detail, engineers must enable debug logging on the operational log type , which records system activity and runtime behavior.

Thus the correct command is:

system set-log logtype operational level debug

This provides the deepest troubleshooting visibility.

In Cisco NFVI, the management node relies heavily on Docker containers for:

NFVIS management functions

VIM services

Orchestration components

If the management node fails to start and the system shows:

docker.service: inactive (dead)

…then all Docker-based platform services also fail to start.

The correct recovery action is to restart the Docker engine :

systemctl restart docker

This brings up:

All NFVI-required Docker containers

Management services

REST APIs and cluster components

Why other answers are incorrect:

docker-kibana → Only affects Kibana logging container

docker-cobbler → Used for provisioning, not core NFVI management

kube-apiserver → Part of Kubernetes cluster, but relies on Docker; restarting it won’t help until Docker is running

Thus, the correct answer is B. docker .

Comprehensive and Detailed Explanation (Cisco NFVI / Virtualization Knowledge)

SR-IOV (Single Root I/O Virtualization) allows a VM to access the network interface hardware directly , without going through the hypervisor’s virtual switch.

This is achieved by:

Assigning Virtual Functions (VFs) directly to VMs

Allowing high-performance, low-latency packet I/O

Bypassing the hypervisor datapath

Therefore, SR-IOV does not bypass the guest OS; it bypasses the hypervisor I/O virtualization layer , delivering near-native performance.

Thus the correct answer is C .

In Cisco Catalyst SD-WAN cloud integration, when the requirement is:

Automatically discovering AWS VPCs

Automatically identifying AWS services

Allowing the user to choose which private SD-WAN network connects to the cloud

Using AWS credentials (Access Key / Secret Key) for automatic provisioning

…the Cisco-supported mechanism is the Cisco SD-WAN Transit VPC solution .

Why Transit VPC is the correct answer:

It is specifically designed to integrate Cisco SD-WAN with AWS environments.

Uses AWS APIs and user credentials to automatically discover:

VPC IDs

Subnets

Regions

Routing tables

Automatically deploys and configures CSR1000v or Catalyst 8000V routers into the VPC.

Provides a centralized “hub” in AWS to interconnect multiple SD-WAN sites.

Enables the user to choose which SD-WAN segments connect to which VPCs.

This matches the requirement of automatic cloud resource identification based on user credentials .

Why the other options are incorrect

A. AWS Direct Connect

This is a physical/private Layer 2 cloud connection.

It does not auto-discover VPCs or integrate through credentials.

It does not provide automated SD-WAN service provisioning.

C. IPsec VPN

Works for connectivity but is manual , not automated.

Does not identify AWS cloud resources via credentials.

D. Segment routing

A transport technology used inside SP networks, irrelevant to AWS API-based VPC discovery.

Thus, only Transit VPC provides automatic AWS cloud discovery and integration with SD-WAN.

Comprehensive and Detailed Explanation

In Cisco NFV Infrastructure (NFVI) Assurance and Monitoring, enabling gRPC activates the device’s ability to support model-driven telemetry streaming.

Key points from Cisco SP Cloud/NFVI design principles:

gRPC is used as the transport protocol for model-driven telemetry.

Telemetry replaces traditional polling methods (SNMP, CLI scraping) with continuous, push-based updates.

It allows NFVI components to stream real-time operational data (CPU, memory, interfaces, VM metrics, fabric state) to collectors such as Cisco Crosswork, InfluxDB, Prometheus, or other analytic systems.

gRPC does not provide NetFlow/IPFIX export or syslog itself; those are separate subsystems.

Evaluation of options:

A. telemetry streaming — Correct. gRPC enables model-driven streaming telemetry.

B. IPFIX monitoring — Incorrect; IPFIX uses UDP exports, not gRPC.

C. Cisco IOS NetFlow monitoring — Incorrect; uses NetFlow export protocols.

D. system logging — Incorrect; syslog uses UDP/TCP, not gRPC.

Comprehensive and Detailed Explanation From Exact Extract from my knowledge of Designing and Implementing Cisco Service Provider Cloud Network Infrastructure Outlines without Any External URL or Links:

Container orchestration is the automated management of container lifecycle tasks such as deployment, scaling, failover, and updates. In Cisco cloud and NFV design guidance, typical orchestration platforms include Docker (with Swarm) and Kubernetes , which integrate with Cisco networking and security for cloud-native workloads.

Docker provides the container runtime and can also perform basic orchestration through Docker Swarm mode, managing multi-container, multi-host deployments.

Kubernetes is a full-featured orchestration system that automates deployment, scaling, and operations of application containers across clusters. It is the de-facto standard used with Cisco Container Platform and other Cisco cloud solutions.

VMware vCenter, Cisco vManage, and Cisco vSmart focus on virtual machines or SD-WAN control, not container orchestration. Therefore, the correct tools are Docker and Kubernetes (A, D).

To run EVPN over Segment Routing MPLS (SR-MPLS) , the IGP (here OSPF ) must be enabled for segment routing so it can:

Advertise Segment IDs (SIDs) for prefixes and links

Carry SR extensions in OSPF LSAs

On Cisco devices, this is done under the OSPF process with:

router ospf 100

router-id 192.168.1.1

segment-routing mpls

Without the segment-routing mpls command, Spine_A will not participate correctly in the SR-enabled OSPF domain, and SR-related adjacencies/LSAs will not form as expected, resulting in failure to integrate into the intended SR-MPLS core.

The other options are not OSPF SR-enabling commands:

A otv join-interface → OTV, unrelated to OSPF or SR-MPLS.

B address-family ipv4 → BGP address family, not OSPF.

C connected-prefix-sid-map → Global SR mapping for connected prefixes but does not itself enable SR for OSPF.

Therefore, the correct command is segment-routing mpls (D) .

Overlay Transport Virtualization (OTV) allows Layer 2 extension across Layer 3 infrastructures. To operate, OTV requires three fundamental components on the overlay interface:

Join interface – used to reach the OTV control plane over L3 (already configured: otv join-interface g1/0).

Control-group multicast address – for control-plane advertisement (already configured: otv control-group 224.1.1.1).

Extended VLAN list – specifies which VLANs will be transported through the OTV overlay.

The configuration shown in the exhibit includes the join-interface, control-group, and data-group, but it does NOT specify which VLANs should be extended. Without the otv extend-vlan command, OTV will form the overlay interface but will not forward any Layer 2 information, preventing adjacency and MAC distribution between sites.

In OTV, the command required to activate VLANs for transport is:

otv extend-vlan < vlan-range >

This enables the VLANs (such as 101–111) to be carried across the OTV overlay, completing the configuration and establishing connectivity.

Why the Other Options Are Incorrect

B. otv isis authentication-type md5

This is optional and only required if ISIS authentication is enabled on both edges. It does not resolve the absence of VLAN extension.

C. otv isis authentication-check

This command enforces authentication verification but does not fix connectivity when VLANs are not extended.

D. otv join-interface vlan 101-111

This is not a valid OTV command. The join-interface must be a routed interface, not a VLAN list.

Comprehensive and Detailed Explanation From Cisco SP Core Optimization Knowledge

Cisco IOS supports BGP Multipath for installing multiple equal-cost BGP routes (both iBGP and eBGP) into the routing table. The correct global BGP command syntax to set the number of allowable parallel BGP paths is:

maximum-paths < number >

For BGP specifically, the form is:

maximum-paths bgp < number >

This enables the router to install up to the specified number of equal-cost BGP routes (iBGP and eBGP) into the RIB and then potentially into the FIB.

Setting:

maximum-paths bgp 6

allows six parallel ECMP paths learned via BGP—this matches the requirement in the question.

Why the other options are incorrect

B. multipath eibgp 6 Not a valid Cisco IOS command.

C. maximum paths bgp routers 6 Invalid syntax.

D. maximum-paths eibgp 6 The correct keyword is bgp , not eibgp . Cisco does not use “eibgp” in this context; IOS supports BGP multipath across iBGP/eBGP automatically when configured under maximum-paths bgp.

From the RAID controller output:

The RAID1 virtual drive is shown as “Dgrd” (degraded) with a note: “RAID 1 in degraded state.”

In the PD LIST , one disk (slot 2) is marked “UGood – active disk in slot 2 disconnected from drive group 0” , while the other (slot 3) is “Onln 0” (online and part of drive group 0).

This means:

In a RAID 1 mirror, only one disk may fail while the array remains available.

Here, one disk has failed/disconnected , the other is still online → the array is degraded but operational .

Therefore:

B. One RAID 1 disk failed – correct.

C. The node is still functional – correct; RAID1 can tolerate a single disk failure.

The other options are incorrect:

A and E suggest two disk failures, which is not indicated.

D would be true only if both disks failed; with one disk still online, the node continues to function, though in a degraded state.

Router R2 is inside AS 100 and has three iBGP paths (via R3, R4, R5) toward AS 101. To perform iBGP multipath across these three equal-cost paths, BGP must:

Run the correct BGP process for AS 100

Allow installation of multiple iBGP paths in the routing table

This is done with:

router bgp 100

maximum-paths ibgp 3

router bgp 100 – enters the BGP process for AS 100 (correct AS per diagram).

maximum-paths ibgp 3 – tells BGP to keep up to 3 iBGP paths to the same destination, enabling CEF to load-share across them.

Other options:

ip load-sharing ibgp 3 – not a valid command.

router bgp 101 – wrong AS number.

ip load-sharing per-destination – controls CEF hashing but does not enable BGP to install multiple iBGP paths by itself.

Comprehensive and Detailed Explanation From Cisco SP Cloud & AFM Knowledge

Cisco AFM (Active Fault Manager), part of Cisco Crosswork, uses machine learning algorithms to:

Analyze large volumes of telemetry

Detect anomalies

Identify abnormal behavior patterns

Predict potential service-impacting faults before they occur

This predictive analytics capability is one of AFM’s core advantages, enabling proactive fault avoidance rather than reactive troubleshooting.

The other options do not represent AFM functionality:

AFM does not require offline operation (B).

It does not upgrade hardware (C).

ML does not reduce resource usage (D); it increases analytical capability.

Thus, A is correct.