Practice Free 300-540 Designing and Implementing Cisco Service Provider Cloud Network Infrastructure (SPCNI v1.0) Exam Questions Answers With Explanation

In Cisco SD-WAN,vSmart controllers must be assigned to controller groupsso that edge routers can form redundant control-plane connections. Each data center in the diagram has its own group:

New York DC ? Controller group-ID 1(vSmart1, vSmart2, vSmart3)

Los Angeles DC ? Controller group-ID 2(vSmart4, vSmart5, vSmart6)

To configure the controllers correctly:

vSmart1

It resides in theNew York DC, so it must be assigned tocontroller-group 1.

Required command:

system controller-group-id 1

This corresponds toOption D.

vSmart4

It resides in theLos Angeles DC, so it must be assigned tocontroller-group 2.

Required command:

system controller-group-id 2

This corresponds toOption C.

Why Other Options Are Incorrect

A and B:The command max-control-connections is configured onedge routers, not vSmart controllers.

E:Controller-group-id 4 does not exist in this design; only group 1 and group 2 are shown.

Comprehensive and Detailed Explanation

In Cisco NFVI security architecture, the primary defense againstlateral movement(an attacker moving from one compromised node to another) isnetwork segmentation.

Segmentation:

Separates workloads (compute, storage, management, tenant networks)

Prevents attackers from pivoting inside the NFVI

Reduces blast radius during breaches

Enforces micro-segmented virtual network boundaries

WPA protects Wi-Fi, not NFVI.

WAF protects web apps, not internal movement.

Data encryption protects confidentiality, not lateral movement control.

Thus,network segmentationis the correct solution.

Comprehensive and Detailed Explanation

BGP Flowspec allows routers to distributetraffic-filtering rulesusing BGP NLRI.

To enable Flowspec, after neighbors are configured, the essential next step is:

?Activate the Flowspec address-family under BGP

Example:

router bgp 65000

address-family ipv4 flowspec

neighbor X.X.X.X activate

exit-address-family

This enables:

FlowSpec NLRI exchange

Distribution of drop rules (rate-limit, redirect, null route, etc.)

Automatic ACL/class-map/policy-map generation on edge routers

Why the other options are incorrect:

B. Set BGP routing process? already done when neighbors were configured

C. Activate neighbors? only makes senseinsidean address-family; flowspec AF must be enabled first

D. Configure route reflector? optional and not required for Flowspec to operate

Thus, the correct next step isA. Configure Flowspec for the BGP address-family.

Comprehensive and Detailed Explanation (Cisco NFVI / Virtualization Knowledge)

SR-IOV (Single Root I/O Virtualization)allows a VM to access the network interface hardwaredirectly, without going through the hypervisor’s virtual switch.

This is achieved by:

Assigning Virtual Functions (VFs) directly to VMs

Allowing high-performance, low-latency packet I/O

Bypassing the hypervisor datapath

Therefore, SR-IOV doesnotbypass the guest OS; it bypasses thehypervisor I/O virtualization layer, delivering near-native performance.

Thus the correct answer isC.

Comprehensive and Detailed Explanation

In Cisco high-availability LAN gateway designs, the requirement is:

Multiple L3 gateways sharing avirtual MAC and virtual IP

Ability toload balanceacross multiple active gateways

Capability toseamlessly take overgateway forwarding during a failure

Among Cisco First Hop Redundancy Protocols (FHRPs):

HSRP? Active/standby only

VRRP? Active/standby only

GLBP (Gateway Load Balancing Protocol)?The only FHRP providing active/active load balancing

GLBP allows multiple routers to share:

Acommon virtual IP

Multiplevirtual MAC addresses

Multipleactive forwardersthat load-balance end hosts

Automatic failover if any gateway fails

Thus, GLBP is the only correct protocol matching the requirement forredundant default gateways with load balancing and shared MAC addressing.

From the RAID controller output:

TheRAID1virtual drive is shown as“Dgrd” (degraded)with a note:“RAID 1 in degraded state.”

In thePD LIST, one disk (slot 2) is marked“UGood – active disk in slot 2 disconnected from drive group 0”, while the other (slot 3) is“Onln 0”(online and part of drive group 0).

This means:

In aRAID 1mirror, onlyone diskmay fail while the array remains available.

Here,one disk has failed/disconnected, the other is still online ? the array isdegraded but operational.

Therefore:

B. One RAID 1 disk failed– correct.

C. The node is still functional– correct; RAID1 can tolerate a single disk failure.

The other options are incorrect:

A and Esuggest two disk failures, which is not indicated.

Dwould be true only if both disks failed; with one disk still online, the node continues to function, though in a degraded state.

Comprehensive and Detailed Explanation (Cisco Cloud Model Knowledge)

The requirement states:

All infrastructure in the cloud

All applications delivered from the cloud

No software management

No maintenance by the customer

This matchesSoftware as a Service (SaaS).

SaaS provides:

Fully managed applications

No patching, upkeep, installation, or infrastructure maintenance

End-to-end cloud delivery

PaaS and IaaS still require some software/application management.

FaaS is event-driven serverless compute, not full application hosting.

Therefore, the correct answer isA. SaaS.

Overlay Transport Virtualization (OTV) allows Layer 2 extension across Layer 3 infrastructures. To operate, OTV requires three fundamental components on the overlay interface:

Join interface – used to reach the OTV control plane over L3 (already configured: otv join-interface g1/0).

Control-group multicast address – for control-plane advertisement (already configured: otv control-group 224.1.1.1).

Extended VLAN list – specifies which VLANs will be transported through the OTV overlay.

The configuration shown in the exhibit includes the join-interface, control-group, and data-group, but it does NOT specify which VLANs should be extended. Without the otv extend-vlan command, OTV will form the overlay interface but will not forward any Layer 2 information, preventing adjacency and MAC distribution between sites.

In OTV, the command required to activate VLANs for transport is:

otv extend-vlan

This enables the VLANs (such as 101–111) to be carried across the OTV overlay, completing the configuration and establishing connectivity.

Why the Other Options Are Incorrect

B. otv isis authentication-type md5

This is optional and only required if ISIS authentication is enabled on both edges. It does not resolve the absence of VLAN extension.

C. otv isis authentication-check

This command enforces authentication verification but does not fix connectivity when VLANs are not extended.

D. otv join-interface vlan 101-111

This is not a valid OTV command. The join-interface must be a routed interface, not a VLAN list.

Comprehensive and Detailed Explanation

For virtualization functions and operational reliability, the architecture must leverageCisco NSO (Network Services Orchestrator)capabilities. NSO provides:

Transactional service modeling

Automatic rollbackwhen any step of a transactional deployment fails

Real-time network-state visibilityvia NSO CLI and live device synchronization

End-to-end service lifecycle automation

Among the options:

Why B is correct

"Virtualization service modeling" fits NSO’s core design principle: model the service, not individual devices.

NSO’s CLI providesstate visibility, operational introspection, transaction logs, and commit details.

NSO’s transactional engine providesautomatic rollbackupon any device or service failure.

This option capturesfull lifecycle automation,real-time state visibility, andreliability, exactly as required.

Why others are incorrect

A: CLI NED alone does not provide real-time state visibility or automated rollback; manual rollback contradicts requirements.

C: Only focuses on service modeling + CLI, but doesnotinclude rollback or lifecycle automation.

D: Templates alone do not ensure rollback or real-time operational state.

Comprehensive and Detailed Explanation

Cisco Container Platform (CCP), built on Kubernetes orchestration, usesYAMLfiles for:

Cluster configuration

Pod definitions

Network settings

Storage mappings

YAML is the industry-standard declarative syntax for Kubernetes and container orchestration platforms.

HTML, XHTML, and XML are not used for CCP configuration.

Comprehensive and Detailed Explanation

In Cisco Secure Endpoint Private Cloud AirGap mode, Internet access is disabled. Updates must be uploaded manually and then triggered inside the Secure Endpoint console.

The commandforce update -yinitiates the update of the manually uploaded Secure Endpoint package.

Other commands are not used for Secure Endpoint updates:

rpm -qa? Lists Linux packages only

jamf-sync all? Used for Apple JAMF integrations

genisoimage? Used to create ISO files, irrelevant to Secure Endpoint

Therefore,Ais correct.

Comprehensive and Detailed Explanation

For distancesgreater than 20 miles, valid inter-facility transport options must support:

Metro-scale connectivity

High bandwidth

Low latency

Carrier-grade reliability

Acarrier access Ethernet ring (MEN / Metro Ethernet)is designed for:

Interconnecting data centers or meet-me rooms

Distances far exceeding 20 miles

High-availability layer-2 or layer-3 transport

Why the others are invalid:

CAT6e? maximum ~100 meters

Multimode fiber? typically <2 km (~1.25 miles)

Private wireless? not used for high-capacity DC interconnects, unreliable for core transport

Thus, the only correct carrier-grade method isCarrier access Ethernet ring.

The attacker’s IP is:

10.10.10.2

The servers under attack are:

Web Server:10.20.10.2

Mail Server:10.30.10.2

We must denytraffic from attacker ? servers.

Correct ACL format useshost wildcards (0.0.0.0):

deny ip 10.10.10.2 0.0.0.0 10.20.10.2 0.0.0.0

deny ip 10.10.10.2 0.0.0.0 10.30.10.2 0.0.0.0

These matchD and E.