300-540 Exam Questions & Answers
Designing and Implementing Cisco Service Provider Cloud Network Infrastructure v1.0 • Cisco
100% money-back guarantee
Sample 300-540 Questions
Practice with real exam-style questions, each with the verified correct answer and explanation.
What should be used to protect against lateral movements during a Cisco NFVI security breach?
Comprehensive and Detailed Explanation
In Cisco NFVI security architecture, the primary defense against lateral movement (an attacker moving from one compromised node to another) is network segmentation.
Segmentation:
Separates workloads (compute, storage, management, tenant networks)
Prevents attackers from pivoting inside the NFVI
Reduces blast radius during breaches
Enforces micro-segmented virtual network boundaries
WPA protects Wi-Fi, not NFVI.
WAF protects web apps, not internal movement.
Data encryption protects confidentiality, not lateral movement control.
Thus, network segmentation is the correct solution.
Which format is used by Cisco Container Platform for configuration files?
Comprehensive and Detailed Explanation
Cisco Container Platform (CCP), built on Kubernetes orchestration, uses YAML files for:
Cluster configuration
Pod definitions
Network settings
Storage mappings
YAML is the industry-standard declarative syntax for Kubernetes and container orchestration platforms.
HTML, XHTML, and XML are not used for CCP configuration.
Refer to the exhibit.
Refer to the exhibit. An engineer must configure an IPsec VPN connection between site 1 and site 2. The indicated configuration was applied to router R1; however, the tunnel fails to come up. Which command must be run on R1 to resolve the issue?
A. ip route 0.0.0.0 0.0.0.0 10.1.1.2 B. crypto isakmp key vpnuser address 192.168.20.2 C. ip route 0.0.0.0 0.0.0.0 192.168.20.2 D. crypto isakmp key vpnuser address 10.1.1.2
For a site-to-site IPsec VPN, each peer must configure a pre-shared key tied to the public IP address of the remote VPN peer:
crypto isakmp key <KEY> address <REMOTE_PUBLIC_IP>
From the diagram:
R1 outside IP: 192.168.10.1/24
R2 outside IP: 192.168.20.2/24 remote peer for R1
In the current R1 configuration, the ISAKMP key is incorrectly bound to 192.168.10.2, which is a local next-hop/ISP address on R1's own subnet, not the R2 public IP. Because the pre-shared-key address does not match the source IP of R2's IKE packets, phase 1 negotiation fails and the tunnel never comes up.
The correct configuration on R1 must therefore be:
crypto isakmp key vpnuser address 192.168.20.2
Options A and C incorrectly change the default route (next hop must be the local ISP router, not R2's public IP or a LAN address). Option D uses an internal address (10.1.1.2), which is not the IP used for IKE on the Internet.
Refer to the exhibit.
Refer to the exhibit. An engineer must configure dual-homing with single active redundancy in a BGP EVPN VXLAN fabric. Which command must be run on the leaf router to complete the EVPN Ethernet segment configuration?
In a BGP EVPN VXLAN multi-homing design, Ethernet Segment Identifiers (ESIs) are used to represent a set of links from one or more leaf switches to the same downstream device (such as a CE, firewall, or aggregation switch). By default, when multiple leafs share the same ESI, the EVPN design supports all-active redundancy, where all participating leafs can forward traffic for that Ethernet segment simultaneously.
However, some use cases---like connecting to devices that do not support multipath forwarding or for strict active/standby redundancy---require single-active multi-homing. In single-active mode, only one leaf in the Ethernet segment forwards traffic at any time; the other leaf(s) act as standby and only take over if the active node fails. This behavior is explicitly controlled in the EVPN Ethernet-segment configuration.
On Cisco platforms for EVPN VXLAN fabrics, this is configured under the l2vpn evpn ethernet-segment stanza using the command:
l2vpn evpn ethernet-segment 1
identifier type 0 01.01.01.10.10.10.10.10.10.10
redundancy single-active
identifier type 0 ... defines the ESI for the multi-homed connection.
redundancy single-active specifies that only one leaf in that ESI is allowed to be active at a time, thus enabling dual-homing with single-active redundancy.
The other options do not relate to Ethernet-segment redundancy mode:
B . default-gateway advertise is used in EVPN anycast gateway configurations to advertise the default gateway MAC/IP, not for ESI redundancy.
C . replication-type static is associated with multicast or ingress replication behavior for VXLAN VTEPs, not Ethernet-segment redundancy.
D . vlan configuration 101 is a VLAN configuration context command and has no effect on EVPN ESI redundancy.
A large company's legacy network is set up with equipment from multiple vendors. The company engaged a network architect to optimize the network for virtualization. The architect must ensure robust and efficient operation, considering the company's immediate needs but also anticipating future network complexities and scalability requirements. The chosen strategy must be capable of integrating seamlessly with existing systems, while providing a pathway for innovation and growth. The solution must facilitate end-to-end service automation throughout the entire lifecycle, and the implementation must ensure the validation, execution, and abstraction of network configurations and services. Which action must be taken to meet the requirements?
Cisco NSO-based orchestration principles in a multi-vendor environment require:
Service modeling using flexible, reusable YANG models
Abstraction of vendor-specific device differences
Transaction-safe configuration validation and execution
End-to-end automation across lifecycle stages (Day-0, Day-1, Day-N)
Scalability and adaptability for evolving requirements
Option C aligns perfectly with NSO service-modeling approaches:
Service models must be flexible, not rigid, enabling changes as technologies and needs evolve.
The architecture must support continuous refinement, enabling multi-vendor abstraction and lifecycle automation.
This ensures the network evolves seamlessly while remaining stable and automated.
Why the Other Options Are Incorrect
A -- Simplified monitoring and post-deployment adjustments do not meet the core need for full lifecycle service modeling and abstraction.
B -- Configuring devices individually contradicts the entire purpose of orchestration and abstraction.
D -- A static YANG model cannot accommodate multi-vendor environments or future scalability.
Thus, only Option C matches full NSO-capable service modeling requirements.
Get access to all 61 verified questions with detailed answers.
Unlock All 300-540 Questions