300-540 Exam Questions & Answers

Comprehensive and Detailed Explanation

In Cisco NFVI security architecture, the primary defense against lateral movement (an attacker moving from one compromised node to another) is network segmentation.

Segmentation:

Separates workloads (compute, storage, management, tenant networks)

Prevents attackers from pivoting inside the NFVI

Reduces blast radius during breaches

Enforces micro-segmented virtual network boundaries

WPA protects Wi-Fi, not NFVI.

WAF protects web apps, not internal movement.

Data encryption protects confidentiality, not lateral movement control.

Thus, network segmentation is the correct solution.

Comprehensive and Detailed Explanation

Cisco Container Platform (CCP), built on Kubernetes orchestration, uses YAML files for:

Cluster configuration

Pod definitions

Network settings

Storage mappings

YAML is the industry-standard declarative syntax for Kubernetes and container orchestration platforms.

HTML, XHTML, and XML are not used for CCP configuration.

For a site-to-site IPsec VPN, each peer must configure a pre-shared key tied to the public IP address of the remote VPN peer:

crypto isakmp key <KEY> address <REMOTE_PUBLIC_IP>

From the diagram:

R1 outside IP: 192.168.10.1/24

R2 outside IP: 192.168.20.2/24 remote peer for R1

In the current R1 configuration, the ISAKMP key is incorrectly bound to 192.168.10.2, which is a local next-hop/ISP address on R1's own subnet, not the R2 public IP. Because the pre-shared-key address does not match the source IP of R2's IKE packets, phase 1 negotiation fails and the tunnel never comes up.

The correct configuration on R1 must therefore be:

crypto isakmp key vpnuser address 192.168.20.2

Options A and C incorrectly change the default route (next hop must be the local ISP router, not R2's public IP or a LAN address). Option D uses an internal address (10.1.1.2), which is not the IP used for IKE on the Internet.

In a BGP EVPN VXLAN multi-homing design, Ethernet Segment Identifiers (ESIs) are used to represent a set of links from one or more leaf switches to the same downstream device (such as a CE, firewall, or aggregation switch). By default, when multiple leafs share the same ESI, the EVPN design supports all-active redundancy, where all participating leafs can forward traffic for that Ethernet segment simultaneously.

However, some use cases---like connecting to devices that do not support multipath forwarding or for strict active/standby redundancy---require single-active multi-homing. In single-active mode, only one leaf in the Ethernet segment forwards traffic at any time; the other leaf(s) act as standby and only take over if the active node fails. This behavior is explicitly controlled in the EVPN Ethernet-segment configuration.

On Cisco platforms for EVPN VXLAN fabrics, this is configured under the l2vpn evpn ethernet-segment stanza using the command:

l2vpn evpn ethernet-segment 1

identifier type 0 01.01.01.10.10.10.10.10.10.10

redundancy single-active

identifier type 0 ... defines the ESI for the multi-homed connection.

redundancy single-active specifies that only one leaf in that ESI is allowed to be active at a time, thus enabling dual-homing with single-active redundancy.

The other options do not relate to Ethernet-segment redundancy mode:

B . default-gateway advertise is used in EVPN anycast gateway configurations to advertise the default gateway MAC/IP, not for ESI redundancy.

C . replication-type static is associated with multicast or ingress replication behavior for VXLAN VTEPs, not Ethernet-segment redundancy.

D . vlan configuration 101 is a VLAN configuration context command and has no effect on EVPN ESI redundancy.

Cisco NSO-based orchestration principles in a multi-vendor environment require:

Service modeling using flexible, reusable YANG models

Abstraction of vendor-specific device differences

Transaction-safe configuration validation and execution

End-to-end automation across lifecycle stages (Day-0, Day-1, Day-N)

Scalability and adaptability for evolving requirements

Option C aligns perfectly with NSO service-modeling approaches:

Service models must be flexible, not rigid, enabling changes as technologies and needs evolve.

The architecture must support continuous refinement, enabling multi-vendor abstraction and lifecycle automation.

This ensures the network evolves seamlessly while remaining stable and automated.

Why the Other Options Are Incorrect

A -- Simplified monitoring and post-deployment adjustments do not meet the core need for full lifecycle service modeling and abstraction.

B -- Configuring devices individually contradicts the entire purpose of orchestration and abstraction.

D -- A static YANG model cannot accommodate multi-vendor environments or future scalability.

Thus, only Option C matches full NSO-capable service modeling requirements.