Important Cisco 300-540 SPCNI Exam Questions

Answer: A

Explanation:

Comprehensive and Detailed Explanation

A Web Application Firewall (WAF) protects HTTP/HTTPS applications against:

DDoS attacks (layer 7)

Bot traffic

Request floods

SQL injection, XSS, OWASP Top 10 threats

Other options:

Device Authorization Control device authentication, not DDoS

NAC endpoint authorization, not DDoS

WPA Wi-Fi protection, irrelevant to web servers

Thus, the correct protection mechanism for web servers is A. Web Application Firewall.

Answer:

Explanation:

Comprehensive and Detailed Explanation From Exact Extract from my knowledge of Designing and Implementing Cisco Service Provider Cloud Network Infrastructure Outlines without Any External URL or Links: Container orchestration is the automated management of container lifecycle tasks such as deployment, scaling, failover, and updates. In Cisco cloud and NFV design guidance, typical orchestration platforms include Docker (with Swarm) and Kubernetes, which integrate with Cisco networking and security for cloud-native workloads.

Docker provides the container runtime and can also perform basic orchestration through Docker Swarm mode, managing multi-container, multi-host deployments.

Kubernetes is a full-featured orchestration system that automates deployment, scaling, and operations of application containers across clusters. It is the de-facto standard used with Cisco Container Platform and other Cisco cloud solutions.

VMware vCenter, Cisco vManage, and Cisco vSmart focus on virtual machines or SD-WAN control, not container orchestration. Therefore, the correct tools are Docker and Kubernetes (A, D).

Answer: A

Explanation:

The requirements in the scenario match the capabilities of Segment Routing (SR-MPLS) combined with MPLS Performance Measurement (MPM):

1. Low-latency slice creation

Segment Routing allows deterministic paths using:

SR-TE (Traffic Engineering)

Colored or intent-based policies

Path selection based on link latency, loss, bandwidth, or utilization

MPLS Performance Measurement supplies real-time data such as:

One-way delay

Round-trip delay

Loss metrics

This allows SR-TE to compute paths with minimum latency.

2. Secure slice with minimized transport cost

Segment Routing supports:

Slicing through SR Policies

Steering encrypted traffic (IPsec/GETVPN) through specific SR tunnels

Traffic separation without requiring additional MPLS LSP state in the core

Optimizing transport cost via constraint-based TE computations

3. Transport SLA enforcement beyond best effort

SR-TE + MPM provides:

SLA-aware intent routing

Guaranteed performance paths

Automatic re-optimization if links violate latency or loss SLAs

Why the other options are incorrect

B . IPsec VPN

Provides encryption but does not offer latency-aware or SLA-based path selection. Not a slicing mechanism.

C . AWS Direct Connect

Cloud connectivity service. Not related to MPLS performance monitoring or transport slicing.

D . Transit VPC for AWS

Used for SD-WAN cloud integration. Does not support SR-TE slicing or MPLS SLAs.

Therefore, only Segment Routing provides latency-based path computation, slicing, SLA guarantees, and cost optimization.

Answer:

Explanation:

In Cisco Overlay Transport Virtualization (OTV), the join interface is the Layer 3 interface that connects the edge device to the transport network (the routed core / WAN) where multicast groups (control, data, broadcast) are reachable.

From the topology:

Interface g1/0 on Switch_A is connected to the routed 20.20.20.0/30 link toward Switch_C (the transport / WAN).

Interface g1/1 is a trunk toward Switch_B and carries extended VLANs (101, 111), so it belongs to the internal site-facing side, not the transport.

In the show otv output, the join interface is incorrectly configured as g1/1 (20.20.20.2), which is an internal trunk and not the correct routed interface to the OTV transport network. Because the join interface does not face the multicast-enabled transport, OTV cannot establish adjacency and the VPN state remains DOWN.

Correct configuration should use:

otv join-interface GigabitEthernet1/0

Options A and C about group addresses are not the issue; addresses shown (224.x for control/broadcast and 232.x for data group range) are valid multicast ranges. Option D (e1/1) is also an internal access/trunk interface and not the WAN transport interface.

Answer: B

Explanation:

In Cisco Catalyst SD-WAN cloud integration, when the requirement is:

Automatically discovering AWS VPCs

Automatically identifying AWS services

Allowing the user to choose which private SD-WAN network connects to the cloud

Using AWS credentials (Access Key / Secret Key) for automatic provisioning

...the Cisco-supported mechanism is the Cisco SD-WAN Transit VPC solution.

Why Transit VPC is the correct answer:

It is specifically designed to integrate Cisco SD-WAN with AWS environments.

Uses AWS APIs and user credentials to automatically discover:

VPC IDs

Subnets

Regions

Routing tables

Automatically deploys and configures CSR1000v or Catalyst 8000V routers into the VPC.

Provides a centralized ''hub'' in AWS to interconnect multiple SD-WAN sites.

Enables the user to choose which SD-WAN segments connect to which VPCs.

This matches the requirement of automatic cloud resource identification based on user credentials.

Why the other options are incorrect

A . AWS Direct Connect

This is a physical/private Layer 2 cloud connection.

It does not auto-discover VPCs or integrate through credentials.

It does not provide automated SD-WAN service provisioning.

C . IPsec VPN

Works for connectivity but is manual, not automated.

Does not identify AWS cloud resources via credentials.

D . Segment routing

A transport technology used inside SP networks, irrelevant to AWS API-based VPC discovery.

Thus, only Transit VPC provides automatic AWS cloud discovery and integration with SD-WAN.