400-007 Exam Dumps - Cisco Certified Design Expert (CCDE v3.1)

B (IP Source Guard):IP Source Guard prevents IP address spoofing at Layer 2 by binding IP-to-MAC addresses and filtering unauthorized source IPs. It operates independently of encryption, so it has no impact on encryption performance.

Other options explained:

A: MACsec adds encryption and has performance implications.

C: DHCP snooping with DAI focuses on ARP spoofing, not IP address antispoofing specifically.

D: IPsec handles encryption, which directly impacts performance.

Virtual Private LAN Service (VPLS) provides Layer 2 VPN connectivity over MPLS. Each Provider Edge (PE) device must learn and maintain MAC addresses per virtual instance.

PE Scalability is the primary concern: With 2000 VLANs, each PE participating in those instances must maintain a large forwarding table and handle associated control-plane activity.

MAC learning and aging, along with full-mesh label-switched paths (LSPs), place a heavy burden on CPU and memory.

Flooding (A) is expected but not the primary concern; it’s a symptom of scale.

The underlying transport (C) and VLAN ID limits (D) are important but not as critical in the context of PE resource scalability.

==========

A (VXLAN offers native loop avoidance): VXLAN uses Layer 3 underlay with encapsulation, inherently avoiding Layer 2 loops common in traditional Layer 2 fabrics.

Why other options are incorrect:

B: Storm control mitigates broadcast storms but doesn ' t prevent loops.

C: vPC+ helps but doesn’t replace VXLAN ' s loop-free architecture.

D: BPDU Guard helps protect edge ports, but loop prevention in VXLAN is primarily handled by its Layer 3 foundation.

A (BGP PIC — Prefix Independent Convergence) enables BGP to rapidly converge during link or node failures by pre-installing backup forwarding paths in the FIB.

BGP PIC minimizes traffic loss during failover, improving resiliency in both edge and core environments, and is a key recommendation for scalable and high-availability BGP design in CCDE v3.1.

Why other options are incorrect:

B: BGP-EVPN is used for L2VPN services, not for fast convergence.

C: BGP FlowSpec is used for DDoS mitigation and traffic filtering.

D: BGP-LS (Link-State) provides topology distribution for controllers, not convergence.

VPLS (Virtual Private LAN Service) is a Layer 2 VPN technology that simulates a LAN across an MPLS or IP core. VPLS uses a flood-and-learn mechanism where unknown unicast, broadcast, and multicast traffic is flooded to build the forwarding database dynamically — much like a traditional LAN switch.

This flood-and-learn behavior leads to MAC learning based on incoming traffic, not control-plane advertisement.

VPLS may require extra control-plane scaling mechanisms in large-scale deployments due to this learning behavior.

Other options explained:

A (LISP): Uses mapping servers and control plane for EID-to-RLOC mapping, not flood-and-learn.

B (OTV): Uses control-plane MAC address learning instead of data-plane flooding.

D (EVPN): Uses BGP control-plane learning for MAC and IP address distribution.

—