400-007 Exam Dumps - Cisco Certified Design Expert (CCDE v3.1)

Ingress filtering (also known as uRPF or source address verification) prevents packets with spoofed source addresses from entering the network. By validating that incoming packets have legitimate source addresses (based on routing tables or prefix lists), ingress filtering directly blocks many spoofed DDoS attacks, which often rely on forged source IP addresses.

This principle is foundational in network security design per CCDE v3.1:

Stops source-spoofed attacks before they enter.

Protects critical infrastructure from volumetric and reflection/amplification attacks.

Forms part of secure edge design best practices.

Why other options are incorrect:

A: DSCP remarking relates to traffic classification, not spoof prevention.

C: Bogon classification isn ' t the main function of ingress filtering.

D: RFC 1918 filtering is a special policy but not the core function of ingress filtering.

—

A (Route Reflector design): Using R5 as a route reflector reduces the IBGP full-mesh requirement while maintaining route visibility between R1, R2 (edge) and R3, R4 (ABRs).

Internet routes can be redistributed into OSPF at the edge routers (R1, R2), allowing internal reachability while avoiding redistribution complexity on every router.

Why other options are incorrect:

B: Sub-AS designs (confederations) add unnecessary complexity for this scenario.

C: Full mesh IBGP is not scalable with increasing n odes.

D: Not using a route reflector would force full mesh IBGP.

B (EAP - Extensible Authentication Protocol):EAP is commonly used for 802.1X port-based authentication, allowing identity-based control for users on the network. This enables policy enforcement, identity-based segmentation (micro/macro segmentation), and leverages existing domain credentials via backend integration.

Other options explained:

A: LDAP is backend directory, not an authentication protocol for access ports.

C: TACACS+ is used primarily for administrative access.

D: RADIUS transports the EAP exchange but is not the authentication protocol itself.

D (SAML2.0):SAML2.0 is widely used for federated identity management in enterprise environments, supporting Single Sign-On (SSO) across multiple applications and domains.

Other options explained:

A: OAuth2 is primarily for authorization, not identity federation.

B: OpenID Connect extends OAuth2 for authentication but is more common for consumer web apps than enterprise SSO.

C: OpenID is older and largely replaced by OpenID Connect.

B (Separate priority queues): Both VoIP and the custom stock-trading application require low latency and jitter guarantees but serve different business functions. Best practice is to place them in separate priority queues to prevent one application ' s bursts from affecting the other, ensuring deterministic service levels for both mission-critical services.

Other options explained:

A: Sharing queues may lead to competition between traffic types, risking SLA violations.

C/D: CBWFQ is not sufficient for true low-latency guarantees; priority queuing is required.

—

A (Financial and governance models): In the Define Strategy step, it ' s crucial to establish financial frameworks and governance structures that will guide the use of cloud services. This includes determining budgeting approaches (CapEx vs. OpEx), compliance, policy enforcement, risk management, and ownership of IT resources.

Governance models also define roles, responsibilities, and accountability for managing cloud services across the organization.

Other options explained:

B: Business alignment is important but comes after strategic governance and financial planning.

C: Due diligence is typically performed during vendor selection or migration readiness.

D: Contingency planning is part of exit or risk management phases, not the initial strategy step.

—