300-540 Dumps PDF New [2026] Ultimate Study Guide
300-540 Exam Dumps PDF Updated Dump from Pass4guide Guaranteed Success
NEW QUESTION # 66
What is Virtualized Architecture primarily used for in the context of IT infrastructure?
- A. Simplifying legal compliance
- B. Reducing the need for physical hardware
- C. Increasing physical hardware costs
- D. Decreasing system security
Answer: B
NEW QUESTION # 67 
Refer to the exhibit. An engineer is troubleshooting an issue where switch LEAF-SW-1 and switch LEAF- SW-2 receive corrupted forwarding and learning information about each other. LEAF-SW-1 and LEAF-SW-2 are configured with BGP EVPN VTEP. Which action resolves the issue?
- A. On LEAF-SW-1, run the host-reachability protocol bgp command against interface nve1.
- B. On each switch, run the delete suppress-arp command against interface nve1.
- C. On each switch, ensure the same BGP router ID is configured.
- D. On each switch, configure a different secondary IP address against interface loopback0.
Answer: A
Explanation:
In a VXLAN BGP EVPN fabric, each VTEP (NVE interface) must useBGP EVPN as the host-reachability protocolso that MAC/IP information and VTEP reachability are exchanged through the control plane.
From the exhibit:
* LEAF-SW-1 - interface nve1
* source-interface loopback0
* No host-reachability protocol bgp
* Host Learning Mode: Data-Plane in show nve interface
* LEAF-SW-2 - interface nve1
* source-interface loopback0
* host-reachability protocol bgp configured
This mismatch causes one VTEP to rely ondata-plane flood-and-learn, while the other usesEVPN BGP control-plane learning, leading to inconsistent and "corrupted" MAC/IP and ARP/ND information between the leaf switches.
The fix is to configure LEAF-SW-1 to also use BGP for host reachability:
interface nve1
host-reachability protocol bgp
Options B and D are incorrect because anycast VTEP designs intentionally share the sameprimaryloopback IP while usingdifferent secondary IPsandunique BGP router IDs. Option A (removing suppress-arp) does not correct the control-plane mismatch.
Therefore, enabling host-reachability protocol bgp on LEAF-SW-1 (OptionC) resolves the issue.
NEW QUESTION # 68
A key benefit of data plane high availability in VNF is:
- A. Lower operational costs
- B. Simplified network design
- C. Enhanced performance and reliability
- D. Increased network congestion
Answer: C
NEW QUESTION # 69
The use of Yang models in network configuration is to:
- A. Provide a standardized data modeling language
- B. Replace XML-based data models
- C. Simplify the parsing of binary data
- D. Increase the complexity of network scripts
Answer: A
NEW QUESTION # 70
An engineer must design a high-availability solution that provides path redundancy for IP by allowing redundant gateways to share MAC protocols and addresses. A group of Layer 3 routers must be allowed to share the default gateway on a LAN, load balance, and seamlessly take over the traffic transfer role if a router in the group fails. What must be used?
- A. Routed network core
- B. GLBP
- C. Load balancer
- D. BFD
Answer: B
Explanation:
Comprehensive and Detailed Explanation
In Cisco high-availability LAN gateway designs, the requirement is:
* Multiple L3 gateways sharing avirtual MAC and virtual IP
* Ability toload balanceacross multiple active gateways
* Capability toseamlessly take overgateway forwarding during a failure
Among Cisco First Hop Redundancy Protocols (FHRPs):
* HSRP# Active/standby only
* VRRP# Active/standby only
* GLBP (Gateway Load Balancing Protocol)#The only FHRP providing active/active load balancing GLBP allows multiple routers to share:
* Acommon virtual IP
* Multiplevirtual MAC addresses
* Multipleactive forwardersthat load-balance end hosts
* Automatic failover if any gateway fails
Thus, GLBP is the only correct protocol matching the requirement forredundant default gateways with load balancing and shared MAC addressing.
NEW QUESTION # 71
API security is crucial for protecting:
- A. Software interfaces
- B. Data storage units
- C. Network cables
- D. Physical devices only
Answer: A
NEW QUESTION # 72
Troubleshooting ACI involves understanding:
- A. Only the physical layer of the network
- B. The brand of hardware being used
- C. The application-centric policies and their impact on network behavior
- D. Basic routing protocols only
Answer: C
NEW QUESTION # 73 
Refer to the exhibit. An engineer must configure multihoming between router R1 and service provider SP-2.
Locally generated routes must be advertised to service provider SP-2. Which command must be run on R1 to complete the configuration?
- A. neighbor 10.0.0.0 route-map localonly out
- B. neighbor 10.12.10.1 route-map localonly out
- C. network 10.12.10.1 route-map as200only in
- D. network 10.0.0.0 route-map as200only out
Answer: B
Explanation:
On R1 (AS200), the requirement is:
* Advertiselocally generated routes(for example, 10.10.10.0/24 from AS200)
* Only towardSP-2, which peers on IP10.12.10.1
* Apply a policy (route-map) controlling what R1 advertises
In BGP, to controlwhich locally originated routesare sent to a specific neighbor, the correct configuration is:
neighbor <IP> route-map <map-name> out
This applies outbound policy filtering or permitting to the prefixes advertised.
Thus:
* The neighbor toward SP-2 is10.12.10.1
* The route-map must be appliedoutbound
* The command that accomplishes this is:
neighbor 10.12.10.1 route-map localonly out
Why the Other Options Are Incorrect
* A. network 10.0.0.0 route-map as200only outThe network command doesnotaccept route-map out.
This is invalid syntax.
* C. network 10.12.10.1 route-map as200only inIncorrect network, incorrect direction, and invalid syntax with in.
* D. neighbor 10.0.0.0 route-map localonly out10.0.0.0 is not a BGP neighbor; it's a network prefix.
NEW QUESTION # 74
SR-IOV is used in VNF optimization to:
- A. Provide direct virtual function access to improve performance
- B. Reduce network virtualization benefits
- C. Monitor physical network connections
- D. Encrypt data traffic
Answer: A
NEW QUESTION # 75
An engineer must create a new VPC and deploy several Amazon EC2 instances in AWS. Only SSH connections originating from IP address 20.20.20.20 must be allowed to reach the EC2 instances. What must be configured?
- A. Web application firewall
- B. Security group
- C. Resource group
- D. Access control list
Answer: B
Explanation:
Comprehensive and Detailed Explanation
AWSSecurity Groupsact as the primary stateful firewalls for EC2 instances.
To restrict SSH (TCP/22) to a single host (20.20.20.20/32), aSecurity Groupmust be configured with:
* Inbound rule: TCP 22
* Source: 20.20.20.20/32
ACLs operate at the subnet level but are not used for instance-specific SSH restrictions.
WAF controls HTTP/HTTPS traffic, not SSH.
Resource groups only organize cloud assets.
Thus,Bis the correct solution.
NEW QUESTION # 76 
Refer to the exhibit. An engineer must configure Cisco IOS SLB for DNS on router R1 to meet these requirements:
The first DNS request to www.ccnp.test
must be redirected to the DNS server at 10.1.1.1;
The second DNS request to www.ccnp.test
must be redirected to the DNS server at 10.2.1.1;
The third DNS request to www.ccnp.test
must be redirected to the DNS server at 10.3.1.1.
In each case, the other two addresses must also be attempted if the first one fails. The indicated configuration was applied to R1; however, the load balancing failed. Which command must be run on R1 to resolve the issue?
- A. ip domain retry 3
- B. maximum-paths 3
- C. ip dns server
- D. ip domain round-robin
Answer: D
Explanation:
On R1 the configuration (simplified) is:
ip domain lookup
ip domain name ccnp.test
ip host www.ccnp.test 10.1.1.1 10.2.1.1 10.3.1.1
The ip host command statically maps the hostname www.ccnp.test
to three IP addresses. By default, Cisco IOS will always return these IP addresses to DNS queries in the same order they are configured (10.1.1.1, then 10.2.1.1, then 10.3.1.1). This means that clients will always attempt
10.1.1.1 first and will not achieve per-query load balancing across all three servers.
To enable DNS-based load balancing so that each successive query rotates the order of the addresses, Cisco IOS provides the command:
ip domain round-robin
This command enables round-robin rotation of multiple A records associated with a single hostname defined by ip host. With this feature enabled:
1st query: response order 10.1.1.1, 10.2.1.1, 10.3.1.1
2nd query: response order 10.2.1.1, 10.3.1.1, 10.1.1.1
3rd query: response order 10.3.1.1, 10.1.1.1, 10.2.1.1
Clients will typically try the first IP address in the list and use the others if the first one fails, exactly matching the requirement.
Why other options are incorrect:
A). ip domain retry 3 controls how many times the router retries DNS queries to a server; it does not control the order of multiple A records.
C). ip dns server turns the router into a DNS server but does not itself provide round-robin behavior for statically defined hosts.
D). maximum-paths 3 is a routing (IP forwarding) parameter for equal-cost multipath, unrelated to DNS resolution.
NEW QUESTION # 77 
Refer to the exhibit. An engineer is troubleshooting an issue with switch LEAF-SW-11. The engineer observes that several main servers on the VXLAN BGP EVPN Multi-Site network experience 50-60% packet loss inbound and outbound, and all the DCI tracking interfaces are down. Which two actions must be taken to resolve the issue? (Choose two.)
- A. On the Nexus switch, run the ip access-list permit ip address 172.16.2.200 command.
- B. On LEAF-SW-11, run the inner ipv4 src_ip 172.16.2.200 command against module-1.
- C. On LEAF-SW-11, run the evpn multisite dci-tracking command against interface Eth1/1.
- D. On the Nexus switch, run the inner ipv4 dst_ip 172.16.2.200 command against module-1.
- E. On LEAF-SW-11, enable the multisite ingress-replication command for the L2VNI of VLAN 11.
Answer: C,E
Explanation:
In a VXLAN BGP EVPNMulti-Siteenvironment:
* DCI trackingmonitors the health of the DCI links. If all DCI-tracking interfaces go down, the leaf can incorrectly keep advertising or learning remote MAC/IP reachability, leading to packet loss and sub- optimal forwarding for servers in that VLAN/L2VNI.
* For proper operation, eachDCI-facing interfacemust be enabled with evpn multisite dci-tracking so that the Multi-Site border leaf tracks reachability over that link.
* When using EVPN Multi-Site, BUM (broadcast, unknown unicast, multicast) traffic toward remote sites is typically handled viaingress replication, not multicast groups, for each L2VNI participating in Multi-Site. The configuration snippet shows an L2VNI (vn-segment 16535) still mapped to mcast- group 239.1.1.0, which is inconsistent with Multi-Site recommendations and contributes to packet loss.
Therefore, to fix the problem:
* Enable DCI tracking on the uplink:
* interface Ethernet1/1
* evpn multisite dci-tracking
This restores proper DCI-link state monitoring for Multi-Site. #Option C
* Change the L2VNI behavior from multicast to Multi-Site ingress replication:
Under the VNI for VLAN 11, configure:
evpn
vni 16535 l2
multisite ingress-replication
or the equivalent command for the specific NX-OS release, thereby aligning the L2VNI with EVPN Multi- Site design and eliminating packet loss. #Option D Options A and B are ELAM (embedded logic analyzer) filters used only for packet capture and do not resolve the forwarding issue.
Option E is an ACL line unrelated to EVPN VXLAN or DCI tracking and does not address the underlying problem.
NEW QUESTION # 78
How does SR-IOV move data directly to and from the network adapter?
- A. Using the STP VLAN root
- B. Bypassing the guest operating system
- C. Using the STP PortFast
- D. Bypassing the hypervisor
Answer: D
Explanation:
Comprehensive and Detailed Explanation (Cisco NFVI / Virtualization Knowledge) SR-IOV (Single Root I/O Virtualization)allows a VM to access the network interface hardwaredirectly, without going through the hypervisor's virtual switch.
This is achieved by:
* Assigning Virtual Functions (VFs) directly to VMs
* Allowing high-performance, low-latency packet I/O
* Bypassing the hypervisor datapath
Therefore, SR-IOV doesnotbypass the guest OS; it bypasses thehypervisor I/O virtualization layer, delivering near-native performance.
Thus the correct answer isC.
NEW QUESTION # 79
Software-accelerated virtual switches like DPDK and VPP enhance VNF performance by:
- A. Reducing the need for high availability
- B. Increasing network latency
- C. Improving packet processing speed
- D. Lowering network throughput
Answer: C
NEW QUESTION # 80
Cloud agents are deployed for:
- A. Reducing data storage needs
- B. Manual network configuration
- C. Physical security
- D. Automated network and performance monitoring
Answer: D
NEW QUESTION # 81
Onboarding VNF refers to:
- A. The initial setup and integration of VNFs into a network
- B. Updating VNFs to the latest version
- C. Removing VNFs from the network
- D. Monitoring VNF performance
Answer: A
NEW QUESTION # 82
High availability design models often include:
- A. Decreased focus on redundancy
- B. Only physical redundancy
- C. DNS, routing, and load balancers
- D. Single points of failure
Answer: C
NEW QUESTION # 83
SR-PM is related to:
- A. Security risk performance management
- B. Storage replication performance management
- C. Segment routing performance monitoring
- D. Software redundancy performance metrics
Answer: C
NEW QUESTION # 84
SNMP traps are utilized for which of the following purposes?
- A. Encrypting data packets
- B. Virtualizing network functions
- C. Sending unsolicited alerts from network devices to a management station
- D. Monitoring network performance in real-time
Answer: C
NEW QUESTION # 85
Which of the following are benefits of using streaming telemetry for network assurance? (Select two)
- A. Improved scalability and flexibility
- B. Increased network latency
- C. Reduced monitoring capabilities
- D. Real-time data collection
Answer: A,D
NEW QUESTION # 86
RTBH is effective in mitigating what kind of traffic?
- A. Outgoing traffic
- B. Legitimate traffic
- C. Malicious traffic
- D. Incoming legitimate requests
Answer: C
NEW QUESTION # 87
NFVI errors and events diagnosis is crucial for:
- A. Manual network configurations
- B. Ensuring high network availability and reliability
- C. Reducing the efficiency of the network
- D. Increasing network costs
Answer: B
NEW QUESTION # 88
Which of the following techniques is used for DoS mitigation?
- A. Disabling security protocols
- B. Decreasing redundancy
- C. Reducing network segmentation
- D. Blackhole routing
Answer: D
NEW QUESTION # 89
Connectivity options to other carrier-neutral facilities enhance:
- A. Network redundancy and resilience
- B. Complexity of network management
- C. The need for physical infrastructure
- D. Vendor lock-in
Answer: A
NEW QUESTION # 90
An engineer must implement a SaaS solution that will use a Cisco ASAv to enhance security for enterprise customers by using Cisco Crosswork NSO. Which command must be run in NSO?
- A. ncs -status
- B. ncs
- C. ncs-setup
- D. ls -l nso-instance/packages/
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Cisco NSO Orchestration Knowledge In Cisco NSO deployments:
* ncs-setupis only used once, during initial NSO instance creation.
* ls -l nso-instance/packages/simply lists packages - not used to start NSO.
* ncs -statuschecks status but doesnotrun NSO.
To actuallystart the NSO serviceso that device packages (including ASAv service packages) can be loaded and orchestration can begin, the correct command is:
ncs
This launches the NSO runtime and loads all configured packages, enabling the SaaS ASAv service.
NEW QUESTION # 91
......
Pass Your Cisco Exam with 300-540 Exam Dumps: https://www.pass4guide.com/300-540-exam-guide-torrent.html
300-540 Exam Dumps - Cisco Practice Test Questions: https://drive.google.com/open?id=1iIWGz0vocCGRbIkHRlifrTpPLTkqdQWj