Destination-based Remote Triggered Black Hole (RTBH) routing is a DDoS mitigation technique where traffic to a victim’s IP address is intentionally routed to a special next hop (usually Null0) so that the traffic is dropped as close to the source as possible.

On the edge router (R1 in the figure), this is accomplished by installing /32 static routes for the victim endpoints, pointing to the null interface. When these routes are installed (often triggered via BGP in larger deployments), any traffic destined to those exact IP addresses is discarded.

In the topology:

Web server IP: 10.20.10.2

Mail server IP: 10.30.10.2

To perform destination-based RTBH at R1, we must configure static /32 routes to Null0 for each victim IP:

ip route 10.20.10.2 255.255.255.255 Null0

ip route 10.30.10.2 255.255.255.255 Null0

These correspond to:

Option C for the web server (10.20.10.2)

Option A for the mail server (10.30.10.2)

The other options are incorrect for RTBH:

B and D remove /24 routes via 10.10.10.2; they do not implement black-holing and would break normal routing rather than selectively drop attack traffic.

E black-holes 10.20.10.1, which is the default gateway on R2, not the victim server; that would impact overall connectivity instead of just dropping traffic to the attacked host.

In a VXLAN BGP EVPN Multi-Site environment:

DCI tracking monitors the health of the DCI links. If all DCI-tracking interfaces go down, the leaf can incorrectly keep advertising or learning remote MAC/IP reachability, leading to packet loss and sub-optimal forwarding for servers in that VLAN/L2VNI.

For proper operation, each DCI-facing interface must be enabled with evpn multisite dci-tracking so that the Multi-Site border leaf tracks reachability over that link.

When using EVPN Multi-Site, BUM (broadcast, unknown unicast, multicast) traffic toward remote sites is typically handled via ingress replication , not multicast groups, for each L2VNI participating in Multi-Site. The configuration snippet shows an L2VNI (vn-segment 16535) still mapped to mcast-group 239.1.1.0, which is inconsistent with Multi-Site recommendations and contributes to packet loss.

Therefore, to fix the problem:

Enable DCI tracking on the uplink:

interface Ethernet1/1

evpn multisite dci-tracking

This restores proper DCI-link state monitoring for Multi-Site. → Option C

Change the L2VNI behavior from multicast to Multi-Site ingress replication:

Under the VNI for VLAN 11, configure:

evpn

vni 16535 l2

multisite ingress-replication

or the equivalent command for the specific NX-OS release, thereby aligning the L2VNI with EVPN Multi-Site design and eliminating packet loss. → Option D

Options A and B are ELAM (embedded logic analyzer) filters used only for packet capture and do not resolve the forwarding issue.

Option E is an ACL line unrelated to EVPN VXLAN or DCI tracking and does not address the underlying problem.

The requirements in the scenario match the capabilities of Segment Routing (SR-MPLS) combined with MPLS Performance Measurement (MPM) :

1. Low-latency slice creation

Segment Routing allows deterministic paths using:

SR-TE (Traffic Engineering)

Colored or intent-based policies

Path selection based on link latency, loss, bandwidth, or utilization

MPLS Performance Measurement supplies real-time data such as:

One-way delay

Round-trip delay

Loss metrics This allows SR-TE to compute paths with minimum latency .

2. Secure slice with minimized transport cost

Segment Routing supports:

Slicing through SR Policies

Steering encrypted traffic (IPsec/GETVPN) through specific SR tunnels

Traffic separation without requiring additional MPLS LSP state in the core

Optimizing transport cost via constraint-based TE computations

3. Transport SLA enforcement beyond best effort

SR-TE + MPM provides:

SLA-aware intent routing

Guaranteed performance paths

Automatic re-optimization if links violate latency or loss SLAs

Why the other options are incorrect

B. IPsec VPN Provides encryption but does not offer latency-aware or SLA-based path selection . Not a slicing mechanism.

C. AWS Direct Connect Cloud connectivity service. Not related to MPLS performance monitoring or transport slicing.

D. Transit VPC for AWS Used for SD-WAN cloud integration. Does not support SR-TE slicing or MPLS SLAs.

Therefore, only Segment Routing provides latency-based path computation, slicing, SLA guarantees, and cost optimization.

NETCONF rules state:

A user cannot terminate their own active session .

Attempting to kill the same session returns invalid-value error.

The session continues running normally.

Thus:

No logout

No termination

No configuration impact

Therefore, A is correct.

Comprehensive and Detailed Explanation

AWS Security Groups act as the primary stateful firewalls for EC2 instances.

To restrict SSH (TCP/22) to a single host (20.20.20.20/32), a Security Group must be configured with:

Inbound rule: TCP 22

Source: 20.20.20.20/32

ACLs operate at the subnet level but are not used for instance-specific SSH restrictions.

WAF controls HTTP/HTTPS traffic, not SSH.

Resource groups only organize cloud assets.

Thus, B is the correct solution.

Comprehensive and Detailed Explanation

Infrastructure as Code (IaC) requires:

Declarative configuration

Automation

API-driven workflows

Multi-cloud capability

Integration with orchestration and provisioning tools

Terraform is a widely adopted IaC platform supporting:

Cloud automation (AWS, Azure, GCP, private clouds)

Cisco infrastructure provisioning (Nexus, ACI, IOS-XR, NSO, SD-WAN, etc.)

REST APIs and providers for programmability

Cisco provides official Terraform providers for multiple platforms, enabling full IaC operations. This aligns exactly with SP cloud automation design principles.

Other options:

Cloud-based sandboxes → For testing, not IaC automation

ThousandEyes → Monitoring and performance analytics

AppDynamics → Application performance management

Comprehensive and Detailed Explanation

Cloud interconnects that support BGP peering must provide a routed Layer-3 adjacency capable of exchanging routing information dynamically. In major cloud architectures:

AWS Direct Connect supports private virtual interfaces (VIFs) where BGP is used between the customer router and AWS to exchange routes.

Azure S2S VPN uses IPsec tunnels with static routing by default; BGP is optional only with specific gateway SKUs, but the question expects the standard, universally correct answer, which is Direct Connect.

Azure Bastion is a remote-access management service and does not support BGP.

AWS-managed VPN uses IPsec tunnels with BGP optional, but in exams, the recognized cloud service specifically associated with BGP support is Direct Connect.

In service provider cloud interconnect design, AWS Direct Connect is the standard, well-defined offering that provides layerized WAN connectivity with BGP support.

Comprehensive and Detailed Explanation From Cisco Cloud Architecture Knowledge

Event-driven applications require:

Stateless, micro-sized execution units

Automatic scaling

Code that runs only when triggered

No server or VM lifecycle management

This model is known as Function-as-a-Service (FaaS) .

Cisco FaaS provides:

Serverless execution

Event-driven triggers

Deployment of atomic micro-functions

Automatic scaling and resource abstraction

Ideal environment for microservices and cloud-native workloads

Why the others are incorrect:

A. Cisco+ Hybrid Cloud for VDI → delivers desktops, not serverless compute

C. Cisco+ Hybrid Cloud Virtualization → VM-based infrastructure, not event-driven micro-functions

D. Cisco Intersight → operational management tool, not a serverless execution platform