InBidirectional PIM, redundancy for Rendezvous Points (RPs) is provided through thePhantom RPmechanism. This setup offers HA by:

A. Using two phantom RP addresses: You configure two RPs with the same virtual RP address but advertise them with loopback interfaces having different subnet masks. These phantom RPs allow seamless failover between active and standby RPsdatatracker.ietf.org+14arubanetworking.hpe.com+14examtopics.com+14ciscolive.com+3examtopics.com+3ccie-sp.gitbook.io+3learnwithsalman.com+4lostintransit.se+4learningnetwork.cisco.com+4.

F. Controlling routing through a longest match prefix: The active RP is chosen based on unicast routing — the loopback with the longest prefix match to the RP address is preferred. If that RP fails, the IGP converges and the standby with the next-longest prefix becomes activearubanetworking.hpe.com.

This combined mechanism aligns with CCDE v3.1 design principles by ensuring multicast HA with minimal complexity — no MSDP involvement and leveraging existing IGP behaviors.

Why other options are incorrect:

B and D: Changing administrative distance or protocol advertisement doesn ' t inherently establish redundancy in Bidir-PIM RP selection.

C: Static mroutes are static and don’t support dynamic redundancy or failover.

E: Anycast RP with MSDP is not supported or needed in Bidir-PIM environments.

This design ensures robust, seamless RP redundancy using phantom RPs with longest-prefix selection logic, remaining cost-effective and operationally concise.

https://community.cisco.com/t5/networking-knowledge-base/rp-redundancy-with-pim-bidir-phantom-rp/ta-p/3117191

B (IPFIX telemetry data):IPFIX provides detailed flow-level visibility, enabling identification of traffic patterns, data flows, and destinations. This data is critical for understanding current traffic behavior to identify governance gaps and improve policy compliance.

Other options explained:

A: Secure tunnels protect traffic but do not identify governance gaps.

C: Firewalls provide limited flow visibility compared to telemetry.

D: Workload policies enforce security but do not aid initial visibility analysis.

B (Strategic planning): Long-term business-aligned decisions that shape future infrastructure needs.

D (Tactical planning): Short-to-mid-term activities that adjust design based on evolving operational realities, constraints, and priorities.

Why other options are incorrect:

A and E: While cost and business optimization are goals, they are not defined planning approaches.

C: Modular is a design methodology, not a planning approach.

—

B (IP Source Guard):IP Source Guard prevents IP address spoofing at Layer 2 by binding IP-to-MAC addresses and filtering unauthorized source IPs. It operates independently of encryption, so it has no impact on encryption performance.

Other options explained:

A: MACsec adds encryption and has performance implications.

C: DHCP snooping with DAI focuses on ARP spoofing, not IP address antispoofing specifically.

D: IPsec handles encryption, which directly impacts performance.

???? Explanation:

B: To prefer ISP 1 for outbound traffic, advertise a longer AS path to ISP 2 (so it ' s used as backup). To prefer ISP 1 for inbound traffic, you want ISP 2 to receive a higher MED, making it less preferred. These changes signal to both ISPs and remote ASes to prioritize the ISP 1 path.

Other options:

A: Local preference is set inbound by your own routers, not outbound to ISPs.

C: Local preference affects only your own AS, and more specific routes are better advertised on primary links, not secondary.

D: Advertising less specific routes does not help establish control over preference cleanly.

==========

???? QUESTION NO: 387 [Security, Automation, and Policy Integration in Design]

Which three components support enforcing security policy compliance for devices attempting network access? (Choose three)

A. Posture agent

B. Audit and decision point servers

C. Management and reporting tools

D. Endpoint security application

E. Network access devices

F. Web filtering devices

Answer: A, B, E

???? Explanation:

A: Posture agents assess the health of endpoints (e.g., antivirus status, OS patching).

B: Decision servers (e.g., Cisco ISE) enforce access decisions based on posture and policies.

E: Network access devices (e.g., switches, WLCs, routers) apply access controls based on server instructions (802.1X, NAC).

Other options:

C: Management tools are for visibility—not enforcement.

D: While useful, endpoint AV/firewalls act independently—not part of policy enforcement infrastructure.

F: Web filters do not participate in initial access decisions.

==========

???? QUESTION NO: 388 [Security, Automation, and Policy Integration in Design]

When are Network Behavior Anomaly Detection (NBAD) systems better than signature-based systems? (Choose two)

A. Malware detection

B. Encrypted threat traffic

C. Spyware detection

D. Intrusion threat detection

E. New zero-day attacks

Answer: B, E

???? Explanation:

B: Signature-based systems cannot inspect encrypted payloads effectively, whereas NBAD relies on traffic behavior.

E: NBAD identifies deviations from known good behavior, allowing detection of previously unknown (zero-day) threats.

Incorrect Options:

A, C, D: These are often more accurately detected using signature-based approaches where known

???? QUESTION NO: 389

[Main Topic: Security, Automation, and Policy Integration in Design]

A company is adopting IPv6 in a dual-stack campus network. The first IPv6-only application is now hosted in the data center. To prevent a malicious user from masquerading as the IPv6 default gateway, which two mechanisms should be used? (Choose two)

A. IPv6 RA guard

B. IPv6 snooping

C. IPv6 device tracking

D. IPv6 address glean

E. port ACLs

Answer: A, E

???? Comprehensive and Detailed Explanation (CCDE v3.1 aligned):

A. IPv6 RA Guard:This feature helps mitigate rogue router advertisements (RAs), which attackers can use to spoof the default gateway in an IPv6 environment. RA Guard drops unauthorized or unexpected RAs at the access layer switch ports, preventing malicious devices from advertising themselves as routers.

E. Port ACLs (PACLs):Port-based ACLs can restrict which devices are allowed to send or receive RA packets on switch ports. By tightly controlling which sources can send traffic (including RA messages), port ACLs help prevent spoofing attempts.

Other Options:

❌ B. IPv6 Snooping:Not a standard or widely supported security feature; it is sometimes used synonymously with device tracking but is not a direct mitigation for spoofed RAs.

❌ C. IPv6 Device Tracking:Useful for monitoring IP-to-MAC bindings, but it does not prevent spoofing or gateway impersonation.

❌ D. IPv6 Address Glean:Primarily used for learning IPv6 addresses from traffic for things like DHCPv6 relay; not a security feature.

CCDE Blueprint Alignment:

Topic: Security, automation, and policy integration in design

Subdomain: IPv6 security, access control, rogue device prevention.

Let me know if you ' d like the next question explained!

C (Complex and distributed management flow):SDN centralizes control-plane management, simplifying complex, distributed configuration and operational models, which is especially valuable in large-scale, dynamic cloud environments.

Other options explained:

A: SDN may assist, but intelligent monitoring is a separate operational task.

B: SDN does not directly address resource growth—it supports scalability but doesn’t limit application resource demands.

D: SDN may reduce OpEx, but the primary benefit is operational simplification rather than direct cost reduction.

==========

Comprehensive and Detailed Explanation:

B: The IPsec anti-replay mechanism protects against packet injection and replay attacks by rejecting packets outside the anti-replay window. Increasing the anti-replay window (e.g., to 4096) allows legitimate packets with slightly reordered or delayed sequence numbers to be accepted—especially critical during bursts or with asymmetric paths.

Other options:

A: QoS marking does not prevent replay.

C: Tunnel keyword restrictions don ' t address replay attacks.

D: Shaping affects traffic rate, not sequence validation.

B (R1 adjusts to R2’s Required Min RX):In BFD, each side advertises itsDesired Min TX IntervalandRequired Min RX Interval. Each device adjusts its transmission interval to match the remote side’s ability to receive packets (Required Min RX). So R1 reduces its transmission rate to 100 ms to match R2 ' s platform limitations.

Other options explained:

A: R2 does not adjust to R1’s Desired Min TX; it’s the sender who adapts.

C: BFD quickly converges after initial negotiation.

D: P-bit and F-bit are not involved in this specific interval negotiation.

Port Numbers

✅ It does not consume many resources.

✅ It does not implement the application-layer payload, so it does not compromise the users ' privacy.

Deep Packet Inspection

✅ Signatures must be kept up to date because the applications change very frequently.

✅ Encryption makes this method impossible in many cases.

Statistical Classification

✅ It very often uses machine learning algorithms.

✅ It can detect the class of yet unknown applications.