Cisco Updated 400-007 Exam Questions and Answers by wynter

End-to-end network visibility is often hindered by:

Siloed monitoring and logging systems

Vendor-specific platforms that don’t integrate

Inconsistent telemetry across domains (e.g., WAN, DC, Cloud)

Too many disparate solutions lead to data fragmentation, blind spots, and lack of unified analytics. This makes correlating threats and verifying policy enforcement complex. Overlapping controls (A) and manual processes (C) are operational concerns but don’t directly obstruct architectural visibility.

The CCDE blueprint emphasizes cross-domain visibility, consistent policy enforcement, and integration as central to a secure and scalable network design.

==========

C (Class-Based Weighted Fair Queuing - CBWFQ): CBWFQ allows assigning bandwidth limits (in this case, 2 Mbps) to specific traffic classes, effectively controlling scavenger traffic without dropping excess packets unnecessarily.

Other options explained:

A: Policing drops excess traffic immediately rather than queuing.

B: LLQ is for delay-sensitive traffic, not scavenger control.

D: Shaping is useful but typically applied at interface level, not specific traffic classes.

GLOP addressing is defined in RFC 2770. It assigns globally unique multicast addresses based on an organization's ASN by mapping the 16-bit ASN into the middle two octets of the 233.0.0.0/8 address space.

233.0.0.0/8 is specifically reserved for GLOP addressing.

The uniqueness of the address is derived from the assigned ASN.

Why other options are incorrect:

A: 232.0.0.0/8 is SSM address space.

C: 239.0.0.0/8 is for administratively scoped multicast.

D: 224.0.0.0/24 is reserved for local multicast (link-local scope).

—

B (Strong cryptography for cardholder data):PCI DSS requires strong cryptographic protocols (e.g. TLS 1.2 or higher) to protect sensitive data during processing and storage.

C (Strong encryption for transmission):Data-in-transit across public or untrusted networks must be encrypted using strong protocols to comply with PCI DSS.

Other options explained:

A/D/E: These are general security best practices but not directly tied to TLS upgrade compliance for cardholder data under PCI DSS.