Cisco Updated 400-007 Exam Questions and Answers by arjan

D: Traditional three-tier architectures (access, distribution, and core layers) require that east-west traffic (between servers or pods in different access layers) traverse up to the distribution or core and then back down—introducing unnecessary hops and latency. This is a key design limitation addressed by spine-leaf and fabric architectures.

Other options:

A: Bandwidth may be sufficient but not optimally utilized due to suboptimal pathing.

B: Security is not inherently compromised by architecture, although microsegmentation is harder.

C: Three-tier architectures can scale, but less efficiently and not without trade-offs like latency and complexity.

==========

To split an Ethernet domain and ensure isolation of configuration and topology changes, the key mechanism is separating the VLAN management domains. This is achieved through:

VTP (VLAN Trunking Protocol) domain separation

Each VTP domain controls its own set of VLAN information and will not propagate VLAN changes across domain boundaries. By assigning unique VTP domain names to each half of the network, administrators prevent unintended synchronization of VLANs between switches.

Other options:

B. VTP password: Adds security but does not separate domains.

C. STP type: All switches in the domain can run the same or different STP versions and still be part of the same Ethernet domain.

D. VLAN ID: These can overlap across domains; uniqueness is not required to split domains.

==========

Unicast Reverse Path Forwarding (uRPF)is a security feature that helps mitigate IP spoofing attacks. It checks whether the source of a packet received on an interface matches the best return path to that source in the routing table.

Strict Mode (C):Ensures the source IP address of a packet is reachable via the same interface on which the packet was received. This prevents forged source IP addresses from traversing the network, which is essential in defending against outbound DDoS attacks sourced from infected hosts.

Loose Mode (B):Only verifies that the source IP exists in the routing table (less strict), which might still allow spoofing in multi-homed or asymmetric environments.

uRPF strict mode is the best fit in secure environments with symmetric routing—commonly in enterprise edge or distribution layers.

==========