300-420 Exam Dumps : Designing Cisco Enterprise Networks (ENSLD) v1.1

A scalable two-level IS-IS design uses Level 1 areas for internal campus routing and Level 2 for the interarea backbone. Each campus should have a unique IS-IS NET area value so the internal routers belong to that campus’s Level 1 area. Internal campus routers should be configured as Level 1 routers, which keeps detailed campus prefixes inside the local area and prevents unnecessary propagation of more-specific routes to other campuses. At the edge of each campus, routers that connect the campus to the backbone should operate as Level 1/Level 2 routers. These routers connect the local Level 1 area to the Level 2 backbone and can summarize or control routing information between levels. IS-IS does not use BDR routers; that is an OSPF term, so option A is invalid. Assigning the same NET value everywhere collapses the hierarchy and defeats the segregation goal. MTU differences are not a hierarchy or route-segmentation tool. Therefore, the design should use unique NET values per campus with Level 1 internal routers and Level 1/Level 2 routers at the campus edge.

Cisco traffic policing evaluates packets against a configured traffic contract and classifies them into action states such as conforming, exceeding, and violating. The policy then applies configured actions to those states, such as transmit, drop, or remark. In a two-rate or three-color policing design, conforming traffic is within the committed rate, exceeding traffic is above the committed rate but may still be within an excess burst allowance, and violating traffic is outside the permitted profile. Therefore, conforming and violating are valid policing parameters or state/action categories in the context of the question. Shaping is not a policing parameter; it is a different QoS mechanism that buffers excess traffic and sends it later. Marking can be an action applied by policing, but the listed policing state that directly corresponds to Cisco class-based policing syntax is conform or violate. Bursting is related to token bucket sizing, but the answer choices specifically align to policing state categories. The correct pair is violating and conforming.

Secure segmentation is the Cisco SD-WAN Secure Direct Cloud Access function that separates user traffic into different zones and VPNs or VRFs. In Cisco SD-WAN, VPNs provide logical segmentation that is comparable to VRF separation in traditional routing. Secure Direct Cloud Access extends this segmentation model when users access internet and cloud applications directly from the branch. The design can keep corporate, guest, payment, voice, IoT, and other traffic classes isolated, with policy and security controls applied per segment or zone. Centralized data policy controls forwarding behavior, but the feature that divides traffic into separate zones and VPN or VRF contexts is secure segmentation. Perimeter control and application-aware routing are useful security and performance functions, but they do not describe the core segmentation mechanism. Segmentation is a fundamental SD-WAN design requirement because direct cloud access must not collapse trust boundaries simply because traffic no longer hairpins through a central data center. Reference topics: Cisco SD-WAN secure segmentation, VPNs, VRFs, direct cloud access, zone-based policy.