300-420 Exam Dumps : Designing Cisco Enterprise Networks (ENSLD) v1.1

The correct BGP design is to attach the well-known No-Export community to the prefixes that should not be advertised beyond the service provider boundary. Cisco BGP communities are policy attributes that allow routes to carry instructions or classifications across BGP peers. The No-Export community tells a receiving BGP speaker not to advertise the route outside its confederation or autonomous system. That behavior is exactly what is needed when branch prefixes may be exchanged with the provider but must not be propagated to the public Internet. The No-Advertise community is stronger: it prevents the route from being advertised to any BGP peer, which may block reachability even where the provider still needs to know the route. NOPEER is used for route-server or peering policy control and is not the clean answer for excluding branch prefixes from Internet propagation. Setting a generic “Internet community” is not a standard solution by itself. The architect should also ensure that outbound prefix filters and provider-side community support are documented in the service agreement. Reference topics: BGP communities, No-Export, No-Advertise, provider edge filtering, Internet route policy.

PortFast is the correct functionality for the Gi1/0/1-10 interfaces when those ports are endpoint-facing access ports. Cisco spanning-tree design uses PortFast to allow edge ports to transition directly to the forwarding state, avoiding the normal listening and learning delay associated with traditional STP convergence. That improves user and endpoint connectivity after link-up events and is especially important for workstations, phones, printers, and access devices that should not participate in the Layer 2 topology. Root guard and BPDU guard are protection features, not the primary convergence optimization requested by the architect. UplinkFast was used in older STP designs to accelerate recovery for access switches with redundant uplinks, but it is not the edge-port functionality for interfaces Gi1/0/1-10. In a modern design, PortFast should be enabled only on true host-facing ports, normally together with BPDU guard to protect against accidental switch attachment. If the exhibit shows these interfaces as end-user access ports, PortFast is the feature that follows the recommendation to optimize STP convergence time. Reference topics: STP PortFast, edge-port convergence, BPDU guard, Layer 2 campus design.

Out-of-band Ethernet is the correct management design for a large data center when the customer wants device grouping, management-plane isolation, and reduced blast radius from compromise. In an out-of-band design, management traffic uses a physically or logically separate management network instead of traversing the production data plane. This allows different device classes to be placed into management zones, protected by access control, authentication, logging, and rate-limiting policies. If one managed device is compromised, the attacker should not automatically gain production network reachability through the management interface. In-band Ethernet would share the production infrastructure and therefore would not provide the same isolation. Dial-up out-of-band access can be useful for emergency console access, but it is not appropriate as the primary management architecture for a large data center. Out-of-band Ethernet provides scale, speed, and segmentation while still allowing centralized management systems to reach routers, switches, controllers, and appliances. Reference topics: out-of-band management, management-plane security, data-center operations, isolation, access control, DoS mitigation.