300-420 Exam Dumps : Designing Cisco Enterprise Networks (ENSLD) v1.1

BFD is not required for the specific failure described: a physical fiber break on point-to-point routed links. In a Layer 3 campus or routed-access design, a direct physical link failure is detected by the interface state change, so the routing protocol can react immediately without waiting for hello/dead timers. Cisco campus design guidance favors point-to-point routed links partly because they give rapid convergence and avoid STP delays. BFD is valuable when a forwarding-path failure is not reliably detected by Layer 1 or Layer 2, or when a protocol adjacency must detect loss faster than its native timers. It does not automatically create convergence by itself; it detects failure and notifies the routing protocol. For a clean fiber cut on a routed point-to-point link, link-down detection is already fast enough for sub-second failover in the design. OSPF timer tuning is also not the preferred design answer for this physical-failure case. Reference topics: routed access design, point-to-point links, link-failure detection, BFD, OSPF convergence.

The most efficient campus design aligns the active first-hop gateway with the Layer 2 forwarding path. In a traditional access-distribution topology using STP and HSRP, traffic should not cross the distribution-to-distribution link simply because the HSRP active gateway is on the opposite distribution switch from the STP forwarding path. Cisco campus design guidance stresses aligning the STP root bridge with the active FHRP gateway so hosts forward northbound traffic directly to the distribution switch that owns the optimal Layer 2 path. Reconfiguring distribution switch A to become the HSRP active device fixes the asymmetric and inefficient traffic flow in the exhibit. Adding a link between access switches would extend the Layer 2 domain and increase loop-prevention complexity, not improve the northbound default-gateway path. Changing the distribution interconnect to a routed link may be valid in a routed-access redesign, but it is not the targeted correction for this Layer 2/FHRP misalignment. An EtherChannel between distribution switches only increases interswitch capacity; it does not remove the unnecessary hairpin path caused by the wrong active gateway.

The selected command is correct because the port is already restricted to one manually learned MAC address, and the requirement is to let the switch dynamically learn the connected endpoint while retaining port-security control. In Cisco Catalyst port security, a static secure MAC address is manually configured, while a sticky secure MAC address is dynamically learned and then added to the running configuration. This design is useful on access ports where the administrator wants the operational convenience of dynamic learning but still wants the switch to enforce the maximum secure-address limit. Once the endpoint MAC is learned, subsequent frames from different source MAC addresses can trigger the configured violation action, such as protect, restrict, or shutdown. The command must therefore enable sticky learning on the secured interface rather than simply changing the maximum, disabling port security, or configuring a normal switching feature. This is an access-layer security function, not a routing or QoS function. Reference topics: Catalyst port security, secure MAC addresses, sticky learning, access port hardening, Layer 2 campus design.