300-420 Exam Dumps : Designing Cisco Enterprise Networks (ENSLD) v1.1

Out-of-band Ethernet is the correct management design for a large data center when the customer wants device grouping, management-plane isolation, and reduced blast radius from compromise. In an out-of-band design, management traffic uses a physically or logically separate management network instead of traversing the production data plane. This allows different device classes to be placed into management zones, protected by access control, authentication, logging, and rate-limiting policies. If one managed device is compromised, the attacker should not automatically gain production network reachability through the management interface. In-band Ethernet would share the production infrastructure and therefore would not provide the same isolation. Dial-up out-of-band access can be useful for emergency console access, but it is not appropriate as the primary management architecture for a large data center. Out-of-band Ethernet provides scale, speed, and segmentation while still allowing centralized management systems to reach routers, switches, controllers, and appliances. Reference topics: out-of-band management, management-plane security, data-center operations, isolation, access control, DoS mitigation.

The correct IS-IS design combines tuned SPF/PRC behavior with a proper Level 1 and Level 2 hierarchy. Reducing SPF and PRC intervals, within platform and stability limits, helps routers react more quickly to topology changes after a link failure. However, fast timers alone are not enough; the hierarchy must contain instability so physical link flaps in the access layer have limited impact on the rest of the network. Access routers should form Level 1 adjacencies inside their local area, while aggregation routers should operate as Level 1/Level 2 routers to connect the access area to the Level 2 backbone. This design gives access routers a simple local view and uses aggregation as the interarea boundary. Running all access and aggregation routers as L1/L2 across the network increases the size of the backbone and exposes more routers to wider flooding, which is the opposite of the requirement. Redistributing Internet routes into Level 1 is also poor design because it bloats the access area. Therefore, the right choices are C and E. Reference topics: IS-IS hierarchy, L1/L2 design, SPF and PRC tuning, access-layer convergence, fault containment.

GETVPN is the correct transport-encryption design for this environment. The company is using a private MPLS-based service and requires encryption without maintaining permanent point-to-point tunnels. GETVPN was designed for private WAN environments where routing remains native and packets are encrypted without adding GRE or IPsec tunnel overlays between every pair of sites. It uses group-based keying, typically with key servers that distribute security policy and rekey material to group members. That supports dynamic key rotation and spoke-to-spoke communication while avoiding the operational burden of building and maintaining individual tunnels. DMVPN also supports dynamic spoke-to-spoke tunnels, but it is still a tunnel overlay using mGRE, NHRP, and IPsec, and it is usually selected for Internet or mixed transport overlays. Standard IPsec VPN requires maintaining tunnel relationships, and GRE VPN alone does not provide encryption. GETVPN therefore best matches tunnel-less encryption across a private MPLS WAN with centralized security policy and direct site-to-site forwarding. Reference topics: GETVPN, group encrypted transport, tunnel-less IPsec, private MPLS WAN encryption, group keying.