300-420 Exam Dumps : Designing Cisco Enterprise Networks (ENSLD) v1.1

Graceful restart and nonstop forwarding designs depend on preserving forwarding continuity during a control-plane processor switchover. Cisco Stateful Switchover provides the mechanism for a standby route processor or supervisor to maintain synchronized state so it can assume control when the active processor fails. When SSO is combined with NSF or graceful restart capabilities in routing protocols, neighboring devices can continue forwarding traffic while the restarting device preserves or rebuilds control-plane adjacencies. Cisco Express Forwarding is required for fast data-plane forwarding, but CEF alone does not provide route processor state synchronization after processor failure. Virtual Switch System is a chassis or switching architecture that can provide high availability in certain campus designs, but it is not the required feature named by graceful restart recovery. Bidirectional Forwarding Detection is a failure-detection protocol used to detect path or neighbor failures quickly; it does not recover a failed processor. Therefore, the feature that must be incorporated for graceful restart recovery from processor failure is Stateful Switchover. In a resilient enterprise design, SSO, NSF, and protocol graceful restart are coordinated to reduce outage impact.

Secure segmentation is the Cisco SD-WAN Secure Direct Cloud Access function that separates user traffic into different zones and VPNs or VRFs. In Cisco SD-WAN, VPNs provide logical segmentation that is comparable to VRF separation in traditional routing. Secure Direct Cloud Access extends this segmentation model when users access internet and cloud applications directly from the branch. The design can keep corporate, guest, payment, voice, IoT, and other traffic classes isolated, with policy and security controls applied per segment or zone. Centralized data policy controls forwarding behavior, but the feature that divides traffic into separate zones and VPN or VRF contexts is secure segmentation. Perimeter control and application-aware routing are useful security and performance functions, but they do not describe the core segmentation mechanism. Segmentation is a fundamental SD-WAN design requirement because direct cloud access must not collapse trust boundaries simply because traffic no longer hairpins through a central data center. Reference topics: Cisco SD-WAN secure segmentation, VPNs, VRFs, direct cloud access, zone-based policy.

Explicit QoS trust should be configured at the network boundary points where markings first enter the managed DiffServ domain and are known to be reliable. In a DiffServ design, traffic classification and marking are typically performed at the access edge or at a controlled ingress boundary, and downstream devices then honor DSCP or CoS markings based on the trust boundary. Cisco QoS design stresses that the trust boundary must be intentionally placed; endpoints or unmanaged devices should not be trusted by default because they can mark traffic incorrectly and steal priority treatment. The exhibit answer identifies B and E as the correct trust points, meaning those are the controlled ingress locations where markings should be accepted. Options that trust uncontrolled endpoint-facing points or internal transit locations would either create a security problem or add no practical value. Once traffic is trusted and marked at the correct boundary, queuing, policing, and shaping policies can use the DSCP values consistently across the campus or WAN. Reference topics: DiffServ, QoS trust boundary, DSCP marking, classification, enterprise QoS design.