300-420 Exam Dumps : Designing Cisco Enterprise Networks (ENSLD) v1.1

The best answer is to use a single IP address for a static NAT entry that represents the server with a nonoverlapping address. When two companies use overlapping private address space, routing directly between the networks can fail because each side may already have a local route for the same prefix. The requirement is narrow: users in the acquired company need access to one server in Company A, and the design must conserve address space. A static NAT mapping for the server solves the destination overlap problem with one translated address, giving remote users a unique reachable address for that server without renumbering either company. Overload NAT is normally used to translate many inside clients behind one address for outbound access; it is not the most precise solution for publishing one overlapping server. One-to-one NAT for every user wastes addresses and adds operational overhead. Readdressing the acquired company would solve the overlap permanently, but it does not conserve effort or address space. Therefore, a single static NAT entry for the server is the most efficient design.

The SD-Access control-plane node performs the LISP Map-Server and Map-Resolver functions. Cisco SD-Access uses LISP in the control plane to maintain mappings between endpoint identifiers and routing locators. Fabric edge nodes discover local endpoints and register them with the control-plane node. When a destination endpoint is not known locally, a fabric node queries the control-plane node, which resolves the endpoint location and returns the locator information needed for VXLAN forwarding through the fabric. This is why the control-plane node is the correct answer. A fabric edge node connects endpoints, provides the anycast gateway, encapsulates and decapsulates user traffic, and registers endpoints. A border node connects the fabric to external networks. An intermediate node simply transports routed underlay traffic between fabric nodes and does not hold endpoint mappings. In design terms, control-plane placement and redundancy are critical because endpoint mobility, fabric forwarding lookup, and location resolution depend on stable Map-Server and Map-Resolver services. Reference topics: Cisco SD-Access control plane, LISP Map-Server, LISP Map-Resolver, EID-to-RLOC mapping, fabric edge registration.

DMVPN Phase 3 hub-and-spoke is the best design for this requirement. The customer wants secure dynamic site-to-site VPN connectivity for voice, video, and FTP, and also wants branches to communicate directly instead of hairpinning all traffic through headquarters. DMVPN supports dynamic spoke-to-spoke tunnels using multipoint GRE, NHRP, and IPsec protection. Phase 3 is more scalable than Phase 2 because the hub can send NHRP redirect messages and spokes can install shortcut routes, reducing the need for every spoke to maintain detailed next-hop information for every other spoke. That is important because the branch routers have limited memory. Phase 1 is hub-and-spoke only and does not provide dynamic spoke-to-spoke forwarding. A hierarchical Phase 3 design can be useful at very large scale, but the question describes a headquarters and remote branch design rather than multiple tiers of hubs. Phase 3 hub-and-spoke satisfies direct branch communication, security, and scale. Reference topics: DMVPN Phase 3, NHRP redirect, spoke-to-spoke tunnels, IPsec encryption, branch WAN scalability.