400-007 Exam Dumps : Cisco Certified Design Expert (CCDE v3.1)

D (Group Encrypted Transport VPN - GET VPN):GET VPN encrypts traffic across private WANs like MPLS while maintaining full-mesh routing visibility and offering centralized key management with minimal encapsulation overhead.

Other options explained:

A: S-VTI is used for point-to-point IPsec tunnels.

B: DMVPN is used for dynamic multipoint Internet-based VPNs.

C: MGRE is a tunneling protocol but lacks security features.

In IPv6, routers advertise prefixes via Router Advertisement (RA) messages. An attacker could inject rogue RAs to manipulate the IPv6 configuration of endpoints.

Router Advertisement Guard (RA Guard) blocks unauthorized RA messages from being received on access ports, preventing endpoints from receiving incorrect IPv6 prefixes from malicious or misconfigured devices.

This security feature is crucial when devices have IPv6 enabled but the network is IPv4-only.

Other options explained:

A: Source Guard and Prefix Guard enforce valid address and prefix assignment but do not prevent RA spoofing directly.

C: Prefix Guard focuses on controlling prefixes being assigned, not blocking RA messages.

D: Secure Neighbor Discovery (SEND) provides cryptographic protection but is rarely deployed due to complexity.

B (OSPF Type 1 external):Type 1 external routes include both the external cost (from redistribution) and the internal OSPF cost to the ASBR. This ensures accurate end-to-end metric calculation across domains.

Other options explained:

A: Type 2 external ignores internal OSPF cost, potentially creating suboptimal routing.

C/D: EIGRP doesn’t use OSPF metric types; redistribution into EIGRP uses EIGRP metrics.