Enterprise Network Design practice questions

STP requires all switches to be in the same VLAN to function correctly.

Why wrong: Incorrect because STP operates per VLAN (PVST+) and does not require all switches to be in the same VLAN.

STP cannot be used with 5000 users due to MAC address table limitations.

Why wrong: Incorrect because STP does not directly limit the number of users; MAC address table size is a hardware limitation, not a STP issue.

STP will cause broadcast storms in a three-building design.

Why wrong: Incorrect because STP is designed to prevent broadcast storms by blocking redundant paths; it does not cause them.

Three-tier, because it offers more redundancy with multiple aggregation layers.

Why wrong: Incorrect because three-tier designs often have bottlenecks at the aggregation layer for east-west traffic, and redundancy is not inherently better.

Spine-leaf, because it supports legacy spanning tree protocols.

Why wrong: Incorrect because spine-leaf typically uses routing (e.g., BGP) rather than STP, and legacy STP is not a benefit.

Three-tier, because it is easier to manage with traditional VLANs.

Why wrong: Incorrect while three-tier may be familiar, it does not optimize east-west traffic; spine-leaf is preferred for modern data centers.

The standby switch is forwarding all broadcast traffic due to a misconfigured STP root.

Why wrong: Incorrect because STP root placement affects forwarding, but broadcast traffic is not typically the primary cause of high CPU on standby; HSRP hellos are more likely.

The standby switch is performing routing for all VLANs because the active switch failed.

Why wrong: Incorrect because if the active failed, the standby would become active and handle routing, which would increase CPU, but the scenario says standby is also experiencing high CPU, not that it became active.

The standby switch is processing VTP updates from the distribution layer.

Why wrong: Incorrect because VTP is not commonly used in modern designs and would not cause sustained high CPU on standby unless there are frequent changes.

Configure static routes with different metrics for each link and use HSRP for failover.

Why wrong: Incorrect because static routes with different metrics provide only active/passive failover, not active/active load balancing; HSRP is for LAN redundancy, not WAN.

Use BGP with both ISPs and rely on BGP best path selection for load balancing.

Why wrong: Incorrect because BGP does not load balance by default; it selects a single best path unless multipath is configured, and it may not provide per-packet load balancing easily.

Implement a VPN tunnel between the branch and headquarters using only one link.

Why wrong: Incorrect because this uses only one link, not both, and does not provide load balancing or bandwidth aggregation.

Enable STP on the access switches and set the root bridge priority to 0.

Why wrong: Incorrect because STP will block one of the uplinks to prevent loops, so only one link is active at a time, reducing redundancy.

Configure the access switches with HSRP to the distribution switches.

Why wrong: Incorrect because HSRP is for first-hop redundancy for hosts, not for switch-to-switch uplink redundancy; it does not make both links active.

Use static routing with equal-cost paths from the access switches to the distribution switches.

Why wrong: Incorrect because static routing does not prevent Layer 2 loops; if both links are in the same VLAN, a loop will occur without STP or VPC.

Fabric Control node

Why wrong: Incorrect because the Fabric Control node handles LISP mapping and registration, not direct endpoint integration.

Fabric Border node

Why wrong: Incorrect because the Fabric Border node connects the fabric to external networks (e.g., WAN, Internet), not to wireless endpoints.

Wireless LAN Controller (WLC)

Why wrong: Incorrect because while the WLC manages wireless access points, it is not the component that integrates policies in SD-Access; the Fabric Edge does that.

VRF

Why wrong: Incorrect because VRFs provide Layer 3 isolation within a tenant, but they do not isolate traffic between tenants; tenants are the top-level isolation boundary.

Bridge Domain

Why wrong: Incorrect because bridge domains define Layer 2 boundaries within a tenant, not inter-tenant isolation.

Contract

Why wrong: Incorrect because contracts define policies that allow traffic; they are used to permit communication, not to block it by default.

Use a full mesh design with OSPF on all routers.

Why wrong: Incorrect because a full mesh with OSPF is complex and unnecessary for a small branch; it increases configuration overhead.

Use a point-to-point design with BGP on the branch router.

Why wrong: Incorrect because BGP is more complex than needed for a simple branch; static routes are simpler.

Use a spine-leaf design with multiple WAN links.

Why wrong: Incorrect because spine-leaf is a data center architecture, not suitable for a small branch WAN design.

Use route maps to filter all redistributed routes.

Why wrong: Incorrect while route maps can filter routes, they do not directly prevent loops; AD and metric settings are more critical.

Enable OSPF on all EIGRP interfaces.

Why wrong: Incorrect because running both protocols on the same interface does not prevent loops and can cause confusion.

Use a single routing protocol throughout the network.

Why wrong: Incorrect while this would avoid redistribution, the scenario requires using both protocols, so it is not a valid solution.

Cisco ISE for policy management, OSPF for control plane, GRE for data plane, and ACLs for enforcement

Why wrong: OSPF and GRE are not used in SD-Access fabric; they lack the overlay scalability and group-based policy capabilities.

Cisco ISE for policy management, BGP for control plane, MPLS for data plane, and VLANs for enforcement

Why wrong: BGP and MPLS are not the standard SD-Access fabric protocols; they do not support SGT propagation and VXLAN encapsulation.

Cisco ISE for policy management, LISP for data plane, VXLAN for control plane, and 802.1X for enforcement

Why wrong: LISP is the control plane protocol, not data plane; VXLAN is the data plane, not control plane. 802.1X is for authentication, not policy enforcement.

vManage

Why wrong: vManage is the management plane (GUI, analytics, configuration), not the initial authentication orchestrator.

vSmart

Why wrong: vSmart is the control plane controller that distributes OMP routes and policies, but it relies on vBond for initial device authentication.

vEdge

Why wrong: vEdge is a data plane device (router) that connects branches; it does not perform orchestration for other devices.

FIFO (First In, First Out) with tail drop

Why wrong: FIFO does not provide any priority or bandwidth guarantees; all traffic is treated equally.

CBWFQ (Class-Based Weighted Fair Queuing) without a priority queue

Why wrong: CBWFQ can guarantee bandwidth per class but does not provide a strict priority queue for voice, which would cause jitter.

WRED (Weighted Random Early Detection) with DSCP-based drop probabilities

Why wrong: WRED is a congestion avoidance mechanism, not a queuing strategy; it does not provide priority or bandwidth guarantees.

VLAN trunking between VNFs on the same hypervisor

Why wrong: VLANs are limited to Layer 2 and require physical reconfiguration for changes; they do not support dynamic service chaining across multiple VNFs.

Static routing between VNFs using dedicated interfaces

Why wrong: Static routing requires manual configuration and does not support dynamic insertion or reordering of VNFs.

MPLS L3VPN between VNFs

Why wrong: MPLS L3VPN is designed for WAN connectivity, not for service chaining within a single NFV host.

Enable hyper-threading and overcommit CPU resources

Why wrong: Overcommitting CPU resources increases contention and latency, which is unsuitable for latency-sensitive workloads.

Use a Type 2 hypervisor (e.g., VMware Workstation) for better isolation

Why wrong: Type 2 hypervisors run on top of an OS, adding overhead; Type 1 is preferred for performance in data centers.

Enable memory ballooning to reclaim unused memory from VMs

Why wrong: Memory ballooning can cause performance variability and is not suitable for latency-sensitive workloads.

Collapsed core design with core and distribution combined into one layer

Why wrong: Collapsed core reduces the number of layers but can create a larger failure domain and may not scale well for 10,000+ users.

Flat Layer 2 design with all switches in a single VLAN

Why wrong: Flat Layer 2 designs have large failure domains, poor scalability, and slow convergence due to spanning tree.

Leaf-spine design with all switches acting as leafs and spines

Why wrong: Leaf-spine is optimized for data center east-west traffic; in a campus, it can be complex and may not align with typical north-south traffic patterns.

vSmart controllers

Why wrong: vSmart controllers manage the control plane (OMP routes, policies) but do not terminate IPsec tunnels; they communicate with vEdge routers via DTLS/TLS.

vManage

Why wrong: vManage is the management plane and does not participate in data plane tunnel establishment.

vBond

Why wrong: vBond is the orchestrator for initial authentication and NAT traversal, not for data plane tunnels.

Voice: DSCP 56 (CS7); Video: DSCP 48 (CS6)

Why wrong: CS7 and CS6 are reserved for network control traffic (e.g., routing protocols), not for user traffic like voice and video.

Voice: DSCP 40 (AF41); Video: DSCP 46 (EF)

Why wrong: This reverses the priorities: video would get strict priority (EF) and voice would get assured forwarding, which is incorrect.

Voice: DSCP 26 (AF31); Video: DSCP 18 (AF21)

Why wrong: AF31 and AF21 are lower priority than EF and AF41; voice requires the highest priority (EF), not assured forwarding.

Spine switches must run Spanning Tree Protocol (STP) to prevent loops

Why wrong: Leaf-spine uses Layer 3 routing with ECMP; STP is not needed and would block redundant paths.

Spine switches must be connected to each other to provide redundancy

Why wrong: Spine switches are not connected to each other; redundancy is achieved by having multiple spines, and leaf switches connect to all spines.

Spine switches must perform NAT to translate between VLANs

Why wrong: NAT is not used in leaf-spine; traffic is routed between subnets using standard IP routing.

OSPF adjacency will not form because the hello interval is too low for point-to-point.

Why wrong: The hello interval of 10 seconds is standard for point-to-point; it is not too low.

The network command under router ospf will be ignored because the interface has an explicit network type.

Why wrong: The network command is still processed; the interface configuration only overrides network type parameters, not the area assignment.

OSPF will use the default broadcast network type because the point-to-point keyword is misspelled.

Why wrong: The keyword 'point-to-point' is correctly spelled; no misspelling exists.

The native VLAN 10 cannot be used as a routed interface because it is the native VLAN.

Why wrong: There is no restriction preventing the native VLAN from being used as an SVI; it is a common practice.

The SVI for VLAN 10 will not come up because the native VLAN must be untagged.

Why wrong: The SVI can come up regardless of native VLAN status; the native VLAN is simply untagged on the trunk.

The configuration is invalid because the native VLAN must be the same as the management VLAN.

Why wrong: There is no such requirement; the native VLAN can be any VLAN.