Cisco 300-540 SPCNI Cloud Network Infrastructure Practice Exam

Correct: B — the VNF Manager. The VNFM owns VNF lifecycle management operations. Cisco Elastic Services Controller performs this role, providing a single point of control for the full VNF lifecycle and exposing ETSI-compliant lifecycle management operations over its northbound API.

Why not the others: The VIM (A) manages the underlying compute, storage, and network resources such as OpenStack or vCenter, not the VNF lifecycle itself. The Element Manager (C) handles fault and configuration management of the running function, not instantiation and scaling. The OSS (D) sits above MANO in the operator's business and operations stack.

Correct: C — gNMI. The gRPC Network Management Interface is a gRPC-based protocol used to modify, install, or delete configuration on network devices and also to view operational data and generate telemetry streams — a single protocol covering both configuration management and telemetry.

Why not the others: SNMPv3 (A) is a polling-oriented management protocol without a gRPC transport or model-driven streaming. NETCONF over SSH (B) handles configuration well but is not the gRPC-based streaming telemetry interface described. Syslog (D) is one-way event logging with no configuration capability.

Correct: A — a border gateway in anycast or vPC mode. VXLAN EVPN Multi-Site interconnects two or more EVPN sites over an IP-only network using BGWs to terminate and interconnect sites, and it is the BGW that provides the control boundary delivering traffic enforcement and failure containment.

Why not the others: Direct spine-to-spine peering (B) or a direct leaf-to-leaf VTEP tunnel (D) bypasses the BGW boundary, which forfeits the failure containment the design exists to provide. A route reflector (C) scales BGP peering but performs no next-hop rewrite or site termination.

Correct: D — a carrier-neutral facility. Carrier-neutral facilities are exactly the blueprint's framing for cloud interconnect: they provide connectivity options to cloud providers, to other carrier-neutral facilities or customer locations, and to cloud edge interconnections, all from a shared, operator-independent location.

Why not the others: A single-tenant enterprise data centre (A) serves one organisation and offers no shared interconnect fabric. A single-carrier PoP (B) is by definition not neutral and limits reach to that carrier's footprint. CPE (C) sits at the customer edge and is not an interconnection venue.

Correct: D — ECMP from NFVI to physical infrastructure. The blueprint calls out implementing ECMP from NFVI to the physical infrastructure using BGP multi-path, OSPF, and IS-IS. Equal-cost paths share the load, so losing one path degrades capacity proportionally instead of causing a full outage.

Why not the others: A single uplink (A) is a textbook single point of failure regardless of its bandwidth. Active-standby (B) provides redundancy but wastes the standby capacity and does not distribute load. Manual failover (C) introduces human reaction time into the recovery path.

Correct: C — data plane redundancy through placement and network resiliency. Surviving a node failure depends on where instances are placed relative to one another and on resilient network paths between them, which is precisely how the blueprint frames VNF data plane redundancy.

Why not the others: More vCPU (A) scales a single instance vertically and does nothing when the node hosting it fails. A larger MTU (B) is a throughput and fragmentation concern, unrelated to availability. Disk snapshots (D) aid recovery after the fact but do not preserve live sessions.

Correct: B — BGP FlowSpec. FlowSpec propagates filtering and policing rules across many BGP peers rapidly, matching on source, destination, Layer 4 parameters, and packet specifics. Cisco contrasts it directly with RTBH, which protects the network but leaves the targeted server completely unreachable.

Why not the others: Destination-based RTBH (A) drops all traffic to the victim address, which is the outcome the question rules out. Loose uRPF (C) validates source reachability and supports source-based RTBH but offers no granular port or protocol matching. MACsec (D) encrypts a link and has no role in volumetric attack filtering.

Correct: A — unicast reverse path forwarding. Source-based RTBH works by setting the next hop for an attacking source to discard, but the drop only happens where uRPF is checking the source address. Cisco's IOS XR guidance configures loose-mode uRPF on the border interfaces for exactly this reason.

Why not the others: BFD (B) accelerates failure detection between peers and has no role in source validation. Storm control (C) rate-limits broadcast and multicast on a port rather than filtering by source prefix. TACACS (D) governs administrative access to the device, not data-plane forwarding.

Correct: D — SR-IOV. Single Root I/O Virtualization allocates dedicated NIC resources to a specific VNF, delivering high performance and low latency by allowing direct memory access of network packets into the virtual machine's memory, bypassing the host software switch.

Why not the others: A kernel-mode OVS bridge (A) is the software path SR-IOV is chosen to avoid, and it incurs the context switching that limits throughput. VLAN trunking (B) is a segmentation mechanism with no bearing on packet-processing latency. Nested virtualization (C) adds a hypervisor layer and typically increases overhead.

Correct: C — dial-out mode. In dial-out mode the router dials out to the receiver to establish a subscription-based telemetry session. Because the router initiates the connection, there is no need to manage ports for inbound traffic, and this is the default mode of operation.

Why not the others: Dial-in mode (A) reverses the roles, with the collector connecting to a gRPC server on the router, which does require inbound port management. Polling (B) describes the pull-based SNMP style that model-driven telemetry replaces. Trap mode (D) is SNMP terminology and is not how streaming telemetry subscriptions are described.