300-540 Dumps are Available for Instant Access [2026]
Practice with these 300-540 dumps Certification Sample Questions
Cisco 300-540 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 96
Which of the following are benefits of using carrier-neutral facilities for cloud interconnect? (Choose two)
- A. Vendor lock-in
- B. Enhanced flexibility and scalability
- C. Reduced redundancy in network architecture
- D. Increased options for connectivity
Answer: B,D
NEW QUESTION # 97
Load balancers are recommended in high availability designs to distribute traffic across multiple
__________.
- A. countries
- B. protocols
- C. servers
- D. networks
Answer: C
NEW QUESTION # 98
Which cloud service model would best suit an organization looking to host its own web applications?
- A. PaaS
- B. FaaS
- C. SaaS
- D. IaaS
Answer: A
NEW QUESTION # 99
The primary benefit of MACSEC is:
- A. Encrypting frames on a network
- B. Authenticating users accessing the network
- C. Filtering traffic based on content
- D. Increasing the speed of network devices
Answer: A
NEW QUESTION # 100
A key benefit of data plane high availability in VNF is:
- A. Enhanced performance and reliability
- B. Lower operational costs
- C. Increased network congestion
- D. Simplified network design
Answer: A
NEW QUESTION # 101
ACI (Application Centric Infrastructure) is designed to:
- A. Simplify the operational management of data centers
- B. Focus on physical, rather than virtual, network infrastructure
- C. Reduce application deployment flexibility
- D. Increase manual configuration requirements
Answer: A
NEW QUESTION # 102
An engineer must enable the highest level of logging when troubleshooting Cisco NFVIS. Which command must be run?
- A. system set-log logtype operational level debug
- B. system set-log logtype configuration level critical
- C. system set-log logtype configuration level error
- D. system set-log logtype configuration level warning
Answer: A
Explanation:
Comprehensive and Detailed Explanation
Cisco NFVIS logging levels (from lowest to highest):
* critical
* error
* warning
* info
* debug#highest verbosity
To capture maximum diagnostic detail, engineers must enabledebuglogging on theoperational log type, which records system activity and runtime behavior.
Thus the correct command is:
system set-log logtype operational level debug
This provides the deepest troubleshooting visibility.
NEW QUESTION # 103
Onboarding VNF refers to:
- A. Removing VNFs from the network
- B. Monitoring VNF performance
- C. The initial setup and integration of VNFs into a network
- D. Updating VNFs to the latest version
Answer: C
NEW QUESTION # 104
Software accelerated virtual switch technologies like DPDK and VPP aim to:
- A. Improve network function virtualization performance
- B. Decrease network security
- C. Slow down packet processing
- D. Increase physical network dependency
Answer: A
NEW QUESTION # 105
RTBH is effective in mitigating what kind of traffic?
- A. Legitimate traffic
- B. Outgoing traffic
- C. Malicious traffic
- D. Incoming legitimate requests
Answer: C
NEW QUESTION # 106 
Refer to the exhibit. An engineer must stop DDoS attacks on web and mail servers by using an ACL. Which two commands must be run on router R17? (Choose two.)
- A. access-list 101 deny ip 10.10.10.2 0.0.0.0 10.20.10.2 0.0.0.0
- B. access-list 101 deny ip 10.10.10.2 255.255.255.255 10.20.10.2 255.255.255.255
- C. access-list 101 deny ip 10.10.10.2 0.0.0.0 10.30.10.2 0.0.0.0
- D. access-list 101 deny ip 10.0.0.0 0.255.255.255 10.10.0.2 0.0.0.0
- E. access-list 101 deny ip 10.10.10.2 255.255.255.255 10.30.10.2 255.255.255.255
Answer: A,C
Explanation:
The attacker's IP is:
* 10.10.10.2
The servers under attack are:
* Web Server:10.20.10.2
* Mail Server:10.30.10.2
We must denytraffic from attacker # servers.
Correct ACL format useshost wildcards (0.0.0.0):
deny ip 10.10.10.2 0.0.0.0 10.20.10.2 0.0.0.0
deny ip 10.10.10.2 0.0.0.0 10.30.10.2 0.0.0.0
These matchD and E.
NEW QUESTION # 107
Which KPI is essential in the VIM control plane for network assurance?
- A. Number of physical routers
- B. Encryption rate
- C. Cable length
- D. CPU utilization
Answer: D
NEW QUESTION # 108
What does Cisco Always-On Cloud DDoS use to protect against DDoS attacks?
- A. Scrubbing centers
- B. Load balancing
- C. Traffic mirroring
- D. Botnet zombies
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Cisco SP Security Knowledge Cisco Always-On Cloud DDoS Protection is a cloud-based, carrier-grade security service used by service providers to protect customers from volumetric and application-layer DDoS attacks.
Its core protection mechanism is the use ofglobal scrubbing centers, which:
* Receive diverted attack traffic
* Scrub (clean) malicious packets
* Forward clean traffic back to the customer
* Use behavioral analysis and real-time detection
* Protect against volumetric, TCP state-exhaustion, and application-layer attacks Why other answers are incorrect:
* Load balancing (A)doesnotmitigate DDoS attacks; it distributes traffic across servers.
* Botnet zombies (B)aresourcesof DDoS attacks, not protection.
* Traffic mirroring (C)is used for analysis and monitoring, not active DDoS protection.
NEW QUESTION # 109
Which of the following are true about IPsec VPNs? (Choose two)
- A. It is suitable for creating secure connections over the public internet
- B. It encrypts data at the application layer
- C. It is used exclusively within private networks
- D. It provides end-to-end encryption
Answer: A,D
NEW QUESTION # 110
Which command must be run on a Cisco IOS device to configure six parallel iBGP and eBGP routes that can be installed into a routing table?
- A. maximum-paths eibgp 6
- B. maximum paths bgp routers 6
- C. multipath eibgp 6
- D. maximum paths bgp 6
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Cisco SP Core Optimization Knowledge Cisco IOS supportsBGP Multipathfor installing multiple equal-cost BGP routes (both iBGP and eBGP) into the routing table. The correct global BGP command syntax to set the number of allowable parallel BGP paths is:
maximum-paths <number>
For BGP specifically, the form is:
maximum-paths bgp <number>
This enables the router to install up to the specified number of equal-cost BGP routes (iBGP and eBGP) into the RIB and then potentially into the FIB.
Setting:
maximum-paths bgp 6
allowssixparallel ECMP paths learned via BGP-this matches the requirement in the question.
Why the other options are incorrect
* B. multipath eibgp 6Not a valid Cisco IOS command.
* C. maximum paths bgp routers 6Invalid syntax.
* D. maximum-paths eibgp 6The correct keyword isbgp, noteibgp.Cisco does not use "eibgp" in this context; IOS supports BGP multipath across iBGP/eBGP automatically when configured under maximum-paths bgp.
NEW QUESTION # 111
OpenStack is:
- A. A hardware-based networking solution
- B. A programming language for network automation
- C. A proprietary virtualization platform
- D. An open-source cloud computing platform for public and private clouds
Answer: D
NEW QUESTION # 112
Equal-Cost Multi-Path (ECMP) routing is used to:
- A. Provide multiple paths for data to increase redundancy and load balancing
- B. Increase the cost of network infrastructure
- C. Ensure a single path for data flow to increase security
- D. Decrease bandwidth between NFVI and physical infrastructure
Answer: A
NEW QUESTION # 113
Which of the following techniques is used for DoS mitigation?
- A. Disabling security protocols
- B. Blackhole routing
- C. Decreasing redundancy
- D. Reducing network segmentation
Answer: B
NEW QUESTION # 114
NSO in the context of virtualized architecture stands for:
- A. Network Service Operator
- B. Network Service Orchestrator
- C. Non-Secure Operations
- D. Network Scale Optimization
Answer: B
NEW QUESTION # 115 
Refer to the exhibit. An engineer must configure an IPsec VPN connection between site 1 and site 2. The ISAKMP policy for the phase 1 negotiations of the tunnel must use AES and SHA-256. This configuration was applied to both PE routers; however, the tunnel fails to come up:
crypto isakmp policy 10
encryption 3des
hash md5
authentication pre-share
group 12
Which two commands must be run on router PE1 to resolve the issue? (Choose two.)
- A. hash sha256
- B. hash aes
- C. group 10
- D. encryption aes
- E. encryption sha256
Answer: A,D
Explanation:
Phase 1 of an IPsec tunnel (ISAKMP/IKE) must havematching proposalson both peers for:
* Encryption algorithm
* Hash (integrity) algorithm
* Authentication method
* DH group
The requirement states thatAESandSHA-256must be used. The current configuration uses:
* encryption 3des # incorrect (must be AES)
* hash md5 # incorrect (must be SHA-256)
To meet the requirement, we must modify the ISAKMP policy:
crypto isakmp policy 10
encryption aes # change 3DES to AES
hash sha256 # change MD5 to SHA-256
authentication pre-share
group 12
Therefore, the necessary commands on PE1 are:
* encryption aes# optionB
* hash sha256# optionE
Options C and D are invalid syntax (encryption sha256 and hash aes are not supported). Changing the DH group (A) is not required by the problem statement and would not by itself fix the mismatch related to encryption and hash algorithms.
NEW QUESTION # 116
What is a valid connection method between carrier-neutral facilities that are more than 20 miles away from each other?
- A. Carrier access Ethernet ring
- B. Private wireless connection
- C. Multimode fiber connection
- D. CAT6e connection
Answer: A
Explanation:
Comprehensive and Detailed Explanation
For distancesgreater than 20 miles, valid inter-facility transport options must support:
* Metro-scale connectivity
* High bandwidth
* Low latency
* Carrier-grade reliability
Acarrier access Ethernet ring (MEN / Metro Ethernet)is designed for:
* Interconnecting data centers or meet-me rooms
* Distances far exceeding 20 miles
* High-availability layer-2 or layer-3 transport
Why the others are invalid:
* CAT6e# maximum ~100 meters
* Multimode fiber# typically <2 km (~1.25 miles)
* Private wireless# not used for high-capacity DC interconnects, unreliable for core transport Thus, the only correct carrier-grade method isCarrier access Ethernet ring.
NEW QUESTION # 117
......
Get Instant Access REAL 300-540 DUMP Pass Your Exam Easily: https://www.prep4sureexam.com/300-540-dumps-torrent.html
300-540 Free Exam Questions with Quality Guaranteed: https://drive.google.com/open?id=17_Rmi6WrYC8KYFOUf--1DYMkgGVPbERj