Free CCDE Practice Questions

Question 1

R1 and R2 advertise 10.64.0.0/16 to the core, which prefers R1. R1 loses reachability to 10.64.48.0/24 but retains other summary components; R2 still reaches the /24. R1 cannot reach it through R2. Traffic for the other regional subnets must continue entering through R1. Select the smallest routing-policy change that restores the affected subnet.

Accepted Answer

Also advertise R2's affected /24 to the core.

Answer

Run more aggressive BFD timers on the otherwise healthy core-to-R1 adjacency.

Answer

Prefer R2's /16 over R1's /16 throughout the core.

Answer

Add a discard route for the regional /16 on R1.

Question 2

At architecture sign-off, an order-processing service has an approved two-minute RPO, a twelve-minute RTO, and a fifteen-millisecond write-acknowledgment limit. The intersite RTT is at least 38 ms. In testing, asynchronous replication acknowledges writes within seven milliseconds, has a maximum recoverable-data lag of 70 seconds, and restores the full service within eight minutes after the required complete-site failure. Both approaches fit the budget. The storage team nevertheless recommends synchronous replication to eliminate lost writes. The architect should recommend:

Accepted Answer

Asynchronous replication, monitored against the agreed recovery and acknowledgment limits.

Answer

Deferring approval until a zero-data-loss synchronous design becomes available.

Answer

Asynchronous replication, conditional on business approval of a seventy-second RTO.

Answer

Synchronous replication, with strict-priority acknowledgment traffic to meet the fifteen-millisecond write limit.

Question 3

An IPv6 application problem appears immediately after a WAN tunnel and edge-policy change. Testing shows:
DNS and neighbor discovery: successful.
TCP handshakes and small HTTPS responses: successful.
Large TCP segments: repeatedly retransmitted, with no TLS alerts.
The tunnel path has a smaller MTU than the client LAN, and ICMPv6 errors do not reach the sender.
Which failure mechanism fits these observations?

Accepted Answer

Path MTU discovery is failing because ICMPv6 Packet Too Big messages cannot reach the sender.

Answer

Recursive resolution of the BGP next hop is failing, leaving the destination route visible but unusable for forwarding.

Answer

Certificate pinning is rejecting the application's server certificate.

Answer

An incorrect AAAA record sends IPv6 clients to a nonresponsive application instance.

Question 4

A branch has a 1 Gb/s Ethernet handoff to a service policed at 100 Mb/s by the carrier. Admitted voice traffic peaks at 6 Mb/s, while backups create short line-rate bursts. Voice quality deteriorates during those bursts, even though average traffic is only 35 Mb/s. The router's priority queue on the physical interface shows no congestion; the carrier reports aggregate policer drops. The contract cannot be increased, and backups must continue. Where should the design introduce congestion management?

Accepted Answer

Apply a parent shaper matched to the carrier's rate and burst profile, with bounded voice priority and separate backup queueing beneath it.

Answer

Increase the physical interface output buffer so that line-rate backup bursts wait locally before reaching the carrier policer.

Answer

Increase the voice priority allocation on the 1 Gb/s interface while leaving aggregate transmission at the physical port rate.

Answer

Police backup traffic at 100 Mb/s before the existing interface queue, leaving voice outside that policer.

Question 5

Two data centers operate independent EVPN/VXLAN fabrics with separate tenant VRFs. Applications replicate at the application layer and do not require a workload to retain its IP address when moving between sites. The interconnect must exchange selected tenant IP prefixes without carrying a broadcast storm from one fabric into the other. Overlapping tenant address spaces must remain isolated. Which intersite architecture preserves these boundaries?

Accepted Answer

Keep bridge domains local and exchange selected EVPN IP-prefix routes between matching tenant VRFs using explicit route-target policy.

Answer

Import the tenant prefixes into one intersite transit VRF and use distinct route distinguishers to preserve separation between tenants.

Answer

Bridge each tenant across the interconnect and place routed firewalls on the external uplinks of both data centers.

Answer

Extend each tenant's Layer 2 VNI between the fabrics and use local anycast gateways to keep normal routed traffic near its source.

Question 6

An active DDoS incident has made a public order API unreachable. The provider measures a 14 Gb/s UDP flood to the API address, saturating the enterprise's 10 Gb/s access circuit before traffic reaches its firewall. Legitimate HTTPS demand is 800 Mb/s, and firewall CPU remains low. A contracted upstream scrubbing service has sufficient capacity to absorb the attack and return clean traffic. The incident objective is to restore this API, not merely protect other destinations. Choose the response that addresses the exhausted resource while preserving the service.

Accepted Answer

Activate upstream scrubbing for the API.

Answer

Blackhole the API host route at the provider edge.

Answer

Publish a new API address on the same circuit, leaving the attacked address routed.

Answer

Block UDP at the enterprise firewall's outside interface.

Question 7

A branch loses connectivity to its SD-WAN controllers while both WAN data tunnels remain established. The tested configuration retains valid routes, keys, and downloaded policies for the entire outage; local path measurements continue. The installed voice policy requires loss below 1% and jitter below 30 ms. Its measurement process has classified MPLS at 2.4% loss and 8 ms jitter, and Internet at 0.2% loss and 14 ms jitter. No new route or policy is needed. During the controller outage, how should the branch select the voice path?

Accepted Answer

Use local application-aware routing to select the established Internet tunnel.

Answer

Wait for MPLS liveness to fail before using the Internet tunnel.

Answer

Suspend encrypted forwarding pending controller revalidation of every route, key, and policy.

Answer

Hold MPLS until the controllers redistribute the application-routing policy.

Question 8

A busy training facility uses 5 GHz, 80 MHz channels. Coverage is strong, wired uplinks have spare capacity, and captures show airtime dominated by neighboring APs sharing channels rather than by non-Wi-Fi interference. The permitted spectrum provides twelve nonoverlapping 20 MHz channels but only three nonoverlapping 80 MHz channels. Existing AP locations are needed for coverage, and load testing confirms that a 20 MHz cell can serve its planned active-client demand. The RF redesign should start by:

Accepted Answer

Moving to 20 MHz, replanning channel reuse, and validating the intended client load.

Answer

Using 160 MHz channels and removing alternate APs to give each remaining radio more spectrum.

Answer

Adding APs while keeping 80 MHz channels to reduce clients per radio.

Answer

Raising AP power at 80 MHz to increase client data rates and reduce airtime.

Question 9

A proposed hybrid-cloud move places an API tier in the cloud while its database must remain on premises. Each transaction makes six sequential database request-response exchanges; they cannot be parallelized in this release. All other, nonoverlapping processing totals 40 ms. API-to-database RTT is 2 ms when colocated and 24 ms after the move. The response-time limit is 140 ms. More WAN bandwidth is available, but it would not change RTT. Which recommendation correctly accounts for the proposed placement?

Accepted Answer

Keep the API colocated for this release; the cloud design would require 184 ms per transaction.

Answer

Move the API tier: the predicted response time is 64 ms, within the 140 ms limit.

Answer

Keep the API colocated: six requests plus six responses, each taking 24 ms, result in 328 ms.

Answer

Move the API tier: the predicted response time is 112 ms, within the 140 ms limit.

Question 10

During a campus migration, two border routers redistribute routes in both directions between a legacy EIGRP domain and a new OSPF domain. Failure testing reveals that an EIGRP-native prefix can return to EIGRP through the other border as an external route after its original path disappears. Prefix ownership is known, and both borders must remain available for cross-domain reachability. The missing protection is:

Accepted Answer

Tagging routes by origin, preserving the tags across redistribution, and rejecting reentry into the originating domain at either border.

Answer

Summarizing external routes at both borders to dampen individual component-route failures.

Answer

Using high seed metrics in both protocols so returned routes remain less attractive.

Answer

Increasing administrative distance for redistributed routes so native routes win whenever they are present.

Free CCDE Practice Questions

Domain 1: Business Strategy Design 15% of exam

Question 1

Domain 2: Control, Data, Management Plane, and Operational Design 25% of exam

Question 2

Question 3

Domain 3: Network Design 30% of exam

Question 4

Question 5

Question 6

Question 7

Domain 4: Service Design 15% of exam

Question 8

Question 9

Domain 5: Security Design 15% of exam

Question 10

That's 10 of 1,030