Cisco Certified Design Expert (CCDE) — Practice Set 1

Question 1

A large financial institution is designing a new enterprise network. The CTO mandates sub-second failover for all routed paths to protect trading application SLAs. The network design team must choose between OSPF and IS-IS as the core IGP. From a design perspective, which factor most strongly differentiates IS-IS from OSPF for a large-scale, sub-second convergence design?

Accepted Answer

IS-IS runs directly over Layer 2 (it uses its own PDU type directly on the data link, not encapsulated in IP), which means IS-IS adjacencies and flood operations are not dependent on IP routing being functional — a critical operational advantage in a large network where IP misconfiguration could cascade. IS-IS also scales better in single-area designs because the NSAP address space is not tied to IP addressing. Both IS-IS and OSPF use Dijkstra SPF (option B is false — IS-IS is link-state, not distance vector). IS-IS supports both IPv4 and IPv6 via multi-topology (MT) extensions (option C is false). Both protocols support hierarchical area designs (option D is partially false — OSPF requires area 0, but IS-IS has Level 1/Level 2 hierarchy without a mandatory backbone area restriction).

Question 2

A multinational corporation is evaluating whether to replace its existing MPLS WAN (managed service) with a Cisco SD-WAN (Viptela) solution using DIA (Direct Internet Access) breakout. The network architect must present a TCO analysis to the board. Which factor most significantly shifts the TCO in favor of SD-WAN over managed MPLS for a company with 200 branch offices?

Accepted Answer

The primary TCO driver favoring SD-WAN over managed MPLS is OpEx reduction: MPLS bandwidth costs are typically 10–50x higher per Mbps than internet broadband, and for 200 branches this cost difference is substantial over a 5-year period. Additionally, SD-WAN application-aware routing can send SaaS traffic (Office 365, Salesforce, Webex) directly to the internet from each branch, avoiding backhauling it to a data center over expensive MPLS circuits. SD-WAN does require hardware (option A), but the circuit cost savings more than offset hardware CapEx at scale. MPLS does offer better predictable SLA (option C), but SD-WAN with multiple WAN links and application-aware failover meets the requirements for most enterprise voice/video applications. SD-WAN does not eliminate WAN routers (option D).

Question 3

A network architect is designing a new campus network for a 5,000-employee organization. The CTO wants to evaluate traditional three-tier hierarchical design (core/distribution/access) versus Cisco SD-Access (LISP/VXLAN fabric). Which design consideration most strongly favors SD-Access over traditional three-tier design?

Accepted Answer

The primary design advantage of SD-Access over traditional three-tier for large enterprises is SGT-based micro-segmentation. In a traditional design, segmenting users, IoT devices, and guest traffic requires separate VLANs per segment per access switch, leading to VLAN sprawl that is operationally complex to manage across hundreds of switches. SD-Access uses LISP for the control plane (endpoint mobility) and VXLAN for the data plane, with SGTs assigned per user/device identity to enforce policy throughout the fabric regardless of physical location — without requiring a new VLAN for each segment. SD-Access does require Layer 3 routing (option A is false). Traditional three-tier with routed access eliminates STP; SD-Access does eliminate STP in the fabric but traditional L3 access designs also achieve this (option B overstates the differentiator). SD-Access requires multiple control plane nodes for redundancy (option D is false).

Question 4

A network architect is designing a technology migration from a legacy hub-and-spoke MPLS network to SD-WAN for a company with 300 branches. The project has a 12-month timeline. The architect must recommend a migration strategy that minimizes risk to production applications during the transition. Which migration approach best balances risk and speed?

Accepted Answer

A phased migration with parallel operation is the standard CCDE-recommended approach for large WAN technology transitions. By running SD-WAN in parallel with MPLS at a pilot site, the team validates SD-WAN performance, routing policies, QoS behavior, and failover before committing production branches. Regional waves allow the team to apply lessons learned from earlier phases. MPLS as fallback during each wave provides a rollback path if critical applications fail. A big-bang migration (option A) is extremely high-risk for 300 branches — a single configuration error could affect the entire organization simultaneously with no fallback. Option C unnecessarily extends the timeline and cost without migration progress. Option D (overlaying SD-WAN on MPLS without changing anything) does not achieve the goal of replacing MPLS with internet broadband circuits.

Question 5

A network architect is designing capacity planning for a large enterprise. The core routing infrastructure must support sub-second reconvergence when a 100 Gbps core link fails. The design uses IS-IS with BFD for failure detection. A critical design constraint is that the OSPF/IS-IS SPF run time must not exceed 100 ms for the 500-router topology. Which design mechanism best ensures sub-100 ms SPF completion?

Accepted Answer

IS-IS incremental SPF (iSPF) recalculates only the affected portion of the SPF tree when a topology change occurs, instead of running a full Dijkstra SPF over the entire LSDB. This dramatically reduces SPF CPU time in large topologies. Tuning SPF throttle timers controls SPF pacing: the initial-wait timer (50ms recommended) determines how quickly SPF runs after the first topology change, enabling fast initial convergence. The second-wait and max-wait timers implement exponential backoff to prevent SPF thrashing during flapping. Increasing the hello interval (option A) would slow failure detection, not improve SPF speed. Reducing topology scope via multiple Level 1 areas (option C) is a valid scalability design but is a topological restructuring, not a per-router SPF tuning mechanism. Disabling BFD (option D) would increase failure detection time from milliseconds to seconds, defeating the sub-second convergence requirement.

Question 6

A network architect is designing IPv6 addressing for a large enterprise with 150 sites. The organization has received a /32 IPv6 prefix from their ISP. The architect plans to allocate a /48 per site. How many sites can be supported with individual /48 allocations from the /32?

Accepted Answer

A /32 IPv6 prefix contains 2^(48-32) = 2^16 = 65,536 individual /48 allocations. This is why ISPs typically receive /32 or larger allocations — they can distribute /48 prefixes to each enterprise customer. A /48 per site is the IETF recommendation (RFC 6177) for enterprise site allocations, providing each site with 2^16 = 65,536 /64 subnets. 256 sites (option A) would result from allocating /40s from a /32. 16 million (option C) would be /56 per site from a /32. 4 billion (option D) would be /64 per site from a /32.

Question 7

A network architect is designing a large-scale data center network. The fabric uses BGP as the routing protocol between leaf and spine nodes (BGP in the DC). Which characteristic of BGP makes it preferable to OSPF or IS-IS as the routing protocol for a large-scale leaf-spine data center fabric?

Accepted Answer

In large-scale leaf-spine fabrics (especially with EVPN/VXLAN), BGP is preferred because its per-neighbor policy control and NLRI (network layer reachability information) architecture avoids the scalability limitation of flooding link-state updates to every node in the topology. Each spine-leaf BGP session can have independent policies, allowing fine-grained control of route advertisement and manipulation using communities and route-maps. BGP does not use Dijkstra SPF, but it does not necessarily converge faster than IS-IS (option A — IS-IS with BFD and iSPF can be faster). BGP tables are generally larger and more memory-intensive than IS-IS LSDBs (option C is false). Cisco Nexus 9000 supports IS-IS and OSPF as well (option D is false).

Question 8

A network architect is designing the SD-Access fabric control plane. The deployment will have 3 border nodes and 2 control plane nodes (LISP Map-Server/Map-Resolver). Which border node type should be used when the fabric needs to route traffic to destinations outside the SD-Access fabric (internet, data center, branch offices) that are not part of the fabric?

Accepted Answer

In Cisco SD-Access, a Default Border Node (also referred to as Border Node in some versions) is the standard exit point for fabric traffic destined to external networks — internet, data center, MPLS/SD-WAN, or other non-fabric sites. The fabric edge nodes route traffic for unknown EIDs (endpoint identifiers not registered in the LISP map-server) to the default border node. An Anywhere Border Node (option B) is a specific type used to interconnect separate SD-Access fabric domains across a traditional routed underlay — it is not the exit point for internet/DC traffic. There is no 'Exit border node' type (option C) as a distinct Cisco SD-Access classification. A transit control plane node (option D) is not a standard SD-Access border node role.

Question 9

A network architect is evaluating the MPLS label stack for an L3VPN service. A customer packet enters the MPLS network at the ingress PE and is forwarded to the egress PE via P routers. How many labels are in the MPLS label stack for a standard L3VPN packet on the wire between two P routers in the core (not at the PE-PE boundary)?

Accepted Answer

An MPLS L3VPN packet carries exactly two labels between PE and P (and P-to-P) routers: the outer label (transport/tunnel label distributed by LDP or Segment Routing) which directs the packet hop-by-hop to the egress PE, and the inner VPN label (the BGP-distributed VPN label, also called the VPNv4 label) which identifies the VRF on the egress PE. P routers only see and swap the outer label (they perform label switching, not IP lookups, and do not read the inner VPN label). The outer label is popped by the penultimate-hop router (PHP) just before the egress PE, leaving only the inner VPN label, but between P routers both labels are present. MPLS EXP bits are a 3-bit field within the label header itself, not a separate label (option D is incorrect — there is no separate QoS label).

Question 10

A network architect is designing traffic engineering for latency-sensitive financial trading applications that require sub-5 ms path latency over a multi-hop IP/MPLS backbone. The architect wants to use Segment Routing Traffic Engineering (SR-TE) with an explicit path. Which SR-TE path computation method provides the most scalable solution without requiring a per-flow RSVP-TE state in the network?

Accepted Answer

SR-TE policies encode the explicit path as a stack of segment IDs (SIDs) in the packet header at the ingress node. No per-hop signaling state (as required by RSVP-TE) is needed at intermediate nodes — they simply perform label operations based on the top SID in the stack. This is the key scalability advantage of SR-TE over RSVP-TE: only the headend (ingress PE) and a centralized PCE need to maintain path state, while core P routers remain stateless. RSVP-TE (option A) requires per-tunnel state at every hop (PATH and RESV state), which does not scale for thousands of TE tunnels. LDP (option C) does not support traffic engineering constraint-based routing — it is a pure hop-by-hop forwarding protocol. BGP-CT (option D) is a valid approach for intent-based routing but operates at the BGP route level, not per-packet path specification.

Question 11

A network architect is designing WAN connectivity for a retail chain with 500 stores. Each store generates 500 Mbps peak bandwidth to reach cloud-hosted POS and inventory applications. The stores currently use MPLS with 50 Mbps circuits that are consistently congested. A new cloud-direct architecture is being evaluated. Which WAN design most cost-effectively addresses the bandwidth and cloud access requirements?

Accepted Answer

SD-WAN with local internet breakout (DIA — Direct Internet Access) is the optimal design for cloud-first retail: broadband internet (cable/fiber) provides significantly more bandwidth per dollar than MPLS, and SD-WAN application-aware routing sends cloud application traffic directly to the internet without backhauling through a data center. LTE provides automatic WAN failover. For a retail chain with cloud-hosted applications, this design provides better bandwidth, lower cost, and better user experience for SaaS. Upgrading MPLS circuits (option A) to 1 Gbps is extremely expensive at 500 locations. Dedicated leased lines to Direct Connect (option C) adds unnecessary complexity — cloud applications don't require Direct Connect from every branch. Satellite (option D) has high latency (500ms+ for GEO) and low bandwidth, making it unsuitable as a primary WAN link for POS applications.

Question 12

A network architect is designing an MPLS L3VPN topology for a financial services company. The company's security policy requires that all inter-branch traffic must be inspected by a centralized firewall at the headquarters data center. Which MPLS VPN topology enforces this requirement?

Accepted Answer

Hub-and-spoke MPLS L3VPN design places the headquarters site as the hub VRF and branch sites as spoke VRFs. Spoke sites only receive routes from (and send routes to) the hub — they do not receive routes from other spokes. This means all inter-branch traffic must be routed through the hub PE and then to the headquarters firewall before being forwarded to the destination branch. RT (Route Target) import/export policies implement this: spokes export to a spoke-RT that only the hub imports, and the hub exports to a hub-RT that the spokes import. Any-to-any full mesh (option A) allows direct spoke-to-spoke communication, bypassing the firewall. Option B inter-AS (option C) is a multi-provider interconnect model, not a topology for firewall enforcement. VPLS (option D) is a Layer 2 VPN service and does not inherently force traffic through a single point.

Question 13

A network architect is designing WAN QoS for an enterprise SD-WAN deployment. The organization uses a third-party MPLS provider with DSCP-transparent transport. The architect must ensure that DSCP markings set by the enterprise QoS policy are preserved end-to-end across the MPLS cloud. Which mechanism ensures DSCP preservation in the MPLS provider network?

Accepted Answer

MPLS networks use a 3-bit Traffic Class (TC) field, formerly called EXP bits, in the MPLS label header for QoS marking. The provider's PE router at ingress must be configured to copy the customer's IP DSCP value (or a subset via a mapping table) into the MPLS TC bits, and the egress PE must restore the original DSCP value. Without this mapping, the P routers in the MPLS core will make QoS decisions based on TC bits alone and the original IP DSCP values may be altered or ignored. Traffic shaping at the CE (option A) controls rate but does not preserve DSCP through the provider cloud. 802.1p CoS bits (option C) are Layer 2 QoS markers in Ethernet dot1q headers and are not automatically mapped to DSCP by MPLS PE routers. Option D describes a completely incorrect QoS concept — reordering packets does not preserve DSCP.

Question 14

A network architect is designing SD-WAN application-aware routing for a company that uses Salesforce CRM as a critical business application. The SD-WAN has two transports: an MPLS circuit (200 Mbps, low latency 10 ms, monthly SLA) and a cable broadband circuit (500 Mbps, variable latency 20–80 ms). The architect needs to ensure Salesforce traffic uses MPLS when latency is below 30 ms, but falls back to broadband when MPLS latency exceeds 30 ms. Which SD-WAN feature implements this policy?

Accepted Answer

Cisco SD-WAN (Viptela) application-aware routing uses SLA classes to define performance thresholds (latency, jitter, packet loss) for each WAN transport. The data policy can match Salesforce traffic (by SAAS application signature or DPI) and apply an SLA class that specifies MPLS as the preferred transport when latency is under 30 ms, with broadband as the fallback. The vEdge continuously monitors each transport path's real-time performance using BFD probes and automatically switches traffic when a threshold is violated. DSCP marking (option A) is useful for QoS within a path but cannot switch between WAN transports based on real-time latency. Static routing with AD (option C) is a static failover with no real-time performance measurement. BGP MED (option D) is a static routing preference mechanism, not a dynamic SLA-based path selector.

Question 15

A network architect is designing DNS for a multinational enterprise with a private internal namespace (corp.example.com) and a public namespace (example.com). Internal clients must resolve both internal hosts and public internet names, while external internet users must only resolve public records. Which DNS design pattern implements this requirement?

Accepted Answer

Split-brain (split-horizon) DNS is the standard architectural pattern for this requirement. Internal DNS servers are authoritative for the private namespace (corp.example.com) and recursively resolve public names via forwarding to public resolvers or root servers. Internal clients query internal DNS servers, receiving both internal and public answers. External DNS servers (e.g., hosted by a DNS provider) are authoritative only for the public namespace (example.com) and have no visibility into internal records. A single DNS server with ACLs (option A) is operationally complex and creates a single point of failure for both internal and external DNS. DNSSEC (option C) provides data integrity and authentication but does not restrict query access — anyone can query DNSSEC-signed records. Anycast DNS with BGP filtering (option D) could work but is far more complex than split-brain DNS and exposes internal architecture to BGP routing decisions.

Question 16

A network architect is designing DHCP redundancy for a large enterprise with 10,000+ DHCP clients distributed across 200 subnets. The current single DHCP server is a single point of failure. Which DHCP high-availability design provides automatic failover with minimal administrative overhead?

Accepted Answer

Windows Server DHCP failover protocol (or DHCP failover as defined in ISC Kea/ISC DHCP equivalents) synchronizes lease databases between active and standby servers. In hot-standby mode, the standby automatically assumes all DHCP responsibilities when the active fails, without manual intervention. This eliminates the SPOF while maintaining a consistent, synchronized lease database for all 200 subnets. Split-scope (option A) is a legacy approach that provides rough redundancy but has no lease synchronization — if a scope's 'owning' server fails, clients cannot renew leases on those addresses. IOS DHCP on every switch (option C) is operationally complex to manage at scale and lacks centralized lease tracking. ip helper-address (option D) provides DHCP relay/forwarding, not DHCP server high availability.

Question 17

A network architect is designing multicast for a financial trading platform where market data feeds (UDP multicast) must be delivered to hundreds of subscriber servers within the data center. The design requires a Rendezvous Point (RP) that is highly available and does not create a single point of failure. Which RP design provides automatic RP redundancy with load distribution?

Accepted Answer

Anycast RP is the standard design for highly available multicast in large networks. Multiple routers are configured with the same IP address as a loopback (the anycast RP address). IGP routes this address to the nearest RP via the shortest IGP path. MSDP (Multicast Source Discovery Protocol) peers between all anycast RP routers to share knowledge of active multicast sources, ensuring any RP can correctly answer PIM-SM Join requests. If one RP fails, the IGP reconverges and traffic flows to the next-closest RP — without any manual reconfiguration. A single static RP (option A) is a SPOF. Auto-RP with a single Mapping Agent (option C) still has a single Mapping Agent SPOF. PIM Sparse-Dense mode (option D) is deprecated and causes flooding in Dense mode, which is unacceptable for large-scale financial multicast.

Question 18

A network architect is designing NTP for a financial services firm that requires microsecond-accurate time synchronization for transaction logging and regulatory compliance. The firm's servers require time accuracy better than 1 millisecond. Which time synchronization technology and design can achieve sub-millisecond accuracy?

Accepted Answer

IEEE 1588 PTP (Precision Time Protocol) with hardware timestamping achieves sub-microsecond accuracy by using hardware-level timestamps at switch ingress/egress, eliminating software processing jitter. PTP uses boundary clocks or transparent clocks in the network switches to compensate for residence time. This is the standard for financial trading, industrial control, and 5G RAN timing. NTP (option A) provides millisecond-level accuracy on LANs — good for log correlation but insufficient for sub-millisecond financial transaction timestamps. SNTP (option C) is a simplified NTP variant with lower accuracy than full NTP; increasing polling frequency does not achieve sub-millisecond accuracy. NTP MD5 authentication (option D) provides security, not timing accuracy — authentication has no effect on synchronization precision.

Question 19

A CISO has mandated zero trust architecture for the enterprise network. The network architect must design the network to enforce zero trust principles. Which design element is most central to a network-based zero trust architecture?

Accepted Answer

Zero trust architecture (NIST SP 800-207) is built on the principle 'never trust, always verify.' The network-centric elements are: (1) micro-segmentation — no implicit trust based on network zone or location; (2) identity-based access — every user, device, and application must authenticate and be authorized for each resource; (3) continuous verification — session risk is continuously evaluated. Traditional perimeter firewalls (option A) trust everything inside the perimeter — the opposite of zero trust. IPsec encryption (option C) protects data in transit but does not implement identity-based access control. Disabling inter-VLAN routing (option D) is an extreme segmentation measure that would prevent legitimate communication and is not a scalable zero trust implementation.

Question 20

A network architect is designing a DMZ for a company that hosts public-facing web servers and an internal database back-end. The security team requires that internet traffic can only reach the web servers in the DMZ, and DMZ servers can only reach the database servers on a specific port. Which DMZ design provides the highest security for this architecture?

Accepted Answer

A dual-firewall DMZ provides defense-in-depth: an outer firewall (typically a lower-cost, high-throughput firewall) filters internet traffic, allowing only HTTP/HTTPS to the DMZ web servers. An inner firewall provides a second layer of security between the DMZ and internal database servers, allowing only specific database ports from DMZ web servers. Using different vendor firewalls eliminates the risk that a single vendor's zero-day vulnerability could compromise both layers simultaneously. A single-firewall DMZ (option A) with three interfaces is a compromise — if the firewall is compromised, all zones are exposed. ACLs on a core router (option C) provide basic filtering but lack stateful inspection and application awareness. WAF-only (option D) protects against web application attacks but provides no network-layer isolation between DMZ and internal servers.

Question 21

A network architect is designing macro-segmentation vs micro-segmentation for a healthcare enterprise. The network must segment 500 IoT medical devices, 5,000 clinical workstations, and 2,000 administrative PCs. The security team requires that IoT devices cannot communicate with clinical workstations at Layer 3. Which segmentation technology scales best for this requirement?

Accepted Answer

Cisco TrustSec with SGT micro-segmentation is specifically designed for large-scale, identity-based segmentation. Each device is assigned a Scalable Group Tag (SGT) based on identity (802.1X result, MAB, profiling) and SGACLs define permitted communication between group pairs regardless of VLAN or physical location. This scales to thousands of devices without requiring separate VLANs per group. As devices move, their SGT travels with them. VLAN-based macro-segmentation (option A) scales poorly — each new device category may require a new VLAN at every access layer switch, leading to VLAN proliferation. PVLANs (option C) work at Layer 2 within a single VLAN and do not enforce policy across subnets. VRF isolation (option D) prevents all inter-group communication, including legitimate communication — it is too coarse-grained for this mixed-device environment.

Question 22

A network architect is designing the NMS (Network Management System) architecture for a large enterprise with 2,000+ network devices across 50 sites. The network operations team requires centralized Syslog, SNMP traps, and NetFlow collection. Which NMS architecture consideration is most critical for reliability at this scale?

Accepted Answer

A distributed collection architecture is essential at 2,000-device scale across 50 sites: sending all device telemetry (especially NetFlow, which can be very high volume) across the WAN to a single central collector is bandwidth-inefficient and creates a single point of failure. Regional collectors process and summarize data locally, sending only aggregate or filtered data to the central NMS. This reduces WAN load and improves resilience. A single central collector (option A) creates a SPOF and WAN bandwidth bottleneck. SNMP v1 (option C) is insecure (clear-text community strings) and 30-second polling intervals are too infrequent for real-time network health. Disabling NetFlow (option D) eliminates traffic flow visibility, which is essential for capacity planning, security investigation, and application performance management.

Question 23

A network architect is evaluating automation platforms for a large enterprise with 500 network devices. The current workflow is entirely CLI-based with manual change windows. The architect must recommend a platform that provides intent-based networking with automated compliance checking and closed-loop remediation. Which platform and approach best fits this requirement?

Accepted Answer

Cisco Catalyst Center (formerly Cisco DNA Center) implements intent-based networking: the operator defines the desired network state (intent), and Catalyst Center translates intent into device configurations, deploys them, continuously monitors the network state, and performs closed-loop remediation when drift is detected. This is the only option in the list that provides all three required capabilities: automated provisioning, compliance checking against defined intent, and closed-loop remediation. Ansible (option A) provides idempotent configuration management but requires explicit playbook execution — it does not provide autonomous closed-loop remediation. Terraform (option C) focuses on resource provisioning lifecycle, not network assurance. RANCID (option D) is a legacy configuration archive tool with no automation or compliance enforcement.

Question 24

A network architect is designing BCP/DRP for the enterprise routing infrastructure. The RTO for the primary data center WAN edge router failure must be under 30 seconds. The current design uses OSPF with default timers (hello 10s, dead 40s). What combination of features achieves sub-30-second recovery?

Accepted Answer

The combination of BFD + OSPF NSF + IP FRR provides sub-second to sub-30-second recovery with multiple layers: BFD detects the physical failure in under 1 second (300ms × 3 = 900ms), vastly faster than reduced OSPF timers. IP FRR with LFA (Loop-Free Alternates) provides pre-computed backup paths that are installed immediately upon BFD-triggered failure detection, achieving sub-second traffic reconvergence before OSPF even begins SPF calculation. OSPF NSF allows the router's forwarding plane to continue operating during a routing process restart, preventing traffic drops during software upgrades. Reducing OSPF timers (option A) achieves ~4 second detection which is within 30 seconds but cannot achieve sub-second recovery and increases OSPF protocol overhead. VRRP (option C) protects the gateway IP but not the entire routing infrastructure. Graceful Restart (option D) helps during planned restarts but does not provide fast failure detection.

Question 25

A network architect is designing SSL/TLS inspection for an enterprise NGFW. The organization needs to inspect HTTPS traffic for malware and DLP policy violations. The architect discovers that several business-critical applications use certificate pinning. What is the design implication of TLS inspection for applications with certificate pinning, and how should the architect address it?

Accepted Answer

TLS inspection (SSL interception) works by terminating the client's TLS session at the NGFW and re-initiating a new TLS session to the server. The NGFW presents a dynamically generated certificate (signed by the enterprise's trusted CA) to the client. Applications that use certificate pinning — where the client application has the expected server certificate or public key hardcoded — will reject the NGFW's re-signed certificate because it does not match the pinned value, causing the application to fail. The correct design is to add pinned-certificate applications (e.g., mobile banking apps, enterprise MDM solutions) to a TLS bypass list, allowing their traffic to pass uninspected while all other HTTPS traffic is inspected. Disabling TLS inspection entirely (option A) defeats the security purpose. Certificate pinning does not help TLS inspection (option C is a false statement). TLS inspection does not require IPsec encapsulation (option D is incorrect).

400-007 CCDE — Cisco Certified Design Expert (CCDE)