A soft failure refers to a condition where the network continues to operate, but performance or behavior is degraded in a way that is not immediately visible or detectable-this includes suboptimal routing, misconfigured protocols, or resource inefficiencies. These are harder to define and detect because they don't cause total outages but still impact user experience or service quality. In contrast, hard failures like outages (Option D) are more visible and measurable.
This aligns with CCDE v3.1's guidance on resilience, observability, and performance-aware design, emphasizing proactive identification of non-fatal but service-impacting anomalies.

# Explanation:
* A: Phishing attacks often spoof SSL/TLS sessions or redirect traffic to rogue endpoints. Monitoring connections to unknown cloud instances-especially with SSL decryption-can detect traffic to phishing sites or unauthorized resources.
Other options:
* B: Monitoring APIs helps but doesn't directly address phishing-based redirection.
* C: Blanket outside access restrictions are impractical and not effective against token hijacking.
* D: Firewall config changes are administrative-level concerns, unrelated to app-level token misuse.

The priority queue (strict priority queue) is intended for real-time, delay-sensitive traffic like voice and certain video, which have:
* D. Intolerance to jitter: Real-time traffic requires consistent latency.
* E. TCP-based application: Many real-time video streams and some financial trading apps use TCP but still require minimal jitter and latency.
CCDE v3.1 emphasizes that strict priority queue should only be used for traffic highly sensitive to delay and jitter to avoid starving other queues.
Why other options are incorrect:
* A: HTTP-like small transactions are delay-tolerant.
* B: WRED (Weighted Random Early Detection) is used for congestion avoidance, not prioritization.
* C: Priority queue is specifically for traffic intolerant to loss and jitter.
-

MLD (Multicast Listener Discovery) snooping for IPv6 operates similarly to IGMP snooping in IPv4. It tracks listener reports to restrict multicast flooding within a Layer 2 domain.
* C: Querier elections are triggered when a querier becomes unreachable or its IP address changes.
* D: The querier with the lowest IPv6 address is elected as the active querier, which manages report
/query communication.
Other options:
* A: QoS is not automatically enabled with MLD snooping.
* B: MLD querier functionality operates per VLAN-not per group-so only one querier is elected per VLAN.