# Explanation:
* A: Virtual networks (e.g., VPNs, tunnels) create secure, logical overlays across segmented physical infrastructure such as the public Internet, effectively re-integrating remote sites into the corporate network. This re-establishes end-to-end connectivity and consistent routing/security policies.
Other options:
* B: QoS does not address segmentation or connectivity.
* C: Lax control-plane policies do not restore logical network integration and may increase security risk.
* D: Blocking traffic further limits connectivity and exacerbates segmentation.

To achieve sub-50 millisecond convergence after a link or node failure, the design must rely on precomputed protection paths and local repair mechanisms in the data plane. The following mechanisms meet this requirement:
* B. Ti-LFA (Topology Independent Loop-Free Alternate): A next-generation fast reroute method used in Segment Routing. It offers local protection by computing loop-free backup paths that are independent of the specific failure type (node or link). It's capable of sub-50 ms convergence by rerouting traffic immediately on failure.
* D. MPLS-FRR (Fast Reroute): A traditional mechanism in MPLS networks that provides pre-signaled backup Label Switched Paths (LSPs). It enables fast switchover upon failure detection-also under 50 ms.
Other options:
* A. BFD: Provides fast failure detection, but does not provide the actual traffic reroute mechanism.
* C. Minimal BGP scan time: Impacts control plane responsiveness but not sub-50 ms convergence.
* E. IGP fast hello: Improves failure detection but alone doesn't guarantee traffic reroute under 50 ms.

* The goal is to prevent AS 111 from being used as a transit AS.
* The most effective method is to use an AS path access list to filter outbound BGP advertisements, allowing only prefixes originated from AS 111 (AS path contains only AS 111).
* This ensures AS 111 only advertises its own prefixes and does not forward third-party prefixes between providers.
Why other options are incorrect:
* A: AS-set is used for aggregation, not for transit prevention.
* B: Local preference controls outbound path selection, not advertisement or transit.
* D: Prefix list on inbound filters received prefixes, but does not prevent transit.
-

In MPLS networks, the MPLS header contains a 3-bit EXP (experimental) field that is used for QoS classification. Since the customer edge (CE) is managed by the service provider, it is common and best practice to map customer traffic classification (DSCP) into MPLS EXP at ingress into the MPLS core. This allows consistent QoS treatment throughout the core.
* DSCP provides granular QoS markings (6-bit field, 64 values) which can be easily mapped to 3-bit EXP (8 values).
* Mapping DSCP to EXP supports the 6-class model required by many service providers.
Why other options are incorrect:
* A, C: IP CoS and IP precedence are legacy and not as granular as DSCP.
* B: Flow-label is used in IPv6 for traffic engineering, not for MPLS QoS classification.
-

Cloud Bursting is the process by which applications or workloads that run in a private cloud or data center environment are "bursted" into a public cloud infrastructure during high-demand periods. This prevents service degradation and ensures performance continuity without manual intervention.
In CCDE design strategy terms, this enables:
* Elastic scalability
* Cost-effective use of public infrastructure on-demand
* Seamless service delivery to end users
Options like "cloud policing" and "cloud shaping" are not standard terms, and "cloud spill" is not an established mechanism. "Cloud bursting" is the correct architectural mechanism that addresses this overflow requirement.