Tested 350-401 Exam Dumps - Fosters Your Exam Passing Skills

Tested 350-401 Exam Dumps – Fosters Your Exam Passing Skills

Jonnie Karnath2023-05-02T06:37:10+00:00

Are you planning to take the Cisco 350-401 exam soon and want to ensure you pass with flying colors? Look no further than Certspots, the leading provider of the latest 350-401 exam dumps designed to help you foster your exam passing skills. At Certspots, we understand how important it is for you to succeed in your 350-401 exam, which is why we offer the most comprehensive and up-to-date collection of 350-401 exam dumps available. Our team of expert trainers and certified professionals have curated a wide range of 350-401 exam dumps that cover all the important topics and areas of the exam, ensuring that you are fully prepared for any question that comes your way.

Page 1 of 23

1. Which technology provides a secure communication channel for all traffic at Layer 2 of the OSI model?

MACsec

IPsec

SSL

Cisco Trustsec

2. What is one difference between EIGRP and OSPF?

OSPF is a Cisco proprietary protocol, and EIGRP is an IETF open standard protocol.

OSPF uses the DUAL distance vector algorithm, and EIGRP uses the Dijkstra link-state algorithm

EIGRP uses the variance command lot unequal cost load balancing, and OSPF supports unequal cost balancing by default.

EIGRP uses the DUAL distance vector algorithm, and OSPF uses the Dijkstra link-state algorithm

3. Which two pieces of information are necessary to compute SNR? (Choose two.)

transmit power

noise floor

EIRP

antenna gain

RSSI

4. Refer to the exhibit.

An engineer must deny Telnet traffic from the loopback interface of router R3 to the loopback interface of router R2 during the weekend hours. All other traffic between the loopback interfaces of routers R3 and R2 must be allowed at all times.

Which command accomplish this task?

A)

Option A

Option B

Option C

Option D

5. Wireless users report frequent disconnections from the wireless network. While troubleshooting a network engineer finds that after the user a disconnect, the connection re-establishes automatically without any input required.

The engineer also notices these message logs.

Which action reduces the user impact?

increase the AP heartbeat timeout

increase BandSelect

enable coverage hole detection

increase the dynamic channel assignment interval

6. What Is a Type 2 hypervisor?

installed as an application on an already installed operating system

runs directly on a physical server and includes its own operating system

supports over-allocation of physical resources

also referred to as a "bare metal hypervisor" because it sits directly on the physical server

7. Refer to the exhibit.

An engineer reconfigures the pot-channel between SW1 and SW2 from an access port to a trunk and immediately notices this error in SW1's log.

Which command set resolves this error?

SW1(config-if)#interface Gi0/0 SW1(config-if)#no spanning-tree bpdufilter SW1(config-if)#shut SW1(config-if)#no shut

SW1(config-if)#interface Gi0/0 SW1(config-if)#no spanning-tree bpduguard enable SW1(config-if)#shut SW1(config-if)#no shut

SW1(config-if)#interface Gi0/0 SW1(config-if)#spanning-tree bpduguard enable SW1(config-if)#shut SW1(config-if)#no shut

SW1(config-if)#interface Gi0/1 SW1(config-if)#spanning-tree bpduguard enable SW1(config-if)#shut SW1(config-if)#no shut

8. Refer to the exhibit.

An engineer must modify the access control list EGRESS to allow all IP traffic from subnet 10.1.10.0/24 to 10.1.2.0/24. The access control list is applied in the outbound direction on router interface GigabitEthemet 0/1.

Which configuration commands can the engineer use to allow this traffic without disrupting existing traffic flows?

A)

Option A

Option B

Option C

Option D

9. How do the RIB and the FIB differ?

FIB contains routes learned through a dynamic routing protocol, and the RIB contains routes that are static or directly connected.

RIB contains the interface for a destination, and the FIB contains the next hop information.

FIB is derived from the control plane, and the RIB is derived from the data plane.

RIB is derived from the control plane, and the FIB is derived from the RI

10. Which features does Cisco EDR use to provide threat detection and response protection?

containment, threat intelligence, and machine learning

firewalling and intrusion prevention

container-based agents

cloud analysis and endpoint firewall controls

Page 2 of 23

11. Which component handles the orchestration plane of the Cisco SD-WAN?

vBond

cSmart

vManage

WAN Edge

12. What are two characteristics of VXLAN? (Choose two)

It uses VTEPs to encapsulate and decapsulate frames.

It has a 12-bit network identifier

It allows for up to 16 million VXLAN segments

It lacks support for host mobility

It extends Layer 2 and Layer 3 overlay networks over a Layer 2 underlay.

13. Which element enables communication between guest VMs within a virtualized environment?

hypervisor

vSwitch

virtual router

pNIC

14. DRAG DROP

Drag and drop the virtual components from the left onto their deceptions on the right.

15. DRAG DROP

Drag and drop the tools from the left onto the agent types on the right.

16. When using BFD in a network design, which consideration must be made?

BFD is used with first hop routing protocols to provide subsecond convergence.

BFD is more CPU-intensive than using reduced hold timers with routing protocols.

BFD is used with dynamic routing protocols to provide subsecond convergence.

BFD is used with NSF and graceful to provide subsecond convergence.

17. Ensure that the /32 networks at Remote Site 1 and Remote Site 2 can ping each other.

18. CORRECT TEXT

Simulation 09

19. Refer to the exhibit.

An engineer is troubleshooting an application running on Apple phones. The application Is receiving incorrect QoS markings. The systems administrator confirmed that ail configuration profiles are correct on the Apple devices.

Which change on the WLC optimizes QoS for these devices?

Enable Fastlane

Set WMM to required

Change the QoS level to Platinum

Configure AVC Profiles

20. Which technology does VXLAN use to provide segmentation for Layer 2 and Layer 3 traffic?

bridge domain

VLAN

VRF

VNI

Page 3 of 23

21. Refer to the exhibit.

Which configuration allows Customer2 hosts to access the FTP server of Customer1 that has the IP address of 192.168.1.200?

ip route vrf Customer1 172.16.1.0 255.255.255.0 172.16.1.1 global ip route vrf Customer2 192.168.1.200 255.255.255.255 192.168.1.1 global ip route 192.168.1.0 255.255.255.0 Vlan10 ip route 172.16.1.0 255.255.255.0 Vlan20

ip route vrf Customer1 172.16.1.0 255.255.255.0 172.16.1.1 Customer2 ip route vrf Customer2 192.168.1.200 255.255.255.255 192.168.1.1 Customer1

ip route vrf Customer1 172.16.1.0 255.255.255.0 172.16.1.1 Customer1 ip route vrf Customer2 192.168.1.200 255.255.255.255 192.168.1.1 Customer2

ip route vrf Customer1 172.16.1.1 255.255.255.255 172.16.1.1 global ip route vrf Customer2 192.168.1.200 255.255.255.0 192.168.1.1 global ip route 192.168.1.0 255.255.255.0 Vlan10 ip route 172.16.1.0 255.255.255.0 Vlan20

22. DRAG DROP

Refer to the exhibit

Drag and drop the snippets into the RESTCONF request to form the request that returns this response Not all options are used

23. Refer to the exhibit.

Rapid PVST+ is enabled on all switches.

Which command set must be configured on switch1 to achieve the following results on port fa0/1?

✑ When a device is connected, the port transitions immediately to a forwarding state.

✑ The interface should not send or receive BPDUs.

✑ If a BPDU is received, it continues operating normally.

Switch1(config)# spanning-tree portfast bpdufilter default Switch1(config)# interface f0/1 Switch1(config-if)# spanning-tree portfast

Switch1(config)# spanning-tree portfast bpduguard default Switch 1 (config)# interface f0/1 Switch1 (config-if)# spanning-tree portfast

Switch1(config)# interface f0/1 Switch1(config-if)# spanning-tree portfast

Switch1(config)# interface f0/1 Switch1(config-if)# spanning-tree portfast Switch1 (config-if)# spanning-tree bpduguard enable

24. Which NGFW mode block flows crossing the firewall?

Passive

Tap

Inline tap

Inline

25. A customer has 20 stores located throughout a city. Each store has a single Cisco access point managed by a central WLC. The customer wants to gather analysis for users in each store.

Which technique supports these requirements?

angle of arrival

hyperlocation

trilateration

presence

26. A network engineer configures BGP between R1 and R2. Both routers use BGP peer group CORP and are set up to use MD5 authentication.

This message is logged to the console of router R1:

“ May 5 39:85:55.469: %TCP-6-BADAUTH ” Invalid MD5 digest from 10.10.10.1 (29832) to 10.120.10.1 (179) tebleid -0

Which two configuration allow peering session to from between R1 and R2? Choose two.)

R1(config-router)#neighbor 10.10.10.1 peer-group CORP R1(config-router)#neighbor CORP password Cisco

R2(config-router)#neighbor 10.120.10.1 peer-group CORP R2(config-router)#neighbor CORP password Cisco

R2(config-router)#neighbor 10.10.10.1 peer-group CORP R2(config-router)#neighbor PEER password Cisco

R1(config-router)#neighbor 10.120.10.1 peer-group CORP R1(config-router)#neighbor CORP password Cisco

R2(config-router)#neighbor 10.10.10.1 peer-group CORP R2(config-router)#neighbor CORP password Cisco

27. An engineer must export the contents of the devices object in JSON format.

Which statement must be used?

json.repr(Devices)

json.dumps(Devices)

json.prints(Devices)

json.loads(Devices)

28. What is the difference between a RIB and a FIB?

The RIB is used to make IP source prefix-based switching decisions

The FIB is where all IP routing information is stored

The RIB maintains a mirror image of the FIB

The FIB is populated based on RIB content

29. Which DNS lookup does an AP perform when attempting CAPWAP discovery?

CAPWAP-CONTROLLE

Iocal

CISCO-CAPWAP-CONTROLLE

Iocal

CISCO-DNA-CONTROLLE

Iocal

CISCO-CONTROLLE

Iocal

30. Refer to the exhibit.

A company has an internal wireless network with a hidden SSID and RADIUS-based client authentication for increased security. An employee attempts to manually add the company network to a laptop, but the laptop does not attempt to connect to the network. The regulatory domains of the access points and the laptop are identical.

Which action resolves this issue?

Ensure that the "Connect even if this network is not broadcasting" option is selected.

Limit the enabled wireless channels on the laptop to the maximum channel range that is supported by the access points.

Change the security type to WPA2-Personal AE

Use the empty string as the hidden SSID network name.

Page 4 of 23

31. Which two Cisco SD-Access components provide communication between traditional network elements and controller layer? (choose two)

network data platform

network underlay

fabric overlay

network control platform

partner ecosystem

32. Which three elements determine Air Time efficiency? (Choose three)

evert-driven RRM

data rate (modulation density) or QAM

channel bandwidth

number of spatial streams and spatial reuse

RF group leader

dynamic channel assignment

33. Which VXLAN component is used to encapsulate and decapsulate Ethernet frames?

VNI

GRE

VTEP

EVPN

34. How does Cisco Trustsec enable more access controls for dynamic networking environments and data centers?

classifies traffic based on advanced application recognition

uses flexible NetFlow

classifies traffic based on the contextual identity of the endpoint rather than its IP address correct

assigns a VLAN to the endpoint

35. Which exhibit displays a valid JSON file?

A)

Option A

Option B

Option C

Option D

36. Which activity requires access to Cisco DNA Center CLI?

provisioning a wireless LAN controller

creating a configuration template

upgrading the Cisco DNA Center software

graceful shutdown of Cisco DNA Center

37. An engineer must configure an EXEC authorization list that first checks a AAA server then a local username. If both methods fail, the user is denied.

Which configuration should be applied?

aaa authorization exec default local group tacacs+

aaa authorization exec default local group radius none

aaa authorization exec default group radius local none

aaa authorization exec default group radius local

38. DRAG DROP

Drag and drop the characteristics from the left onto the deployment models on the right Not all options are used.

39. When is an external antenna used inside a building?

only when using Mobility Express

when it provides the required coverage

only when using 2 4 GHz

only when using 5 GHz

40. What is a VPN in a Cisco SD-WAN deployment?

common exchange point between two different services

attribute to identify a set of services offered in specific places in the SD-WAN fabric

virtualized environment that provides traffic isolation and segmentation in the SD-WAN fabric

virtual channel used to carry control plane information

Page 5 of 23

41. What is used to perform OoS packet classification?

the Options field in the Layer 3 header

the Type field in the Layer 2 frame

the Flags field in the Layer 3 header

the TOS field in the Layer 3 header

42. Which cisco DNA center application is responsible for group-based accesss control permissions?

Design

Provision

Assurance

Policy

43. Which Python snippet should be used to store the devices data structure in a JSON file?

Option A

Option B

Option C

Option D

44. Refer to the exhibit.

A network engineer must configure NETCONF. After creating the configuration, the engineer gets output from the command show line, but not from show running-config.

Which command completes the configuration?

Option A

Option B

Option C

Option D

45. DRAG DROP

An engineer creates the configuration below.

R1#sh run | i aaa -

aaa new-model

aaa authentication login default group ACE group AAA_RADIUS local-case

aaa session-id common

R1#

Drag and drop the authentication methods from the left into the order of priority on the right. Not all options are used.

46. Which line must be added in the Python function to return the JSON object {"cat_9k": “FXS193202SE")?

Option A

Option B

Option C

Option D

47. Refer to the exhibit.

Which configuration enables fallback to local authentication and authorization when no TACACS+ server is available?

Router(config)# aaa authentication login default local Router(config)# aaa authorization exec default local

Router(config)# aaa authentication login default group tacacs+ local Router(config)# aaa authorization exec default group tacacs+ local

Router(config)# aaa fallback local

Router(config)# aaa authentication login FALLBACK local Router(config)# aaa authorization exec FALLBACK local

48. By default, which virtual MAC address does HSRP group 41 use?

0c:5e:ac:07:0c:29

00:05:0c:07:ac:41

004:41:73:18:84:29

00:00:0c:07:ac:29

49. What does the Cisco DNA Center Authentication API provide?

list of global issues that are logged in Cisco DNA Center

access token to make calls to Cisco DNA Center

list of VLAN names

dent health status

50. DRAG DROP

Drag anti drop the characteristics from the ten onto the configuration models on the right.

Page 6 of 23

51. Refer to the exhibit.

Which command allows hosts that are connected to FastEthernet0/2 to access the Internet?

ip nat inside source list 10 interface FastEthernet0/1 overload

ip nat inside source list 10 interface FastEthernet0/2 overload

ip nat outside source list 10 interface FastEthernet0/2 overload

ip nat outside source static 209.165.200.225 10.10.10.0 overload

52. Which JSON syntax is valid?

{“switch”:”name”:”dist1″,”interfaces”:[“gig1″,”gig2″,”gig3”]}

{„switch‟:(„name‟:‟dist1′,‟interfaces‟:[„gig1′,‟gig2′,‟gig3‟])}

{“switch”:{“name”:”dist1″,”interfaces”:[“gig1″,”gig2″,”gig3”]}}

{/”switch/”:{/”name/”:”dist1″,/”interfaces/”:[“gig1″,”gig2″,”gig3”]}}

53. What does the cisco DNA REST response indicate?

Cisco DNA Center has the Incorrect credentials for cat3850- 1

Cisco DNA Center is unable to communicate with cat9000- 1

Cisco DNA Center has the incorrect credentials for cat9000- 1

Cisco DNA Center has the Incorrect credentials for RouterASR-1

54. What is the purpose of the LISP routing and addressing architecture?

It creates two entries for each network node, one for Its identity and another for its location on the network.

It allows LISP to be applied as a network visualization overlay though encapsulation.

It allows multiple Instances of a routing table to co-exist within the same router.

It creates head-end replication used to deliver broadcast and multicast frames to the entire network.

55. DRAG DROP

Drag and drop the snippets onto the blanks within the code to construct a script that advertises the network prefix 192.168.5.0/24 into a BGP session. Not all options are used

56. Refer to the exhibit.

Which configuration establishes EBGP neighborship between these two directly connected neighbors and exchanges the loopback network of the two routers through BGP?

R1(config)#router bgp 1 R1(config-router)#neighbor 192.168.10.2 remote-as 2 R1(config-router)#network 10.1.1.0 mask 255.255.255.0 R2(config)#router bgp 2 R2(config-router)#neighbor 192.168.10.1 remote-as 1 R2(config-router)#network 10.2.2.0 mask 255.255.255.0

R1(config)#router bgp 1 R1(config-router)#neighbor 10.2.2.2 remote-as 2 R1(config-router)#network 10.1.1.0 mask 255.255.255.0 R2(config)#router bgp 2 R2(config-router)#neighbor 10.1.1.1 remote-as 1 R2(config-router)#network 10.2.2.0 mask 255.255.255.0

R1(config)#router bgp 1 R1(config-router)#neighbor 192.168.10.2 remote-as 2 R1(config-router)#network 10.0.0.0 mask 255.0.0.0 R2(config)#router bgp 2 R2(config-router)#neighbor 192.168.10.1 remote-as 1 R2(config-router)#network 10.0.0.0 mask 255.0.0.0

R1(config)#router bgp 1 R1(config-router)#neighbor 10.2.2.2 remote-as 2 R1(config-router)#neighbor 10.2.2.2 update-source |o0 R1(config-router)#network 10.1.1.0 mask 255.255.255.0 R2(config)#router bgp 2 R2(config-router)#neighbor 10.1.1.1 remote-as 1 R2(config-router)#neighbor 10.1.1.1 update-source |o0 R2(config-router)#network 10.2.2.0 mask 255.255.255.0

57. Refer to the exhibit.

Which single security feature is recommended to provide Network Access Control in the enterprise?

MAB

802.1X

WebAuth

port security sticky MAC

58. A company has an existing Cisco 5520 HA cluster using SSO. An engineer deploys a new single Cisco Catalyst 9800 WLC to test new features. The engineer successfully configures a mobility tunnel between the 5520 cluster and 9800 WLC. Client connected to the corporate WLAN roam seamlessly between access points on the 5520 and 9800 WLC. After a failure on the primary 5520 WLC, all WLAN services remain functional; however, Client roam between the 5520 and 9800 controllers without dropping their connection.

Which feature must be configured to remedy the issue?

mobility MAC on the 5520 cluster

mobility MAC on the 9800 WLC

new mobility on the 5520 cluster

new mobility on the 9800 WLC

59. Refer to the exhibit.

Which type of antenna is show on the radiation patterns?

Dipole

Yagi

Patch

Omnidirectional

60. Which IPv4 packet field carries the QoS IP classification marking?

TTL

FCS

ToS

Page 7 of 23

61. Refer to the exhibit.

Extended access-list 100 is configured on interface GigabitEthernet 0/0 in an inbound direction, but it does not have the expected behavior of allowing only packets to or from 192.168.0.0/16.

Which command set properly configures the access list?

R1(config)#no access-list 100 seq 10 R1(config)#access-list 100 seq 40 deny ip any any

R1(config)#ip access-list extended 100 R1(config-ext-nacl)#no 10

R1(config)#no access-list 100 deny ip any any

R1(config)#ip access-list extended 100 R1(config-ext-nacl)#5 permit to any any

62. Which method of account authentication does OAuth 2.0 within REST APIs?

username/role combination

access tokens

cookie authentication

basic signature workflow

63. Which two characteristics define the Intent API provided by Cisco DNA Center? (Choose two.)

northbound API

business outcome oriented

device-oriented

southbound API

procedural

64. Refer to the exhibit.

What is the Json syntax that is formed from the data?

{Name: Bob Johnson, Age: 75, Alive: true, Favorite Foods: [Cereal, Mustard, Onions]}

{"Name": "Bob Johnson", "Age": 75, "Alive": true, "Favorite Foods": ["Cereal", "Mustard", "Onions"]}

{"˜Name': "˜Bob Johnson', "˜Age': 75, "˜Alive': True, "˜Favorite Foods': "˜Cereal', "˜Mustard', "˜Onions'}

{"Name": "Bob Johnson", "Age": Seventyfive, "Alive": true, "Favorite Foods": ["Cereal", "Mustard", "Onions"]}

65. DRAG DROP

Drag and drop the descriptions from the left onto the QoS components on the right.

66. A server running Linux is providing support for virtual machines along with DNS and DHCP services for a small business.

Which technology does this represent?

container

Type 1 hypervisor

hardware pass-thru

Type 2 hypervisor

67. What is the purpose of the weight attribute in an EID-lo-RLOC mapping?

it indicates the preference for using LISP over native IP connectivity.

it determines the administrative distance of LISP generated routes in the RIB

It identifies the preferred RLOC address family.

it indicates the load-balancing ratio between CTRs of 9m earns priority.

68. By default, which virtual MAC address does HSRP group 22 use?

c0:42:01:67:05:16

c0:07:0c:ac:00:22

00:00:0c:07:ac:16

00:00:0c:07:ac:22

69. Refer to the exhibit.

How should the script be completed so that each device configuration is saved into a JSON- formatted file under the device name?

A)

Option

70. Refer to the exhibit.

Which EEM script generates a critical-level syslog message and saves a copy of the running configuration to the boot flash when an administrator saves the running configuration to the startup configuration?

Option A

Option B

Option C

Option D

Page 8 of 23

71. DRAG DROP

Drag and drop the characteristics from the left onto the switching architectures on the right.

72. Refer to the exhibit.

Which IP address becomes the active next hop for 192.168.102 0/24 when 192.168.101.2 fails?

192.168.101.18

192.168.101.6

192.168.101.10

192.168.101.14

73. Which two items are found in YANG data models? (Choose two.)

HTTP return codes

rpc statements

JSON schema

container statements

XML schema

74.

Refer to the exhibit.

Communication between London and New York is down.

Which command set must be applied to the NewYork switch to resolve the issue?

NewYork(config)#no interface po1 NewYork(config)#interface range fa0/1-2 NewYork(config-if)#channel-group 1 mode negotiate NewYork(config-if)#end NewYork#

NewYork(config)#no interface po1 NewYork(config)#interface range fa0/1-2 NewYork(config-if)#channel-group 1 mode on NewYork(config-if)#end NewYork#

NewYork(config)#no interface po1 NewYork(config)#interface range fa0/1-2 NewYork(config-if)#channel-group 1 mode passive NewYork(config-if)#end NewYork#

NewYork(config)#no interface po1 NewYork(config)#interface range fa0/1-2 NewYork(config-if)#channel-group 1 mode auto NewYork(config-if)#end NewYork#

75. In which two ways does the routing protocol OSPF differ from EIGRP? (Choose two.)

OSPF supports an unlimited number of hops. EIGRP supports a maximum of 255 hops.

OSPF provides shorter convergence time than EIGR

OSPF is distance vector protocol. EIGRP is a link-state protocol.

OSPF supports only equal-cost load balancing. EIGRP supports unequal-cost load balancing.

OSPF supports unequal-cost load balancing. EIGRP supports only equal-cost load balancing.

76. Refer to the exhibit.

What does the error message relay to the administrator who is trying to configure a Cisco IOS device?

A NETCONF request was made for a data model that does not exist.

The device received a valid NETCONF request and serviced it without error.

A NETCONF message with valid content based on the YANG data models was made, but the request failed.

The NETCONF running datastore is currently locked.

77. What are two characteristics of Cisco SD-Access elements? (Choose two.)

The border node is required for communication between fabric and nonfabric devices.

Traffic within the fabric always goes through the control plane node.

Fabric endpoints are connected directly to the border node.

The control plane node has the full RLOC-to-EID mapping database.

The border node has the full RLOC-to-EID mapping database.

78. Which statement about TLS is accurate when using RESTCONF to write configurations on network devices?

It requires certificates for authentication

It is provided using NGINX acting as a proxy web server

It is used for HTTP and HTTPS requests

It is not supported on Cisco devices

79. What is a characteristics of traffic policing?

lacks support for marking or remarking

must be applied only to outgoing traffic

can be applied in both traffic directions

queues out-of-profile packets until the buffer is full

80. Which method should an engineer use to deal with a long-standing contention issue between any two VMs on the same host?

Adjust the resource reservation limits

Live migrate the VM to another host

Reset the VM

Reset the host

Page 9 of 23

81. DRAG DROP

A network engineer is adding an additional 10Gps link to an exiting 2x10Gps LACP-based LAG to augment its capacity. Network standards require a bundle interface to be taken out of service if one of its member links goes down, and the new link must be added with minimal impact to the production network.

Drag and drop the tasks that the engineer must perform from the left into the sequence on the right. Not all options are used.

82. What is the result when an active route processor fails that combines NSF with SSO?

An NSF-capable device immediately updates the standby route processor RIB without churning the network.

The standby route processor immediately takes control and forwards packets along known routes.

An NSF-aware device immediately updates the standby route processor RIB without churning the network.

The standby route processor temporarily forwards packets until route convergence is complete.

83. Which QoS feature uses the IP Precedence bits in the ToS field of the IP packet header to partition traffic into different priority levels?

marking

shaping

policing

classification

84. Refer to the exhibit.

Which action completes the configuration to achieve a dynamic continuous mapped NAT for all users?

Configure a match-host type NAT pool

Reconfigure the pool to use the 192.168 1 0 address range

Increase the NAT pool size to support 254 usable addresses

Configure a one-to-one type NAT pool

85. What is a benefit of data modeling languages like YANG?

They enable programmers to change or write their own application within the device operating system.

They create more secure and efficient SNMP OIDs.

They make the CLI simpler and more efficient.

They provide a standardized data structure, which results in configuration scalability and consistency.

86. Which signal strength and noise values meet the minimum SNR for voice networks?

signal strength -67 dBm, noise 91 dBm

signal strength -69 dBm, noise 94 dBm

signal strength -68 dBm, noise 89 dBm

signal strength -66 dBm, noise 90 dBm

87. Which algorithms are used to secure REST API from brute attacks and minimize the impact?

SHA-512 and SHA-384

MD5 algorithm- 128 and SHA-384

SHA- 1, SHA-256, and SHA-512

PBKDF2, BCrypt, and SCrypt

88. Refer to the exhibit.

A network administrator configured RSPAN to troubleshoot an issue between switch1 and switch2. The switches are connected using interface GigabitEthernet 1/1. An external packet capture device is connected is switch2 interface GigabitEthernet 1/2.

Which two commands must be added to complete this configuration? (Choose two)

Option A

Option B

Option C

Option D

Option E

89. What is the function of a VTEP in VXLAN?

provide the routing underlay and overlay for VXLAN headers

dynamically discover the location of end hosts in a VXLAN fabric

encapsulate and de-encapsulate traffic into and out of the VXLAN fabric

statically point to end host locations of the VXLAN fabric

90. Which Cisco FlexConnect state allows wireless users that are connected to the network to continue working after the connection to the WLC has been lost?

Authentication Down/Switching Down

Authentication-Central/Switch-Local

Authentication- Down/Switch-Local

Authentication-Central/Switch-Central

Page 10 of 23

91. Refer to the exhibit.

An engineer must configure HSRP for VLAN 1000 on SW2. The secondary switch must immediately take over the role of active router If the interlink with the primary switch fails.

Which command set completes this task?

A)

Option A

Option B

Option C

Option D

92. A customer requests a network design that supports these requirements:

Which protocol does the design include?

HSRP version 2

VRRP version 2

GLBP

VRRP version 3

93. An engineer must configure router R1 to validate user logins via RADIUS and fall back to the local user database if the RADIUS server is not available.

Which configuration must be applied?

aaa authorization exec default radius local

aaa authorization exec default radius

aaa authentication exec default radius local

aaa authentication exec default radius

94. Refer to the exhibit.

An engineer configures HSRP and enters the show standby command.

Which two facts about the network environment are derived from the output? (Choose two.)

The local device has a higher priority selling than the active router

The virtual IP address of the HSRP group is 10.1.1.1.

If the local device fails to receive a hello from the active router for more than 5 seconds, it becomes the active router.

The hello and hold timers are set to custom values.

If a router with a higher IP address and same HSRP priority as the active router becomes available, that router becomes the new active router 5 seconds later.

95. A customer wants to connect a device to an autonomous Cisco AP configured as a WGB. The WGB is configured properly: however, it fails to associate to a CAPWAP- enabled AP.

Which change must be applied in the advanced WLAN settings to resolve this issue?

Enable Aironet I

Enable passive client.

Disable AAA override.

Disable FlexConnect local switching.

96. Running the script causes the output in the exhibit.

Which change to the first line of the script resolves the error?

from ncclient import

import manager

from ncclient import*

import ncclient manager

97. Which option works with a DHCP server to return at least one WLAN management interface IP address during the discovery phase and is dependent upon the VCI of the AP?

Option 42

Option 15

Option 125

Option 43

98. How do stratum levels relate to the distance from a time source?

Stratum 1 devices are connected directly to an authoritative time source.

Stratum 15 devices are connected directly to an authoritative time source

Stratum 0 devices are connected directly to an authoritative time source.

Stratum 15 devices are an authoritative time source.

99. Refer to the exhibit.

A network engineer must simplify the IPsec configuration by enabling IPsec over GRE using IPsec profiles.

Which two configuration changes accomplish this? (Choose two).

Create an IPsec profile, associate the transform-set ACL, and apply the profile to the tunnel interface.

Apply the crypto map to the tunnel interface and change the tunnel mode to tunnel mode ipsec ipv4.

Remove all configuration related to crypto map from R1 and R2 and eliminate the AC

Create an IPsec profile, associate the transform-set, and apply the profile to the tunnel interface.

Remove the crypto map and modify the ACL to allow traffic between 10.10.0.0/24 to 10.20.0.0/24.

100. Refer to the exhibit.

An engineer is configuring an EtherChannel between Switch1 and Switch2 and notices the console message on switch2.

Based on the output, which action resolves this issue?

Configure less member ports on Switch2.

Configure the same port channel interface number on both switches

Configure the same EtherChannel protocol on both switches

Configure more member ports on Switch1.

Page 11 of 23

101. How does the RIB differ from the FIB?

The RIB is used to create network topologies and routing tables. The FIB is a list of routes to particular network destinations.

The FIB includes many routes a single destination. The RIB is the best route to a single destination.

The RIB includes many routes to the same destination prefix. The FIB contains only the best route

The FIB maintains network topologies and routing tables. The RIB is a Iist of routes to particular network destinations.

102. Which encryption hashing algorithm does NTP use for authentication?

SSL

MD5

AES128

AES256

103. Refer to the exhibit.

What are two results of the NAT configuration? (Choose two.)

Packets with a destination of 200.1.1.1 are translated to 10.1.1.1 or .2. respectively.

A packet that is sent to 200.1.1.1 from 10.1.1.1 is translated to 209.165.201.1 on R1.

R1 looks at the destination IP address of packets entering S0/0 and destined for inside hosts.

R1 processes packets entering E0/0 and S0/0 by examining the source IP address.

R1 is performing NAT for inside addresses and outside address.

104. Which JSON script is properly formatted?

A)

Option A

Option B

Option C

Option D

105. DRAG DROP

Drag and drop the characteristics from the left onto the corresponding infrastructure deployment models on the right.

106. What is the function of the LISP map resolver?

to send traffic to non-LISP sites when connected to a service provider that does not accept nonroutable ElDs as packet sources

to connect a site to the LISP-capable part of a core network publish the EID-to-RLOC mappings for the site, and respond to map-request messages

to decapsulate map-request messages from ITRs and forward the messages to the M

to advertise routable non-LISP traffic from one address family to LISP sites in a different address family

107. What is the recommended MTU size for a Cisco SD-Access Fabric?

1500

9100

4464

17914

108. How does Cisco Trustsec enable more flexible access controls for dynamic networking environments and data centers?

uses flexible NetFlow

assigns a VLAN to the endpoint

classifies traffic based an the contextual identity of the endpoint rather than its IP address

classifies traffic based on advanced application recognition

109. Refer to the exhibit.

Which command when applied to the Atlanta router reduces type 3 LSA flooding into the backbone area and summarizes the inter-area routes on the Dallas router?

Atlanta(config-route)#area 0 range 192.168.0.0 255.255.248.0

Atlanta(config-route)#area 0 range 192.168.0.0 255.255.252.0

Atlanta(config-route)#area 1 range 192.168.0.0 255.255.252.0

Atlanta(config-route)#area 1 range 192.168.0.0 255.255.248.0

110. Refer to the exhibit.

The EtherChannel between SW2 and SW3 is not operational which action resolves this issue?

Configure the channel-group mode on SW2 Gi0/1 and Gi0/1 to on.

Configure the channel-group mode on SW3 Gi0/1 to active

Configure the mode on SW2 Gi0/0 to trunk

Configure the mode on SW2 Gi0/1 to access.

Page 12 of 23

111. DRAG DROP

Drag and drop the descriptions from the left onto the QoS components they describe on the right.

112. In a Cisco SD-WAN solution, how Is the health of a data plane tunnel monitored?

with IP SLA

ARP probing

using BFD

with OMP

113. Which protocol is used to encrypt control plane traffic between SD-WAN controllers and SD-WAN endpoints?

DTLS

IPsec

PGP

HTTPS

114. Refer to the exhibit.

What is the result when a technician adds the monitor session 1 destination remote vlan 223 command1?

The RSPAN VLAN is replaced by VLAN 223.

RSPAN traffic is sent to VLANs 222 and 223

An error is flagged for configuring two destinations.

RSPAN traffic is split between VLANs 222 and 223.

115. Refer to the exhibit

Users cannot reach the web server at 192.168 100 1.

What is the root cause for the failure?

The server is attempting to load balance between links 10.100 100.1 and 10 100.200.1.

The server is out of service.

There is a loop in the path to the server.

The gateway cannot translate the server domain name.

116. Refer to the exhibit.

Which configuration must be applied to ensure that the preferred path for traffic from AS 65010 toward AS 65020 uses the R2 to R4 path?

A)

Option A

Option B

Option C

Option D

117. DRAG DROP

Drag and drop the LIPS components on the left to the correct description on the right.

118. What is a fact about Cisco EAP-FAST?

It does not require a RADIUS server certificate.

It requires a client certificate.

It is an IETF standard.

It operates in transparent mode.

119. What is a characteristics of Cisco SD-WAN?

operates over DTLS/TLS authenticated and secured tunnels

requires manual secure tunnel configuration

uses unique per-device feature templates

uses control connections between routers

120. What are two benefits of implementing a Cisco SD-WAN architecture? (Choose two)

It provides resilient and effective traffic flow using MPL

It improves endpoint protection by integrating embedded and cloud security features.

It allows configuration of application-aware policies with real time enforcement.

It simplifies endpoint provisioning through standalone router management

It enforces a single. scalable. hub-and-spoke topology.

Page 13 of 23

121. DRAG DROP

Drag and drop the Qos mechanisms from the left to the correct descriptions on the right

122. Refer to the exhibit.

What is the effect of this configuration?

When users attempt to connect to vty lines 0 through 4, the device will authenticate them against TACACS+ if local authentication fails

The device will authenticate all users connecting to vty lines 0 through 4 against TACACS+

The device will allow users at 192.168.0.202 to connect to vty lines 0 through 4 using the password ciscotestkey

The device will allow only users at 192.166.0.202 to connect to vty lines 0 through 4

123. When configuration WPA2 Enterprise on a WLAN, which additional security component configuration is required?

NTP server

PKI server

RADIUS server

TACACS server

124. Refer to the exhibit.

A network engineer is enabling logging to a local buffer, to the terminal and to a syslog server for all debugging level logs filtered by facility code 7.

Which command is needed to complete this configuration snippet?

logging buffered debugging

logging discriminator Disc1 severity includes 7

logging buffered discriminator Disc1 debugging

logging discriminator Disc1 severity includes 7 facility includes fac7

125. Refer to the exhibit.

An engineer attempts to configure a router on a stick to route packets between Clients, Servers, and Printers; however, initial tests show that this configuration is not working.

Which command set resolves this issue?

interface Vlan10 no ipvrf forwarding Clients ! interface Vlan20 no ipvrf forwarding Servers ! interface Vlan30 no ipvrf forwarding Printers

router eigrp1 network 10.0.0.0 255.255.255.0 network 172.16.0.0 255.255.255.0 network 192.168.1.0 255.255.255.0

interface Vlan10 no ipvrf forwarding Clients ip address 192.168.1.2. 255.255.255.0 ! interface Vlan20 no ipvrf forwarding Servers ip address 172.16.1.2 255.255.255.0 ! interface Vlan30 no ipvrf forwarding Printers ip address 10.1.1.2 255.255.255.0

router eigrp1 network 10.0.0.0 255.0.0.0 network 172.16.0.0 255.255.0.0 network 192.168.1.0 255.255.0.0

126. How does Cisco Express Forwarding switching differ from process switching on Cisco devices?

Cisco Express Forwarding switching uses adjacency tables built by the CDP protocol, and process switching uses the routing table.

Cisco Express Forwarding switching uses dedicated hardware processors, and process switching uses the main processor.

Cisco Express Forwarding swithing saves memory by storing adjacency tables in dedicated memory on the line cards, and process switching stores all tables in the main memory.

Cisco Express Forwarding switching uses a proprietary protocol based on IS-IS for MAC address lookup, and process switching uses the MAC address table.

127. What is a benefit of a virtual machine when compared with a physical server?

Multiple virtual servers can be deployed on the same physical server without having to buy additional hardware.

Virtual machines increase server processing performance.

The CPU and RAM resources on a virtual machine cannot be affected by other virtual machines.

Deploying a virtual machine is technically less complex than deploying a physical server.

128. Which configuration restricts the amount of SSH that a router accepts 100 kbps?

Option A

Option B

Option C

Option D

129. Refer to the exhibit.

The port channel between the switches does not work as expected.

Which action resolves the issue?

Interface Gi0/0 on Switch2 must be configured as passive.

Interface Gi0/1 on Switch1 must be configured as desirable.

interface Gi0/1 on Switch2 must be configured as active.

Trucking must be enabled on both Interfaces on Switch2.

130. In a Cisco SD-Access solution, which protocol is used by an extended node to connect to a single edge node?

VXLAN

IS-IS

802 1Q

CTS

Page 14 of 23

131. Refer to the exhibit.

Which command set completes the ERSPAN session configuration?

Option A

Option B

Option C

Option D

132. Refer to the exhibit

How was spanning-tree configured on this interface?

By entering the command spanning-tree portfast trunk in the interface configuration mode.

By entering the command spanning-tree portfast in the interface configuration mode

By entering the command spanning-tree mst1 vlan 10,20,30,40 in the global configuration mode

By entering the command spanning-tree vlan 10,20,30,40 root primary in the interface configuration mode

133. An engineer runs the code against an API of Cisco DMA Center, and the platform returns this output.

What does the response indicate?

The authentication credentials are incorrect

The URl string is incorrect.

The Cisco DNA Center API port is incorrect

The HTTP method is incorrect

134. Refer to the exhibit.

An LACP port channel is configured between Switch-1 and Switch-2, but It falls to come up.

Which action will resolve the issue?

Configure Switch- 1 with channel-group mode active

Configure Switch-2 with channel-group mode desirable.

Configure Switch- 1 with channel-group mode on.

Configure SwKch-2 with channel-group mode auto

135. How does CEF switching differ from process switching on Cisco devices?

CEF switching saves memory by sorting adjacency tables in dedicate memory on the line cards, and process switching stores all tables in the main memory

CEF switching uses adjacency tables built by the CDP protocol, and process switching uses the routing table

CEF switching uses dedicated hardware processors, and process switching uses the main processor

CEF switching uses proprietary protocol based on IS-IS for MAC address lookup, and process switching uses in MAC address table

136. Refer to the exhibit.

Which configuration set implements Control plane Policing for SSH and Telnet?

Option A

Option B

Option C

Option D

137. Refer to the exhibit.

An engineer configures routing between all routers and must build a configuration to connect R1 to R3 via a GRE tunnel.

Which configuration must be applied?

A)

Option

138. DRAG DROP

Drag and drop the characteristics from the left onto the routing protocols they describe on the right.

139. A. S2 is configured as LACP. Change the channel group mode to passive

B. S2 is configured with PAgP. Change the channel group mode to active.

C. S1 is configured with LACP. Change the channel group mode to on

D. S1 is configured as PAgP. Change the channel group mode to desirable

140. Refer to the exhibit.

An engineer is designing a guest portal on Cisco ISE using the default configuration. During the testing phase, the engineer receives a warning when displaying the guest portal.

Which issue is occurring?

The server that is providing the portal has an expired certificate

The server that is providing the portal has a self-signed certificate

The connection is using an unsupported protocol

The connection is using an unsupported browser

Page 15 of 23

141. Refer to the exhibit.

Which set of commands on router r R1 Allow deterministic translation of private hosts PC1, PC2, and PC3 to addresses in the public space?

RouterR1(config)#int f0/0 RouterR1(config)#ip nat inside RouterR1(config)#exit RouterR1(config)#int f0/1 RouterR1(config)#ip nat outside RouterR1(config)#exit RouterR1(config)#access-list 1 10.10.10.0 0.0.0.255 RouterR1(config)#ip nat inside source list 1 interface f0/1 overload

RouterR1(config)#int f0/0 RouterR1(config)#ip nat inside RouterR1(config)#exit RouterR1(config)#int f0/1 RouterR1(config)#ip nat outside RouterR1(config)#exit RouterR1(config)#ip nat inside source static 10.10.10.101 155.1.1.101 RouterR1(config)#ip nat inside source static 10.10.10.102 155.1.1.102 RouterR1(config)#ip nat inside source static 10.10.10.103 155.1.1.103

RouterR1(config)#int f0/0 RouterR1(config)#ip nat outside RouterR1(config)#exit RouterR1(config)#int f0/1 RouterR1(config)#ip nat inside RouterR1(config)#exit RouterR1(config)#ip nat inside source static 10.10.10.101 155.1.1.101 RouterR1(config)#ip nat inside source static 10.10.10.102 155.1.1.102 RouterR1(config)#ip nat inside source static 10.10.10.103 155.1.1.103

142. Refer to the exhibit.

Which code results in the working Python script displaying a list of network devices from the Cisco DNA Center?

A)

Option A

Option B

Option C

Option D

143. A network engineer wants to configure console access to a router without using AAA so that the privileged exec mode is entered directly after a user provides the correct login credentials.

Which action achieves this goal?

Configure login authentication privileged on line con 0.

Configure a local username with privilege level 15.

Configure privilege level 15 on line con 0.

Configure a RADIUS or TACACS+ server and use it to send the privilege level.

144. Where is the wireless LAN controller located in a mobility express deployment?

There is no wireless LAN controller in the network.

The wireless LAN controller is embedded into the access point.

The wireless LAN controller exists in the cloud.

The wireless LAN controller exists in a server that is dedicated for this purpose.

145. An engineer is describing QoS to a client.

Which two facts apply to traffic policing? (Choose two.)

Policing adapts to network congestion by queuing excess traffic

Policing should be performed as close to the destination as possible

Policing drops traffic that exceeds the defined rate

Policing typically delays the traffic, rather than drops it

Policing should be performed as close to the source as possible

146. Which devices does Cisco DNA Center configure when deploying an IP-based access control policy?

All devices integrating with ISE

selected individual devices

all devices in selected sites

all wired devices

147. Which hypervisor requires a host OS to run and is not allowed to directly access the hosts hardware and resources?

native

bare metal

type 1

type 2

148. What does the destination MAC on the outer MAC header identify in a VXLAN packet?

thee emote spine

the next hop

the leaf switch

the remote switch

149. An administrator must enable Telnet access to Router X using the router username and password database for authentication.

Which configuration should be applied?

A)

Option A

Option B

Option C

Option D

150. Which protocol is responsible for data plane forwarding in a Cisco SD-Access deployment?

VXLAN

IS-IS

OSPF

LISP

Page 16 of 23

151. An engineer must configure the strongest password authentication to locally authenticate on a router.

Which configuration must be used?

username netadmin secret 5 $1$b1Ju$kZbBS1Pyh4QzwXyZ1kSZ2

username netadmin secret 9 $9$vFpMf8elb4RVV8$seZ/bDAx1uV

username netadmin secret $1$b1Ju$k406689705QzwXyZ1kSZ2

line Console 0 password $1$b1Ju$

152. Which method does Cisco DNA Center use to allow management of non-Cisco devices through southbound protocols?

It creates device packs through the use of an SDK

It uses an API call to interrogate the devices and register the returned data.

It obtains MIBs from each vendor that details the APIs available.

It imports available APIs for the non-Cisco device in a CSV format.

153. What is the structure of a JSON web token?

three parts separated by dots: header payload, and signature

header and payload

three parts separated by dots: version header and signature

payload and signature

154. Which two operations are valid for RESTCONF? (Choose two.)

HEAD

REMOVE

PULL

PATCH

ADD

PUSH

155. How is Layer 3 roaming accomplished in a unified wireless deployment?

An EoIP tunnel is created between the client and the anchor controller to provide seamless connectivity as the client is associated with the new A

The client entry on the original controller is passed to the database on the new controller.

The new controller assigns an IP address from the new subnet to the client

The client database on the original controller is updated the anchor entry, and the new controller database is updated with the foreign entry.

156. Refer to the exhibit.

R1 has a BGP neighborship with a directly connected router on interface Gi0/0.

Which command set is applied between the iterations of show ip bgp 2.2.2.2?

R1(config)#router bgp 65001 R1(config-router)#neighbor 192.168.50.2 shutdown

R1(config)#router bgp 65002 R1(config-router)#neighbor 192.168.50.2 shutdown

R1(config)#no ip route 192.168.50.2 255.255.255.255 Gi0/0

R1(config)#ip route 2.2.2.2 255.255.255.255 192.168.50.2

157. Refer to the exhibit.

What are two effects of this configuration? (Choose two.)

R1 becomes the active router.

R1 becomes the standby router.

If R2 goes down, R1 becomes active but reverts to standby when R2 comes back online.

If R1 goes down. R2 becomes active and remains the active device when R1 comes back online.

If R1 goes down, R2 becomes active but reverts to standby when R1 comes back online.

158. Refer to the exhibit.

Which Python code snippet prints the descriptions of disabled interfaces only?

A)

Option A

Option B

Option C

Option D

159. Refer to the exhibit.

An engines configured TACACS^ to authenticate remote users but the configuration is not working as expected.

Which configuration must be applied to enable access?

A)

Option A

Option B

Option C

Option D

160. Which technology reduces the implementation of STP and leverages both unicast and multicast?

VSS

VXLAN

VPC

VLAN

Page 17 of 23

161. DRAG DROP

An engineer must create a script to append and modify device entries in a JSON-formatted file.

The script must work as follows:

✑ Until interrupted from the keyboard, the script reads in the hostname of a device, its management IP address, operating system type, and CLI remote access protocol.

✑ After being interrupted, the script displays the entered entries and adds them to the JSON-formatted file, replacing existing entries whose hostname matches.

The contents of the JSON-formatted file are as follows:

Drag and drop the statements onto the blanks within the code to complete the script. Not all options are used.

162. Which two actions, when applied in the LAN network segment, will facilitate Layer 3 CAPWAP discovery for lightweight AP? (Choose two.)

Utilize DHCP option 17.

Configure WLC IP address on LAN switch.

Utilize DHCP option 43.

Configure an ip helper-address on the router interface

Enable port security on the switch port

163. Refer to the exhibit.

What is achieved by the XML code?

It reads the access list sequence numbers from the output of the show ip access-list extended flp command into a dictionary list.

It displays the output of the show ip access-list extended flp command on the terminal screen

It displays the access list sequence numbers from the output of the show Ip access-list extended flp command on the terminal screen

It reads the output of the show ip access-list extended flp command into a dictionary list.

164. Which two security features are available when implementing NTP? (Choose two.)

symmetric server passwords

dock offset authentication

broadcast association mode

encrypted authentication mechanism

access list-based restriction scheme

165. DRAG DROP

Refer to the exhibit.

An engineer must deny HTTP traffic from host A to host B while allowing all other communication between the hosts, drag and drop the commands into the configuration to achieve these results. Some commands may be used more than once. Not all commands are used.

166. DRAG DROP

Drag and drop the snippets onto the blanks within the code to construct a script that shows all logging that occurred on the appliance from Sunday until 9:00 p.m Thursday Not all options are used.

167. Refer to the exhibit.

A network engineer must load balance traffic that comes from the NAT Router and is destined to 10.10.110.10, to several FTP servers.

Which two commands sets should be applied? (Choose two).

A)

Option A

Option B

Option C

Option D

Option E

168. Which two characteristics apply to the endpoint security aspect of the Cisco Threat Defense architecture? (Choose two.)

detect and black ransomware in email attachments

outbound URL analysis and data transfer controls

user context analysis

blocking of fileless malware in real time

cloud-based analysis of threats

169. An engineer is connected to a Cisco router through a Telnet session.

Which command must be issued to view the logging messages from the current session as soon as they are generated by the router?

logging buffer

service timestamps log uptime

logging host

terminal monitor

170. DRAG DROP

Drag and drop the code snippets from the bottom onto the blanks in the Python script to print the device model to the screen and write JSON data to a file Not all options are used

Page 18 of 23

171. Which there application has the ability to make REST calls against Cisco DNA Center?

API Explorer

REST Explorer

Postman

Mozilla

172. What happens when a FlexConnect AP changes to standalone mode?

All controller-dependent activities stop working except the DF

All client roaming continues to work

Only clients on central switching WLANs stay connected.

All clients on an WLANs are disconnected

173. An engineer is configuring RADIUS-Based Authentication with EAP. MS-CHAPv2 is configured on a client device.

Which outer method protocol must be configured on the ISE to support this authentication type?

EAP-TLS

EAP-FAST

LDAP

PEAP

174. Which technology uses network traffic telemetry, contextual information, and file reputation to provide insight into cyber threats?

threat defense

security services

security intelligence

segmentation

175. A switch is attached to router R1 on its gig 0/0 interface. Fort security reasons, you want to prevent R1 from sending OSPF hellos to the switch.

Which command should be enabled to accomplish this?

R1(config-router)#ip ospf hello disable

R1(config-router)#ip ospf hello-interval 0

R1(config)#passive-interface Gig 0/0

R1(config-router)#passive-interface Gig 0/0

176. DRAG DROP

Drag and drop the characteristics from the left onto the routing protocols they describe on the right

177. Refer to the exhibit.

A network engineer checks connectivity between two routers. The engineer can ping the remote endpoint but cannot see an ARP entry.

Why is there no ARP entry?

The ping command must be executed in the global routing table.

Interface FastEthernet0/0 Is configured in VRF CUST-A, so the ARP entry is also in that VR

When VRFs are used. ARP protocol must be enabled In each VR

When VRFs are used. ARP protocol is disabled in the global routing table.

178. Which protocol infers that a YANG data model is being used?

SNMP

NX-API

REST

RESTCONF

179. 1.What are two benefits of YANG? (Choose two.)

It enforces the use of a specific encoding format for NETCON

It collects statistical constraint analysis information.

It enables multiple leaf statements to exist within a leaf list.

It enforces configuration semantics.

It enforces configuration constraints.

180. Refer to the exhibit.

The administrator troubleshoots an EtherChannel that keeps moving to err-disabled.

Which two actions must be taken to resolve the issue? (Choose two.)

Reload the switch to force EtherChannel renegotiation

Ensure that interfaces Gi1/0/2 and Gi1/0/3 connect to the same neighboring switch.

Ensure that the switchport parameters of Port channel1 match the parameters of the port channel on the neighbor switch

Ensure that the corresponding port channel interface on the neighbor switch is named Port- channel1.

Ensure that the neighbor interfaces of Gi1/0/2 and Gi/0/3 are configured as members of the same EtherChannel

Page 19 of 23

181. In a Cisco SD-Access solution, what is the role of the Identity Services Engine?

It is leveraged for dynamic endpoint to group mapping and policy definition.

It provides GUI management and abstraction via apps that share context.

it is used to analyze endpoint to app flows and monitor fabric status.

It manages the LISP EID database.

182. What is the rose of the vSmart controller in a Cisco SD-WN environment?

it performs authentication and authorization

it manages the control plane.

it is the centralized network management system

it manages the data plane

183. Under which network conditions is an outbound QoS policy that is applied on a router WAN interface most beneficial?

under interface saturation condition

under network convergence condition

under all network condition

under traffic classification and marking conditions.

184. What is a benefit of Cisco TrustSec in a multilayered LAN network design?

Policy or ACLS are nor required.

There is no requirements to run IEEE 802. 1X when TrustSec is enabled on a switch port.

Applications flows between hosts on the LAN to remote destinations can be encrypted.

Policy can be applied on a hop-by-hop basis.

185. What is one being of implementing a data modetag language?

accuracy of the operations performed

uses XML style of data formatting

machine-oriented logic and language-facilitated processing.

conceptual representation to simplify interpretation.

186. What is one characteristic of VXLAN?

It supports a maximum of 4096 VLANs.

It supports multitenant segments.

It uses STP to prevent loops in the underlay network.

It uses the Layer 2 header to transfer packets through the network underlay.

187. Refer to the exhibit.

How does the router handle traffic after the CoPP policy is configured on the router?

Traffic coming to R1 that does not match access list SNMP is dropped.

Traffic coming to R1 that matches access list SNMP is policed.

Traffic passing through R1 that matches access list SNMP is policed.

Traffic generated by R1 that matches access list SNMP is policed.

188. Refer to the exhibit.

Which command set must be added to the configuration to analyze 50 packets out of every 100?

A)

Option A

Option B

Option C

Option D

189. Refer to the exhibit.

An engineer has configured Cisco ISE to assign VLANs to clients based on their method of authentication, but this is not working as expected.

Which action will resolve this issue?

require a DHCP address assignment

utilize RADIUS profiling

set a NAC state

enable AAA override

190. Refer to the exhibit.

What does the snippet of code achieve?

It creates a temporary connection to a Cisco Nexus device and retrieves a token to be used for API calls.

It opens a tunnel and encapsulates the login information, if the host key is correct.

It opens an ncclient connection to a Cisco Nexus device and maintains it for the duration of the context.

It creates an SSH connection using the SSH key that is stored, and the password is ignored.

Page 20 of 23

191. Refer to the exhibit:

An engineer configures VRRP and issues the show commands to verify operation.

What does the engineer confirm about VRRP group 1 from the output?

There is no route to 10. 10. 1. 1/32 in R2’s routing table

If R1 reboots, R2 becomes the master virtual router until R2 reboots

Communication between VRRP members is encrypted using MD5

R1 is primary if 10. 10. 1. 1/32 is in its routing table

192. Which two GRE features are configured to prevent fragmentation? (Choose two.)

TCP MSS

PMTUD

DF bit Clear

MTU ignore

IP MTU

TCP window size

193. What is one primary REST security design principle?

fail-safe defaults

password hash

adding a timestamp in requests

OAuth

194. A network engineer configures a WLAN controller with increased security for web access. There is IP connectivity with the WLAN controller, but the engineer cannot start a management session from a web browser.

Which action resolves the issued

Disable JavaScript on the web browser

Disable Adobe Flash Player

Use a browser that supports 128-bit or larger ciphers.

Use a private or incognito session.

195. What is the output of this code?

username Cisco

get_credentials

username

CISCO

196. Refer to the exhibit.

A network engineer must be notified when a user switches to configuration mode.

Which script should be applied to receive an SNMP trap and a critical-level log message?

A)

Option

197. Why would a customer implement an on-premises solution instead of a cloud solution?

On-premises Offers greater compliance for government regulations than cloud

On-premises offers greater scalability than cloud.

On-premises oilers shorter deployment time than cloud.

On-premises is more secure man cloud.

198. Refer to the exhibit.

An engineer must allow the FTP traffic from users on 172.16.1.0 /24 to 172.16.2.0 /24 and block all other traffic.

Which configuration must be applied?

A)

Option A

Option B

Option C

Option D

199. An engineer is configuring RADIUS-Based Authentication with EAP MS-CHAPv2 is configured on a client device.

Which outer method protocol must be configured on the ISE to support this authentication type?

EAP-TLS

PEAP

LDAP

EAP-FAST

200. In which way are EIGRP and OSPF similar?

They both support unequal-cost load balancing

They both support MD5 authentication for routing updates.

They nave similar CPU usage, scalability, and network convergence times.

They both support auto summarization

Page 21 of 23

201. Refer to the exhibit.

After running the code in the exhibit.

Which step reduces the amount of data that NETCONF server returns to the NETCONF client, to only the interface’s configuration?

Create an XML filter as a string and pass it to get_config() method as an argument

Use the txml library to parse the data returned by the NETCONF server for the interface’s configuration

Create a JSON filter as a string and pass it to the get_config() method as an argument

Use the JSON library to parse the data returned by the NETCONF server for the interface’s configuration

202. What is the API keys option for REST API authentication?

a predetermined string that is passed from client to server

a one-time encrypted token

a username that is stored in the local router database

a credential that is transmitted unencrypted

203. Refer to the exhibit.

An engineer must create a configuration that executes the show run command and then terminates the session when user CCNP legs in.

Which configuration change is required?

Add the access-class keyword to the username command

Add the access-class keyword to the aaa authentication command

Add the autocommand keyword to the username command

Add the autocommand keyword to the aaa authentication command

204. What is the function of a control-plane node In a Cisco SD-Access solution?

to run a mapping system that manages endpoint to network device relationships

to implement policies and communicate with networks outside the fabric

to connect external Layer 3 networks to the SD-Access fabric

to connect APs and wireless endpoints to the SD-Access fabric

205. DRAG DROP

Drag and drop the characteristics from the left onto the orchestration tool classifications on the right.

206. Which unit of measure is used to measure wireless RF SNR?

bBm

dBi

207. What is a characteristic of a traditional WAN?

low complexity and high overall solution scale

centralized reachability, security, and application policies

operates over DTLS and TLS authenticated and secured tunnels

united data plane and control plane

208. Refer to the exhibit.

Which commands are required to allow SSH connection to the router?

A)

Option A

Option B

Option C

Option D

209. An engineer must implement a configuration to allow a network administrator to connect to the console port of a router and authenticate over the network.

Which command set should the engineer use?

aaa new-model aaa authentication login default enable

aaa new-model aaa authentication login console local

aaa new-model aaa authentication login console group radius

aaa new-model aaa authentication enable default

210. DRAG DROP

Drag and drop the characteristics from the left onto the switching mechanisms they describe on the right.

Page 22 of 23

211. Refer to me exhibit.

What is the cause of the log messages?

hello packet mismatch

OSPF area change

MTU mismatch

IP address mismatch

212. Refer to the exhibit.

A network engineer configures a GRE tunnel and enters the show Interface tunnel command.

What does the output confirm about the configuration?

The keepalive value is modified from the default value.

Interface tracking is configured.

The tunnel mode is set to the default.

The physical interface MTU is 1476 bytes.

213. Refer to the exhibit.

Which configuration change ensures that R1 is the active gateway whenever it is in a functional state for the 172.30.110.0724 network?

R2 standby 1 priority 90 standby 1 preempt

R2 standby 1 priority 100 standby 1 preempt

R1 standby 1 preempt R2 standby 1 priority 90

R1 standby 1 preempt R2 standby 1 priority 100

214. An engineer must configure AAA on a Cisco 9800 WLC for central web authentication.

Which two commands are needed to accomplish this task? (Choose two.)

Option A

Option B

Option C

Option D

Option E

215. What is one characteristic of the Cisco SD-Access control plane?

It is based on VXLAN technology.

Each router processes every possible destination and route

It allows host mobility only in the wireless network.

It stores remote routes in a centralized database server

216. Which technology enables a redundant supervisor engine to take over when the primary supervisor engine fails?

NSF

graceful restart

SSO

FHRP

217. How does NETCONF YANG represent data structures?

as strict data structures denned by RFC 6020

in an XML tree format

in an HTML format

as modules within a tree

218. If the maximum power level assignment for global TPC 802.11a/n/ac is configured to 10 dBm, which power level effectively doubles the transmit power?

13dBm

14 dBm

17dBm

20 dBm

219. Refer to the exhibit.

After configuring the BGP network, an engineer verifies that the path between Servers and Server2 Is functional.

Why did RouterSF choose the route from RouterDAL instead of the route from RouterCHI?

The Router-ID Tor Router DAL is lower than the Roter-ID for RouterCH

The route from RouterOAL has a lower ME

BGP is not running on RouterCH

There is a static route in RouterSF for 10.0.0.0/24.

220. Which solution supports end to end line-rate encryption between two sites?

IPsec

TrustSec

MACseC

GRE

Page 23 of 23

221. DRAG DROP

Drag and drop the characteristics from the left onto the protocols they apply to on the right?

222. Which two components are supported by LISP? (Choose two.)

Proxy ETR

egress tunnel router

route reflector

HMAC algorithm

spoke

Facebook Twitter LinkedIn Google + Email