Part_5 Flashcards
Question 2
What are two characteristics of Cisco SD-Access elements? (Choose two)
A. Fabric endpoints are connected directly to the border node
B. The border node is required for communication between fabric and nonfabric devices
C. The control plane node has the full RLOC-to-EID mapping database
D. Traffic within the fabric always goes through the control plane node
E. The border node has the full RLOC-to-EID mapping database
Answer:B C
Explanation
There are five basic device roles in the fabric overlay: + Control plane node: This node contains the settings, protocols, and mapping tables to provide the endpoint-to-location (EID-to-RLOC) mapping system for the fabric overlay. + Fabric border node: This fabric device (for example, core layer device) connects external Layer 3 networks to the SDA fabric. + Fabric edge node: This fabric device (for example, access or distribution layer device) connects wired endpoints to the SDA fabric. + Fabric WLAN controller (WLC): This fabric device connects APs and wireless endpoints to the SDA fabric. + Intermediate nodes: These are intermediate routers or extended switches that do not provide any sort of SD-Access fabric role other than underlay services.
Question 3
Refer to the exhibit.
Current configuration: 142 bytes
vrf definition STAFF
!
!
interface GigabitEthernet1
vrf forwarding STAFF
no ip address
negotiation auto
no mop enabled
no mop sysid
end
An engineer must assign an IP address of 192.168.1.1/24 to the GigabitEthemet1 interface. Which two commands must be added to the existing configuration to accomplish this task? (Choose two)
A. Router(config-vrf)#address-family ipv6
B. Router(config-if)#ip address 192.168.1.1 255.255.255.0
C. Router(config-vrf)#ip address 192.168.1.1 255.255.255.0
D. Router(config-if)#address-family ipv4
E. Router(config-vrf)#address-family ipv4
Answer:B E
Explanation
In fact we only need to assign IP address to Gi1 with the command “Router(config-if)#ip address 192.168.1.1 255.255.255.0”. The command “Router(config-vrf)#address-family ipv4” is unnecessary unless we have other configurations.
Question 4
What is the data policy in a Cisco SD-WAN deployment?
A. list of ordered statements that define node configurations and authentication used within the SD-WAN overlay
B. Set of statements that defines how data is forwarded based on IP packet information and specific VPNs
C. detailed database mapping several kinds of addresses with their corresponding location
D. group of services tested to guarantee devices and links liveliness within the SD-WAN overlay
Answer:B
Explanation
Data policy operates on the data plane in the Cisco SD-WAN overlay network and affects how data traffic is sent among Cisco SD-WAN devices in the network. The Cisco SD-WAN architecture defines two types of data policy, centralized data policy, which controls the flow of data traffic based on the IP header fields in the data packets and based on network segmentation, and localized data policy, which controls the flow of data traffic into and out of interfaces and interface queues on the devices.
Question 9
Which encryption hashing algorithm does NTP use for authentication?
A. SSL
B. AES256
C. AES128
D. MD5
Answer:D
Explanation
An example of configuring NTP authentication is shown below:
Router1(config)#ntp authentication-key 2 md5 9tut
Router1(config)#ntp authenticate
Router1(config)#ntp trusted-key 2
What is a VPN in a Cisco SD-WAN deployment?
A. virtual channel used to carry control plane information
B. attribute to identify a set of services offered in specific places in the SD-WAN fabric
C. common exchange point between two different services
D. virtualized environment that provides traffic isolation and segmentation in the SD-WAN fabric
Answer:D
Question 13
What is an emulated machine that has dedicated compute, memory, and storage resources and a fully installed operating system?
A. host
B. virtual machine
C. container
D. mainframe
Answer:B
Question 14
Which two methods are used to reduce the AP coverage area? (Choose two)
A. Reduce AP transmit power
B. Increase minimum mandatory data rate
C. Reduce channel width from 40 MHz to 20 MHz
D. Enable Fastlane
E. Disable 2.4 GHz and use only 5 GHz
Answer:A B
Explanation
Thetransmit power of an AP affects the wireless coverage areaand the maximum achievable signal-to-noise ratio. Proper configuration of transmit power is important for ensuring a wireless network is operating at its highest capacity.
Reference:https://documentation.meraki.com/MR/Radio_Settings/Transmit_Power_and_Antenna_Configuration
According to thisCisco link, there are two ways to reduce the AP coverage area (or the cell size):
+ Tuning Cell Size with Transmit Power
+ Tuning Cell Size with Data Rates
Setting the transmit power level is a simplistic approach to defining the cell size, but that is not the only variable involved. The cell size of an AP is actually a compromise between its transmit power and the data rates that it offers.
To design a wireless LAN for best performance, you would most likely need todisable some of the lower data rates. For example, you could disable the 1, 2, and 5.5 Mbps rates to force clients to use higher rates and better modulation and coding schemes. That would improve throughput for individual clients and would also benefit the BSS as a whole by eliminating the slower rates that use more time on a channel.
Question 18
In a three-tier hierarchical campus network design, which action is a design best-practice for the core layer?
A. provide QoS prioritization services such as marking, queueing, and classification for critical network traffic
B. provide advanced network security features such as 802. IX, DHCP snooping, VACLs, and port security
C. provide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence
D. provide redundant aggregation for access layer devices and first-hop redundancy protocols such as VRRP
Answer:C
Explanation
The core should be highly available and redundant. The core aggregates the traffic from all the distribution layer devices, so it must be capable of forwarding large amounts of data quickly.
Considerations at the core layer include
– Providing high-speed switching (i.e., fast transport)
– Providing reliability and fault tolerance
– Scaling by using faster, and not more, equipment
– Avoiding CPU-intensive packet manipulation caused by security, inspection, quality of service (QoS) classification, or other processes
Question 19
Which two network problems indicate a need to implement QoS in a campus network? (Choose two)
A. port flapping
B. misrouted network packets
C. excess jitter
D. bandwidth-related packet loss
E. duplicate IP addresses
Answer:C D
Question 20
In a Cisco SD-Access solution, what is the role of the Identity Services Engine?
A. It provides GUI management and abstraction via apps that share context.
B. It is leveraged for dynamic endpoint to group mapping and policy definition.
C. It is used to analyze endpoint to app flows and monitor fabric status.
D. It manages the LISP EID database.
Answer:B
Explanation
DNA Controller – Enterprise SDN Controller (e.g. DNA Center) provides GUI management and abstraction via Apps that share context
Identity Services – External ID System(s) (e.g. ISE) are leveraged for dynamic Endpoint to Group mapping and Policy definition
Analytics Engine – External Data Collector(s) (e.g. NDP) are leveraged to analyze Endpoint to App flows and monitor fabric status
Reference:https://www.cisco.com/c/dam/global/da_dk/assets/training/seminaria-materials/Software_Defined_Access_2017.pdf
Question 21
A customer has completed the installation of a Wi-Fi 6 greenfield deployment at their new campus. They want to leverage Wi-Fi 6 enhanced speeds on the trusted employee WLAN. To configure the employee WLAN, which two Layer 2 security policies should be used? (Choose two)
A. WPA (AES)
B. WPA2 (AES) + WEP
C. 802.1X
D. OPEN
Answer:C D
Explanation
Wi-Fi 6 (IEEE 802.11ax)
In greenfield we don’t need to use any security policy to reduce the wasting time of encryption/decryption.
Wi-Fi 6 does not support WPA with AES while WPA2 (AES) would slow down the connection -> Only 802.1X is the best choice left.
Question 22
Which outcome is achieved with this Python code?
client.connect (ip, port=22,username=usr,password=pswd)
stdin,stdout,stderr = client.exec_command(‘show ip bgp 192.168.10.100 bestpath\n’)
print(stdout)
A. displays the output of the show command in a formatted way
B. connects to a Cisco device using SSH and exports the routing table information
C. connects to a Cisco device using Telnet and exports the routing table information
D. connects to a Cisco device using SSH and exports the BGP table for the prefix
Answer:D
Question 23
What is YANG used for?
A. scraping data via CLI
B. providing a transport for network configuration data between client and server
C. processing SNMP read-only polls
D. describing data models
Answer:D
Explanation
YANG is used to model each protocol based on RFC 6020.
Question 29
Which two actions, when applied in the LAN network segment, will facilitate Layer 3 CAPWAP discovery for lightweight AP? (Choose two)
A. Utilize DHCP option 17
B. Utilize DHCP option 43
C. Configure WLC IP address on LAN switch
D. Enable port security on the switch port
E. Configure an ip helper-address on the router interface
Answer:B E
Explanation
In a Cisco Unified Wireless network, the LAPs must first discover and join a WLC before they can service wireless clients. However, this presents a question: how did the LAPs find the management IP address of the controller when it is on a different subnet? If you do not tell the LAP where the controller isvia DHCP option 43, DNS resolution of “Cisco-capwap-controller.local_domain”, or statically configure it, the LAP does not know where in the network to find the management interface of the controller.
Question 31
The following system log message is presented after a network administrator configures a GRE tunnel:
%TUN-RECURDOWN: Interface Tunnel 0 temporarily disabled due to recursive routing.
Why is Tunnel 0 disabled?
A. Because the tunnel cannot reach its tunnel destination
B. Because the best path to the tunnel destination is through the tunnel itself
C. Because dynamic routing is not enabled
D. Because the router cannot recursively identify its egress forwarding interface
Answer:B
Explanation
The%TUN-5-RECURDOWN: Tunnel0 temporarily disabled due to recursive routing errormessage means that the generic routing encapsulation (GRE) tunnel router has discovered a recursive routing problem. This condition is usually due to one of these causes:
+ A misconfiguration that causes the router to try to route to the tunnel destination address using the tunnel interface itself (recursive routing)
+ A temporary instability caused by route flapping elsewhere in the network
