Question Part-1 Flashcards
A. The FIB is populated based on RIB content. Most Voted
B. The RIB maintains a mirror image of the FIB.
C. The RIB is used to make IP source prefix-based switching decisions.
D. The FIB is where all IP routing information is stored.
a
What is a benefit of deploying an on-premises infrastructure versus a cloud infrastructure deployment?
A. ability to quickly increase compute power without the need to install additional hardware
B. less power and cooling resources needed to run infrastructure on-premises
C. faster deployment times because additional infrastructure does not need to be purchased
D. lower latency between systems that are physically located near each othe
d
Question 1
Which two security mechanisms are used by Cisco Threat Defense to gain visibility into the most dangerous cyber threats? (Choose two)
A. dynamic enforce policy
B. file reputation
C. virtual private networks
D. Traffic Telemetry
E. VLAN segmentation
b,d
Which is a fact about Cisco EAP-FAST?
A. It does not require a RADIUS server certificate
B. It requires a client certificate
C. It is an IETF standard.
D. It operates in transparent mode
A
The EAP-FAST protocol is a publicly accessible IEEE 802.1X EAP type that Cisco developed to support customers that cannot enforce a strong password policy and want to deploy an 802.1X EAP type that does not require digital certificates.
EAP-FAST is also designed for simplicity of deployment since it does not require a certificate on the wireless LAN client or on the RADIUS infrastructure yet incorporates a built-in provisioning mechanism.
Which two operations are valid for RESTCONF? (Choose two)
A. HEAD
B. REMOVE
C. PULL
D. GET
E. ADD
F. PUSH
Answer: A D
Explanation
RESTCONF operations include OPTIONS, HEAD, GET, POST, PUT, PATCH, DELETE.
Which configuration restricts the amount of SSH that a router accepts to 100 kbps?
Option A
class-map match-all CoPP_SSH
match access-group name CoPP_SSH
!
policy-map CoPP_SSH
class CoPP_SSH
police cir 100000
exceed-action drop
!
!
!
interface GigabitEthernet0/1
ip address 209.165.200.225 255.255.255.0
ip access-group CoPP_SSH out
duplex auto
speed auto
media-type rj45
service-policy input CoPP_SSH
!
ip access-list extended CoPP_SSH
permit tcp any any eq 22
! Option B
class-map match-all CoPP_SSH
match access-group name CoPP_SSH
!
policy-map CoPP_SSH
class CoPP_SSH
police cir CoPP_SSH
exceed-action drop
!
!
!
interface GigabitEthernet0/1
ip address 209.165.200.225 255.255.255.0
ip access-group CoPP_SSH out
duplex auto
speed auto
media-type rj45
service-policy input CoPP_SSH
!
ip access-list extended CoPP_SSH
deny tcp any any eq 22
!
Option C
class-map match-all CoPP_SSH
match access-group name CoPP_SSH
!
policy-map CoPP_SSH
class CoPP_SSH
police cir 100000
exceed-action drop
!
!
!
control-plane
service-policy input CoPP_SSH
!
ip access-list extended CoPP_SSH
permit tcp any any eq 22
! Option D
class-map match-all CoPP_SSH
match access-group name CoPP_SSH
!
policy-map CoPP_SSH
class CoPP_SSH
police cir 100000
exceed-action drop
!
!
!
control-plane transit
service-policy input CoPP_SSH
!
ip access-list extended CoPP_SSH
permit tcp any any eq 22
!
A. Option A
B. Option B
C. Option C
D. Option D
Answer: C
Explanation
CoPP protects the route processor on network devices by treating route processor resources as a separate entity with its own ingress interface (and in some implementations, egress also). CoPP is used to police traffic that is destined to the route processor of the router such as:
+ Routing protocols like OSPF, EIGRP, or BGP.
+ Gateway redundancy protocols like HSRP, VRRP, or GLBP.
+ Network management protocols like telnet, SSH, SNMP, or RADIUS.
Answer: C
Explanation
CoPP protects the route processor on network devices by treating route processor resources as a separate entity with its own ingress interface (and in some implementations, egress also). CoPP is used to police traffic that is destined to the route processor of the router such as:
+ Routing protocols like OSPF, EIGRP, or BGP.
+ Gateway redundancy protocols like HSRP, VRRP, or GLBP.
+ Network management protocols like telnet, SSH, SNMP, or RADIUS.
A
What is one primary REST security design principle?
A. password hash
B. fail-safe defaults
C. adding a timestamp in requests
D. OAuth
B
What is the responsibility of a secondary WLC?
A. It shares the traffic load of the LAPs with the primary controller.
B. It avoids congestion on the primary controller by sharing the registration load on the LAPs.
C. It registers the LAPs if the primary controller fails.
D. It enables Layer 2 and Layer 3 roaming between itself and the primary controller.
C
Which action is a LISP ITR responsible for?
A. responding to map-request messages
B. finding EID-to-RLOC mappings
C. accepting registration requests from ETRs
D. forwarding user data traffic
Answer: B
Explanation
Ingress Tunnel Router (ITR) is the device (or function) that is responsible for finding EID-to-RLOC mappings for all traffic destined for LISP-capable sites. After the encapsulation, the original packet become a LISP packet.
An engineer modifies the existing ISE guest portal URL to use a static FQDN. Users immediately report that they receive certificate errors when they are redirected to the new page. Which two additional configuration steps are needed to implement the change? (Choose two)
A. Create and sign a new CSR that contains the static FQDN entry
B. Add the FQDN entry under the WLC virtual interface
C. Manually configure the hosts file on each user device
D. Disable HTTPS on the WLC under the Management menu
E. Add a new DNS record to resolve the FQDN to the PSN IP address
A,E
In a Cisco Catalyst switch equipped with two supervisor modules an administrator must temporally remove the active supervisor from the chassis to perform hardware maintenance on it. Which mechanism ensure that the active supervisor removal is not disruptive to the network operation?
A. NSF/NSR
B. SSO
C. HSRP
D. VRRP
B
Question 17
Which encryption hashing algorithm does NTP use for authentication?
A. SSL
B. AES256
C. AES128
D. MD5
D
Explanation
An example of configuring NTP authentication is shown below:
Router1(config)#ntp authentication-key 2 md5 digitaltut
Router1(config)#ntp authenticate
An engineer must provide wireless converge in a square office. The engineer has only one AP and believes that it should be placed it in the middle of the room. Which antenna type should the engineer use?
A. directional
B. polarized
C. Yagi
D. omnidirectional
D
ypes of external antennas:
+ Omnidirectional: Provide 360-degree coverage. Ideal in houses and office areas
+ Directional: Focus the radio signal in a specific direction. Examples are the Yagi and parabolic dish
+ Multiple Input Multiple Output (MIMO) – Uses multiple antennas (up to eight) to increase bandwidth
An omnidirectional antenna is designed to provide a 360-degree radiation pattern. This type of antenna is used when coverage in all directions from the antenna is required.
A customer requires their wireless data traffic to egress at the switch port of the access point. Which access point mode supports this?
A. FlexConnect
B. Sniffer
C. Bridge
D. Monitor
Answer: A
Explanation
FlexConnect AP mode enables switching traffic between an SSID and a VLAN locally if the CAPWAP to the WLC is down, even when the AP is at a remote site. It can also be configured to egress at the access point’s LAN port.
What is a benefit of YANG modules?
A. tightly coupled models with encoding to improve performance
B. easier multivendor interoperability provided by common or industry models
C. avoidance of ecosystem fragmentation by having fixed modules that cannot be changed
D. single protocol and model coupling to simplify maintenance and support
B
What is contained in the VXLAN header?
A. VXLAN network identifier
B. source and destination RLOC ID
C. endpoint ID
D. original Layer 2 VLAN ID
A
Which two steps are required for a complete Cisco DNA Center upgrade? (Choose two)
A. golden image selection
B. automation backup
C. proxy configuration
D. application updates
E. system update
D E
A complete Cisco DNA Center upgrade includes “System Update” and “Appplication Updates”
Which virtualization component creates VMs and performs hardware abstraction that allows multiple VMs to run at the same time?
A. rkt
B. Docker
C. container
D. hypervisor
D
Drag and drop the LISP components from the left onto the function they perform on the right. Not all options are used.
Answer:
+ accepts LISP encapsulated map requests: LISP map resolver
+ learns of EID prefix mapping entries from an ETR: LISP map server
+ receives traffic from LISP sites and sends it to non-LISP sites: LISP proxy ETR
+ receives packets from site-facing interfaces: LISP ITR
Which technology is used to provide Layer 2 and Layer 3 logical networks in the Cisco SD-Access architecture?
A. underlay network
B. overlay network
C. VPN routing/forwarding
D. easy virtual network
B
What does Call Admission Control require the client to send in order to reserve the bandwidth?
A. SIP flow information
B. Wi-Fi multimedia
C. traffic specification
D. VoIP media session awareness
C
Which network devices secure API platform?
A. next-generation intrusion detection systems
B. Layer 3 transit network devices
C. content switches
D. web application firewalls
Answer: D
Explanation
Cisco Secure Web Application Firewall (WAF) and bot protection defends your online presence and ensures that website, mobile applications, and APIs are secure, protected, and “always on.”
Where is the wireless LAN controller located in a mobility express deployment?
A. There is no wireless LAN controller in the network.
B. The wireless LAN controller is embedded into the access point.
C. The wireless LAN controller exists in the cloud.
D. The wireless LAN controller exists in a server that is dedicated for this purpose.
Answer: B
Explanation
Mobility Express is the ability to use an access point (AP) as a controller instead of a real WLAN controller. But this solution is only suitable for small to midsize, or multi-site branch locations where you might not want to invest in a dedicated WLC. A Mobility Express WLC can support up to 100 APs.
What is a characteristic of VXLAN?
A. It uses TCP for transport.
B. It has a 12-byte packet header.
C. It extends Layer 2 and Layer 3 overlay networks over a Layer 2 underlay.
D. It is a multi-tenant solution.
Answer: D
VXLAN header consists of 8 bytes and contains the 24-bit VNI -> Answer B is not correct.
VXLAN uses UDP, not TCP -> Answer A is not correct.
VXLAN is often described as an overlay technology because it allows to stretch Layer 2 connections over an intervening Layer 3 network -> Answer C is not correct.Therefore only answer D is left.
An engineer is configuring Local WebAuth on a Cisco Wireless LAN Controller. According to RFC 5737, which virtual IP address must be used in this configuration?
A. 1.1.1.1
B. 192.168.0.1
C. 192.0.2.1
D. 172.20.10.1
C
A large campus network has deployed two wireless LAN controllers to manage the wireless network. WLC1 and WLC2 have been configured as mobility peers. A client device roams from AP1 on WLC1 to AP2 on WLC2, but the controller’s client interfaces are on different VLANs. How do the wireless LAN controllers handle the inter-subnet roaming?
A. WLC2 marks the client with a foreign entry in its own database. The database entry is copied to the new controller and marked with an anchor entry on WLC1
B. WLC2 marks the client with an anchor entry in its own database. The database entry is copied to the new controller and marked with a foreign entry on WLC1
C. WLC1 marks the client with a foreign entry in its own database. The database entry is copied to the new controller and marked with an anchor entry on WLC2
D. WLC1 marks the client with an anchor entry in its own database. The database entry is copied to the new controller and marked with a foreign entry on WLC2
D
What is the function of the fabric control plane node in a Cisco SD-Access deployment?
A. It is responsible for policy application and network segmentation in the fabric.
B. It performs traffic encapsulation and security profiles enforcement in the fabric.
C. It holds a comprehensive database that tracks endpoints and networks in the fabric.
D. It provides integration with legacy nonfabric-enabled environments.
C
Fabric control plane node (C): One or more network elements that implement the LISP Map-Server (MS) and Map-Resolver (MR) functionality. The control plane node’s host tracking database keep track of all endpoints in a fabric site and associates the endpoints to fabric nodes in what is known as an EID-to-RLOC binding in LISP.
