266 free Cisco 350-401 ENCOR practice questions from the CertStash pack of 1,066, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 266 free here, all 1,066 in the pack, and each step includes the one before it.
Get all 1,066 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which QoS component alters a packet to change the way that traffic is treated in the network?
Show answer and explanation
Correct answer: C. marking
Marking is the QoS component that alters packets by changing fields such as DSCP, IP Precedence, or CoS values to indicate how the traffic should be treated. This modification happens within the packet itself and allows downstream devices to recognize and handle the traffic according to the marked priority.
Why the other options are wrong
- A. Policing enforces rate limits and drops or marks traffic that exceeds thresholds; it does not alter packet headers for treatment purposes.
- B. Classification identifies and categorizes traffic into groups but does not alter the packets themselves.
- D. Shaping buffers and queues excess traffic but does not modify packet contents to change how traffic is treated.
Question 2
What is a benefit of deploying an on-premises infrastructure versus a cloud infrastructure deployment?
Show answer and explanation
Correct answer: D. lower latency between systems that are physically located near each other
Lower latency between physically co-located systems is a key benefit of on-premises infrastructure. When systems are located near each other in the same data center, network latency is minimized compared to cloud deployments where resources may be geographically distributed or remotely hosted.
Why the other options are wrong
- A. This is a benefit of cloud infrastructure, not on-premises; cloud allows rapid scaling without physical hardware installation.
- B. On-premises deployments typically require more power and cooling resources than cloud, as you maintain all hardware yourself.
- C. Cloud deployments enable faster deployment times; on-premises requires purchasing and installing physical hardware first.
Question 3
How does QoS traffic shaping alleviate network congestion?
Show answer and explanation
Correct answer: B. It buffers and queues packets above the committed rate.
Traffic shaping alleviates congestion by buffering and queuing packets that exceed the committed rate, delaying them rather than dropping them immediately. This smooths traffic flow and prevents sudden bursts from overwhelming network links, allowing congestion to be managed gracefully.
Why the other options are wrong
- A. Dropping packets is a characteristic of policing, not shaping; shaping buffers excess traffic instead.
- C. Traffic shaping does not fragment packets; it queues whole packets to regulate their transmission rate.
- D. Random packet dropping from lower priority queues describes RED (Random Early Detection) or tail-drop behavior, not shaping mechanisms.
Question 4
An engineer is describing QoS to a client. Which two facts apply to traffic policing? (Choose two.)
Show answer and explanation
Correct answer: A, D. Policing should be performed as close to the source as possible; Policing drops traffic that exceeds the defined rate.
Policing should be applied as close to the traffic source as possible to prevent non-compliant traffic from entering the network early. Policing also drops traffic that exceeds the defined rate limit, unlike shaping which buffers excess traffic. These are fundamental characteristics of rate enforcement in QoS.
Why the other options are wrong
- B. Policing does not queue excess traffic; that is the function of shaping. Policing enforces hard rate limits by dropping traffic.
- C. Policing should be performed at the source, not the destination, to prevent unwanted traffic from traversing the network.
- E. Policing drops excess traffic rather than delaying it; delaying traffic is the function of shaping, not policing.
Question 5
Which component handles the orchestration plane of the Cisco SD-WAN?
Show answer and explanation
Correct answer: A. vBond
The vBond controller handles the orchestration plane in Cisco SD-WAN. It is responsible for device authentication, certificate management, and orchestrating the control connections between vSmart controllers and WAN edge devices. The vBond (now SD-WAN Validator) enables the overlay network to function properly.
Why the other options are wrong
- B. vSmart is the control plane component that maintains routing policies and establishes control connections with edge devices.
- C. vManage is the management and analytics plane component for monitoring and configuring the SD-WAN deployment.
- D. WAN Edge represents the data plane devices that forward traffic according to policies learned from the control plane.
Question 6
What are two device roles in Cisco SD-Access fabric? (Choose two.)
Show answer and explanation
Correct answer: A, E. edge node; border node
In Cisco SD-Access fabric architecture, edge nodes and border nodes are the two primary device roles. Edge nodes connect endpoints to the fabric, while border nodes connect the fabric to external networks. Access and core switches are legacy terminology; the fabric uses a unified architecture based on these two primary role types.
Why the other options are wrong
- B. vBond controller is part of SD-WAN, not SD-Access; it is not a device role in the SD-Access fabric.
- C. Access switches are not a defined role in the SD-Access fabric; edge nodes serve the function of accessing endpoints.
- D. Core switches are not a defined role in SD-Access fabric; the architecture uses edge and border nodes instead of traditional core/access layers.
Question 7
What is the role of the vSmart controller in a Cisco SD-WAN environment?
Show answer and explanation
Correct answer: B. It manages the control plane.
The vSmart controller is the centralized control plane component in Cisco SD-WAN that manages all control plane functions, including policy distribution, routing decisions, and network intelligence. It communicates with WAN Edge nodes to direct how they should forward traffic and handle network operations.
Why the other options are wrong
- A. Authentication and authorization are handled by other components like vManage and ISE, not vSmart.
- C. While vSmart is centralized, it specifically manages the control plane, not the overall network management system (that role belongs to vManage).
- D. The data plane is managed by WAN Edge nodes; vSmart manages the control plane.
Question 8
When a wired client connects to an edge switch in a Cisco SD-Access fabric, which component decides whether the client has access to the network?
Show answer and explanation
Correct answer: B. Identity Services Engine
In Cisco SD-Access, the Identity Services Engine (ISE) is the policy decision point that performs authentication, authorization, and accounting for all devices connecting to the fabric, including wired clients connecting through edge switches. ISE evaluates the client's identity and applies appropriate network access policies.
Why the other options are wrong
- A. The edge node forwards traffic but does not make access control decisions.
- C. RADIUS is an authentication protocol that ISE may use, but ISE itself is the decision-making component.
- D. The control-plane node manages fabric control functions but does not directly authorize individual client access.
Question 9
What is the function of vBond in a Cisco SD-WAN deployment?
Show answer and explanation
Correct answer: C. onboarding of SD-WAN routers into the SD-WAN overlay
vBond (Orchestrator) in Cisco SD-WAN is responsible for onboarding SD-WAN routers into the SD-WAN overlay network. It manages the initial registration and authentication of SD-WAN devices, establishes their identities, and facilitates their integration into the overlay fabric. This onboarding function is vBond's primary operational responsibility.
Why the other options are wrong
- A. vSmart (controller) initiates connections and manages control plane interactions; vBond primarily handles onboarding and authentication.
- B. vManage pushes configuration toward SD-WAN routers; vBond focuses on registration and overlay membership establishment.
- D. vManage gathers telemetry data from SD-WAN routers; vBond's role is onboarding and certificate management.
Question 10
What is provided by the Stealthwatch component of the Cisco Cyber Threat Defense solution?
Show answer and explanation
Correct answer: B. real-time awareness of users, devices, and traffic on the network
Cisco Stealthwatch provides real-time network visibility and awareness of users, devices, and traffic flows across the network. It offers behavioral analytics and threat detection through deep flow inspection and network telemetry, enabling security teams to understand and monitor network activity in real time.
Why the other options are wrong
- A. DDoS protection and core/access network defense is provided by other components like Cisco DDoS Defense or ASR platforms, not Stealthwatch.
- C. Malware control is handled by Cisco AMP and endpoint security solutions, not Stealthwatch.
- D. Web traffic control is provided by Firepower and web security gateways; Stealthwatch focuses on flow analysis rather than dynamic web traffic control.
What people say about the full 350-401 pack 4.9 from 11
Thank you! Finally passed. Incredible value for money. Was not going to try again without changing something. Bought this dump and it worked. Should have done it sooner. Specifically for ENCOR, highly recommend.
Passed on first attempt. Legit questions.
Passed the ENCOR 350-401. This is a hard exam and having seen real questions beforehand made walking in much less stressful. Passed on first attempt.
Question 11
What is a characteristic of a next-generation firewall?
Show answer and explanation
Correct answer: D. provides intrusion prevention
A next-generation firewall (NGFW) is characterized by its ability to provide advanced threat protection beyond traditional Layer 3/4 filtering. Intrusion prevention is a core characteristic of NGFWs, as they can detect and block malicious traffic patterns and exploits in real-time. This distinguishes them from traditional firewalls.
Why the other options are wrong
- A. NGFWs are required throughout network architecture, not only at the perimeter, for comprehensive protection.
- B. While NGFWs can be deployed in multiple layers, this is not their defining characteristic.
- C. NGFWs go beyond Layer 3 and 4; they perform deep packet inspection and application-layer filtering.
Question 12
What is a Type 1 hypervisor?
Show answer and explanation
Correct answer: B. runs directly on a physical server and includes its own operating system
A Type 1 hypervisor (bare-metal hypervisor) runs directly on physical hardware and includes its own operating system or kernel, eliminating the need for a pre-installed OS. Examples include VMware ESXi, Hyper-V, and KVM, which control hardware resources directly.
Why the other options are wrong
- A. Type 1 hypervisors do not depend on a previously installed OS; they run directly on bare metal.
- C. Type 2 hypervisors run on top of an installed operating system, not Type 1.
- D. Type 2 hypervisors run on virtual servers with an installed OS, not Type 1.
Question 13
Based on this interface configuration, what is the expected state of OSPF adjacency?
Show answer and explanation
Correct answer: B. not established
OSPF adjacency will not be established between R1 and R2 because they have mismatched hello intervals. R1 is configured with 'ip ospf hello-interval 2' (2 seconds), while R2 has no hello-interval configured, meaning it uses the default of 10 seconds. For OSPF neighbors to form an adjacency, they must have matching hello intervals and dead intervals. Since these values differ, the routers will not progress beyond the INIT state and adjacency will not be established.
Why the other options are wrong
- A. 2WAY/DROTHER state requires OSPF neighbors to have matching hello and dead intervals, which these routers do not have.
- C. FULL adjacency cannot be achieved with mismatched hello intervals; the routers will not even reach 2WAY state.
- D. FULL/BDR state requires successfully established adjacency, which is prevented by the hello interval mismatch.
Question 14
What do Cisco DNA southbound APIs provide?
Show answer and explanation
Correct answer: C. interface between the controller and the network devices
Cisco DNA southbound APIs provide the interface between the controller and the network devices. The southbound direction refers to communication flowing from the controller down to the managed network devices, enabling the controller to manage and configure those devices through standard APIs.
Why the other options are wrong
- A. Northbound APIs provide the interface between the controller and consumer applications, not southbound APIs.
- B. While DNA does use RESTful APIs, the southbound APIs specifically interface with devices, not orchestrators.
- D. NETCONF is a device management protocol, but southbound APIs are RESTful interfaces between controller and devices.
Question 15
The following system log message is presented after a network administrator configures a GRE tunnel: %TUN-RECURDOWN Interface Tunnel 0 temporarily disabled due to recursive routing Why is Tunnel 0 disabled?
Show answer and explanation
Correct answer: C. Because the best path to the tunnel destination is through the tunnel itself.
The TUN-RECURDOWN message indicates recursive routing, which occurs when the tunnel destination can only be reached through the tunnel itself, creating an impossible routing loop. The router disables the tunnel to prevent this recursion. This is a fundamental GRE configuration problem where the tunnel endpoint is unreachable via the underlying routing table because the best path to reach it points back through the tunnel.
Why the other options are wrong
- A. Dynamic routing is not required for GRE tunnels; static routes work fine and would avoid this recursive problem.
- B. If the tunnel cannot reach its destination at all, the issue would be different; recursive routing specifically means the path loops back through itself.
- D. The router can identify egress interfaces; the problem is that the identified interface leads back into the tunnel, not a failure to identify it.
Question 16
What is the role of vSmart in a Cisco SD-WAN environment?
Show answer and explanation
Correct answer: A. to establish secure control plane connections
The vSmart controller (now the Catalyst SD-WAN Controller) is the control plane brain of the Cisco SD-WAN fabric. It keeps secure DTLS or TLS control connections to every WAN edge router and runs OMP over them to distribute routes, TLOCs, and policies. Establishing these secure control plane connections is therefore the role of vSmart.
Why the other options are wrong
- B. Monitoring, configuring, and maintaining the devices is the job of vManage.
- C. Secure data plane connectivity is provided by the WAN edge routers through IPsec tunnels.
- D. Initial authentication of devices is performed by the vBond orchestrator.
Question 17
Which access control list allows only TCP traffic with a destination port range of 22-443, excluding port 80?
Show answer and explanation
Correct answer: D. deny tcp any any eq 80 permit tcp any any range 22 443
Option D correctly denies TCP traffic on port 80 first, then permits TCP traffic in the range of ports 22-443. ACLs are processed sequentially, so denying port 80 first removes it from the range, effectively allowing ports 22-79 and 81-443. Option A has incorrect syntax with 'lt 444' instead of 'lt 443'. Option B has incorrect syntax and ordering. Option C only permits port 80, which contradicts the requirement.
Why the other options are wrong
- A. The syntax is malformed with 'lt 444' instead of 'lt 443', and uses 'gt 21' which incorrectly includes port 21.
- B. The permit statement comes before the deny statement, so it would allow port 80 before the deny rule can filter it out.
- C. This only permits port 80, which directly contradicts the requirement to exclude port 80.
Question 18
While configuring an IOS router for HSRP with a virtual IP of 10.1.1.1, an engineer sees this log message. Jan 1 12:12:12.111 : %HSRP-4-DIFFVIP1: GigabitEthernet0/0 Grp 1 active routers virtual IP address 10.1.1.1 is different to the locally configured address 10.1.1.25 Which configuration change must the engineer make?
Show answer and explanation
Correct answer: B. Change the HSRP virtual address on the local router to 10.1.1.1.
The error message indicates that the active router on group 1 has a virtual IP of 10.1.1.1, but the local router is configured with 10.1.1.25. For HSRP to function properly, all routers in the same group must be configured with the same virtual IP address. The local router's virtual address must be changed from 10.1.1.25 to 10.1.1.1 to match the group configuration.
Why the other options are wrong
- A. The group configuration is already correct (group 1); the problem is the IP address mismatch, not the group number.
- C. The remote router is already configured correctly with 10.1.1.1; the local router is the one that needs fixing.
- D. The remote router's group configuration is correct; changing it would break the HSRP setup.
Question 19
A network engineer must configure a router to send logging messages to a syslog server based on these requirements: * uses syslog IP address: 10.10.10.1 * uses a reliable protocol * must not use any well-known TCP/UDP ports Which configuration must be used?
Show answer and explanation
Correct answer: A. logging host 10.10.10.1 transport tcp port 1024
The requirements mandate a reliable protocol (TCP, not UDP), a non-well-known port (ports above 1023 are non-privileged), and the syslog server IP 10.10.10.1. Option A uses TCP for reliability and port 1024, which is the first non-well-known port and satisfies all requirements.
Why the other options are wrong
- B. UDP is unreliable and does not meet the requirement for a reliable protocol.
- C. UDP is unreliable, failing the reliable protocol requirement.
- D. This command configures the origin ID for logging messages, not the syslog server destination and transport protocol.
Question 20
By default, which virtual MAC address does HSRP group 16 use?
Show answer and explanation
Correct answer: C. 00:00:0c:07:ac:10
HSRP group 16 uses the default virtual MAC address 00:00:0c:07:ac:10. The HSRP virtual MAC address format is 00:00:0c:07:ac:XX where XX is the group number in hexadecimal (16 decimal = 0x10 in hexadecimal), resulting in 00:00:0c:07:ac:10.
Why the other options are wrong
- A. This format does not match the standard HSRP virtual MAC address structure.
- B. This uses an incorrect OUI and format for HSRP MAC addresses.
- D. This uses an incorrect OUI prefix (05:00 instead of 00:00) for HSRP.
Question 21
How is a data modeling language used?
Show answer and explanation
Correct answer: A. To enable data to be easily structured, grouped, validated, and replicated.
Data modeling languages are designed to structure, organize, validate, and allow replication of data in a consistent format. They provide a framework for defining how data is organized, stored, and accessed. Option A correctly describes these core functions of data modeling languages like XML, JSON, and YANG.
Why the other options are wrong
- B. Data modeling languages represent data structures, not necessarily finite network elements, and they can be modified and evolved.
- C. Data modeling languages are primarily used for structured data, not unstructured data flows.
- D. Data modeling languages enhance machine readability and structured processing, not human readability of scripts.
Question 22
By default, which virtual MAC address does HSRP group 32 use?
Show answer and explanation
Correct answer: C. 00:00:0c:07:ac:20
HSRP group 32 uses the virtual MAC address 00:00:0c:07:ac:20 by default. HSRP virtual MAC addresses follow the pattern 00:00:0c:07:ac:XX where XX is the group number in hexadecimal. Group 32 converts to 0x20 in hexadecimal, resulting in this specific MAC address.
Why the other options are wrong
- A. This MAC address does not follow the standard HSRP virtual MAC address format and is not associated with any HSRP group.
- B. This is not a valid HSRP virtual MAC address; it does not follow the required 00:00:0c:07:ac:XX pattern.
- D. While this is close to the correct format, the fifth octet is incorrect; HSRP uses 07 not 0c in that position.
Question 23
What is used to validate the authenticity of client and is sent in HTTP requests as a JSON object?
Show answer and explanation
Correct answer: C. JWT
JWT (JSON Web Token) is a self-contained token sent in HTTP requests as a JSON object that validates the authenticity and identity of a client. It is commonly used in REST APIs for stateless authentication and is transmitted in request headers.
Why the other options are wrong
- A. SSH is a network protocol for secure remote access, not an HTTP request authentication method
- B. HTTPS is a transport layer protocol; it does not validate client authenticity via JSON objects in requests
- D. TLS is a cryptographic protocol for securing connections; it does not validate client identity via JSON objects in HTTP requests
Question 24
Which resource is able to be shared among virtual machines deployed on the same physical server?
Show answer and explanation
Correct answer: A. disk
Disk storage can be shared among multiple virtual machines deployed on the same physical server through shared storage mechanisms, allowing multiple VMs to access the same data. This is commonly used for shared databases and file systems.
Why the other options are wrong
- B. Each VM has its own configuration file; these are not shared among VMs.
- C. Applications are installed within each VM's operating system; they cannot be directly shared without network services.
- D. Each VM must have its own separate operating system instance; operating systems cannot be shared among VMs.
Question 25
How is MSDP used to interconnect multiple PIM-SM domains?
Show answer and explanation
Correct answer: A. MSDP allows a rendezvous point to dynamically discover active sources outside of its domain.
MSDP (Multicast Source Discovery Protocol) allows rendezvous points in different PIM-SM domains to dynamically discover active multicast sources located outside their own domain. This enables inter-domain multicast communication by sharing source information through SA (Source Active) messages between RPs.
Why the other options are wrong
- B. MSDP SA request messages query for sources, but the primary function is source discovery, not requesting specific group sources.
- C. While BGP provides reachability information, MSDP does not fundamentally depend on BGP for interdomain operation; it operates independently.
- D. Though MSDP does advertise active sources via SA messages, this describes the mechanism rather than how MSDP interconnects domains.
Question 26
A customer requests a design that includes GLBP as the FHRP. The network architect discovers that the members of the GLBP group have different throughput capabilities. Which GLBP load balancing method supports this environment?
Show answer and explanation
Correct answer: C. weighted
Weighted load balancing in GLBP allows different members of the group to handle traffic proportional to their capabilities. This method assigns different weights to each gateway based on throughput capacity, enabling the architect to account for heterogeneous hardware with varying performance levels.
Why the other options are wrong
- A. Round robin distributes traffic equally among all gateways regardless of their capabilities.
- B. Host dependent uses MAC addresses to make consistent forwarding decisions but doesn't account for different throughput capabilities.
- D. Least connection is not a GLBP load balancing method.
Question 27
Which two components are supported by LISP? (Choose two.)
Show answer and explanation
Correct answer: A, B. proxy ETR; egress tunnel router
LISP (Locator/ID Separation Protocol) supports Proxy ETR (Egress Tunnel Router) and ETR as core components. A Proxy ETR acts on behalf of non-LISP sites to provide LISP functionality. ETR devices are fundamental LISP infrastructure that decapsulates packets at the destination. These are essential LISP architectural elements for mapping and routing.
Why the other options are wrong
- C. Route reflectors are BGP components, not LISP components.
- D. HMAC algorithms are cryptographic functions not specific to LISP architecture.
- E. Spokes are hub-and-spoke topology terms used in IPsec or SD-WAN, not LISP components.
Question 28
What does a northbound API accomplish?
Show answer and explanation
Correct answer: A. programmatic control of abstracted network resources through a centralized controller
A northbound API provides programmatic control of abstracted network resources through a centralized controller. It abstracts the underlying network complexity and allows upper-layer applications and orchestration systems to control network behavior through well-defined APIs, enabling software-defined networking principles.
Why the other options are wrong
- B. This describes read-only access, whereas northbound APIs provide full programmatic control.
- C. Communication between SDN controllers and physical switches is handled by southbound APIs, not northbound.
- D. This describes a specific security application use case, not the general purpose of northbound APIs.
Question 29
What are the main components of Cisco TrustSec?
Show answer and explanation
Correct answer: B. Cisco ISE, network switches, firewalls, and routers
Cisco TrustSec is a comprehensive network access control and identity-based segmentation solution comprising multiple components: Cisco ISE for policy enforcement and identity management, network switches for enforcing access control, firewalls for policy application, and routers for implementing segmentation across the network infrastructure.
Why the other options are wrong
- A. While ISE and Enterprise Directory are part of the ecosystem, this excludes the critical network devices required for TrustSec enforcement.
- C. ISE and TACACS+ are authentication components but do not represent the full scope of TrustSec's main components.
- D. ASA and Firepower are firewall solutions but do not accurately represent the core TrustSec architecture with ISE and network switches.
Question 30
Which feature is used to propagate ARP, broadcast, and link-local frames across a Cisco SD-Access fabric to address connectivity needs for silent hosts that require reception of traffic to start communicating?
Show answer and explanation
Correct answer: D. Layer 2 Flooding
Layer 2 Flooding in SD-Access fabric propagates ARP broadcasts, multicast, and link-local frames (addresses like 169.254.x.x) across the fabric to enable discovery and communication for silent hosts that need to receive traffic before initiating communication. This feature ensures that broadcast and link-local traffic reaches all necessary fabric nodes.
Why the other options are wrong
- A. Multisite Fabric is used to connect multiple SD-Access fabrics across different sites, not for ARP and broadcast propagation.
- B. Native Fabric Multicast handles multicast traffic optimization within the fabric but is not the primary mechanism for ARP and link-local frame propagation.
- C. SDA Transit is used to connect external networks to the fabric, not for internal ARP and broadcast propagation.
Question 31
What is one benefit of adopting a data modeling language?
Show answer and explanation
Correct answer: B. refactoring vendor and platform specific configurations with widely compatible configurations
A primary benefit of adopting a data modeling language is the ability to create vendor-agnostic and platform-independent configurations that can be widely compatible across different systems and vendors. This allows organizations to avoid vendor lock-in and enables portability of configurations across heterogeneous infrastructure.
Why the other options are wrong
- A. Data modeling languages are not specifically designed to augment SNMP-based management protocols.
- C. Data modeling languages are intended to reduce vendor-centric approaches, not augment them.
- D. While machine-friendly code is a benefit, the primary advantage is vendor-platform compatibility, not simply device count management.
Question 32
Refer to this output. R1# *Feb 14 37:09:53.129: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up What is the logging severity level?
Show answer and explanation
Correct answer: A. notification
The severity level indicated by '%LINEPROTO-5-UPDOWN' is notification (level 5). In Cisco syslog severity levels, the digit represents the severity: 0=emergency, 1=alert, 2=critical, 3=error, 4=warning, 5=notification, 6=informational, 7=debug. The '5' in this message indicates notification severity.
Why the other options are wrong
- B. Emergency is severity level 0, not level 5.
- C. Critical is severity level 2, not level 5.
- D. Alert is severity level 1, not level 5.
Question 33
In Cisco DNA Center what is the integration API?
Show answer and explanation
Correct answer: B. westbound interface, which allows the exchange of data to be used by ITSM, IPAM and reporting
Cisco DNA Center (Catalyst Center) exposes several API families. The Integration API is the westbound interface used to exchange data and events with external systems such as ITSM, IPAM, and reporting tools. The Intent API is the northbound consumer-facing REST API, and the southbound interfaces connect the controller to the network devices.
Why the other options are wrong
- A. Network discovery and configuration management are not delivered by a southbound consumer-facing API; the integration API is westbound.
- C. An interface between the controller and the network devices is a southbound interface, not the integration API.
- D. The northbound consumer-facing REST API for discovery and configuration is the Intent API.
Question 34
Which protocol is implemented to establish secure control plane adjacencies between Cisco SD-WAN nodes?
Show answer and explanation
Correct answer: B. TLS
TLS (Transport Layer Security) is the protocol implemented to establish secure control plane adjacencies between Cisco SD-WAN nodes. TLS provides encryption and authentication for the control plane communication between vEdge routers and the vSmart controller, protecting the exchange of routing and policy information. The data plane uses IPsec for encryption, but the control plane uses TLS.
Why the other options are wrong
- A. IKE is used for IPsec key establishment in the data plane, not for control plane adjacencies.
- C. IPsec is used for data plane encryption in SD-WAN, not for establishing control plane adjacencies.
- D. ESP is an IPsec protocol component used in the data plane for encrypting traffic, not for control plane security.
Question 35
What is used to perform QoS packet classification?
Show answer and explanation
Correct answer: C. the TOS field in the Layer 3 header
The TOS (Type of Service) field in the Layer 3 header is used to perform QoS packet classification. The TOS field, which includes the DSCP (Differentiated Services Code Point) bits, allows devices to identify and classify packets for differential treatment based on quality of service requirements.
Why the other options are wrong
- A. Layer 2 frame Type fields are used for protocol identification, not QoS classification.
- B. The Options field in Layer 3 headers is for miscellaneous IP options, not standard QoS classification.
- D. The Flags field in Layer 3 headers is used for fragmentation control, not QoS classification.
Question 36
Which deployment option of Cisco NGFW provides scalability?
Show answer and explanation
Correct answer: C. clustering
Clustering is the Cisco NGFW deployment option that provides scalability by allowing multiple firewall units to work together as a single logical entity, distributing traffic load and providing horizontal scaling. This enables the solution to handle increased traffic volumes and provide redundancy while scaling performance.
Why the other options are wrong
- A. Inline tap is a deployment mode (traffic visibility method) but does not inherently provide scalability.
- B. High availability provides redundancy and failover capability but does not scale capacity in the same way clustering does.
- D. Tap is a passive traffic monitoring mode that does not provide scalability for throughput or performance.
Question 37
Which HTTP status code is the correct response for a request with an incorrect password applied to a REST API session?
Show answer and explanation
Correct answer: C. HTTP Status Code: 401
HTTP 401 Unauthorized is the correct response when authentication credentials are invalid or incorrect, such as when a wrong password is submitted to a REST API. This status code indicates that the request lacks valid authentication credentials and the client should provide proper credentials to access the resource.
Why the other options are wrong
- A. HTTP 200 OK indicates successful authentication, not a failed authentication attempt.
- B. HTTP 302 Found is a redirect status code used for URL redirection, not for authentication failures.
- D. HTTP 504 Gateway Timeout indicates a server connectivity issue, not an authentication problem.
Question 38
A network engineer is enabling HTTPS access to the core switch, which requires a certificate to be installed on the switch signed by the corporate certificate authority. Which configuration commands are required to issue a certificate signing request from the core switch?
Show answer and explanation
Correct answer: C. Core-Switch(config)#crypto pki trustpoint Core-Switch Core-Switch(ca-trustpoint)#enrollment terminal Core-Switch(config)#crypto pki enroll Core-Switch
The correct sequence involves creating a trustpoint with crypto pki trustpoint, configuring enrollment to terminal mode, and then enrolling with crypto pki enroll. This process generates the CSR that can be submitted to the certificate authority. The WLAN controller then applies the signed certificate using ip http secure-trustpoint.
Why the other options are wrong
- A. The order is incorrect; trustpoint must be configured before enrollment, and the ip http secure-trustpoint command comes after enrollment.
- B. The order is reversed; trustpoint configuration and enrollment setup must occur before the enrollment command.
- D. While the trustpoint and enrollment setup are correct, the ip http secure-trustpoint command placement is incorrect (should follow successful enrollment, not be part of CSR generation).
Question 39
An engineer must configure HSRP group 300 on a Cisco IOS router. When the router is functional, it must be the active HSRP router. The peer router has been configured using the default priority value. Which command set is required?
Show answer and explanation
Correct answer: A. standby version 2 standby 300 priority 110 standby 300 preempt
To ensure this router becomes active, it must have a priority higher than the default (100) and preemption enabled. Option A specifies HSRP version 2, a priority of 110 (higher than default), and preempt to immediately take over if it becomes functional. The version 2 specification is important for modern deployments. The timers in option B are incorrect syntax, option C uses priority 90 (lower than default), and option D lacks the version specification.
Why the other options are wrong
- B. The timers parameter syntax is incorrect; this command structure does not properly configure HSRP priority and preemption.
- C. A priority of 90 is lower than the default 100, so this router would become standby, not active.
- D. While this sets preemption and a higher priority, it lacks the version 2 specification which is a best practice for modern configurations.
Question 40
How do cloud deployments differ from on-premises deployments?
Show answer and explanation
Correct answer: C. Cloud deployments have lower upfront costs than on-premises deployments.
Cloud deployments have lower upfront costs than on-premises deployments because they eliminate the need for large capital expenditures on hardware, infrastructure, and facilities. Cloud providers handle infrastructure investment, and customers pay operational expenses instead.
Why the other options are wrong
- A. Cloud deployments typically enable faster implementation times due to reduced infrastructure setup requirements.
- B. On-premises deployments are generally more customizable than cloud deployments, allowing direct hardware and software control.
- D. Cloud deployments often require more frequent updates and upgrades managed by the provider, not fewer.
Question 41
An engineer runs the code against an API of Cisco DNA Center, and the platform returns this output. What does the response indicate?
Show answer and explanation
Correct answer: D. The HTTP method is incorrect.
The output shows <Response [405]>. HTTP 405 means Method Not Allowed: the server knows the method but the target resource does not support it. The code calls requests.get() on /dna/system/api/v1/auth/token, while the Cisco DNA Center token API requires POST. Changing the call to requests.post() resolves the error.
Why the other options are wrong
- A. Incorrect credentials would produce HTTP 401 Unauthorized, not 405.
- B. The path /dna/system/api/v1/auth/token is the documented token path. A URI that does not exist would normally produce HTTP 404 Not Found.
- C. The URI uses HTTPS with no explicit port, which is the default 443. HTTP 405 describes the request method, not the port.
Question 42
Which method displays text directly into the active console with a synchronous EEM applet policy?
Show answer and explanation
Correct answer: D. event manager applet boom event syslog pattern 'UP' action 1.0 puts 'logging directly to console'
The 'puts' action in EEM applets is used to display text directly to the active console in a synchronous manner. This is the standard Tcl command for console output within EEM policy scripts. The 'puts' command writes the specified message directly to the console where the EEM applet is executing.
Why the other options are wrong
- A. The 'syslog priority direct' syntax is not a valid EEM action for direct console output.
- B. The 'gets' command is used for reading input, not writing output to console.
- C. The 'string' action is used for string manipulation, not for displaying text to console.
Question 43
Why would a log file contain a * next to the date?
Show answer and explanation
Correct answer: D. The network device is not configured to use NTP time stamps for logging.
An asterisk (*) in log timestamps indicates that NTP time synchronization is not available or not configured for logging purposes. The device falls back to unsynchronized local time. Option D correctly identifies that the absence of NTP time stamp configuration for logging results in the asterisk appearing next to the date in log entries.
Why the other options are wrong
- A. If the device was successfully receiving NTP time, there would be no asterisk; the timestamp would be synchronized.
- B. This describes why an asterisk would appear, but it's more specifically about not having NTP configured for logging rather than just being unable to reach the server at one moment.
- C. While related, not configuring NTP at all is broader than the specific issue of not configuring NTP time stamps for logging.
Question 44
Which entity is responsible for maintaining Layer 2 isolation between segments in a VXLAN environment?
Show answer and explanation
Correct answer: A. VNID
The VNID (VXLAN Network Identifier) is a 24-bit value that provides Layer 2 segmentation in VXLAN environments. Each VNID represents a separate broadcast domain, ensuring that traffic in one VNID is isolated from traffic in another, similar to how VLANs provide isolation.
Why the other options are wrong
- B. The switch fabric is the underlying physical network infrastructure, not responsible for maintaining logical Layer 2 isolation.
- C. VTEPs encapsulate and de-encapsulate traffic but use the VNID to determine isolation boundaries.
- D. A host switch is a component in the physical infrastructure but does not maintain VXLAN-level Layer 2 isolation.
Question 45
An engineer reviews a router's logs and discovers the following entry. What is the event's logging severity level? Router# *Jan 01 38:24:04.401: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Show answer and explanation
Correct answer: A. error
In Cisco syslog messages, the format %FACILITY-SEVERITY-MNEMONIC indicates severity level. The number 3 in %LINK-3-UPDOWN corresponds to severity level 3, which is 'error' on the standard 0-7 syslog severity scale (0=emergencies, 1=alerts, 2=critical, 3=errors, 4=warnings, 5=notification, 6=informational, 7=debugging).
Why the other options are wrong
- B. Warning is severity level 4, not 3.
- C. Informational is severity level 6, not 3.
- D. Notification is severity level 5, not 3.
Question 46
What is the result of applying this access control list? ip access-list extended STATEFUL 10 permit tcp any any established 20 deny ip any any
Show answer and explanation
Correct answer: C. TCP traffic with the ACK bit set is allowed.
The 'established' keyword in Cisco ACLs permits TCP traffic with the ACK or RST bits set, indicating an already-established connection. This ACL allows returning traffic from established connections. The established keyword specifically matches packets with ACK or RST flags, which are present in response packets from established TCP sessions.
Why the other options are wrong
- A. The URG bit is not matched by the established keyword; it is a rarely-used urgent flag.
- B. The SYN bit indicates a new connection attempt and is explicitly NOT matched by established; it only matches existing connections.
- D. The DF (Don't Fragment) bit is an IP header flag, not a TCP flag, and is not evaluated by the established keyword.
Question 47
Which action is a function of VTEP in VXLAN?
Show answer and explanation
Correct answer: C. encapsulating and de-encapsulating VXLAN Ethernet frames
A VTEP (VXLAN Tunnel Endpoint) is responsible for encapsulating Ethernet frames into VXLAN packets for transmission across the underlay network, and de-encapsulating VXLAN packets back into Ethernet frames at the destination. This encapsulation/de-encapsulation is the core function that enables VXLAN overlay networking.
Why the other options are wrong
- A. VTEPs do not handle IPv6 to IPv4 conversion; VXLAN operates independently of the underlay IP version.
- B. Encryption is not a primary VTEP function; VXLAN provides segmentation, not encryption by default.
- D. VTEPs do not convert between IPv4 and IPv6; VXLAN tunneling works over either protocol transparently.
Question 48
What is a TLOC in a Cisco SD-WAN deployment?
Show answer and explanation
Correct answer: C. attribute that acts as a next hop for network prefixes
A Transport Locator (TLOC) identifies the point where a WAN edge device attaches to a transport network, and it is made up of the system IP address, a color, and an encapsulation type. In OMP, the TLOC is the attribute of a route that acts as its next hop, much like the BGP next-hop attribute. An OMP route is usable only when the TLOC it points to is reachable.
Why the other options are wrong
- A. Tunnels are built between pairs of TLOCs, but a TLOC is defined as the next hop attribute of a route, not as a tunnel identifier.
- B. A service offered by nodes in the overlay is identified by a service ID, not by a TLOC.
- D. Differentiating similar nodes that offer a common service is done with a tag, not with a TLOC.
Question 49
How does Cisco TrustSec enable more flexible access controls for dynamic networking environments and data centers?
Show answer and explanation
Correct answer: D. classifies traffic based on the contextual identity of the endpoint rather than its IP address
Cisco TrustSec enables flexible access controls by classifying traffic based on the contextual identity of the endpoint (who/what the device is) rather than just its IP address. This identity-based approach allows more granular, flexible policies suitable for dynamic environments where endpoints move and change.
Why the other options are wrong
- A. Flexible NetFlow is a traffic monitoring tool, not a TrustSec access control mechanism.
- B. VLAN assignment is a layer 2 method that is less flexible than identity-based classification used by TrustSec.
- C. Application recognition is useful but is not the primary mechanism TrustSec uses for flexible access control; identity context is the key feature.
Question 50
Which definition describes JWT in regard to REST API security?
Show answer and explanation
Correct answer: D. an encoded JSON token that is used for authentication
JWT (JSON Web Token) is an encoded (not encrypted) JSON token used primarily for authentication in REST API security. The token contains claims about the user identity and is signed to ensure integrity, allowing stateless authentication where the server can verify the token's validity without maintaining session state. While JWTs can include authorization information, their fundamental purpose in REST API security is authentication of the client.
Why the other options are wrong
- A. JWT is encoded, not encrypted, and while it supports authentication, encryption is not its standard mechanism.
- B. Though JWTs can carry authorization information through claims, their primary function in REST APIs is authentication, not authorization.
- C. While JWTs do securely exchange information, this is too vague; the specific purpose in REST API security contexts is authentication.
Question 51
Which function does a Cisco SD-Access extended node perform?
Show answer and explanation
Correct answer: C. used to extend the fabric connecting to downstream nonfabric enabled Layer 2 switches
A Cisco SD-Access extended node serves to extend fabric connectivity to nonfabric-enabled Layer 2 switches downstream. It acts as a bridge between the fabric domain and legacy switches that do not support SD-Access capabilities, allowing those nonfabric switches to participate in the extended network while maintaining their Layer 2 switching functionality.
Why the other options are wrong
- A. Extended nodes do not provide remote registration and configuration to nonfabric devices; they extend fabric reach to nonfabric Layer 2 switches.
- B. Extended nodes do not perform tunneling between fabric and nonfabric devices; they operate at Layer 2 to bridge networks.
- D. Extended nodes do not establish Layer 3 adjacencies; they extend Layer 2 fabric capabilities to nonfabric downstream switches.
Question 52
What is one primary REST security design principle?
Show answer and explanation
Correct answer: A. fail-safe defaults
Fail-safe defaults is a primary REST security design principle, meaning the system should deny access by default and only grant permissions explicitly. While password hashing, timestamps, and OAuth are all security-related, fail-safe defaults is the foundational design principle that ensures secure-by-default behavior in REST API design.
Why the other options are wrong
- B. Password hashing is an implementation detail for credential storage, not a REST design principle.
- C. Adding timestamps helps prevent replay attacks but is not a primary design principle.
- D. OAuth is an authentication mechanism, not a design principle for REST APIs.
Question 53
What are two reasons why broadcast radiation is caused in the virtual machine environment? (Choose two.)
Show answer and explanation
Correct answer: A, B. vSwitch must interrupt the server CPU to process the broadcast packet.; The Layer 2 domain can be large in virtual machine environments.
In VM environments many VMs share a few hosts, which creates large Layer 2 domains in which broadcasts such as ARP reach every VM. Each broadcast the software vSwitch receives must interrupt the server CPU so it can be processed. Large Layer 2 domains and CPU interruption by the vSwitch cause broadcast radiation.
Why the other options are wrong
- C. VMs use normal unicast communication; they do not communicate primarily by broadcast.
- D. The link between the vSwitch and the network switch is not broadcast based.
- E. That communication is not multicast based.
Question 54
How does an on-premises infrastructure compare to a cloud infrastructure?
Show answer and explanation
Correct answer: C. On-premises offers lower latency for physically adjacent systems than cloud.
On-premises infrastructure offers lower latency for physically adjacent systems compared to cloud infrastructure because data does not need to traverse the internet or cloud provider networks. Systems located in the same physical data center can communicate directly with minimal network overhead, whereas cloud-based systems introduce additional network hops and potential geographic distance.
Why the other options are wrong
- A. Cloud infrastructure typically enables faster deployment through automated provisioning and pre-built services.
- B. On-premises requires significant power and cooling resources; cloud offloads these operational demands to providers.
- D. Cloud infrastructure can scale compute power faster through elastic resource allocation than on-premises fixed capacity.
Question 55
What are two benefits of virtualizing the server with the use of VMs in a data center environment? (Choose two.)
Show answer and explanation
Correct answer: A, D. reduced rack space, power, and cooling requirements; speedy deployment
Server virtualization with VMs provides reduced rack space, power, and cooling requirements by consolidating multiple physical servers onto fewer physical hosts. It also enables speedy deployment because new VMs can be provisioned quickly from templates without requiring physical hardware procurement and setup time.
Why the other options are wrong
- B. VM virtualization typically increases Layer 2 domain size by enabling more devices in the same physical space, not reducing it.
- C. While VMs can enhance security through isolation, this is not a primary or universal benefit compared to the infrastructure benefits.
- E. VM virtualization does not reduce IP and MAC address requirements; more VMs typically means more addresses are consumed.
Question 56
What does this EEM applet event accomplish? "event snmp oid 1.3.6.1.3.7.6.5.3.9.3.8.7 get-type next entry-op gt entry-val 75 poll-interval 5"
Show answer and explanation
Correct answer: B. It reads an SNMP variable, and when the value exceeds 75%, it triggers an action.
This EEM applet monitors an SNMP OID value using polling every 5 seconds (poll-interval 5). When the value exceeds 75 (entry-op gt entry-val 75), the event is triggered and associated actions execute. The 'get-type next' indicates it retrieves the next OID value, and the comparison operator 'gt' (greater than) checks against the threshold.
Why the other options are wrong
- A. The applet triggers an action when the threshold is exceeded, not specifically sending SNMP traps to a trap server.
- C. Email functionality is not configured in this applet syntax, and there is no five-cycle requirement mentioned.
- D. While it does read an SNMP variable, the applet actively triggers actions rather than merely presenting a variable for interrogation.
Question 57
Company policy restricts VLAN 10 to be allowed only on SW1 and SW2. All other VLANs can be on all three switches. An administrator has noticed that VLAN 10 has propagated to SW3. Which configuration corrects the issue?
Show answer and explanation
Correct answer: C. SW2(config)#int gi1/2 SW2(config)#switchport trunk allowed vlan 1-9,11-4094
VLAN 10 has propagated to SW3, which violates the policy that VLAN 10 should only exist on SW1 and SW2. The issue occurs at the trunk link between SW2 and SW3 (Gi1/2), where VLAN 10 is being allowed to pass through. To prevent VLAN 10 from reaching SW3, the trunk port on SW2 facing SW3 (Gi1/2) must be configured to allow all VLANs except VLAN 10. Option C correctly configures SW2's Gi1/2 interface to allow VLANs 1-9 and 11-4094, explicitly blocking VLAN 10 from traversing to SW3.
Why the other options are wrong
- A. Configuring SW1's Gi1/1 to block VLAN 10 would prevent VLAN 10 from reaching SW2, violating the policy that allows VLAN 10 on both SW1 and SW2.
- B. Configuring SW2's Gi1/2 to allow only VLAN 10 would block all other VLANs from reaching SW3, contradicting the requirement that all other VLANs can be on all three switches.
- D. Configuring SW1's Gi1/1 to allow only VLAN 10 would prevent all other VLANs from reaching SW2, which violates the policy allowing other VLANs on all switches.
Question 58
Which statement describes the IP and MAC allocation requirements for virtual machines on Type 1 hypervisors?
Show answer and explanation
Correct answer: C. Each virtual machine requires a unique IP and MAC addresses to be able to reach to other nodes.
Each virtual machine on a Type 1 hypervisor requires a unique IP address and unique MAC address to function properly on the network. These unique identifiers allow VMs to be distinguished and communicated with individually by other nodes on the network, enabling proper network connectivity and avoiding address conflicts.
Why the other options are wrong
- A. VMs must have unique identifiers to be individually addressable and reachable on the network.
- B. While unique IPs are needed, VMs cannot share the physical server's MAC address or they would not have separate network identities.
- D. While unique MAC addresses are important, VMs cannot share the physical server's IP address; each needs its own for independent network communication.
Question 59
Which reason could cause an OSPF neighborship to be in the EXSTART/EXCHANGE state?
Show answer and explanation
Correct answer: D. mismatched MTU size
The EXSTART/EXCHANGE state occurs when OSPF neighbors are beginning database synchronization. A mismatched MTU size between neighbors prevents them from progressing past this state because MTU mismatch causes Database Description (DD) packet fragmentation issues, halting the exchange of LSA information.
Why the other options are wrong
- A. Mismatched link costs do not prevent neighbor state progression; costs are local values.
- B. Mismatched network types prevent neighbors from becoming FULL, but MTU mismatch specifically stalls the EXSTART/EXCHANGE state.
- C. Mismatched areas prevent neighbors from forming at all; they would not reach EXSTART/EXCHANGE state.
Question 60
Which component does Cisco Threat Defense use to measure bandwidth, application performance, and utilization?
Show answer and explanation
Correct answer: C. NetFlow
NetFlow is the Cisco component used to measure bandwidth consumption, application performance, and network utilization. It provides detailed flow-level visibility into network traffic patterns, allowing Threat Defense to analyze and report on bandwidth and performance metrics across the infrastructure.
Why the other options are wrong
- A. TrustSec is Cisco's identity and access control framework, not a measurement component for bandwidth and performance
- B. Advanced Malware Protection for Endpoints focuses on endpoint security and threat detection, not bandwidth measurement
- D. Cisco Umbrella is a cloud security platform for DNS protection and threat prevention, not bandwidth and performance measurement
Question 61
A network engineer attempts to connect to the Router1 console port. Which configuration is needed to allow Telnet connections?
Show answer and explanation
Correct answer: C. Router1(config)# line console 0 Router1(config-line)# transport output telnet
To enable Telnet connections on the console port, you must configure the console line (line console 0) and specify 'transport output telnet' to allow outbound Telnet traffic from the console. The console port is the direct physical connection to the router and requires console-level configuration, not VTY lines.
Why the other options are wrong
- A. VTY lines (0-15) are for remote access like SSH/Telnet, not console port configuration; console requires 'line console 0'.
- B. The command 'telnet client' does not enable console port connectivity; it configures the router as a Telnet client.
- D. This creates an access list but applies it incorrectly; console port configuration does not use access-class in this manner for transport.
Question 62
In a Cisco SD-WAN solution, which two functions are performed by OMP? (Choose two.)
Show answer and explanation
Correct answer: A, D. advertisement of network prefixes and their attributes; delivery of crypto keys
OMP (Overlay Management Protocol) in Cisco SD-WAN performs two primary functions: it advertises network prefixes and their associated attributes across the overlay network, and it delivers cryptographic keys needed for secure communication between sites. OMP is the control plane protocol that handles these critical functions.
Why the other options are wrong
- B. Policy configuration is handled by the vManage controller, not by OMP.
- C. Gathering underlay infrastructure data is a function of other SD-WAN components, not OMP's primary role.
- E. Traffic segmentation and differentiation is accomplished through policies and QoS mechanisms, not through OMP itself.
Question 63
In a Cisco DNA Center Plug and Play environment, why would a device be labeled unclaimed?
Show answer and explanation
Correct answer: A. The device has not been assigned a workflow.
A device is labeled as unclaimed in Cisco DNA Center (now Cisco Catalyst Center) Plug and Play when it has not been assigned a workflow. The device has been discovered and registered but awaits assignment to a configuration workflow before provisioning can proceed. Once a workflow is assigned, the device moves from unclaimed to claimed status.
Why the other options are wrong
- B. Failure to be added to fabric results in different error states, not simply an unclaimed status.
- C. Provisioning errors result in failed or error states, not an unclaimed designation.
- D. Third-party devices can be claimed and managed in DNA Center Plug and Play; vendor origin does not determine claimed status.
Question 64
Which solution do IaaS service providers use to extend a Layer 2 segment across a Layer 3 network?
Show answer and explanation
Correct answer: A. VXLAN
VXLAN (Virtual Extensible LAN) is the solution IaaS providers use to extend Layer 2 segments across Layer 3 networks. VXLAN encapsulates Layer 2 frames in UDP packets, allowing virtual network segments to span geographically distributed data centers while maintaining Layer 2 semantics over Layer 3 infrastructure.
Why the other options are wrong
- B. VTEP (VXLAN Tunnel Endpoint) is a component that implements VXLAN, not the solution itself.
- C. VRF (Virtual Routing and Forwarding) is a Layer 3 mechanism for routing isolation, not Layer 2 extension.
- D. VLAN is a Layer 2 technology but only works within a single Layer 3 network, not across one.
Question 65
Which two threats does AMP4E have the ability to block? (Choose two.)
Show answer and explanation
Correct answer: C, E. Microsoft Word macro attack; ransomware
Cisco AMP for Endpoints is an endpoint protection product. Its file reputation, behavioral protection, and exploit prevention engines block malware delivered through weaponized documents, such as a malicious Microsoft Word macro, and stop ransomware by detecting ransomware-like behavior. It is not an email security gateway or a network firewall.
Why the other options are wrong
- A. Blocking email phishing is the job of an email security gateway, not an endpoint agent.
- B. DDoS attacks are mitigated at the network edge, not by AMP for Endpoints.
- D. SQL injection targets web applications and is addressed by web application firewalls.
Question 66
In which part of the HTTP message is the content type specified?
Show answer and explanation
Correct answer: C. header
The content type is specified in the HTTP header section of an HTTP message. The Content-Type header field indicates the media type of the resource being sent (e.g., application/json, text/html), allowing the client to understand how to process the message body.
Why the other options are wrong
- A. The HTTP method (GET, POST, etc.) specifies the action to be performed, not the content type.
- B. The body contains the actual message payload, not metadata about its content type.
- D. The URI (Uniform Resource Identifier) specifies the resource location, not the content type of the message.
Question 67
Which LISP component decapsulates messages and forwards them to the map server responsible for the egress tunnel routers?
Show answer and explanation
Correct answer: B. Map Resolver
The Map Resolver is the LISP component that receives decapsulated messages (ELP requests) from the Ingress Tunnel Router and forwards them to the appropriate Map Server responsible for the egress tunnel routers. It acts as an intermediary in the LISP mapping system, resolving location identities to routing locators.
Why the other options are wrong
- A. A Router Locator is a routing address identifier, not a processing component that decapsulates and forwards messages.
- C. A Proxy ETR (Egress Tunnel Router) encapsulates and forwards traffic on behalf of non-LISP sites, but does not handle message decapsulation and forwarding to map servers.
- D. An Ingress Tunnel Router sends encapsulated packets and initiates map requests, but does not decapsulate messages intended for map servers.
Question 68
A network administrator is implementing a routing configuration change and enables routing debugs to track routing behavior during the change. The logging output on the terminal is interrupting the command typing process. Which two actions can the network administrator take to minimize the possibility of typing commands incorrectly? (Choose two.)
Show answer and explanation
Correct answer: B, E. Configure the logging synchronous command under the vty.; Press the TAB key to reprint the command in a new line.
Debug and syslog output can interrupt a command that is being typed. Enabling 'logging synchronous' under the vty lines makes the router redisplay the interrupted command after each message, and pressing the TAB key also redisplays the partially typed command on a new line. The 'logging synchronous' command is a line command, not a global one.
Why the other options are wrong
- A. logging synchronous is a line-level command and cannot be entered in global configuration mode.
- C. The terminal length command only sets the number of lines per page.
- D. A logging delimiter does not stop messages from interrupting the command line.
Question 69
Which action is the vSmart controller responsible for in a Cisco SD-WAN deployment?
Show answer and explanation
Correct answer: C. distribute policies that govern data forwarding performed within the Cisco SD-WAN fabric
The vSmart controller's primary responsibility is to distribute policies and control information that govern how WAN Edge nodes forward data traffic within the SD-WAN fabric. It serves as the policy engine that communicates routing and forwarding decisions to all edge nodes.
Why the other options are wrong
- A. Onboarding of WAN Edge nodes is performed by the vBond orchestrator, not vSmart.
- B. Telemetry data gathering is the responsibility of vManage, the management plane component.
- D. Configuration and status management is handled by vManage, not vSmart.
Question 70
What are two reasons a company would choose a cloud deployment over an on-prem deployment? (Choose two.)
Show answer and explanation
Correct answer: A, B. Cloud costs adjust up or down depending on the amount of resources consumed. On-prem costs for hardware, power, and space are ongoing regardless of usage; Cloud resources scale automatically to an increase in demand. On-prem requires additional capital expenditure.
Cloud deployments offer cost flexibility (option A) where costs scale with consumption, whereas on-premises requires continuous expenditure on hardware, power, and facilities regardless of usage. Cloud resources also auto-scale (option B) to meet demand without capital expenditure, while on-premises scaling requires additional hardware investment. These are fundamental economic advantages of cloud deployment models.
Why the other options are wrong
- C. This is backward; companies typically have more control and responsibility for their data in on-premises environments, while cloud providers manage access controls.
- D. This is also backward; in cloud environments, the service provider resolves technical issues, whereas on-premises requires the company's own technical staff.
- E. This is reversed; cloud deployments are typically faster to implement using operational expenditure, while on-premises requires capital expenditure processes.
Question 71
How does SSO work with HSRP to minimize network disruptions?
Show answer and explanation
Correct answer: C. It enables data forwarding along known routes following a switchover, while the routing protocol reconverges.
SSO (Stateful Switchover) works with HSRP to enable data forwarding along known routes following a switchover event, allowing the standby switch to take over as active while routing protocols are reconverging. This minimizes network disruptions by maintaining forwarding capability during the failover process rather than waiting for full route reconvergence.
Why the other options are wrong
- A. HSRP itself elects the active switch; SSO does not perform this election function but rather enables continuity during switchover.
- B. SSO does not specifically address link failures; it handles switchover of the routing processor.
- D. SSO enables failover between the active and standby RP on the same device, but this is specific to the RP redundancy within a single device, not the primary mechanism for minimizing network disruptions in typical HSRP scenarios.
Question 72
A network administrator has designed a network with two multilayer switches on the distribution layer, which act as default gateways for the end hosts. Which two technologies allow every end host in a VLAN to use both gateways? (Choose two.)
Show answer and explanation
Correct answer: B, C. GLBP; VSS
GLBP and VSS both allow every end host in a VLAN to use both gateways simultaneously. GLBP (Gateway Load Balancing Protocol) distributes traffic across multiple gateways by assigning different virtual MAC addresses to hosts. VSS (Virtual Switching System) makes two physical switches appear as one logical switch, allowing both to actively forward traffic. VRRP, HSRP, and MHSRP designate one active and one standby gateway, preventing simultaneous use of both.
Why the other options are wrong
- A. VRRP only allows one active gateway and one standby, not simultaneous use of both gateways.
- D. MHSRP is not a standard technology for this purpose and does not enable both gateways to be active.
- E. HSRP uses an active-standby model where only one gateway forwards traffic at a time, not simultaneous multi-gateway forwarding.
Question 73
Which feature must be configured to allow packet capture over Layer 3 infrastructure?
Show answer and explanation
Correct answer: B. ERSPAN
ERSPAN (Encapsulated Remote SPAN) must be configured to allow packet capture over Layer 3 infrastructure. Unlike RSPAN which is limited to Layer 2 switched networks, ERSPAN encapsulates mirrored traffic in GRE packets, allowing it to traverse Layer 3 routed networks and reach remote monitoring destinations.
Why the other options are wrong
- A. RSPAN operates only on Layer 2 switched infrastructure and cannot cross Layer 3 boundaries.
- C. VSPAN is not a standard Cisco monitoring feature for Layer 3 packet capture.
- D. IPSPAN is not a recognized Cisco feature for packet capture over Layer 3.
Question 74
What is a characteristic of MACsec?
Show answer and explanation
Correct answer: A. 802.1AE is built between the host and switch using the MKA protocol, which negotiates encryption keys based on the primary session key from a successful 802.1X session.
MACsec (802.1AE) is a standards-based protocol that provides encryption and authentication at the MAC layer. It uses the MKA (MACsec Key Agreement) protocol to negotiate encryption keys, which are derived from the primary session key established during a successful 802.1X authentication session. This creates a secure point-to-point link between host and switch.
Why the other options are wrong
- B. MACsec is not negotiated using Cisco AnyConnect NAM or SAP protocol; it uses standard 802.1X and MKA.
- C. While MKA is used, it does not generate keys via anonymous Diffie-Hellman; keys are derived from the 802.1X session key.
- D. While MACsec does provide encryption and authentication, option A is more specific and correct regarding the mechanism.
Question 75
Which PAgP mode combination prevents an EtherChannel from forming?
Show answer and explanation
Correct answer: D. auto/auto
PAgP has three modes: on, desirable, and auto. For EtherChannel to form using PAgP, at least one side must be in desirable mode. The auto/auto combination means both sides are passively waiting for the other to initiate negotiation, so neither side actively negotiates the EtherChannel formation, preventing it from forming.
Why the other options are wrong
- A. auto/desirable works because desirable actively initiates negotiation.
- B. desirable/desirable works because both sides actively negotiate.
- C. desirable/auto works because desirable actively initiates negotiation.
Question 76
Which LISP infrastructure device provides connectivity between non-LISP sites and LISP sites by receiving non-LISP traffic with a LISP site destination?
Show answer and explanation
Correct answer: A. PITR
A PITR (Proxy Ingress Tunnel Router) provides connectivity between non-LISP sites and LISP sites by receiving non-LISP traffic destined for a LISP site and encapsulating it in LISP format before sending it into the LISP network. This enables interoperability between legacy non-LISP networks and LISP-enabled networks.
Why the other options are wrong
- B. Map resolvers assist LISP devices in resolving mappings but do not specifically handle non-LISP to LISP traffic conversion.
- C. Map servers store and distribute mapping information but do not provide non-LISP to LISP traffic handling.
- D. A PETR (Proxy Egress Tunnel Router) handles traffic exiting the LISP network to non-LISP destinations, the opposite direction.
Question 77
Which three resources must the hypervisor make available to the virtual machines? (Choose three.)
Show answer and explanation
Correct answer: A, D, E. Memory; Processor; storage
A hypervisor must allocate three fundamental resources to virtual machines: Memory (RAM) for VM execution, Processor (CPU) cores for computation, and Storage (disk/persistent storage) for the operating system and applications. These are the core computing resources that any VM requires to function. Bandwidth is a network characteristic managed at the network level, IP addresses are network configuration items assigned by the OS or DHCP, and secure access is a security policy rather than a physical resource the hypervisor directly allocates.
Why the other options are wrong
- B. Bandwidth is a network characteristic managed by network infrastructure, not directly allocated by the hypervisor as a computational resource.
- C. IP addresses are assigned by the guest operating system or DHCP server, not allocated by the hypervisor as a core resource.
- F. Secure access is a security policy implementation, not a physical or logical resource the hypervisor allocates to VMs.
Question 78
In which two ways does the routing protocol OSPF differ from EIGRP? (Choose two.)
Show answer and explanation
Correct answer: B, D. OSPF supports only equal-cost load balancing EIGRP supports unequal-cost load balancing; OSPF supports an unlimited number of hops EIGRP supports a maximum of 255 hops.
OSPF and EIGRP differ fundamentally in their load balancing capabilities and routing algorithm classification. OSPF (a link-state protocol) supports only equal-cost load balancing, while EIGRP (a hybrid protocol) supports both equal-cost and unequal-cost load balancing. Additionally, EIGRP has a maximum hop count of 255, while OSPF supports unlimited hops through its area design.
Why the other options are wrong
- A. EIGRP provides faster convergence time than OSPF due to its incremental updates and DUAL algorithm; OSPF convergence is slower.
- C. OSPF is a link-state protocol and EIGRP is a hybrid protocol (not purely distance vector); this statement is incorrect.
- E. This reverses the actual capabilities: OSPF supports only equal-cost load balancing, and EIGRP supports unequal-cost load balancing.
Question 79
Which NTP Stratum level is a server that is connected directly to an authoritative time source?
Show answer and explanation
Correct answer: B. Stratum 1
Stratum 1 represents NTP servers that are directly connected to an authoritative time source such as a GPS receiver or atomic clock. Stratum 0 is the reference clock itself (not a network layer), Stratum 14 and 15 are reserved for undefined purposes or unsynchronized states.
Why the other options are wrong
- A. Stratum 0 is the reference clock itself, not a server level on the network.
- C. Stratum 14 is not used for primary time sources; it indicates unsynchronized or test conditions.
- D. Stratum 15 indicates that a device is unsynchronized and should not be used as a time source.
Question 80
Which IPv4 packet field carries the QoS IP classification marking?
Show answer and explanation
Correct answer: D. ToS
The Type of Service (ToS) field in the IPv4 header is used to carry QoS (Quality of Service) classification markings. This 8-bit field allows packets to be marked with different service levels, which is essential for QoS implementations. The ToS field has been extended with DSCP (Differentiated Services Code Point) for more granular QoS classification.
Why the other options are wrong
- A. The ID field is used for packet identification and fragmentation reassembly, not QoS marking.
- B. The TTL (Time to Live) field controls packet hop limits to prevent infinite loops, not QoS classification.
- C. FCS (Frame Check Sequence) is a Layer 2 concept in frames, not an IPv4 header field used for QoS.
Question 81
Which method does Cisco DNA Center use to allow management of non-Cisco devices through southbound protocols?
Show answer and explanation
Correct answer: A. It creates device packs through the use of an SDK.
Cisco DNA Center (now Cisco Catalyst Center) uses device packs to extend management capabilities to non-Cisco devices through southbound protocols. These device packs are created using the Cisco DNA Center SDK, allowing integration with third-party network devices by defining their specific capabilities and management interfaces.
Why the other options are wrong
- B. API interrogation is not the primary mechanism for non-Cisco device management in DNA Center.
- C. MIB imports are not how DNA Center handles non-Cisco device APIs; it uses device packs instead.
- D. CSV import of APIs is not the correct mechanism; device packs developed with SDK are the standard approach.
Question 82
A customer requests a network design that supports these requirements: • FHRP redundancy • multivendor router environment • IPv4 and IPv6 hosts Which protocol does the design include?
Show answer and explanation
Correct answer: B. VRRP version 3
VRRP version 3 is the only protocol that meets all three requirements. VRRP v3 supports multivendor environments (it's a standards-based protocol), provides FHRP redundancy, and crucially supports both IPv4 and IPv6. VRRP v2 only supports IPv4. HSRP and GLBP are Cisco-proprietary, failing the multivendor requirement.
Why the other options are wrong
- A. VRRP version 2 only supports IPv4 and cannot meet the IPv6 requirement.
- C. GLBP is a Cisco-proprietary protocol that cannot be used in a multivendor router environment.
- D. HSRP version 2 is a Cisco-proprietary protocol incompatible with non-Cisco routers in a multivendor environment.
Question 83
A network monitoring system uses SNMP polling to record the statistics of router interfaces. The SNMP queries work as expected until an engineer installs a new interface and reloads the router. After this action, all SNMP queries for the router fail. What is the cause of this issue?
Show answer and explanation
Correct answer: A. The SNMP interface index changed after reboot.
After a router reboot with a new interface installed, SNMP queries fail because the SNMP interface index changed. SNMP uses numeric interface indexes (ifIndex values) to identify interfaces in the MIB. When a router reboots, especially with new hardware, these indexes are recalculated, causing previously recorded interface indexes to become invalid. The monitoring system is querying interfaces using old index numbers that no longer correspond to the actual interfaces.
Why the other options are wrong
- B. SNMP traps being disabled for link state would cause trap notifications to fail, not all SNMP queries.
- C. While related to indexing, trap configuration would not cause all polling queries to fail across the device.
- D. If the SNMP community was incorrectly configured, queries would have failed before the reboot and interface installation.
Question 84
Which statement about an RSPAN session configuration is true?
Show answer and explanation
Correct answer: B. A special VLAN type must be used as the RSPAN destination.
A special VLAN type must be used as the RSPAN destination. RSPAN requires a dedicated VLAN to carry the mirrored traffic across the switched network to the remote monitoring port. This VLAN is configured as the reflection VLAN and serves as the transport mechanism for the mirrored data.
Why the other options are wrong
- A. Multiple RSPAN sessions can be configured simultaneously, each using its own VLAN.
- C. Filters are optional in RSPAN configuration; they are not required.
- D. RSPAN can monitor both incoming and outgoing traffic in both directions.
Question 85
What is a characteristic of a Type 2 hypervisor?
Show answer and explanation
Correct answer: B. Problems in the base operating system can affect the entire system.
Type 2 hypervisors (also called hosted hypervisors) run on top of a host operating system and depend on it for hardware access and resource management. A critical characteristic is that problems or failures in the base/host operating system directly impact the entire virtualization system and all guest virtual machines running on it, since they all rely on that OS layer for their operation.
Why the other options are wrong
- A. Type 2 hypervisors require an underlying operating system; they do not eliminate this requirement.
- C. Managing hardware resources between operating systems is a characteristic of Type 1 hypervisors, not Type 2.
- D. Type 2 hypervisors are completely dependent on the underlying operating system, not independent from it.
Question 86
What function does VXLAN perform in a Cisco SD-Access deployment?
Show answer and explanation
Correct answer: C. data plane forwarding
VXLAN performs data plane forwarding in Cisco SD-Access by encapsulating and transporting data traffic across the overlay network. While the control plane uses protocols like LISP for endpoint discovery and mapping, VXLAN itself handles the actual forwarding of user traffic.
Why the other options are wrong
- A. Policy enforcement is handled by the control plane and policy engines, not VXLAN directly.
- B. Control plane forwarding involves routing decisions and discovery, handled by separate mechanisms like LISP.
- D. Systems management and orchestration are handled by higher-level components like DNAC, not VXLAN.
Question 87
If a VRRP master router fails, which router is selected as the new master router?
Show answer and explanation
Correct answer: B. router with the highest priority
In VRRP, when the master router fails, the backup router with the highest priority value becomes the new master router. If priorities are equal, the router with the highest IP address becomes master. Priority-based selection ensures the administrator can control which router is preferred as master.
Why the other options are wrong
- A. VRRP selects based on highest priority, not lowest.
- C. Loopback address is not used in VRRP master selection; interface IP addresses matter only when priorities are tied.
- D. VRRP uses highest priority and highest IP address, not lowest values.
Question 88
What is one fact about Cisco SD-Access wireless network deployments?
Show answer and explanation
Correct answer: A. The access point is part of the fabric overlay.
In Cisco SD-Access wireless deployments, the access point is considered part of the fabric overlay. The AP connects to the wireless LAN controller (WLC), which is integrated into the fabric, and the AP itself becomes part of the overlay fabric architecture, enabling the same segmentation and policy capabilities as wired fabric edge nodes.
Why the other options are wrong
- B. The wireless client (endpoint) is not part of the fabric overlay; it connects through the AP.
- C. The AP is part of the overlay, not the underlay.
- D. The WLC is part of the overlay as a control and management component, not the underlay.
Question 89
When is the Design workflow used in Cisco DNA Center?
Show answer and explanation
Correct answer: A. in a greenfield deployment, with no existing infrastructure
The Design workflow in Cisco DNA Center (now Cisco Catalyst Center) is used in greenfield deployments where no existing infrastructure exists. It allows network architects to design network topology, device configurations, policies, and security settings from scratch before deployment and provisioning of new devices.
Why the other options are wrong
- B. The Design workflow does not wipe out existing data; it is meant for new deployments without prior infrastructure.
- C. Modifying configurations of existing devices in brownfield deployments is handled by other workflows like Provision or Assurance.
- D. Provisioning and onboarding new devices in brownfield deployments occurs after design and uses the Provision workflow.
Question 90
Which configuration allows administrators to configure the device through the console port and use a network authentication server?
Show answer and explanation
Correct answer: D. aaa new-model aaa authentication login default group radius aaa authorization console aaa authorization config-commands
Option D enables AAA with network authentication server (RADIUS via 'group radius') while also allowing console port access and supporting configuration command authorization. This configuration uses 'aaa authentication login default group radius' to delegate authentication to a RADIUS server rather than using only local credentials.
Why the other options are wrong
- A. This configuration specifies local authentication ('default local') and includes a hardcoded username/password, not network authentication server integration.
- B. This configuration uses local authentication rather than a network authentication server like RADIUS.
- C. This authentication method ('default line') uses line-based authentication, not a network server or proper AAA model.
Question 91
What is the function of a fabric border node in a Cisco SD-Access environment?
Show answer and explanation
Correct answer: B. To connect the Cisco SD-Access fabric to another fabric or external Layer 3 networks.
A fabric border node serves as the gateway between the Cisco SD-Access fabric and external networks, including other fabric instances and traditional Layer 3 networks. It handles the translation and routing of traffic between the fabric's VXLAN overlay and non-fabric networks, enabling secure and controlled inter-fabric and fabric-to-external connectivity.
Why the other options are wrong
- A. Collecting traffic flow information is a function of network analytics and telemetry systems, not specifically the border node.
- C. Attaching and registering clients to the fabric is the function of fabric edge switches, not border nodes.
- D. Handling IP address and location information for endpoints is a controller or policy server function, not the border node.
Question 92
Which element enables communication between guest VMs within a virtualized environment?
Show answer and explanation
Correct answer: C. vSwitch
A vSwitch (virtual switch) is the component that enables communication between guest VMs by providing Layer 2 switching functionality within the hypervisor. It forwards frames between VMs connected to the same virtual network, allowing intra-VM communication within the virtualized environment.
Why the other options are wrong
- A. The hypervisor is the overall virtualization platform, not the specific component managing VM-to-VM communication.
- B. A virtual router handles Layer 3 routing, not Layer 2 switching for VM communication.
- D. A pNIC (physical NIC) connects to the external network, not directly enables guest-to-guest VM communication.
Question 93
What are two benefits of virtual switching when compared to hardware switching? (Choose two.)
Show answer and explanation
Correct answer: D, E. hardware independence; increased flexibility
Virtual switches provide hardware independence by abstracting network switching from physical hardware, allowing flexible reconfiguration without hardware changes. They also offer increased flexibility through software-based configuration, dynamic resource allocation, and the ability to implement advanced networking policies at the VM level. These benefits enable efficient network resource management in virtualized environments.
Why the other options are wrong
- A. MTU size is determined by underlying physical network configuration and is not increased by virtual switching.
- B. VM-level isolation is more of a security consideration than a benefit of virtual switching specifically.
- C. The 802.1Q VLAN range is not extended by virtual switching; it remains limited to 4094 VLANs regardless of switching method.
Question 94
Which outbound access list, applied to the WAN interface of a router, permits all traffic except for http traffic sourced from the workstation with IP address 10.10.10.1?
Show answer and explanation
Correct answer: D. ip access-list extended 100 deny tcp host 10.10.10.1 any eq 80 permit ip any any
The correct syntax for an extended ACL is 'ip access-list extended [name/number] deny tcp host [source] any eq [port] permit ip any any'. Option D uses numeric identifier 100, denies TCP from 10.10.10.1 to any destination on port 80, then permits all other IP traffic. The source host must be listed before the destination, and the port (80 for HTTP) must be specified as the destination with 'eq'.
Why the other options are wrong
- A. Uses incorrect syntax with 'eq 80' before 'any' (should be after destination), and extended ACLs should not use 200 as a numeric identifier in this context.
- B. Uses 10 which is a standard ACL number range, not extended (100-199); also has incorrect port placement syntax.
- C. Missing the 'permit ip any any' statement at the end, which is required to allow all other traffic after denying HTTP.
Question 95
Which two results occur if Cisco DNA Center loses connectivity to devices in the SD-Access fabric? (Choose two.)
Show answer and explanation
Correct answer: D, E. User connectivity is unaffected; Cisco DNA Center is unable to collect monitoring data in Assurance
When Cisco DNA Center (now Cisco Catalyst Center) loses connectivity to devices in the SD-Access fabric, user connectivity remains unaffected because the fabric operates autonomously once established, and Cisco DNA Center becomes unable to collect monitoring data in Assurance since it cannot communicate with the devices. The answer options suggest users continue to experience normal connectivity while management visibility is lost.
Why the other options are wrong
- A. Users do not lose connectivity when DNA Center disconnects; the fabric continues operating autonomously.
- B. This scenario is not the result of DNA Center disconnection; the fabric maintains all user connectivity.
- C. Devices do not reload when DNA Center connectivity is lost; the fabric is designed for autonomous operation.
Question 96
Which behavior can be expected when the HSRP version is changed from 1 to 2?
Show answer and explanation
Correct answer: C. Each HSRP group reinitializes because the virtual MAC address has changed.
When HSRP version is changed from version 1 to version 2, each HSRP group reinitializes because the virtual MAC address changes. HSRPv1 uses MAC addresses in the format 0000.0c07.acXX while HSRPv2 uses 0000.0c9f.fXXX. This MAC address change causes the HSRP groups to restart their election process.
Why the other options are wrong
- A. The upgrade sequence does not prevent reinitialization; the MAC change triggers group resets regardless of upgrade order.
- B. Version 1 and 2 do use different virtual MAC addresses (different OUI patterns), so this statement is incorrect.
- D. While the multicast address does change between versions, the primary cause of reinitialization is the virtual MAC address change.
Question 97
Under which network conditions is an outbound QoS policy that is applied on a router WAN interface most beneficial?
Show answer and explanation
Correct answer: B. under interface saturation conditions
An outbound QoS policy on a WAN interface is most beneficial under interface saturation conditions. When the WAN interface becomes congested and cannot accommodate all offered traffic, QoS policies control congestion through traffic classification, marking, and queuing, preventing dropped packets and maintaining service quality. Under normal conditions with available bandwidth, QoS provides minimal benefit.
Why the other options are wrong
- A. Traffic classification and marking are mechanisms used by QoS, not conditions under which it is most beneficial; QoS provides the greatest benefit when those markings are acted upon during congestion.
- C. QoS policies are most beneficial under specific conditions (saturation), not under all network conditions when bandwidth is available.
- D. During network convergence, QoS has minimal impact; saturation conditions are when QoS policies provide the most value.
Question 98
Which Cisco DNA Center application is responsible for group-based access control permissions?
Show answer and explanation
Correct answer: D. Policy
The Policy application in Cisco DNA Center (now Cisco Catalyst Center) is responsible for group-based access control permissions, including managing security group tags, access policies, and role-based access controls throughout the network.
Why the other options are wrong
- A. Provision handles device provisioning and configuration deployment.
- B. Design is used for network design and planning.
- C. Assurance monitors network health and performance metrics.
Question 99
Which algorithms are used to secure REST API from brute attacks and minimize the impact?
Show answer and explanation
Correct answer: D. PBKDF2, BCrypt, and SCrypt
PBKDF2, BCrypt, and SCrypt are key derivation and password hashing algorithms specifically designed to secure REST APIs against brute-force attacks. These algorithms are computationally expensive and slow, making brute-force attacks impractical by increasing the time required to test each password guess.
Why the other options are wrong
- A. SHA-512 and SHA-384 are cryptographic hash functions not designed for password storage and are vulnerable to brute-force attacks due to their speed.
- B. MD5 is cryptographically broken and unsuitable for further use, and SHA-384 alone is not designed for brute-force protection.
- C. SHA-1, SHA-256, and SHA-512 are general-purpose hash functions not optimized for password hashing and lack the computational expense needed to mitigate brute-force attacks.
Question 100
Which two solutions are used for backing up a Cisco DNA Center Assurance database? (Choose two.)
Show answer and explanation
Correct answer: B, C. remote server; NFS share
Cisco DNA Center (now Cisco Catalyst Center) Assurance database can be backed up to either a remote server or an NFS (Network File System) share. These are the two supported backup locations for the Assurance database. NFS shares provide network-based storage, while remote servers offer off-site backup capabilities, both meeting enterprise backup requirements.
Why the other options are wrong
- A. Bare metal servers are not a supported backup destination for DNA Center Assurance databases.
- D. Local server backups alone do not provide adequate redundancy and are not recommended as a primary backup solution.
- E. Non-Linux servers are not supported backup targets; DNA Center infrastructure requires Linux-based systems.
Question 101
When using TLS for syslog, which configuration allows for secure and reliable transportation of messages to its default port?
Show answer and explanation
Correct answer: C. logging host 10.2.3.4 vrf mgmt transport tcp port 6514
TLS for syslog uses TCP port 6514 as its default secure port, with TCP providing reliable, connection-oriented transport. The command 'logging host 10.2.3.4 vrf mgmt transport tcp port 6514' correctly specifies TCP transport with the standard TLS syslog port, ensuring secure and reliable message delivery.
Why the other options are wrong
- A. Port 514 is the standard unencrypted syslog port, not the TLS default; TLS syslog requires port 6514.
- B. UDP does not provide the reliable transport required for secure TLS syslog communication.
- D. UDP port 6514 is neither the correct transport protocol nor the correct pairing for TLS syslog.
Question 102
Which statement explains why Type 1 hypervisor is considered more efficient than Type2 hypervisor?
Show answer and explanation
Correct answer: C. Type 1 hypervisor runs directly on the physical hardware of the host machine without relying on the underlying OS.
Type 1 hypervisors run directly on physical hardware without requiring an underlying operating system, which reduces overhead and improves efficiency. Type 2 hypervisors run as applications on top of a host OS, adding a layer of abstraction and overhead. This direct hardware access makes Type 1 more efficient for resource utilization and performance.
Why the other options are wrong
- A. Both Type 1 and Type 2 hypervisors can support hardware acceleration; this is not exclusive to Type 1.
- B. This describes Type 2 hypervisors, not Type 1, which is the opposite of why Type 1 is more efficient.
- D. Both Type 1 and Type 2 hypervisors enable other operating systems to run; this is a shared characteristic, not a differentiator.
Question 103
What is YANG used for?
Show answer and explanation
Correct answer: C. describing data models
YANG is a data modeling language used to describe the structure and constraints of data in network management. It defines how data is organized, validated, and accessed on network devices, making it the standard for describing network configuration and operational data models.
Why the other options are wrong
- A. YANG is not used for CLI scraping; it is a data modeling language
- B. YANG does not process SNMP polls; it is used for data structure definition
- D. YANG describes data models; NETCONF provides the transport mechanism for configuration data between client and server
Question 104
Which statements are used for error handling in Python?
Show answer and explanation
Correct answer: D. try/except
Python uses try/except blocks for error handling. The try block contains code that might raise an exception, and the except block catches and handles that exception. This is the standard Python syntax defined in the language specification.
Why the other options are wrong
- A. try/catch is the syntax used in Java and JavaScript, not Python.
- B. catch/release is not valid syntax in any major programming language.
- C. block/rescue is the syntax used in Ruby, not Python.
Question 105
Which benefit is offered by a cloud infrastructure deployment but is lacking in an on-premises deployment?
Show answer and explanation
Correct answer: D. efficient scalability
Cloud infrastructure provides efficient scalability through elastic resource provisioning, the ability to quickly add or remove resources based on demand without significant capital investment or physical infrastructure changes. On-premises deployments require purchasing and installing physical hardware, making scaling slower and less efficient.
Why the other options are wrong
- A. Both cloud and on-premises deployments support virtualization technologies.
- B. Both cloud and on-premises can support various systems; this is not a distinguishing factor.
- C. Storage capacity can be scaled in both environments; cloud offers elastic scaling, but on-premises can add storage as well.
Question 106
Which LISP component is required for a LISP site to communicate with a non-LISP site?
Show answer and explanation
Correct answer: D. Proxy ETR
A Proxy ETR (Egress Tunnel Router) is required for a LISP site to communicate with non-LISP sites. The Proxy ETR acts as a gateway that understands both LISP and non-LISP protocols, accepting traffic from non-LISP sites and forwarding it into the LISP network. It bridges the gap between LISP-enabled and legacy non-LISP environments.
Why the other options are wrong
- A. A Proxy ITR is used for the opposite direction, allowing LISP sites to communicate outbound to non-LISP destinations.
- B. An ITR (Ingress Tunnel Router) is an internal LISP component and cannot directly receive traffic from non-LISP sites.
- C. An ETR (Egress Tunnel Router) is an internal LISP component; a Proxy ETR is specifically required for non-LISP interoperability.
Question 107
Which two Cisco SD-WAN components exchange OMP information? (Choose two.)
Show answer and explanation
Correct answer: A, E. WAN Edge; vSmart
WAN Edges and vSmart controllers exchange OMP (Overlay Management Protocol) information in Cisco SD-WAN. The WAN Edges learn routes and policies from vSmart controllers through OMP, while vBond (now SD-WAN Validator) acts as an orchestrator, vManage (now SD-WAN Manager) provides management, and vAnalytics handles analytics, none of which exchange OMP directly with WAN Edges.
Why the other options are wrong
- B. vBond is an orchestrator that facilitates connections but does not exchange OMP information.
- C. vManage is the management and visualization platform but does not exchange OMP with WAN Edges.
- D. vAnalytics is an analytics platform and does not participate in OMP exchange.
Question 108
A server running Linux is providing support for virtual machines along with DNS and DHCP services for a small business. Which technology does this represent?
Show answer and explanation
Correct answer: C. Type 2 hypervisor
A Linux server providing virtual machine support along with DNS and DHCP services represents a Type 2 hypervisor deployment. Type 2 hypervisors run on top of a host operating system (Linux in this case) and allow virtual machines to run alongside native services. The Linux OS manages system resources and provides DNS/DHCP services while the hypervisor manages the virtual machines.
Why the other options are wrong
- A. Containers are a different virtualization technology that share the host kernel; they are not what is described with hypervisor-based VMs.
- B. Type 1 hypervisors are bare-metal solutions that run directly on hardware without a host OS; this requires a host OS (Linux).
- D. Hardware pass-thru is a feature allowing direct device access to VMs, not the primary technology enabling the virtualization described.
Question 109
Which technology does VXLAN use to provide segmentation for Layer 2 and Layer 3 traffic?
Show answer and explanation
Correct answer: C. VNI
The VNI (VXLAN Network Identifier) is the technology VXLAN uses to provide segmentation for both Layer 2 and Layer 3 traffic. The 24-bit VNI enables up to 16 million separate network segments, providing isolation comparable to VLAN segmentation but at much greater scale.
Why the other options are wrong
- A. Bridge domains are layer 2 forwarding domains but not the segmentation technology specific to VXLAN.
- B. VLANs are limited to 4094 segments; VXLAN uses VNI for its segmentation capability.
- D. VRF (Virtual Routing and Forwarding) provides Layer 3 segmentation in traditional networks, not the VXLAN-specific segmentation mechanism.
Question 110
Which two entities are Type 1 hypervisors? (Choose two.)
Show answer and explanation
Correct answer: B, D. Microsoft Hyper-V; VMware ESXi
VMware ESXi and Microsoft Hyper-V are both Type 1 (bare-metal) hypervisors that run directly on physical hardware without requiring a host operating system. ESXi is VMware's enterprise-grade bare-metal hypervisor, and Hyper-V is Microsoft's enterprise hypervisor platform that installs directly on hardware.
Why the other options are wrong
- A. Oracle VM VirtualBox is a Type 2 hypervisor that runs as an application on top of a host OS.
- C. VMware Server is a Type 2 hypervisor that runs as an application on an existing host operating system.
- E. Microsoft Virtual PC is a Type 2 hypervisor that runs as an application on Windows host systems.
Question 111
A client with IP address 209.165.201.25 must access a web server on port 80 at 209.165.200.225. To allow this traffic, an engineer must add a statement to an access control list that is applied in the inbound direction on the port connecting to the web server. Which statement allows this traffic?
Show answer and explanation
Correct answer: C. permit tcp host 209.165.200.225 eq 80 host 209.165.201.25
When an ACL is applied inbound on the port connecting to the web server, it filters traffic arriving at that interface. The syntax must be 'permit tcp [source] [destination] eq [port]'. Option C correctly specifies the destination web server (209.165.200.225) with port 80 as the destination port where traffic is destined, and the source client (209.165.201.25).
Why the other options are wrong
- A. Uses 'lt 80' (less than) instead of 'eq 80' (equals), and reverses source/destination order.
- B. Missing the port specification entirely with 'eq 80', making it incomplete and not targeting port 80.
- D. Reverses the source and destination, it specifies the server as source and client as destination, which is backwards for inbound filtering at the server's port.
Question 112
What is the structure of a JSON web token?
Show answer and explanation
Correct answer: A. three parts separated by dots: header, payload, and signature
A JSON Web Token consists of three parts separated by dots: the header (containing token type and hashing algorithm), the payload (containing claims and user data), and the signature (for verification). This three-part structure is the standard JWT format.
Why the other options are wrong
- B. Version is not a standard JWT component; the three parts are header, payload, and signature
- C. JWT requires three parts, not two; the signature is essential for token verification
- D. JWT requires three parts including the header; payload and signature alone are insufficient
Question 113
A company plans to implement intent-based networking in its campus infrastructure. Which design facilitates a migration from a traditional campus design to a programmable fabric design?
Show answer and explanation
Correct answer: D. routed access
Routed access design facilitates migration to intent-based networking and programmable fabric design. In a routed access topology, every access switch connects via Layer 3 to the distribution layer, eliminating spanning tree complexity and enabling the device-level programmability and policy-based forwarding required by intent-based networking. This architecture provides the foundation needed to transition from traditional campus designs to modern fabric-based architectures.
Why the other options are wrong
- A. Two-tier design collapses access and distribution layers but doesn't specifically enable the programmable fabric transition as effectively as routed access.
- B. Layer 2 access relies on spanning tree and lacks the Layer 3 programmability needed for fabric designs.
- C. Three-tier design adds unnecessary complexity and doesn't align with the flattened, programmable nature of modern fabric designs.
Question 114
What is the difference between the enable password and the enable secret password when service password encryption is enabled on an IOS device?
Show answer and explanation
Correct answer: A. The enable secret password is protected via stronger cryptography mechanisms.
The enable secret password uses stronger cryptography (MD5 hashing by default, or AES on newer devices) compared to the enable password, which uses a weaker encryption algorithm (type 7) when service password encryption is enabled. This makes enable secret more secure and resistant to attacks.
Why the other options are wrong
- B. The enable password can be decrypted when using type 7 encryption; enable secret cannot be reversed due to hashing.
- C. The enable password actually uses weaker encryption (type 7), not stronger encryption.
- D. Both passwords are encrypted differently; enable secret uses stronger hashing than enable password's type 7 encryption.
Question 115
A customer transitions a wired environment to a Cisco SD-Access solution. The customer does not want to integrate the wireless network with the fabric. Which wireless deployment approach enables the two systems to coexist and meets the customer requirement?
Show answer and explanation
Correct answer: A. Deploy the wireless network over the top of the fabric.
Deploying the wireless network over the top of the fabric allows the wireless infrastructure to operate independently while coexisting with the SD-Access fabric. This approach enables the customer to maintain separate wireless and wired systems without full fabric integration, meeting their requirement to keep the networks from being tightly integrated while still allowing them to coexist in the same environment.
Why the other options are wrong
- B. DNA Center management alone does not achieve separation; it would typically lead to tighter integration.
- C. A completely separate network is more costly and defeats the purpose of having a converged infrastructure.
- D. Autonomous mode APs are disconnected from centralized management and would not coexist efficiently with a managed SD-Access solution.
Question 116
What does the Cisco DNA Center use to enable the delivery of applications through a network and to yield analytics for innovation?
Show answer and explanation
Correct answer: C. intent-based APIs
Cisco DNA Center (now Cisco Catalyst Center) uses intent-based APIs to enable the delivery of applications through a network and to provide analytics for innovation. These APIs abstract the complexity of network management and allow applications to interact with the network based on business intent rather than low-level device configurations.
Why the other options are wrong
- A. Process adapters are not a primary mechanism for application delivery and analytics in DNA Center.
- B. Command Runner is a tool for executing commands on devices, not for enabling application delivery and analytics across the network.
- D. Domain adapters are not the primary feature used for application delivery and analytics in DNA Center.
Question 117
What is a benefit of data modeling languages like YANG?
Show answer and explanation
Correct answer: B. They provide a standardized data structure, which results in configuration scalability and consistency.
A key benefit of YANG data modeling languages is that they provide a standardized data structure, which enables configuration scalability and consistency across devices and networks. YANG defines a standard format for network configuration and operational data, allowing for interoperability and easier management.
Why the other options are wrong
- A. YANG is not specifically designed to create SNMP OIDs; it is a separate data modeling approach that complements but does not directly enhance SNMP.
- C. While programmers can write applications using YANG models, the primary benefit is standardization and consistency, not enabling custom OS modifications.
- D. YANG is primarily a data modeling language for programmatic access, not a tool for simplifying CLI interfaces.
Question 118
By default, which virtual MAC address does HSRP group 14 use?
Show answer and explanation
Correct answer: C. 00:00:0c:07:ac:0e
HSRP group 14 uses the virtual MAC address 00:00:0c:07:ac:0e by default. The HSRP virtual MAC address format is 00:00:0c:07:ac:XX, where XX is the hexadecimal representation of the group number. For group 14 (0x0e in hexadecimal), this results in 00:00:0c:07:ac:0e.
Why the other options are wrong
- A. This MAC address format does not match the standard HSRP virtual MAC address pattern.
- B. While this contains the correct HSRP OUI prefix, it uses an incorrect encoding of the group number (14 in decimal is 0e in hex, not 14 in the last octet).
- D. This format uses 5e instead of the correct 0c in the third octet, deviating from the standard HSRP MAC address structure.
Question 119
An engineer must configure interface GigabitEthernet0/0 for VRRP group 10. When the router has the highest priority in the group, it must assume the master role. Which command set must be added to the initial configuration to accomplish this task? Initial Configuration interface GigabitEthernet0/0 description To IDF A 38-24-044.40 ip address 172.16.13.2 255.255.255.0
Show answer and explanation
Correct answer: D. vrrp 10 ip 172.16.13.254 vrrp 10 preempt
The correct VRRP configuration syntax uses 'vrrp' as the command keyword followed by the group number, then 'ip' for the virtual IP address, and 'preempt' to allow the router to assume the master role when it has the highest priority. Option D shows the correct VRRP syntax, while the other options use incorrect command structures or HSRP syntax.
Why the other options are wrong
- A. This uses 'standby' commands, which is HSRP syntax, not VRRP syntax.
- B. This uses incorrect VRRP syntax with 'priority' keyword alone; the priority value is required, and the IP address specification format is incomplete.
- C. This uses 'standby' commands which are HSRP syntax, not VRRP, and also contains a typo ('standy').
Question 120
Which entity is a Type 1 hypervisor?
Show answer and explanation
Correct answer: B. Citrix XenServer
Citrix XenServer is a Type 1 (bare-metal) hypervisor that installs directly on physical hardware and manages guest VMs without requiring a host operating system. It provides direct hardware control and is designed for enterprise data center deployment with high performance and scalability.
Why the other options are wrong
- A. Oracle VM VirtualBox is a Type 2 (hosted) hypervisor designed for desktop and laptop systems.
- C. VMware Server (now deprecated) was a Type 2 hypervisor that ran on top of existing operating systems.
- D. Microsoft Virtual PC is a Type 2 (hosted) hypervisor designed for client systems running Windows.
Question 121
Which action is the vSmart controller responsible for in an SD-WAN deployment?
Show answer and explanation
Correct answer: C. distribute security information for tunnel establishment between vEdge routers
The vSmart controller is responsible for distributing security information and policies needed for secure tunnel establishment between vEdge routers. It provides the control plane intelligence for the SD-WAN fabric, determining which tunnels should be established and what security parameters they should use.
Why the other options are wrong
- A. Onboarding of vEdge nodes is handled by the vBond orchestrator.
- B. Telemetry data gathering is a function of vManage, the management plane.
- D. Configuration and status management is handled by vManage, not vSmart.
Question 122
On which protocol or technology is the fabric data plane based in Cisco SD-Access fabric?
Show answer and explanation
Correct answer: A. VXLAN
VXLAN (Virtual Extensible LAN) is the foundational technology for the Cisco SD-Access fabric data plane, providing overlay network virtualization across the underlay network. LISP is used for the control plane and endpoint discovery, Cisco TrustSec provides policy and segmentation, and IS-IS is the underlay routing protocol, but VXLAN specifically forms the basis of the data plane.
Why the other options are wrong
- B. LISP is used for control plane functions and endpoint location services, not the data plane.
- C. Cisco TrustSec provides policy and segmentation capabilities but is not the data plane technology.
- D. IS-IS is the underlay routing protocol used to build the fabric infrastructure, not the data plane itself.
Question 123
An engineer configures GigabitEthernet 0/1 for VRRP group 115. The router must assume the primary role when it has the highest priority in the group. Which command set is required to complete this task? interface GigabitEthernet0/1 ip address 10.10.10.2 255.255.255.0 vrrp 115 ip 10.10.10.1 vrrp 115 authentication 407441579
Show answer and explanation
Correct answer: B. Router(config-if)# vrrp 115 priority 100
To ensure a router assumes the primary VRRP role when it has the highest priority, the command vrrp 115 priority 100 sets a priority value higher than the default 100, allowing this router to become primary. Without specifying a higher priority, the router cannot become primary based on having the highest priority alone.
Why the other options are wrong
- A. While track and preempt are valid VRRP commands, they require the priority to be set first; this option omits the priority command.
- C. This option includes track and preempt but still omits the required priority command to establish this router as primary.
- D. These are HSRP (Hot Standby Router Protocol) commands, not VRRP commands; the configuration uses VRRP syntax.
Question 124
Which statement about multicast RPs is true?
Show answer and explanation
Correct answer: D. By default, the RP is needed only to start new sessions with sources and receivers.
By default, the RP (Rendezvous Point) is needed only to start new sessions with sources and receivers in PIM sparse mode. Once a session is established and the shortest-path trees are built, the RP is no longer required to maintain the active multicast flow. This differs from dense mode where RPs are not used at all.
Why the other options are wrong
- A. RPs are required in PIM sparse mode, not just dense mode; dense mode does not use RPs.
- B. RPs are only required for PIM sparse mode; they are not used in dense mode at all.
- C. The RP is not needed periodically to maintain existing sessions; it is only needed to initiate new sessions.
Question 125
Which First Hop Redundancy Protocol should be used to meet a design requirement for more efficient default gateway bandwidth usage across multiple devices?
Show answer and explanation
Correct answer: A. GLBP
GLBP (Gateway Load Balancing Protocol) is the only FHRP designed to provide load balancing across multiple gateways, allowing more efficient bandwidth usage by distributing traffic across several devices rather than using a single active gateway like HSRP or VRRP. This directly meets the requirement for efficient default gateway bandwidth usage across multiple devices.
Why the other options are wrong
- B. LACP is a link aggregation protocol for combining physical interfaces, not a First Hop Redundancy Protocol.
- C. HSRP provides high availability but uses a single active gateway, not load balancing across multiple devices.
- D. VRRP provides high availability but uses a single master gateway, not load balancing across multiple devices.
Question 126
Based on the output below, which Python code shows the value of the "upTime" key?
Show answer and explanation
Correct answer: A. json_data = response.json() print(json_data['response'][0]['upTime'])
The output shows a JSON response object containing an array with a single device object. The 'upTime' key is located within the first element of the 'response' array. Option A uses response.json() to parse the JSON, accesses the 'response' key (which contains an array), indexes into the first element with [0], and then accesses the 'upTime' key as a quoted string. This matches the structure in the exhibit, where upTime is a direct property of the device object within the response array.
Why the other options are wrong
- B. Uses unquoted names (response, upTime), which Python treats as variables rather than string keys, so the lookup fails at run time.
- C. Applies ['family'] to the 'response' array, which needs an integer index. 'family' is a key of the device object, holding the value 'Routers', and upTime is not nested under it.
- D. Uses unquoted family, which Python treats as a variable rather than a string key, and it omits the [0] index. upTime is not nested under the 'family' key either.
Question 127
What is one characteristic of the Cisco SD-Access control plane?
Show answer and explanation
Correct answer: D. It stores remote routes in a centralized database server.
The Cisco SD-Access control plane uses a centralized architecture where routes and network policies are stored in a centralized database server. This centralized approach (typically through the DNA Center and policy servers) allows for intelligent, scalable network management and eliminates the need for every router to process and store all possible destinations.
Why the other options are wrong
- A. SD-Access enables host mobility across both wired and wireless networks, not just wireless only.
- B. VXLAN is used in the data plane for overlay encapsulation, not as the basis of the control plane architecture.
- C. SD-Access specifically avoids having each router process every possible destination through its centralized control plane design.
Question 128
An engineer must create an EEM applet that sends a syslog message in the event a change happens in the network due to trouble with an OSPF process. Which action should the engineer use? event manager applet LogMessage event routing network 172.30.197.0/24 type all
Show answer and explanation
Correct answer: A. action 1 syslog msg "OSPF ROUTING ERROR"
In Cisco EEM (Embedded Event Manager) applet syntax, the correct action to send a syslog message is 'action 1 syslog msg "message text"'. The 'msg' parameter is the standard syntax for specifying the syslog message content that should be logged when the event is triggered.
Why the other options are wrong
- B. The 'send' parameter is not valid EEM syslog action syntax; the correct parameter is 'msg'.
- C. The 'pattern' parameter is used for matching/filtering syslog messages, not for sending/writing them.
- D. The 'write' parameter is not valid EEM syslog action syntax for sending syslog messages.
Question 129
Which standard access control entry permits traffic from odd-numbered hosts in the 10.0.0.0/24 subnet?
Show answer and explanation
Correct answer: B. permit 10.0.0.1 0.0.0.254
A standard ACE matches the source address using a wildcard mask in which a 0 bit must match and a 1 bit is ignored. The wildcard 0.0.0.254 (11111110 in the last octet) ignores every bit of the last octet except the lowest one, and the base address 10.0.0.1 has that bit set to 1. The ACE therefore matches only odd host addresses in 10.0.0.0/24.
Why the other options are wrong
- A. The wildcard 0.0.0.1 ignores only the last bit, so it matches just 10.0.0.0 and 10.0.0.1.
- C. The wildcard 0.0.0.0 matches only the single host 10.0.0.1.
- D. 255.255.255.254 is a subnet mask, not a wildcard mask, so it does not express an odd-host match.
Question 130
What is the purpose of a data modeling language?
Show answer and explanation
Correct answer: A. to describe the structure and meaning of exchanged data
Data modeling languages like XML, JSON, and ASN.1 are specifically designed to describe the structure and semantic meaning of data that is exchanged between systems. They define how data should be organized and interpreted, enabling different systems to understand and process shared data correctly. This is the fundamental purpose of these languages.
Why the other options are wrong
- B. Standardizing parsing procedures is a function of parsing specifications or protocols, not data modeling languages themselves.
- C. While object-oriented programming exists as a paradigm, data modeling languages are not primarily designed to enforce OOP approaches.
- D. Transcoding rules between encodings are handled by encoding specifications, not by data modeling languages per se.
Question 131
How can an engineer prevent basic replay attacks from people who try to brute force a system via REST API?
Show answer and explanation
Correct answer: A. Add a timestamp to the request in the API header.
Adding a timestamp to the REST API request header is the most effective basic defense against replay attacks. A timestamp ensures that old captured requests cannot be reused, as the server will reject requests with timestamps outside an acceptable time window, preventing attackers from brute-forcing by replaying previous valid requests.
Why the other options are wrong
- B. Password hashing protects stored credentials but does not prevent replay of valid API requests.
- C. OAuth is an authentication mechanism but does not specifically prevent replay attacks on captured requests.
- D. HTTPS provides encryption in transit but does not prevent an attacker who has captured a valid request from replaying it.
Question 132
What is the data policy in a Cisco SD-WAN deployment?
Show answer and explanation
Correct answer: B. set of statements that defines how data is forwarded based on IP packet information and specific VPNs
Data policy in Cisco SD-WAN is a set of statements that defines how data is forwarded based on IP packet information and specific VPNs. It determines packet routing decisions, QoS treatment, and VPN membership based on traffic characteristics.
Why the other options are wrong
- A. This describes device configuration and authentication policies, not data policies.
- C. This describes address mapping or a routing/forwarding database function, not a data policy.
- D. This describes monitoring and health-check services, not data policy definitions.
Question 133
Which router is elected the IGMP Querier when more than one router is in the same LAN segment?
Show answer and explanation
Correct answer: D. The router with the lowest IP address.
When multiple routers exist in the same LAN segment, the IGMP Querier is elected based on the lowest IP address. The router with the lowest IP address wins the election and becomes the designated querier responsible for sending IGMP queries to discover multicast group memberships on that segment.
Why the other options are wrong
- A. Uptime is not a criterion for IGMP Querier election; IP address precedence is used.
- B. Longer uptime does not determine IGMP Querier election; the lowest IP address is the deciding factor.
- C. The highest IP address would lose the election; the lowest IP address becomes the querier.
Question 134
What is the purpose of an RP in PIM?
Show answer and explanation
Correct answer: A. send join messages toward a multicast source SPT
The RP (Rendezvous Point) in PIM receives IGMP joins from multicast receivers and sends join messages upstream toward the multicast source to build the shared tree (RPT). This allows the RP to serve as a central meeting point for multicast flows, enabling receivers to discover and join multicast groups through the RP.
Why the other options are wrong
- B. Ensuring the shortest path to the receiver is the responsibility of the SPT (Shortest Path Tree), not the RP, though the RP may facilitate SPT switchover.
- C. While the RP does receive IGMP joins from receivers as part of its function, sending join messages toward the source is the more complete and accurate primary purpose.
- D. The RP does not secure communication channels; security in multicast is handled through other mechanisms like authentication and encryption policies.
Question 135
Which technology is used to provide Layer 2 and Layer 3 logical networks in the Cisco SD-Access architecture?
Show answer and explanation
Correct answer: D. overlay network
The overlay network in Cisco SD-Access provides Layer 2 and Layer 3 logical network segments that operate on top of the physical underlay network infrastructure. It uses technologies like VXLAN to create scalable, multi-tenant virtual networks that are independent of the physical topology.
Why the other options are wrong
- A. The underlay network is the physical infrastructure layer, not the logical network layer.
- B. VPN routing/forwarding (VRF) is a routing technique but does not specifically describe the SD-Access L2/L3 logical network architecture.
- C. Easy Virtual Network (EVN) is not the technology used in SD-Access for creating logical networks.
Question 136
Which component of the Cisco Cyber Threat Defense solution provides user and flow context analysis?
Show answer and explanation
Correct answer: B. Cisco Stealthwatch system
Cisco Stealthwatch system provides user and flow context analysis, enabling visibility into network traffic patterns and user behavior. Firepower/FireSIGHT focuses on threat prevention and intrusion detection, Advanced Malware Protection detects malware, and Web Security Appliance filters web traffic, but only Stealthwatch specializes in user and flow context analysis.
Why the other options are wrong
- A. Cisco Firepower and FireSIGHT focus on threat prevention and intrusion detection, not user and flow context analysis.
- C. Advanced Malware Protection focuses on detecting and preventing malware, not analyzing user and flow context.
- D. Cisco Web Security Appliance provides web filtering and threat prevention, not user and flow context analysis.
Question 137
Which time protocol offers security features and utilizes site-local IPv6 multicast addresses?
Show answer and explanation
Correct answer: C. NTPv4
NTPv4 offers security features including NTS (Network Time Security) and utilizes IPv6 multicast addresses including site-local addresses. NTPv3 predates these security enhancements. PTP (Precision Time Protocol) standards focus on high-precision timing rather than security features as a primary characteristic.
Why the other options are wrong
- A. NTPv3 lacks the security features and IPv6 multicast support that were added in NTPv4.
- B. PTP IEEE 1588v1 is designed for precision timing but does not emphasize security features.
- D. While PTP IEEE 1588v2 is an improved standard, it focuses on precision timing rather than security as a primary characteristic.
Question 138
Which devices does Cisco DNA Center configure when deploying an IP-based access control policy?
Show answer and explanation
Correct answer: C. all devices in selected sites
When deploying an IP-based access control policy in Cisco DNA Center (now Cisco Catalyst Center), the policy is applied to all devices in selected sites. This site-based approach allows for scalable and organized policy deployment across groups of network devices within defined physical or logical locations.
Why the other options are wrong
- A. While devices may integrate with ISE, policy deployment is not limited to all ISE-integrated devices only.
- B. Policies are deployed at the site level rather than to individually selected devices, which would not scale effectively.
- D. IP-based access control policies are not limited to wired devices only; they apply to all device types within selected sites.
Question 139
A network engineer configures BGP between R1 and R2. Both routers use BGP peer group CORP and are set up to use MD5 authentication. This message is logged to the console of router R1: `May 5 39:85:55.469: %TCP-6-BADAUTH` Invalid MD5 digest from 10.10.10.1 (29832) to 10.120.10.1 (179) tebleid -0 Which two configurations allow a peering session to form between R1 and R2? (Choose two.)
Show answer and explanation
Correct answer: A, B. R1(config-router)#neighbor 10.10.10.1 peer-group CORP R1(config-router)#neighbor CORP password Cisco; R2(config-router)#neighbor 10.120.10.1 peer-group CORP R2(config-router)#neighbor CORP password Cisco
For BGP peering with MD5 authentication to succeed, both routers must use the same password for the peer group. R1 at 10.120.10.1 connects to R2 at 10.10.10.1. Option A configures R1 to use peer-group CORP with password Cisco for neighbor 10.10.10.1 (R2). Option B configures R2 to use peer-group CORP with password Cisco for neighbor 10.120.10.1 (R1). Both options establish matching passwords on both sides, allowing the session to form. Options C and D either use incorrect neighbor IPs or incorrect peer-group names.
Why the other options are wrong
- C. This uses peer-group PEER instead of CORP, creating a mismatch in authentication configuration.
- D. This configures the wrong neighbor IP address for R1's perspective.
- E. While this might seem correct, it only represents R2's configuration; option A is needed to complete the bidirectional setup.
Question 140
What is the correct EBGP path attribute list, ordered from most preferred to least preferred, that the BGP best-path algorithm uses?
Show answer and explanation
Correct answer: B. weight, local preference, AS path, MED
The BGP best-path algorithm evaluates paths in this specific order for EBGP: weight (highest), local preference (highest), AS path (shortest), MED (lowest), and other criteria. Weight is the first criterion evaluated as it is a Cisco-specific attribute that takes precedence before the standardized BGP attributes.
Why the other options are wrong
- A. Local preference is not evaluated before weight; weight takes precedence.
- C. AS path is not evaluated before local preference in the standard BGP algorithm.
- D. MED is evaluated after AS path, not before local preference.
Question 141
An engineer must configure the strongest password authentication to locally authenticate on a router. Which configuration must be used?
Show answer and explanation
Correct answer: B. username netadmin secret 9 $9$vFpMf8elb4RVV8$seZ/bDAx1uV
Option B uses the 'secret 9' command, which applies Scrypt encryption, the strongest password encryption method available on Cisco routers. Type 9 secrets provide superior cryptographic strength compared to Type 5 (MD5) shown in other options. This is the most secure local authentication configuration.
Why the other options are wrong
- A. Type 5 uses MD5 hashing, which is weaker than Type 9 Scrypt encryption.
- C. This appears to be an incomplete or malformed Type 5 hash and is not a valid configuration.
- D. This is a line-level password configuration on console 0, which is less secure than user-level secret credentials and does not use strong encryption.
Question 142
What is a VPN in a Cisco SD-WAN deployment?
Show answer and explanation
Correct answer: C. virtualized environment that provides traffic isolation and segmentation in the SD-WAN fabric
A VPN in Cisco SD-WAN is a virtualized environment that provides traffic isolation and segmentation within the SD-WAN fabric. VPNs create separate logical networks allowing different departments, applications, or customers to have isolated routing and forwarding instances while sharing the same physical SD-WAN infrastructure.
Why the other options are wrong
- A. A common exchange point between services is not the definition of a VPN in SD-WAN context.
- B. An attribute to identify services in specific places describes a service definition or location attribute, not a VPN.
- D. A virtual channel for control plane information describes an overlay tunnel mechanism, not the functional definition of a VPN.
Question 143
In a Cisco SD-Access solution, what is the role of the Identity Services Engine?
Show answer and explanation
Correct answer: A. It is leveraged for dynamic endpoint to group mapping and policy definition.
In Cisco SD-Access, the Identity Services Engine (ISE) provides dynamic endpoint profiling and group-based policy application. It performs endpoint identification, maps endpoints to security groups, and defines policies based on those group memberships, enabling dynamic segmentation and security policy enforcement.
Why the other options are wrong
- B. That role is performed by DNA Center, which provides the GUI management and abstraction layer through applications sharing context.
- C. Network traffic analysis and fabric monitoring is handled by Stealthwatch and other monitoring tools, not ISE.
- D. LISP EID database management is handled by fabric edge nodes and the SD-Access control plane, not ISE.
Question 144
Which control plane protocol is used between Cisco SD-WAN routers and vSmart controllers?
Show answer and explanation
Correct answer: B. OMP
OMP (Overlay Management Protocol) is the control plane protocol used between Cisco SD-WAN routers and vSmart controllers. OMP carries routing information, policy, and control messages across the SD-WAN overlay network, enabling centralized policy distribution and dynamic routing.
Why the other options are wrong
- A. TCP is a transport layer protocol and is not the dedicated control protocol between routers and controllers in SD-WAN.
- C. UDP is used for data plane encapsulation but not as the primary control plane protocol between routers and vSmart controllers.
- D. BGP is a routing protocol but not the control protocol used between SD-WAN routers and vSmart controllers; OMP serves this function.
Question 145
In a Cisco SD-Access fabric, which control plane protocol is used for mapping and resolving endpoints?
Show answer and explanation
Correct answer: D. LISP
LISP (Locator/ID Separation Protocol) is the control plane protocol used in Cisco SD-Access fabric for mapping and resolving endpoints. LISP provides the mechanism to map endpoint identifiers (EIDs) to routing locators (RLOCs), enabling dynamic endpoint location discovery and mobility across the fabric.
Why the other options are wrong
- A. DHCP is a data plane protocol used for IP address assignment, not for endpoint mapping in SD-Access.
- B. VXLAN is an encapsulation protocol used for data plane tunneling, not for endpoint mapping and resolution.
- C. SXP (Scalable Group Tag eXchange Protocol) is used for tag propagation in SD-Access, not for endpoint mapping.
Question 146
What is a requirement for an Ansible-managed node?
Show answer and explanation
Correct answer: A. It must have an SSH server running.
An Ansible-managed node must have an SSH server running to allow Ansible to connect and execute commands remotely. SSH is the primary communication protocol that Ansible uses to connect to and manage target nodes, making it a fundamental requirement.
Why the other options are wrong
- B. Ansible can manage many types of devices beyond just Linux and Cisco devices, including Windows servers and various network equipment.
- C. Ad hoc commands are a feature of Ansible, not a requirement for managed nodes; nodes only need SSH connectivity.
- D. Ansible Tower is an optional management interface; it is not required for nodes to be managed by Ansible.
Question 147
Which TCP setting is tuned to minimize the risk of fragmentation on a GRE/IP tunnel?
Show answer and explanation
Correct answer: A. MSS
MSS (Maximum Segment Size) is the TCP setting that is tuned to minimize fragmentation risk on GRE/IP tunnels. Since GRE adds additional header overhead to packets, the MSS must be reduced to ensure the final encapsulated packet does not exceed the MTU of the physical network, preventing fragmentation.
Why the other options are wrong
- B. MTU is a network interface setting, not a TCP setting, and while related to fragmentation, it is not specifically tuned as a TCP parameter.
- C. MRU (Maximum Receive Unit) is not a standard TCP setting used for fragmentation prevention in GRE tunnels.
- D. Window size relates to TCP flow control and buffering, not fragmentation risk mitigation.
Question 148
What are two benefits of YANG? (Choose two.)
Show answer and explanation
Correct answer: D, E. It enforces configuration semantics; It enforces configuration constraints.
YANG is a data modeling language that enforces configuration constraints (E) through statements like 'must', 'when', and 'range', and it also enforces configuration semantics (D) by defining the structure, type validation, and relationships of configuration data. These features ensure data integrity and consistency in network device configurations.
Why the other options are wrong
- A. YANG does not enforce a specific encoding format; it is encoding-neutral and can be used with NETCONF (XML), RESTCONF (JSON/XML), or other protocols.
- B. YANG does not collect statistical constraint analysis information; it defines data models and constraints, but does not perform statistical analysis.
- C. YANG does not allow multiple leaf statements within a leaf-list; a leaf-list contains instances of a single leaf type, not multiple different leaf statements.
Question 149
Which two security features are available when implementing NTP? (Choose two.)
Show answer and explanation
Correct answer: A, E. encrypted authentication mechanism; access list-based restriction scheme
NTP provides two primary security features: encrypted authentication mechanism (Option A), which allows secure authentication of NTP peers using encryption, and access list-based restriction scheme (Option E), which controls which hosts can query or synchronize with the NTP server. These are the standard security mechanisms implemented in NTP to prevent unauthorized time source manipulation.
Why the other options are wrong
- B. NTP uses symmetric keys or certificates, not symmetric server passwords as a distinct security feature.
- C. Clock offset authentication is not a recognized NTP security feature; authentication is based on cryptographic keys, not clock offsets.
- D. Broadcast association mode is a mode of operation, not a security feature.
Question 150
What it the purpose of the LISP routing and addressing architecture?
Show answer and explanation
Correct answer: A. It creates two entries for each network node, one for its identity and another for its location on the network.
LISP (Locator/ID Separation Protocol) separates identity (EID - Endpoint ID) from location (RLOC - Routing Locator), creating two distinct entries for each network node. This separation enables scalable routing and mobility by decoupling the host identity from its network location.
Why the other options are wrong
- B. While LISP can be used as an overlay through encapsulation, its primary architectural purpose is the separation of identity and location.
- C. Multiple routing table instances relate to VRFs, not the core purpose of LISP architecture.
- D. Head-end replication for broadcast/multicast is not the primary purpose of LISP; that relates more to VXLAN implementations.
Question 151
Which function is performed by vSmart in the Cisco SD-WAN architecture'?
Show answer and explanation
Correct answer: A. distribution of IPsec keys
The vSmart controller acts as the distribution point for the information that WAN edge routers need to build the data plane. Edge routers send their data plane encryption (IPsec) keys to vSmart over OMP, and vSmart distributes those keys to the other edge routers so they can form encrypted IPsec tunnels. Distribution of IPsec keys is therefore a vSmart function.
Why the other options are wrong
- B. Localized policies are executed on the WAN edge routers, not on vSmart.
- C. Redistribution between OMP and other routing protocols is configured and performed on the WAN edge routers.
- D. NAT detection and traversal is facilitated by the vBond orchestrator.
Question 152
What is one characteristic of VXLAN?
Show answer and explanation
Correct answer: B. It supports multitenant segments
VXLAN is a network virtualization technology designed to support multitenant environments by enabling the creation of virtual Layer 2 networks overlaid on Layer 3 infrastructure. It uses a 24-bit VXLAN Network Identifier (VNI) that supports 16 million unique segments, far exceeding VLAN limitations. This multitenant capability is a defining characteristic of VXLAN.
Why the other options are wrong
- A. VXLAN supports 16 million segments via the 24-bit VNI field, not limited to 4096 like traditional VLANs.
- C. VXLAN operates over Layer 3 underlay networks and does not rely on STP; it uses UDP encapsulation to tunnel traffic.
- D. VXLAN uses UDP/Layer 4 headers (typically port 4789) to encapsulate Layer 2 frames, not Layer 2 headers for underlay transport.
Question 153
A customer wants to provide wireless access to contractors using a guest portal on Cisco ISE. The portal is also used by employees. A solution is implemented, but contractors receive a certificate error when they attempt to access the portal. Employees can access the portal without any errors. Which change must be implemented to allow the contractors and employees to access the portal?
Show answer and explanation
Correct answer: A. Install a trusted third-party certificate on the Cisco ISE.
Contractors receive certificate errors because their devices do not have the internal CA certificate in their trusted store. When employees access the portal successfully, they likely have the internal CA pre-installed. Installing a trusted third-party certificate on the Cisco ISE server allows both contractors and employees to validate the certificate through a common public CA, eliminating certificate validation errors for all users without requiring individual device configuration.
Why the other options are wrong
- B. An internal CA certificate, while technically valid for authentication, does not solve the problem since contractors' devices would still not trust it without pre-installation.
- C. Installing certificates on contractor devices requires managing individual endpoints, which is impractical and does not scale for guest access scenarios.
- D. Installing internal CA certificates on contractor devices requires pre-staging and management of devices outside the organization's control, which is not feasible for guest users.
Question 154
Which two actions provide controlled Layer 2 network connectivity between virtual machines running on the same hypervisor? (Choose two.)
Show answer and explanation
Correct answer: A, B. Use a virtual switch provided by the hypervisor; Use a virtual switch running as a separate virtual machine.
A virtual switch provided by the hypervisor enables direct Layer 2 connectivity between VMs on the same physical host, and a virtual switch running as a separate VM can also provide this connectivity. Both options provide controlled Layer 2 networking without requiring external infrastructure for intra-host communication.
Why the other options are wrong
- C. VXLAN is an overlay technology designed for inter-host connectivity, not required for same-hypervisor VM communication.
- D. A routed link provides Layer 3 connectivity, not Layer 2 connectivity between VMs.
- E. An external Layer 2 switch is unnecessary for connectivity between VMs on the same hypervisor and does not provide controlled local connectivity.
Question 155
Which outcome is achieved with this Python code? client.connect (ip, port= 22, username= usr, password= pswd ) stdin, stdout, stderr = client.exec_command ( 'show ip bgp 192.168.101.0 bestpath\n ' ) print (stdout)
Show answer and explanation
Correct answer: A. connects to a Cisco device using SSH and exports the BGP table for the prefix
The code uses client.connect() with port 22 (SSH), then executes 'show ip bgp 192.168.101.0 bestpath' which is a Cisco command that displays BGP information for a specific prefix. The output is printed, showing BGP table data for that particular prefix.
Why the other options are wrong
- B. While print(stdout) displays output, it does not format it in a special way; it simply outputs the raw response
- C. The command specifically queries BGP information, not general routing table information
- D. Port 22 is SSH, not Telnet (which uses port 23); additionally the command targets BGP, not routing table
Question 156
A network is being migrated from IPv4 to IPv6 using a dual-stack approach. Network management is already 100% IPv6 enabled. In a dual-stack network with two dual-stack NetFlow collectors, how many flow exporters are needed per network device in the flexible NetFlow configuration?
Show answer and explanation
Correct answer: B. 2
Two flow exporters are needed per network device in a dual-stack configuration with two dual-stack NetFlow collectors. Since the network is dual-stack with both IPv4 and IPv6 traffic, and there are two collectors, one exporter is needed for IPv4 flows and one for IPv6 flows to ensure proper load distribution and segregation of traffic types.
Why the other options are wrong
- A. A single exporter cannot adequately handle both IPv4 and IPv6 traffic separately in a dual-stack environment with two collectors.
- C. Four exporters would be excessive; dual-stack requires only two exporters for the two IP versions.
- D. Eight exporters far exceeds the requirements for a dual-stack network with two collectors.
Question 157
In a Cisco SD-WAN solution, how is the health of a data plane tunnel monitored?
Show answer and explanation
Correct answer: C. using BFD
BFD (Bidirectional Forwarding Detection) is used in Cisco SD-WAN to monitor the health of data plane tunnels. BFD provides fast failure detection with minimal overhead by sending periodic heartbeat messages between tunnel endpoints, allowing the system to quickly identify and react to tunnel failures.
Why the other options are wrong
- A. IP SLA is used for monitoring but not as the primary method for data plane tunnel health in SD-WAN.
- B. ARP probing is a Layer 2 mechanism unsuitable for monitoring tunnels across Layer 3 networks.
- D. OMP (Overlay Management Protocol) is the control plane protocol, not used for data plane tunnel health monitoring.
Question 158
Which technology provides a secure communication channel for all traffic at Layer 2 of the OSI model?
Show answer and explanation
Correct answer: C. MACsec
MACsec (Media Access Control Security) is the IEEE 802.1AE standard that provides secure communication at Layer 2 of the OSI model by encrypting and authenticating all traffic on the link. SSL/TLS operates at Layer 4-7, IPsec operates at Layer 3, and Cisco TrustSec is a policy framework that works across layers but is not itself a Layer 2 encryption protocol.
Why the other options are wrong
- A. SSL operates at Layer 4-7 (Transport/Application), not Layer 2.
- B. Cisco TrustSec is a policy and segmentation framework, not a Layer 2 encryption protocol.
- D. IPsec operates at Layer 3 (Network layer), not Layer 2.
Question 159
What mechanism does PIM use to forward multicast traffic?
Show answer and explanation
Correct answer: A. PIM sparse mode uses a pull model to deliver multicast traffic.
PIM sparse mode uses a pull model where multicast traffic is only delivered to networks that have explicitly requested it through join messages sent toward the Rendezvous Point (RP). This is in contrast to dense mode, which uses a flood-and-prune approach. The pull model means receivers and their upstream routers actively request (pull) multicast traffic rather than having it pushed to them.
Why the other options are wrong
- B. PIM dense mode uses a flood-and-prune model, not a pull model.
- C. While receivers do register with the RP in sparse mode, this describes the registration process rather than the forwarding mechanism itself.
- D. The flood-and-prune model describes PIM dense mode, not sparse mode.
Question 160
Which controller is the single plane of management for Cisco SD-WAN?
Show answer and explanation
Correct answer: C. vManage
The vManage controller is the single management plane for Cisco SD-WAN. It provides centralized management, configuration, monitoring, and analytics for all SD-WAN devices. While vSmart (now SD-WAN Controller) provides control plane functions and vBond (now SD-WAN Validator) provides orchestration, vManage (now SD-WAN Manager) is the unified management interface for the entire SD-WAN fabric.
Why the other options are wrong
- A. vBond is the orchestrator that helps bootstrap devices, not the management plane.
- B. vSmart is the control plane controller that distributes policies, not the management plane.
- D. vEdge is a forwarding node, not a controller.
Question 161
A network administrator applies the following configuration to an IOS device: aaa new-model aaa authentication login default local group tacacs+ What is the process of password checks when a login attempt is made to the device?
Show answer and explanation
Correct answer: D. A local database is checked first. If that check fails, a TACACS+ server is checked.
In the command 'aaa authentication login default local group tacacs+', the authentication methods are checked in order: first the local database is consulted, and if that fails, then the TACACS+ server is checked. The configuration specifies 'local' first and 'group tacacs+' second, so the local database has priority.
Why the other options are wrong
- A. The order is reversed; local is checked first, not TACACS+ server.
- B. There is no RADIUS server specified in the configuration, only local and TACACS+.
- C. The configuration does not include RADIUS, and TACACS+ is checked second, not after a non-existent RADIUS check.
Question 162
An engineer must configure an ACL that permits packets which include an ACK in the TCP header. Which entry must be included in the ACL?
Show answer and explanation
Correct answer: C. access-list 110 permit tcp any any eq 21 established
The 'established' keyword in a standard ACL entry matches TCP packets with the ACK or RST flags set, which indicates an established connection. Option C uses the correct syntax with 'established' keyword and numeric identifier 110 (extended ACL range), allowing packets containing ACK bits.
Why the other options are wrong
- A. Uses non-standard syntax 'tcp-ack' which is not valid Cisco ACL syntax for matching ACK flags.
- B. Uses numeric identifier 10, which is in the standard ACL range (1-99), not the extended range required for TCP port and flag matching.
- D. Uses 'ip' instead of 'tcp' protocol and invalid 'tcp-ack' syntax; also 10 is a standard ACL number.
Question 163
When using BFD in a network design, which consideration must be made?
Show answer and explanation
Correct answer: A. BFD is used with dynamic routing protocols to provide subsecond convergence.
BFD (Bidirectional Forwarding Detection) is used with dynamic routing protocols to provide subsecond convergence time. BFD operates independently of routing protocol timers and can detect link failures in milliseconds, allowing dynamic routing protocols to react and converge much faster than their native timers would normally allow.
Why the other options are wrong
- B. BFD is used with dynamic routing protocols (OSPF, EIGRP, BGP), not specifically with first hop routing protocols.
- C. BFD is not used with NSF (Non-Stop Forwarding) and graceful restart; it operates independently to provide fast failure detection.
- D. BFD is actually less CPU-intensive than reducing hold timers because it operates separately from the routing protocol and provides more efficient failure detection.
Question 164
How do agent-based versus agentless configuration management tools compare?
Show answer and explanation
Correct answer: B. Agentless tools require no messaging systems between master and slaves.
Agentless configuration management tools (like Ansible) do not require persistent messaging systems or agents running on slave/target nodes. They typically use SSH or similar protocols for direct communication, making them simpler to deploy without installing additional services on managed nodes.
Why the other options are wrong
- A. Agentless tools do not use proxy nodes; they communicate directly with target nodes over standard protocols.
- C. Agent-based tools actually do require interpreters like Python on slave nodes to execute management code.
- D. Agent-based tools specifically require installation of agent software packages on slave nodes; that is their defining characteristic.
Question 165
Which two features does the Cisco SD-Access architecture add to a traditional campus network? (Choose two.)
Show answer and explanation
Correct answer: B, C. software-defined segmentation; identity services
Cisco SD-Access adds software-defined segmentation and identity services to traditional campus networks. Software-defined segmentation enables dynamic policy-based network access using micro-segmentation, while identity services provide centralized user and device authentication and authorization, replacing traditional VLAN-based access controls.
Why the other options are wrong
- A. Modular QoS is a traditional feature not specifically added by SD-Access architecture.
- D. Private VLANs are a traditional VLAN feature not a key addition of SD-Access.
- E. SD-WAN is a separate architecture focused on wide-area networks, not a core feature of campus SD-Access.
Question 166
What is the function of a VTEP in VXLAN?
Show answer and explanation
Correct answer: C. encapsulate and de-encapsulate traffic into and out of the VXLAN fabric
A VTEP (VXLAN Tunnel Endpoint) is responsible for encapsulating Layer 2 traffic into VXLAN packets with UDP headers for transport over the underlay network, and de-encapsulating incoming VXLAN packets back to original Layer 2 frames. This is the core function of a VTEP in enabling VXLAN overlay networking.
Why the other options are wrong
- A. The underlay routing is provided by the network infrastructure, not the VTEP itself.
- B. End host discovery in VXLAN is handled through ARP learning and multicast or control plane mechanisms, not the VTEP.
- D. VTEPs learn host locations dynamically, not through static configuration.
Question 167
Which method of account authentication does OAuth 2.0 use within REST APIs?
Show answer and explanation
Correct answer: B. access tokens
OAuth 2.0 uses access tokens as its method of account authentication within REST APIs. After a user authenticates and grants permission, the OAuth 2.0 server issues an access token that the client application uses to make authenticated API requests on behalf of the user.
Why the other options are wrong
- A. Username/role combination is a basic authentication method, not the mechanism used by OAuth 2.0.
- C. Cookie authentication is a session-based authentication method distinct from the token-based approach of OAuth 2.0.
- D. Basic signature workflow is not a standard OAuth 2.0 authentication mechanism.
Question 168
When firewall capabilities are considered, which feature is found only in Cisco next-generation firewalls?
Show answer and explanation
Correct answer: A. malware protection
Malware protection is a distinguishing feature found only in Cisco next-generation firewalls (NGFWs). Traditional firewalls have stateful inspection and traffic filtering capabilities, and active/standby high availability is available in both traditional and next-generation firewalls. Malware protection requires deep packet inspection and threat intelligence unique to NGFWs.
Why the other options are wrong
- B. Stateful inspection is a core feature of traditional firewalls, not unique to NGFWs.
- C. Traffic filtering is a basic firewall capability found in all firewall types.
- D. Active/standby high availability is supported by both traditional and next-generation firewalls.
Question 169
An engineer must protect their company against ransomware attacks. Which solution allows the engineer to block the execution stage and prevent file encryption?
Show answer and explanation
Correct answer: B. Use Cisco AMP deployment with the Malicious Activity Protection engine enabled.
Cisco AMP with the Malicious Activity Protection engine specifically detects and blocks ransomware during the execution stage before file encryption occurs. This engine monitors behavioral patterns and malicious activities characteristic of ransomware, preventing the encryption phase. Option A blocks network access but not execution. Option C addresses exploitation but not the encryption stage. Option D's Exploit Prevention engine focuses on exploit delivery, not ransomware execution prevention.
Why the other options are wrong
- A. Blocking TOR traffic only prevents command and control communication but does not prevent execution or file encryption if the malware is already present.
- C. Intrusion policies targeting SMB exploitation prevent initial compromise but do not specifically block the ransomware execution stage.
- D. Exploit Prevention engine stops exploit delivery but not the ransomware execution and encryption phases.
Question 170
An engineer is concerned with the deployment of a new application that is sensitive to inter-packet delay variance. Which command configures the router to be the destination of jitter measurements?
Show answer and explanation
Correct answer: C. Router(config)# ip sla responder udp-echo 172.29.139.134 5000
The 'ip sla responder udp-echo' command configures a router to act as a destination for jitter measurements. UDP echo is the appropriate protocol for measuring inter-packet delay variance (jitter) between source and responder endpoints.
Why the other options are wrong
- A. UDP-connect is not a valid IP SLA responder command for jitter measurements.
- B. TCP-connect is not the correct protocol for jitter measurements; TCP adds overhead not suitable for latency/jitter testing.
- D. TCP-echo is not used for jitter measurements; UDP is the standard protocol for this purpose.
Question 171
What is a benefit of a virtual machine when compared with a physical server?
Show answer and explanation
Correct answer: A. Multiple virtual servers can be deployed on the same physical server without having to buy additional hardware.
Virtual machines enable multiple guest operating systems to run simultaneously on a single physical server, consolidating workloads and maximizing hardware utilization without requiring purchase of additional physical servers. This is the primary economic and operational benefit of virtualization, resource consolidation and improved hardware efficiency.
Why the other options are wrong
- B. Virtual machines do not increase processing performance; they typically have minimal overhead but do not enhance CPU performance beyond the physical hardware's capabilities.
- C. This statement is false; CPU and RAM resources are actively managed by the hypervisor and can be overcommitted or constrained, allowing other VMs to impact performance.
- D. Deploying a virtual machine is generally more complex technically than deploying a physical server, requiring hypervisor configuration, resource allocation, and network setup.
Question 172
Which encryption hashing algorithm does NTP use for authentication?
Show answer and explanation
Correct answer: B. MD5
NTP uses MD5 (Message Digest 5) as its hashing algorithm for authentication. MD5 creates a cryptographic hash that is used to authenticate NTP packets and verify the identity of NTP servers and clients. This is the standard hashing mechanism employed in NTP authentication schemes.
Why the other options are wrong
- A. SSL is an encryption protocol, not a hashing algorithm used by NTP.
- C. AES128 is an encryption algorithm, not a hashing algorithm; NTP does not use AES for authentication hashing.
- D. AES256 is an encryption algorithm, not the hashing algorithm NTP uses for authentication.
Question 173
What is the function of the fabric control plane node in a Cisco SD-Access deployment?
Show answer and explanation
Correct answer: C. It holds a comprehensive database that tracks endpoints and networks in the fabric.
The fabric control plane node holds a comprehensive database that tracks endpoints and networks within the fabric. This node maintains endpoint location information, network mappings, and other control plane intelligence necessary for fabric operation and policy enforcement.
Why the other options are wrong
- A. Policy application and network segmentation are functions of the policy plane, not exclusively the control plane node.
- B. Traffic encapsulation and security profile enforcement are primarily data plane functions, not control plane responsibilities.
- D. Integration with legacy nonfabric-enabled environments is handled by edge nodes and border nodes, not the control plane node itself.
Question 174
What is required for a virtual machine to run?
Show answer and explanation
Correct answer: B. a hypervisor and physical server hardware
A virtual machine requires both a hypervisor (to manage and allocate resources) and physical server hardware (the underlying compute platform). Type 1 hypervisors run on bare metal and eliminate the need for a host OS, while Type 2 hypervisors require a host OS. However, regardless of hypervisor type, both a hypervisor layer and physical hardware are essential requirements.
Why the other options are wrong
- A. A Type 1 hypervisor does not require a host operating system; it replaces the OS and runs directly on hardware.
- C. A Type 1 hypervisor alone is insufficient; physical server hardware is also required to run the hypervisor.
- D. A Type 2 hypervisor alone is insufficient; it requires physical hardware and also typically requires a host operating system.
Question 175
Which tool is used in Cisco DNA Center to build generic configurations that are able to be applied on devices with similar network settings?
Show answer and explanation
Correct answer: C. Template Editor
The Template Editor is the tool used in Cisco DNA Center (now Cisco Catalyst Center) to build generic configurations (templates) that can be applied to multiple devices with similar network settings. Templates enable standardization and rapid deployment of consistent configurations across devices.
Why the other options are wrong
- A. Command Runner is used to execute ad-hoc commands on devices, not to create reusable configuration templates.
- B. Application Policies are used for managing application-specific network policies, not for building generic device configurations.
- D. Authentication Template is not a feature in DNA Center; Template Editor is the correct tool for building generic configurations.
Question 176
Which two network problems indicate a need to implement QoS in a campus network? (Choose two.)
Show answer and explanation
Correct answer: B, E. excess jitter; bandwidth-related packet loss
QoS implementation in campus networks addresses problems related to traffic quality and bandwidth management. Excess jitter indicates inconsistent packet delivery times that QoS can mitigate through traffic prioritization and shaping. Bandwidth-related packet loss occurs when network congestion exceeds available capacity, which QoS resolves through queue management, rate limiting, and priority mechanisms.
Why the other options are wrong
- A. Port flapping is a Layer 2 issue related to spanning tree or link instability, not a QoS concern.
- C. Misrouted packets are a routing protocol issue, not a QoS problem; QoS operates on already-routed traffic.
- D. Duplicate IP addresses are a network configuration and IPAM issue, not addressed by QoS mechanisms.
Question 177
Which feature of EIGRP is not supported in OSPF?
Show answer and explanation
Correct answer: A. load balancing of unequal-cost paths
EIGRP uniquely supports unequal-cost load balancing through its variance feature, allowing the router to load balance across paths with different metrics. OSPF only supports equal-cost load balancing. Options B and C are supported by both protocols, and option D (per-packet load balancing) is not a standard feature of either protocol in modern implementations.
Why the other options are wrong
- B. OSPF supports load balancing over multiple equal-cost paths.
- C. OSPF uses cost (derived from interface bandwidth) to determine the best path.
- D. Per-packet load balancing is not a standard feature of OSPF or modern EIGRP implementations; flow-based load balancing is standard.
Question 178
Which feature does Cisco TrustSec use to provide scalable, secure communication throughout a network?
Show answer and explanation
Correct answer: B. security group tag number assigned to each user on a switch
Cisco TrustSec uses security group tag (SGT) numbers assigned to each user or endpoint on a switch to provide scalable, secure communication. These SGT numbers are exchanged between devices and used in security policies, enabling identity-based network segmentation and access control across the network.
Why the other options are wrong
- A. SGTs are assigned to users/endpoints, not ports, and SGT ACLs are policy enforcement tools rather than the foundational feature providing scalability.
- C. SGTs are assigned to users/endpoints, not directly to ports, and the mechanism operates at the user/device level for scalability.
- D. SGTs are not assigned to routers; they are user-based identifiers used throughout the network infrastructure.
Question 179
In a Cisco SD-Access solution, what is the role of a fabric edge node?
Show answer and explanation
Correct answer: B. to connect wired endpoints to the SD-Access fabric
A fabric edge node serves as the connection point for wired endpoints to the SD-Access fabric. It is where endpoints attach to the fabric and is responsible for tagging traffic with VLAN information and forwarding it into the LISP overlay. This is the primary role of edge nodes in the fabric architecture.
Why the other options are wrong
- A. Connecting external Layer 3 networks is the role of border nodes, not edge nodes.
- C. Advertising fabric IP address space is not a primary function of edge nodes.
- D. Edge nodes connect endpoints to the fabric; the fusion router role is different and involves connecting to external networks and shared services.
Question 180
Which two parameters are examples of a QoS traffic descriptor? (Choose two.)
Show answer and explanation
Correct answer: A, B. DSCP; MPLS EXP bits
DSCP (Differentiated Services Code Point) and MPLS EXP bits are both QoS marking mechanisms used to classify and identify traffic types in a network. These are traffic descriptors that indicate service level requirements. Packet size and bandwidth are characteristics or metrics, not descriptors, and ToS is largely superseded by DSCP.
Why the other options are wrong
- C. Packet size is a characteristic of traffic but not a QoS traffic descriptor used for classification.
- D. Bandwidth is a resource metric, not a traffic descriptor mechanism.
- E. ToS (Type of Service) is an older field that has been replaced by DSCP for modern QoS descriptors.
Question 181
A response code of 404 is received while using the REST API on Cisco DNA Center to POST to this URI: /dna/intent/api/v1/template-programmer/project What does the code mean?
Show answer and explanation
Correct answer: C. The client made a request for a resource that does not exist.
HTTP status code 404 means 'Not Found', indicating that the requested resource (in this case the URI endpoint for template-programmer/project) does not exist on the server. This is the standard meaning of a 404 error in REST API responses.
Why the other options are wrong
- A. 404 is an error code; 201 indicates successful creation of a new resource
- B. 202 indicates 'Accepted' for asynchronous processing; 404 indicates the resource doesn't exist
- D. 501 indicates 'Not Implemented'; 404 specifically means the requested resource cannot be found
Question 182
At which layer does Cisco DNA Center support REST controls?
Show answer and explanation
Correct answer: B. northbound APIs
Cisco DNA Center (now Cisco Catalyst Center) supports REST controls at the northbound APIs layer. Northbound APIs are the interface through which external applications and management systems interact with DNA Center to manage and monitor network devices and services.
Why the other options are wrong
- A. The session layer is a lower OSI layer that is not specific to where DNA Center exposes its REST controls.
- C. EEM applets or scripts are used for event-driven automation but are not the layer where DNA Center REST controls operate.
- D. YAML output from API responses is a format for returning data, not a layer where REST controls are supported.
Question 183
Which NGFW mode blocks flows crossing the firewall?
Show answer and explanation
Correct answer: B. inline
Inline mode is the NGFW deployment mode that actively blocks flows crossing the firewall. In inline mode, the firewall sits directly in the traffic path and can actively inspect, allow, or deny traffic in real-time.
Why the other options are wrong
- A. Tap mode is passive and only monitors traffic without blocking.
- C. Passive mode observes traffic but does not actively block flows.
- D. Inline tap is a monitoring mode that does not block traffic flows.
Question 184
Which features does Cisco EDR use to provide threat detection and response protection?
Show answer and explanation
Correct answer: A. containment, threat intelligence, and machine learning
Cisco EDR (Endpoint Detection and Response) provides threat detection and response through three key features: containment capabilities to isolate threats, threat intelligence to identify known and emerging threats, and machine learning algorithms to detect anomalous behavior and zero-day threats. These three components work together to provide comprehensive endpoint protection.
Why the other options are wrong
- B. Firewalling and intrusion prevention are network-level security features, not primary EDR detection mechanisms.
- C. Container-based agents are an implementation detail but not the core detection and response features of EDR.
- D. Cloud analysis and endpoint firewall controls are components but do not represent the primary threat detection capabilities of EDR.
Question 185
Which IP SLA operation requires the IP SLA responder to be configured on the remote end?
Show answer and explanation
Correct answer: A. UDP jitter
UDP jitter is an IP SLA operation that requires configuration of an IP SLA responder on the remote end device to generate response packets and measure latency, jitter, and packet loss. The responder must be actively running to collect the necessary bidirectional performance metrics that UDP jitter operations require.
Why the other options are wrong
- B. ICMP jitter operates using standard ICMP echo requests and does not require a responder configuration
- C. TCP connect establishes connections using standard TCP three-way handshakes and does not require an IP SLA responder
- D. ICMP echo uses standard ping mechanism and does not require remote responder configuration
Question 186
Which OSPF network types are compatible and allow communication through the two peering devices?
Show answer and explanation
Correct answer: B. broadcast to nonbroadcast
Broadcast and nonbroadcast network types are compatible and allow OSPF communication through peering devices. Both types support the same neighbor discovery mechanisms and can establish adjacencies with each other. The other combinations involve point-to-multipoint or point-to-point types that have different neighbor discovery and communication requirements.
Why the other options are wrong
- A. Point-to-multipoint to nonbroadcast types are not compatible for direct peering communication.
- C. Point-to-multipoint to broadcast types use different neighbor discovery mechanisms and cannot properly peer.
- D. Broadcast to point-to-point types have fundamentally different communication models and are not compatible.
Question 187
Which protocol does REST API rely on to secure the communication channel?
Show answer and explanation
Correct answer: C. HTTPS
HTTPS (HTTP Secure) is the protocol that REST APIs rely on to secure the communication channel. HTTPS uses TLS/SSL encryption to protect data in transit between the client and server, ensuring confidentiality and integrity of sensitive information.
Why the other options are wrong
- A. HTTP is unencrypted and does not provide security for communication channels.
- B. SSH is a separate protocol used for secure shell access and remote administration, not for REST API communication.
- D. TCP is the underlying transport layer protocol but does not provide encryption or security by itself.
Question 188
How are the different versions of IGMP compatible?
Show answer and explanation
Correct answer: C. IGMPv2 is compatible only with IGMPv1.
IGMPv2 is backward compatible with IGMPv1. When IGMPv2 is present on a network, it can interoperate with IGMPv1 hosts and routers. IGMPv3 is not backward compatible with earlier versions; if IGMPv3 is present, all devices must support IGMPv3. Therefore, IGMPv2's compatibility is limited to IGMPv1.
Why the other options are wrong
- A. IGMPv2 is compatible with IGMPv1, not only with itself.
- B. IGMPv3 is not compatible with IGMPv1 or IGMPv2.
- D. IGMPv3 is not compatible with IGMPv1.
Question 189
A network engineer is configuring OSPF on a router. The engineer wants to prevent having a route to 172.16.0.0/16 learned via OSPF in the routing table and configures a prefix list using the command ip prefix-list OFFICE seq 5 deny 172.16.0.0/16. Which two additional configuration commands must be applied to accomplish the goal? (Choose two.)
Show answer and explanation
Correct answer: A, B. ip prefix-list OFFICE seq 10 permit 0.0.0.0/0 le 32; distribute-list prefix OFFICE in under the OSPF process
To prevent a specific route from being learned via OSPF, two steps are required: (1) create a prefix list that denies the route and permits all others (option A adds the permit statement needed to match routes not explicitly denied), and (2) apply the distribute-list to filter inbound OSPF routes (option B applies the prefix list to incoming OSPF advertisements). The permit statement with 'le 32' allows all other routes to be learned normally.
Why the other options are wrong
- C. The distribute-list command requires the 'prefix' keyword when using a prefix list, not just the list name.
- D. An outbound distribute-list would filter routes being advertised out, not routes being received, so it doesn't prevent learning the route.
- E. Using 'ge 32' instead of 'le 32' would match only /32 routes, not the full range of permitted networks needed as a catch-all.
Question 190
Which QoS queuing method transmits packets out of the interface in the order the packets arrive?
Show answer and explanation
Correct answer: C. FIFO
FIFO (First In, First Out) is the queuing method that transmits packets out of the interface in the exact order they arrive, without any prioritization or reordering.
Why the other options are wrong
- A. Custom queuing allows explicit priority definitions but does not guarantee strict FIFO ordering.
- B. Weighted-fair queuing allocates bandwidth based on weights and priorities, not pure arrival order.
- D. Priority queuing transmits packets based on priority levels, not the order in which they arrive.
Question 191
In a Cisco StackWise Virtual environment, which planes are virtually combined in the common logical switch?
Show answer and explanation
Correct answer: C. control and management
In Cisco StackWise Virtual, the control plane and management plane are virtually combined into a common logical switch. This allows two separate physical switches to operate as a single logical entity while maintaining redundancy and simplified management. The control plane manages routing protocols and network intelligence, while the management plane handles administrative functions, and together they are consolidated in the StackWise Virtual logical switch architecture.
Why the other options are wrong
- A. The data plane (forwarding) and management plane are not the combination in StackWise Virtual; it is control and management.
- B. While control and forwarding are important, StackWise Virtual specifically combines control and management planes in the logical switch.
- D. Control and data planes are not the correct answer; StackWise Virtual combines control and management.
Question 192
Which two protocols are used with YANG data models? (Choose two.)
Show answer and explanation
Correct answer: B, D. RESTCONF; NETCONF
RESTCONF and NETCONF are the two protocols used with YANG data models. NETCONF is a network management protocol that uses YANG for data modeling and configuration management, while RESTCONF is a RESTful API for YANG data models that provides similar functionality over HTTP/HTTPS.
Why the other options are wrong
- A. TLS is a transport security protocol, not a protocol used with YANG data models themselves.
- C. SSH is a transport mechanism that may underlie NETCONF but is not itself a protocol used with YANG data models.
- E. HTTPS is a transport security protocol, not a protocol used with YANG data models (though RESTCONF runs over HTTPS).
Question 193
How does the EIGRP metric differ from the OSPF metric?
Show answer and explanation
Correct answer: C. The EIGRP metric is calculated based on bandwidth and delay. The OSPF metric is calculated on bandwidth only.
EIGRP calculates its metric based on bandwidth and delay (among other factors in the composite metric formula), prioritizing these two components. OSPF uses a simpler metric based solely on bandwidth (the inverse of the link bandwidth). This fundamental difference means EIGRP provides more granular path selection by considering both bandwidth and propagation delay, while OSPF makes decisions primarily on available bandwidth.
Why the other options are wrong
- A. Neither protocol uses only bandwidth or delay exclusively; EIGRP uses both, and OSPF uses bandwidth, not delay alone.
- B. OSPF does not calculate on bandwidth and delay; it uses bandwidth only.
- D. EIGRP does not use hop count as a primary metric component, and OSPF does not use delay in its metric calculation.
Question 194
Why would an engineer use YANG?
Show answer and explanation
Correct answer: B. to model data for NETCONF
YANG is used to model data for NETCONF and other network management protocols. It is a data modeling language that defines the structure, constraints, and semantics of data used in network device configuration and state management. YANG models are the foundation that NETCONF uses to structure and validate the XML data exchanged between controllers and devices.
Why the other options are wrong
- A. YANG does not transport data; it models the structure of data. NETCONF or other protocols handle transport.
- C. YANG is not used with SNMP; it is used with NETCONF and RESTCONF protocols.
- D. YANG does not translate JSON to XML; it is a modeling language that can be used with multiple encoding formats.
Question 195
Which method does the enable secret password option use to encrypt device passwords?
Show answer and explanation
Correct answer: A. MD5
The enable secret password uses MD5 hashing (type 5) by default in IOS devices to encrypt the password. PAP and CHAP are authentication protocols for remote access, not password encryption methods. While newer devices may support AES (type 8), the traditional and standard method for enable secret has been MD5.
Why the other options are wrong
- B. PAP (Password Authentication Protocol) is used for authentication, not for encrypting stored passwords.
- C. CHAP (Challenge Handshake Authentication Protocol) is an authentication protocol, not a password encryption method.
- D. AES is a newer encryption standard supported on some IOS versions but is not the default method for enable secret.
Question 196
What is the recommended MTU size for a Cisco SD-Access Fabric?
Show answer and explanation
Correct answer: C. 9100
The recommended MTU size for a Cisco SD-Access Fabric is 9100 bytes. This jumbo frame size accommodates the overhead introduced by fabric encapsulation (LISP and other headers) while maximizing throughput and minimizing fragmentation across the fabric infrastructure.
Why the other options are wrong
- A. 4464 bytes is not the standard recommended MTU for SD-Access fabric deployments.
- B. 17914 bytes exceeds practical MTU limits and is not a standard recommendation for SD-Access.
- D. 1500 bytes is the standard Ethernet MTU but is too small for SD-Access fabric operations due to encapsulation overhead.
Question 197
An engineer must configure a new loopback interface on a router and advertise the interface as a /24 in OSPF. Which command set accomplishes this task?
Show answer and explanation
Correct answer: B. R2(config)#interface Loopback0 R2(config-if)#ip address 172.22.2.1 255.255.255.0 R2(config-if)#ip ospf network point-to-point R2(configif)#ip ospf 100 area 0
Configuring a loopback interface for OSPF requires creating the interface with the IP address, setting the OSPF network type to point-to-point (which advertises the exact /24 prefix without summarization), and then assigning it to an OSPF process and area. Option B correctly configures all these elements in the proper sequence to advertise the loopback as a /24 network.
Why the other options are wrong
- A. Setting the OSPF network type to broadcast on a loopback interface causes OSPF to advertise it as a /32 host route instead of the configured /24.
- C. The point-to-multipoint network type is not appropriate for loopback interfaces, and 'router ospf 100' from the interface configuration context is invalid syntax.
- D. The network statement used in this option is incomplete and the command sequence is disorganized, lacking proper interface-level OSPF configuration.
Question 198
What is the function of a control-plane node in a Cisco SD-Access solution?
Show answer and explanation
Correct answer: A. to run a mapping system that manages endpoint to network device relationships
The control-plane node in Cisco SD-Access runs the mapping system that maintains and manages the relationships between endpoints (users and devices) and network devices within the fabric. This mapping intelligence is central to policy enforcement and traffic steering throughout the SD-Access solution.
Why the other options are wrong
- B. Implementing policies and communicating with external networks is the function of border nodes, not control-plane nodes.
- C. Connecting external Layer 3 networks to the fabric is the role of border nodes or edge nodes.
- D. Connecting APs and wireless endpoints is performed by fabric WLAN controllers, not control-plane nodes.
Question 199
Which LISP device is responsible for publishing EID-to-RLOC mappings for a site?
Show answer and explanation
Correct answer: A. ETR
The ETR (Egress Tunnel Router) is responsible for publishing EID-to-RLOC mappings for a site to the mapping system. ETRs are located at the edge of a LISP site and send mapping registrations to the Map Server, making the site's EID-to-RLOC associations available throughout the LISP infrastructure.
Why the other options are wrong
- B. The Map Resolver (MR) requests mappings and resolves EID-to-RLOC information; it does not publish mappings.
- C. The ITR (Ingress Tunnel Router) encapsulates packets for LISP routing but does not publish site mappings.
- D. The Map Server (MS) receives and stores mappings from ETRs but does not perform the publishing function itself.
Question 200
Which statement about VXLAN is true?
Show answer and explanation
Correct answer: A. VXLAN encapsulates a Layer 2 frame in an IP-UDP header, which allows Layer 2 adjacency across router boundaries.
VXLAN encapsulates Layer 2 Ethernet frames within UDP packets over an IP network, allowing Layer 2 adjacency and broadcast domains to extend across Layer 3 routed networks. This is the core function of VXLAN technology, enabling virtual networks that span physical infrastructure boundaries.
Why the other options are wrong
- B. VXLAN does not use Spanning Tree Protocol; it uses flood-and-learn or multicast-based mechanisms for unknown destinations.
- C. VXLAN extends the VLAN ID to a 24-bit VNI (VXLAN Network Identifier), allowing up to 16 million segments, but the Layer 2 Segment ID field itself is still limited to 4094 in traditional VLANs.
- D. VXLAN uses UDP as its transport protocol, not TCP, for encapsulation over the physical network.
Question 201
Which two namespaces does the LISP network architecture and protocol use? (Choose two.)
Show answer and explanation
Correct answer: B, E. RLOC; EID
LISP uses two namespaces: the EID (Endpoint ID) namespace, which identifies the actual endpoints and is used within LISP sites, and the RLOC (Routing Locator) namespace, which identifies the network infrastructure and is used for routing packets through the underlay network. These separate namespaces enable LISP's core function of decoupling identity from location.
Why the other options are wrong
- A. TLOC refers to a tunnel locator in some LISP implementations but is not a primary namespace designation.
- C. DNS is not a namespace used by LISP protocol architecture itself.
- D. VTEP (VXLAN Tunnel Endpoint) is associated with VXLAN, not a LISP namespace.
Question 202
Which three methods does Cisco DNA Center use to discover devices? (Choose three.)
Show answer and explanation
Correct answer: A, C, F. CDP; LLDP; a specified range of IP addresses
Cisco DNA Center (now Cisco Catalyst Center) uses three primary discovery methods: CDP (Cisco Discovery Protocol) leverages existing neighbor information, LLDP (Link Layer Discovery Protocol) provides standards-based neighbor discovery, and IP address range scanning allows discovery of devices within specified subnets. These three methods work together to build a comprehensive inventory of network devices.
Why the other options are wrong
- B. SNMP is used for device management and telemetry collection after discovery, not as a primary discovery mechanism
- D. Ping is too basic and inefficient for systematic device discovery in enterprise networks
- E. NETCONF is a configuration management protocol used after device discovery, not a discovery mechanism itself
Question 203
Which action is performed by Link Management Protocol in a Cisco StackWise Virtual domain?
Show answer and explanation
Correct answer: C. It rejects any unidirectional link traffic forwarding.
Link Management Protocol (LMP) in a StackWise Virtual domain performs the critical function of detecting and rejecting unidirectional link traffic. This prevents data plane issues that could arise from asymmetric or one-way links between stack members, ensuring bidirectional connectivity is maintained for proper stack operation and data forwarding.
Why the other options are wrong
- A. Active/standby determination is handled by the Stackwise Virtual protocol election mechanism, not LMP.
- B. Hardware compatibility checking occurs during the initial stack formation, not through LMP.
- D. SVL interface discovery and bring-up is handled by the StackWise Virtual protocol, not specifically by LMP.
Question 204
What is a characteristic of a type 2 hypervisor?
Show answer and explanation
Correct answer: D. ideal for client/end-user system
Type 2 hypervisors (hosted hypervisors) run on top of a host operating system and are ideal for client and end-user systems where users need access to the underlying host OS and applications. Examples include VMware Workstation and VirtualBox, which are commonly deployed on desktops and laptops.
Why the other options are wrong
- A. Type 2 hypervisors have simpler deployment compared to Type 1, as they leverage existing operating systems.
- B. Type 1 bare-metal hypervisors are ideal for data centers, not Type 2 hypervisors.
- C. Type 1 hypervisors are referred to as bare-metal; Type 2 hypervisors are hosted hypervisors that run on an OS.
Question 205
What is a characteristic of Cisco StackWise technology?
Show answer and explanation
Correct answer: D. It uses proprietary cabling.
Cisco StackWise uses proprietary cabling and connectors to create a stack of switches. It is supported on Catalyst 3750 and 3850 series switches, not the 4500 series. It requires physical proximity of devices, so geographic separation is not supported. It can combine more than two devices (typically up to 9 switches in a stack).
Why the other options are wrong
- A. StackWise is not supported on Catalyst 4500 series; it is primarily used on 3750/3850 series.
- B. StackWise requires devices to be in close physical proximity with proprietary cabling; geographic separation is not supported.
- C. StackWise can combine multiple devices (typically up to 9 switches), not just exactly two.
Question 206
Which command set configures RSPAN to capture outgoing traffic from VLAN 3 on interface GigabitEthernet 0/3 while ignoring other VLAN traffic on the same interface?
Show answer and explanation
Correct answer: C. monitor session 2 source interface gigabitethernet0/3 tx monitor session 2 filter vlan 3
To capture outgoing traffic on a port, the 'tx' (transmit) direction must be specified. The command uses 'monitor session 2 source interface gigabitethernet0/3 tx' to capture egress traffic, and 'monitor session 2 filter vlan 3' to allow only VLAN 3 traffic, effectively ignoring other VLANs on that interface.
Why the other options are wrong
- A. Uses 'rx' which captures incoming traffic, not outgoing traffic as required.
- B. Uses 'rx' direction and filters out VLAN 3 instead of filtering for it.
- D. While using correct 'tx' direction, it filters out VLAN 3 instead of filtering for only VLAN 3 traffic.
Question 207
What is a benefit of using a Type 2 hypervisor instead of a Type 1 hypervisor?
Show answer and explanation
Correct answer: D. ability to operate on hardware that is running other OSs
Type 2 hypervisors (hosted hypervisors like VMware Workstation, VirtualBox, Hyper-V Client) run on top of an existing operating system, allowing deployment on hardware that already has an OS running. This contrasts with Type 1 hypervisors that require bare metal and replace the OS entirely. The ability to install on existing systems is the primary advantage for flexibility and ease of deployment in non-dedicated environments.
Why the other options are wrong
- A. Type 1 hypervisors typically provide better application performance due to direct hardware access without OS intermediation.
- B. Type 2 hypervisors actually have a security disadvantage because the underlying OS becomes an additional attack surface.
- C. Type 1 hypervisors achieve better density and scalability by eliminating OS overhead and running directly on hardware.
Question 208
Which function does a fabric wireless LAN controller perform in a Cisco SD-Access deployment?
Show answer and explanation
Correct answer: A. manages fabric-enabled APs and forwards client registration and roaming information to the Control Plane Node
The fabric wireless LAN controller manages fabric-enabled access points and forwards client registration and roaming information to the Control Plane Node. This function enables the controller to integrate wireless clients into the SD-Access fabric by communicating client presence and mobility events to the central mapping system.
Why the other options are wrong
- B. Coordinating nonfabric access points is not the primary role; fabric WLC focuses on fabric-enabled APs.
- C. The assurance engine role is performed by DNA Center or dedicated assurance components, not the fabric WLAN controller.
- D. While the fabric WLAN controller does onboard fabric-enabled APs, it is not dedicated to onboarding nonfabric APs, which falls outside the fabric architecture.
Question 209
Which characteristic distinguishes Ansible from Chef?
Show answer and explanation
Correct answer: C. Ansible pushes the configuration to the client. Chef client pulls the configuration from the server.
A key architectural difference is that Ansible uses a push model where the control server pushes configurations to clients, while Chef uses a pull model where clients pull configurations from the Chef server. This fundamental difference impacts how updates are distributed and managed.
Why the other options are wrong
- A. This is backwards; Ansible uses YAML for configuration management while Chef uses Ruby.
- B. Chef server can run on Linux or Unix; Ansible is agentless and the control machine can run on various platforms, but this is not the distinguishing characteristic.
- D. Both Ansible and Chef support redundancy and high availability configurations; this does not distinguish them.
Question 210
An engineer is configuring GigabitEthernet1/0/0 for VRRP. When the router has the highest priority in group 5, it must assume the master role. Which command set should the engineer add to the configuration to accomplish this task? interface GigabitEthernet1/0/0 description To IDF A 38-70-774-10 ip address 172.16.13.2 255.255.255.0
Show answer and explanation
Correct answer: C. vrrp 5 ip 172.16.13.254 vrrp 5 priority 100
The interface is being configured for VRRP, so the VRRP commands must be used and not the HSRP standby commands. The command 'vrrp 5 ip 172.16.13.254' defines the virtual IP address for group 5 and 'vrrp 5 priority 100' sets the priority. VRRP preemption is enabled by default, so the router with the highest priority in the group automatically assumes the master role without any extra command. The track option shown in options A and D is optional and is not needed to meet the requirement.
Why the other options are wrong
- A. Uses HSRP standby syntax, which does not configure VRRP.
- B. Also uses HSRP standby commands, so it configures HSRP instead of VRRP.
- D. The vrrp ip command does not accept a subnet mask, so this syntax is invalid.
Question 211
In OSPF, which LSA type is responsible for pointing to the ASBR router?
Show answer and explanation
Correct answer: D. type 4
OSPF Type 4 LSAs are generated by the Area Border Router (ABR) and advertise the location of Autonomous System Border Routers (ASBRs) to routers within the area. Type 4 LSAs allow routers to find the path to external routes injected by the ASBR.
Why the other options are wrong
- A. Type 1 LSAs describe routers and their directly connected networks within an area.
- B. Type 2 LSAs describe networks and their attached routers on multi-access segments.
- C. Type 3 LSAs are summary LSAs that describe networks in other areas.
Question 212
Which controller is capable of acting as a STUN server during the onboarding process of Edge devices?
Show answer and explanation
Correct answer: A. vBond
The vBond controller is capable of acting as a STUN server during the onboarding process of Edge devices. vBond (now SD-WAN Validator) facilitates NAT traversal and provides connectivity assistance for new Edge devices joining the SD-WAN overlay network.
Why the other options are wrong
- B. vSmart is the control plane orchestrator responsible for policy and route distribution, not STUN server functions.
- C. vManage is the management and visualization platform, not involved in STUN server operations.
- D. PNP Server is a separate service for plug-and-play onboarding but is not the SD-WAN controller that acts as STUN.
Question 213
Which congestion queuing method on Cisco IOS based routers uses four static queues?
Show answer and explanation
Correct answer: D. priority
Priority queuing uses four static queues: high, medium, normal, and low. Packets are classified into these four priority levels, and the router services higher priority queues before lower priority ones, making it a simple but effective queuing method for differentiating traffic by priority.
Why the other options are wrong
- A. Weighted Fair Queuing (WFQ) uses dynamic queue allocation based on flow weight, not static queues.
- B. Custom queuing allows configuration of multiple queues with configurable bandwidth allocation, not a fixed four-queue model.
- C. Low Latency Queuing (LLQ) combines priority and fair queuing mechanisms with custom queue configurations, not fixed static queues.
Question 214
How does EIGRP differ from OSPF?
Show answer and explanation
Correct answer: D. EIGRP supports equal or unequal path cost, and OSPF supports only equal path cost.
EIGRP supports both equal and unequal cost load balancing through its feasible successor mechanism, allowing traffic distribution across paths with different costs via the feasibility condition. OSPF traditionally supports only equal cost multipath (ECMP) load balancing. This is a fundamental architectural difference between the two routing protocols.
Why the other options are wrong
- A. EIGRP is actually less prone to routing loops than OSPF due to its feasibility condition and DUAL algorithm
- B. OSPF typically uses more CPU and memory due to its full SPF calculation requirements compared to EIGRP's incremental updates
- C. Both EIGRP and OSPF maintain a full topology map; OSPF does not operate with only direct neighbor knowledge
Question 215
Which First Hop Redundancy Protocol maximizes uplink utilization and minimizes the amount of configuration that is necessary?
Show answer and explanation
Correct answer: A. GLBP
GLBP (Gateway Load Balancing Protocol) is a Cisco-proprietary protocol that maximizes uplink utilization by allowing multiple virtual gateways within a single group. Unlike HSRP and VRRP where only the master actively forwards traffic, GLBP distributes traffic across multiple routers, improving bandwidth utilization while minimizing configuration complexity compared to managing multiple groups.
Why the other options are wrong
- B. HSRP v2 uses only a single active router and does not maximize uplink utilization.
- C. VRRP uses a single master router and does not maximize uplink utilization.
- D. HSRP v1 is older, uses a single active router, and requires more configuration than GLBP.
Question 216
Which two characteristics define the Intent API provided by Cisco DNA Center? (Choose two.)
Show answer and explanation
Correct answer: A, B. northbound API; business outcome oriented
The Intent API provided by Cisco DNA Center (now Cisco Catalyst Center) is a northbound API that is business outcome oriented rather than device oriented. It operates at a higher abstraction level focused on business intents and outcomes, and it is northbound (toward management and business systems) rather than southbound (toward network devices).
Why the other options are wrong
- C. The Intent API is business outcome oriented, not device-oriented; device orientation is characteristic of lower-level southbound APIs.
- D. The Intent API is northbound (toward management systems), not southbound (toward network devices).
- E. The Intent API is declarative and intent-based, not procedural; it specifies desired outcomes rather than procedures.
Question 217
What is a characteristic of YANG?
Show answer and explanation
Correct answer: B. It allows model developers to create custom data types.
YANG allows model developers to create custom data types using the 'typedef' statement, enabling the definition of reusable type definitions with specific constraints and properties. This capability makes YANG flexible and extensible for modeling complex network data structures.
Why the other options are wrong
- A. YANG is not proprietary to Cisco; it is an open standard (RFC 6020) maintained by IETF and used across multiple vendors.
- C. While YANG promotes modularity through groupings and augmentation, it is not primarily object-oriented in its structure; it is a data modeling language.
- D. YANG does not provide loops or conditionals to control flow within models; it is a declarative language focused on data structure definition, not procedural logic.
Question 218
Which benefit is realized by implementing SSO?
Show answer and explanation
Correct answer: D. minimal network downtime following an RP switchover
SSO (Stateful Switchover) enables a standby processor to take over without losing sessions or state information, resulting in minimal network downtime during RP (Route Processor) switchover events. This is the primary benefit of implementing SSO on routing platforms.
Why the other options are wrong
- A. IP first-hop redundancy is provided by protocols like HSRP/VRRP, not by SSO.
- B. Communication between nodes for cluster setup is a separate function not directly related to SSO benefits.
- C. Physical link redundancy is achieved through redundant physical connections, not through SSO.
Question 219
What does the number in an NTP stratum level represent?
Show answer and explanation
Correct answer: A. The number of hops it takes to reach the authoritative time source
NTP stratum level represents the number of hops it takes to reach the authoritative time source. Stratum 0 is the atomic clock reference, stratum 1 is directly connected to stratum 0, stratum 2 is one hop away from stratum 1, and so on. Each level indicates distance from the primary authoritative source.
Why the other options are wrong
- B. Stratum level does not represent offset; offset is a separate NTP metric measuring time difference from true time.
- C. Stratum measures distance to the authoritative source, not specifically to a primary server.
- D. Drift is a separate clock characteristic; stratum levels are not a measure of drift.
Question 220
What is the role of a fusion router in an SD-Access solution?
Show answer and explanation
Correct answer: C. performs route leaking between user-defined virtual networks and shared services
The fusion router in SD-Access performs route leaking between user-defined virtual networks (VNs) and shared services. This allows traffic from user VNs to reach shared service resources while maintaining network segmentation. The fusion router bridges the overlay VN policies with external routing domains and shared service access.
Why the other options are wrong
- A. DNS services are not provided by fusion routers in SD-Access.
- B. Additional forwarding capacity is not the primary role; border nodes handle fabric-to-external connectivity.
- D. While fusion routers do connect to external networks, their specific role is route leaking between VNs and shared services.
Question 221
Which protocol infers that a YANG data model is being used?
Show answer and explanation
Correct answer: B. RESTCONF
RESTCONF is the protocol that infers the use of YANG data models. RESTCONF is specifically designed as a RESTful API that uses YANG models to define the structure of configuration and operational data, making YANG usage inherent to RESTCONF.
Why the other options are wrong
- A. SNMP uses its own data modeling approach (MIBs) and is not associated with YANG.
- C. REST is a general architectural style; while RESTCONF (which uses YANG) is built on REST principles, REST itself does not infer YANG usage.
- D. NX-API is a Cisco API that may support various data models but does not specifically infer YANG usage.
Question 222
Which two mechanisms are available to secure NTP? (Choose two.)
Show answer and explanation
Correct answer: C, E. encrypted authentication; IP access list-based
NTP can be secured using encrypted authentication (MD5 or SHA-based keys) and IP access lists (ACLs) to restrict which sources can synchronize with the NTP server. Encrypted authentication verifies the source's authenticity, while IP access lists control which hosts are allowed to communicate with the NTP service.
Why the other options are wrong
- A. IPsec is not a standard NTP security mechanism; NTP has its own authentication methods.
- B. IP prefix lists are not used for NTP security; ACLs are used instead.
- D. TACACS-based authentication is not a NTP security mechanism; TACACS is for device access control.
Question 223
Which method creates an EEM applet policy that is registered with EEM and runs on demand or manually?
Show answer and explanation
Correct answer: A. event manager applet ondemand event none action 1.0 syslog priority critical msg 'This is a message from ondemand'
The 'event none' syntax creates an EEM applet that is registered with EEM but not triggered by any automatic event. Instead, it runs only when manually invoked on demand, making it available for manual execution whenever needed. This is the correct syntax for creating on-demand EEM policies.
Why the other options are wrong
- B. Omitting the event statement entirely results in invalid EEM applet syntax; an event must be specified.
- C. There is no 'event register' syntax in EEM; 'register' is not a valid event type.
- D. There is no 'event manual' syntax in EEM; 'event none' is the correct syntax for on-demand execution.
Question 224
An engineer must configure a multicast UDP jitter operation. Which configuration should be applied?
Show answer and explanation
Correct answer: B. Router(config)#ip sla 1 Router(config)#udp jitter 239.1.1.1 65051 end-point list List source-ip 192.168.1.1
The correct syntax for configuring a multicast UDP jitter operation includes specifying the operation type, the multicast destination address, the port, and the endpoint list with source IP specification. Option B demonstrates the proper command structure with udp jitter, multicast address, port, endpoint list, and source-ip parameters that are required for multicast jitter configuration.
Why the other options are wrong
- A. This uses 'udp-jitter' with a unicast IP address, missing the multicast capability and endpoint list required for multicast operations.
- C. While this includes some correct elements, the 'num-packets' parameter is not the standard approach for configuring multicast UDP jitter operations.
- D. This syntax is incomplete and lacks the proper endpoint list and multicast addressing necessary for multicast UDP jitter configuration.
Question 225
Which JSON syntax is valid?
Show answer and explanation
Correct answer: C. {"switch": {"name": "dist1", "interfaces": ["gig1", "gig2", "gig3"]}}
Option C demonstrates valid JSON syntax with proper use of double quotes for all keys and string values, correct nested object structure, and proper array notation. JSON requires double quotes (not single quotes) and proper placement of colons and commas.
Why the other options are wrong
- A. Contains invalid character sequences and improper quote usage throughout
- B. Uses forward slashes which are not valid JSON syntax; includes malformed escape sequences
- D. Uses single quotes instead of double quotes, and uses parentheses instead of braces for object definition; valid JSON requires double quotes and braces
Question 226
Which two GRE features are configured to prevent fragmentation? (Choose two.)
Show answer and explanation
Correct answer: B, C. IP MTU; TCP MSS
To prevent fragmentation in GRE tunnels, two key configurations are needed: IP MTU (set on the tunnel interface to account for GRE header overhead) and TCP MSS (configured on tunnel interfaces to clamp the maximum segment size for TCP packets). Both work together to ensure that packets do not exceed the tunnel's effective MTU and cause fragmentation.
Why the other options are wrong
- A. TCP window size does not directly prevent fragmentation; it controls flow control, not packet size.
- D. The DF (Don't Fragment) bit being clear actually allows fragmentation, which contradicts the goal of prevention.
- E. MTU ignore is not a standard GRE fragmentation prevention feature; the correct approach is configuring IP MTU.
Question 227
Which measure is used by an NTP server to indicate its closeness to the authoritative time source?
Show answer and explanation
Correct answer: A. stratum
Stratum is the NTP metric that indicates an NTP server's closeness to an authoritative time source. Stratum 0 is the reference clock itself, Stratum 1 devices are directly connected to Stratum 0, and each subsequent level increases by one hop away from the authoritative source. Lower stratum values indicate greater closeness to accurate time.
Why the other options are wrong
- B. Time zone defines geographic offset from UTC but does not indicate closeness to an authoritative time source.
- C. Latency measures network delay but is not the specific NTP metric for indicating proximity to authoritative time.
- D. Hop count is not an NTP concept; stratum serves the equivalent purpose in the NTP hierarchy.
Question 228
In a Cisco SD-Access solution, which protocol is used by an extended node to connect to a single edge node?
Show answer and explanation
Correct answer: C. 802.1Q
In Cisco SD-Access (Software-Defined Access), extended nodes connect to edge nodes using standard 802.1Q VLAN tagging over regular Ethernet connections. This allows non-SD-Access capable devices to connect to the fabric while maintaining compatibility.
Why the other options are wrong
- A. VXLAN is used for overlay tunneling between fabric nodes, not for connecting extended nodes to edge nodes.
- B. IS-IS is the control plane routing protocol used within the SD-Access fabric, not for extended node connectivity.
- D. CTS (Cisco Trusted Security) relates to security policy enforcement, not the protocol for extended node connection.
Question 229
What is an advantage of utilizing data models in a multivendor environment?
Show answer and explanation
Correct answer: C. facilitating a unified approach to configuration and management
An advantage of utilizing data models in a multivendor environment is that they facilitate a unified approach to configuration and management. Data models provide a vendor-agnostic abstraction layer that allows organizations to manage devices from different vendors using consistent interfaces and methodologies, reducing complexity and improving operational efficiency.
Why the other options are wrong
- A. Data models do not inherently lower CPU load on managed devices; this depends on implementation and protocol efficiency.
- B. While data models can work with binary protocols, improving security is not a primary advantage of data models themselves; security depends on the protocols and implementations used.
- D. Data models can actually maintain or clarify the distinction between configuration and runtime state data through separate containers; they do not remove this distinction.
Question 230
What is a characteristic of a virtual machine?
Show answer and explanation
Correct answer: D. It relies on hypervisors to allocate computing resources for it.
A virtual machine fundamentally depends on a hypervisor to allocate and manage computing resources (CPU, memory, disk, network). The hypervisor abstracts physical hardware and provides these resources to the guest OS and applications running within the VM. This resource allocation dependency is a defining characteristic of virtualization.
Why the other options are wrong
- A. Virtual machines can run any OS supported by the hypervisor, regardless of the host OS; a Linux host can run Windows VMs.
- B. A virtual machine cannot run without a hypervisor; it is entirely dependent on hypervisor functionality for execution.
- C. Virtual machines do not need to be aware of each other; the hypervisor handles resource allocation and isolation transparently.
Question 231
Which two operations are valid for RESTCONF? (Choose two.)
Show answer and explanation
Correct answer: C, F. PATCH; HEAD
RESTCONF supports standard REST/HTTP methods including PATCH (for partial updates) and HEAD (for metadata retrieval without body). These are valid RESTCONF operations aligned with standard HTTP methods. RESTCONF is built on HTTP and inherits its method set.
Why the other options are wrong
- A. PULL is not a standard HTTP or RESTCONF method
- B. PUSH is not a standard HTTP or RESTCONF method
- D. REMOVE is not standard; DELETE is the HTTP method for removal
- E. ADD is not a standard HTTP or RESTCONF method; POST is used to create resources
Question 232
Which statement about route targets is true when using VRF-Lite?
Show answer and explanation
Correct answer: A. Route targets control the import and export of routes into a customer routing table.
Route targets are used in VRF-Lite to control which routes are imported into and exported from a customer's VRF routing table. They act as community values that determine route distribution policies between VRFs. While route targets can be carried in BGP communities, their primary function is controlling route import/export behavior.
Why the other options are wrong
- B. Route targets are carried as extended communities in BGP, not standard communities.
- C. Overlapping addresses are enabled by VRF isolation itself, not specifically by route targets.
- D. Route targets control import/export policy; they do not uniquely identify the routing table, the VRF name does that.
Question 233
An engineer must create an EEM script to enable OSPF debugging in the event the OSPF neighborship goes down. Which script must the engineer apply?
Show answer and explanation
Correct answer: A. event manager applet ENABLE_OSPF_DEBUG event syslog pattern "%OSPF-5-ADJCHG: Process 6, Nbr 1.1.1.1 on Serial0/0 from FULL to DOWN" action 1.0 cli command "enable" action 2.0 cli command "debug ip ospf event" action 3.0 cli command "debug ip ospf adj" action 4.0 syslog priority informational msg "ENABLE_OSPF_DEBUG"
The correct script must trigger on the syslog pattern that indicates OSPF adjacency change from FULL to DOWN, which is the event requiring debugging. Option A contains the correct pattern '%OSPF-5-ADJCHG: Process 6, Nbr 1.1.1.1 on Serial0/0 from FULL to DOWN' and includes the necessary enable command before issuing debug commands, making it the complete and correct solution.
Why the other options are wrong
- B. This pattern shows a transition from LOADING to FULL, which indicates the adjacency is coming up, not going down, so debugging would not be triggered when needed.
- C. While the pattern correctly shows FULL to DOWN, the OSPF severity level is listed as -1 instead of -5, which does not match the actual syslog message format.
- D. This pattern shows a transition from LOADING to FULL, indicating adjacency establishment rather than failure, so it would not properly trigger when troubleshooting is needed.
Question 234
In a Cisco SD-Access wireless architecture, which device manages endpoint ID to edge node bindings?
Show answer and explanation
Correct answer: A. fabric control plane node
The fabric control plane node (typically the LISP Map Server/Map Resolver) manages endpoint ID to edge node bindings in a Cisco SD-Access wireless architecture. This device maintains the mapping database that tracks which endpoints are reachable through which edge nodes, enabling proper routing and mobility within the fabric.
Why the other options are wrong
- B. The fabric wireless controller manages wireless-specific functions like authentication and roaming, not endpoint-to-edge bindings.
- C. The fabric border node connects the SD-Access fabric to external networks; it does not manage internal endpoint bindings.
- D. Fabric edge nodes are access points for endpoints but do not manage the centralized binding database.
Question 235
Which two steps are required for a complete Cisco DNA Center upgrade? (Choose two.)
Show answer and explanation
Correct answer: B, E. system update; application updates
A complete Cisco DNA Center (now Cisco Catalyst Center) upgrade requires both a system update (the core platform and services) and application updates (the applications running on DNA Center). These two steps together constitute the full upgrade process. The system update handles infrastructure and core services, while application updates deploy the latest application functionality.
Why the other options are wrong
- A. Automation backup is a preparatory step but not a required step of the actual upgrade process itself.
- C. Golden image selection is relevant to device provisioning, not DNA Center platform upgrades.
- D. Proxy configuration is an optional configuration step, not a required component of the upgrade process.
Question 236
What is the process for moving a virtual machine from one host machine to another with no downtime?
Show answer and explanation
Correct answer: C. live migration
Live migration is the specific technology and process that allows virtual machines to move from one physical host to another while maintaining continuous operation and zero downtime. The VM's memory, state, and connections are transferred seamlessly during operation.
Why the other options are wrong
- A. High availability refers to system uptime and redundancy, not the specific process of moving VMs between hosts.
- B. Disaster recovery involves recovery from failures, not the planned movement of VMs with no downtime.
- D. Multisite replication involves copying data across multiple geographic sites, not moving individual VMs with zero downtime.
Question 237
Which design principle states that a user has no access by default to any resource, and unless a resource is explicitly granted, it should be denied?
Show answer and explanation
Correct answer: B. fail-safe defaults
Fail-safe defaults is the security principle stating that access should be denied by default unless explicitly granted. This is also known as the principle of default deny. While least privilege is related, it describes minimizing permissions for users who do have access, whereas fail-safe defaults specifically addresses the default state of all resources before any grants are made.
Why the other options are wrong
- A. Least privilege refers to granting users only the minimum permissions needed for their role, not the default deny posture.
- C. Economy of mechanism refers to keeping security designs simple and understandable to reduce implementation errors.
- D. Complete mediation requires that all access requests be checked against security policy, but doesn't define the default state.
Question 238
What are two characteristics of VXLAN? (Choose two)
Show answer and explanation
Correct answer: B, C. It uses VTEPs to encapsulate and decapsulate frames; It allows for up to 16 million VXLAN segments.
VXLAN uses VTEPs (VXLAN Tunnel Endpoints) to encapsulate and decapsulate Layer 2 frames within Layer 3 UDP packets, enabling overlay networks. VXLAN supports up to 16 million segments through its 24-bit VXLAN Network Identifier (VNI), providing massive scalability far beyond VLAN's 4,096 limit. These are fundamental to VXLAN's architecture.
Why the other options are wrong
- A. VXLAN actually provides excellent support for host mobility through the overlay architecture.
- D. VXLAN extends Layer 2 networks over a Layer 3 underlay (not Layer 2 underlay), creating overlay networks across routable infrastructure.
- E. VXLAN uses a 24-bit network identifier (VNI), not 12-bit; the 12-bit limitation applies to traditional VLANs.
Question 239
In a three-tier hierarchical campus network design, which action is a design best-practice for the core layer?
Show answer and explanation
Correct answer: B. provide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence
In a three-tier hierarchical design, the core layer should provide redundant Layer 3 point-to-point links between core devices for predictable, faster convergence. This design pattern ensures that core-to-core communication is highly available and converges quickly in failure scenarios, which is critical for maintaining network stability.
Why the other options are wrong
- A. QoS prioritization is better implemented at the distribution layer where traffic is first aggregated and classified.
- C. Advanced security features like 802.1X, DHCP snooping, and port security belong at the access layer where end devices connect.
- D. Redundant aggregation and first-hop redundancy protocols like VRRP are distribution layer responsibilities, not core layer functions.
Question 240
A vulnerability assessment highlighted that remote access to the switches is permitted using unsecure and unencrypted protocols. Which configuration must be applied to allow only secure and reliable remote access for device administration?
Show answer and explanation
Correct answer: B. line vty 0 15 login local transport input ssh
The command 'transport input ssh' restricts VTY line access to only SSH, which is the secure and encrypted protocol for remote device administration. SSH provides encrypted authentication and data transmission, replacing the unencrypted Telnet protocol. This is the only option that allows secure remote access exclusively.
Why the other options are wrong
- A. The 'transport input all' parameter permits all protocols including insecure Telnet, which violates the security requirement.
- C. Including 'telnet' in the transport input still allows unencrypted Telnet connections alongside SSH.
- D. The 'transport input none' parameter would block all remote access, preventing legitimate administration.
Question 241
What is the role of the RP in PIM sparse mode?
Show answer and explanation
Correct answer: C. The RP is the multicast router that is the root of the PIM-SM shared multicast distribution tree.
In PIM sparse mode, the Rendezvous Point (RP) acts as the root of the shared multicast distribution tree. It serves as the meeting point for sources and receivers, building the shared tree (*,G) that connects multicast group members. The RP is essential for the control plane to build and maintain multicast trees.
Why the other options are wrong
- A. While the RP does maintain state for multicast groups, its primary role is not managing aging timeouts.
- B. The RP is not purely control-plane only; it does forward multicast packets along the shared tree.
- D. The RP does not respond to Join messages with the source address; rather, it helps build the tree toward sources when they join.
Question 242
Which statement about TLS is accurate when using RESTCONF to write configurations on network devices?
Show answer and explanation
Correct answer: C. It is provided using NGINX acting as a proxy web server.
On Cisco IOS XE, RESTCONF requests arrive over HTTPS and are first received by the NGINX proxy web server, an internal web server that provides the TLS-based HTTPS transport. NGINX then hands the request on for authentication and processing. TLS support for RESTCONF is therefore delivered by NGINX acting as a proxy web server.
Why the other options are wrong
- A. TLS secures HTTPS only; it is not used for plain HTTP requests.
- B. RESTCONF users authenticate with AAA credentials over the TLS session; client certificates are not required.
- D. TLS is supported: RESTCONF on Cisco IOS XE uses TLS-based HTTPS.
Question 243
A network engineer is configuring Flexible NetFlow and enters these commands. sampler NetFlow1 mode random one-out-of 100 interface fastethernet 1/0 flow-sampler NetFlow1 What are two results of implementing this feature instead of traditional NetFlow? (Choose two.)
Show answer and explanation
Correct answer: B, C. CPU and memory utilization are reduced; The number of packets to be analyzed are reduced.
Flexible NetFlow sampling reduces both CPU and memory utilization by analyzing only a subset of packets (one out of every 100 in this case), rather than examining every packet. This directly reduces the number of packets to be analyzed, which conserves system resources and decreases processing overhead on the network device.
Why the other options are wrong
- A. NetFlow sampling still exports flows from all talkers, not just top 100; it simply samples packet-by-packet rather than capturing all packets.
- D. Sampling does not inherently improve the security of data export flow.
- E. Sampling actually reduces the accuracy of data since it analyzes only a subset of traffic, not all traffic.
Question 244
A network administrator is preparing a Python script to configure a Cisco IOS XE-based device on the network. The administrator is worried that colleagues will make changes to the device while the script is running. Which operation of the ncclient manager prevents colleagues from making changes to the devices while the script is running?
Show answer and explanation
Correct answer: B. m.lock(target='running')
The ncclient manager's lock() method uses the parameter target='running' to lock the running configuration on a network device, preventing other users from making changes while a script is executing. This is the correct syntax for NETCONF lock operations.
Why the other options are wrong
- A. Uses 'config' parameter which is not valid for the lock() method; correct parameter is 'target'
- C. freeze() is not a valid ncclient manager method; lock() is the correct method
- D. freeze() is not a valid method and uses incorrect 'config' parameter
Question 245
Which feature is supported by EIGRP but is not supported by OSPF?
Show answer and explanation
Correct answer: B. unequal-cost load balancing
Unequal-cost load balancing is a distinctive feature of EIGRP that allows traffic distribution across paths with different metrics using the variance command. OSPF only supports equal-cost load balancing across paths with identical metric values. Route filtering, route summarization, and equal-cost load balancing are all supported by both protocols.
Why the other options are wrong
- A. OSPF supports route filtering through distribute-lists and prefix-lists.
- C. OSPF supports route summarization at area boundaries (inter-area) and at AS boundaries (external).
- D. OSPF supports equal-cost load balancing like most modern routing protocols.
Question 246
What are two considerations when using SSO as a network redundancy feature? (Choose two.)
Show answer and explanation
Correct answer: A, C. requires synchronization between supervisors in order to guarantee continuous connectivity; must be combined with NSF to support uninterrupted Layer 3 operations
SSO (Stateful Switchover) requires synchronization between supervisors to maintain continuous connectivity during failover, ensuring that state information is preserved. Additionally, SSO must be combined with NSF (Nonstop Forwarding) to support uninterrupted Layer 3 operations, allowing the data plane to continue forwarding packets while the control plane restarts. These two mechanisms work together to provide seamless redundancy in supervisor failover scenarios.
Why the other options are wrong
- B. Multicast state is not preserved during SSO switchover; this is a limitation of SSO that NSF helps mitigate.
- D. Both supervisors do not need to be configured separately; SSO requires synchronized configurations across supervisors.
- E. NSF supports uninterrupted Layer 3 operations, not Layer 2; Layer 2 forwarding is not disrupted during SSO switchover.
Question 247
Which function does a fabric edge node perform in an SD-Access deployment?
Show answer and explanation
Correct answer: A. Connects endpoints to the fabric and forwards their traffic.
A fabric edge node is the entry point for endpoints into the SD-Access fabric. It connects wired and wireless endpoints to the fabric and is responsible for forwarding their traffic into the fabric overlay. Edge nodes perform LISP encapsulation but that is not their primary defining function, their primary role is endpoint connectivity and traffic forwarding.
Why the other options are wrong
- B. While edge nodes do participate in LISP encapsulation, this is a mechanism they use rather than their defining function.
- C. Connecting the fabric to external networks is the role of a border node, not an edge node.
- D. Providing underlay reachability between border nodes is an underlay function, not an edge node responsibility.
Question 248
What is an emulated machine that has dedicated compute, memory, and storage resources and a fully installed operating system?
Show answer and explanation
Correct answer: C. virtual machine
A virtual machine is an emulated computer system with dedicated compute, memory, and storage resources running a fully installed operating system. VMs are software-based abstractions that simulate physical computers while sharing underlying hardware resources.
Why the other options are wrong
- A. A mainframe is a large physical computer system, not an emulated machine.
- B. A host refers to a physical computer or the hypervisor itself, not an emulated machine.
- D. Containers are lightweight isolated processes that share the host OS kernel, not fully isolated machines with dedicated operating systems.
Question 249
A local router shows an EBGP neighbor in the Active state. Which statement is true about the local router?
Show answer and explanation
Correct answer: A. The local router is attempting to open a TCP session with the neighboring router.
The Active state in BGP indicates that the local router is actively attempting to establish a TCP session with the neighboring router. This occurs when the router is trying to initiate a connection after failing to passively listen or after a previous connection was reset. Active state represents an ongoing connection attempt.
Why the other options are wrong
- B. Receiving prefixes occurs in the Established state, not Active state.
- C. Active prefixes in the forwarding table also only appear after the Established state is reached.
- D. BGP passive mode is not explicitly 'configured' per se; both sides listen by default in BGP's design, and Active state indicates the router is attempting to open.
Question 250
In Cisco SD-WAN, which protocol is used to measure link quality?
Show answer and explanation
Correct answer: D. BFD
BFD (Bidirectional Forwarding Detection) is the protocol used in Cisco SD-WAN to measure link quality and detect failures. It provides fast, accurate feedback on the health and viability of SD-WAN transport links.
Why the other options are wrong
- A. IPsec is an encryption protocol for secure tunneling, not for link quality measurement.
- B. OMP (Overlay Management Protocol) is used for control plane communication and route distribution, not link quality measurement.
- C. RSVP is a resource reservation protocol, not specifically used for SD-WAN link quality measurement.
Question 251
What is one difference between EIGRP and OSPF?
Show answer and explanation
Correct answer: A. EIGRP uses the DUAL distance vector algorithm, and OSPF uses the Dijkstra link-state algorithm.
EIGRP uses the DUAL (Diffusing Update Algorithm) as a distance vector algorithm, while OSPF uses Dijkstra's shortest path first algorithm as a link-state algorithm. This is a fundamental architectural difference between the two routing protocols. Option A accurately distinguishes these core algorithmic differences.
Why the other options are wrong
- B. This reverses the correct relationship; OSPF uses Dijkstra (link-state), not DUAL (distance vector).
- C. While EIGRP does use variance for unequal cost load balancing, OSPF does not support unequal cost balancing by default; this statement is partially correct but not the most fundamental difference.
- D. EIGRP is Cisco proprietary, and OSPF is an IETF open standard, which is the opposite of what is stated.
Question 252
What is one main REST security design principle?
Show answer and explanation
Correct answer: A. separation of privilege
Separation of privilege (also known as principle of least privilege) is a fundamental REST security design principle that limits access and functionality based on user role and necessity. This principle ensures that APIs grant only the minimum permissions required for a task, reducing attack surface and potential damage from compromised credentials.
Why the other options are wrong
- B. Password hashing is a general security practice but not specifically a REST design principle.
- C. Confidential algorithms are an anti-pattern; REST security relies on proven, public algorithms, not secret ones.
- D. OAuth is an implementation mechanism for REST security, not a design principle.
Question 253
You need to weigh the pros and cons of deploying a premise-based data center versus using a cloud-based data center deployment. What is an advantage of using a premise-based solution? (Choose two.)
Show answer and explanation
Correct answer: A, E. Lower application latency for end users; Increased control over the environment
Premise-based data centers provide two key advantages: lower application latency for end users because infrastructure is geographically closer and under direct control, and increased control over the environment including security, configurations, and customizations. These are significant benefits for organizations with performance-critical or compliance-sensitive applications. Cloud solutions excel at scalability and rapid deployment, but premise-based solutions provide control and latency benefits.
Why the other options are wrong
- B. Cloud solutions are easily scalable, not premise-based solutions which require capital investment in additional hardware.
- C. Cloud solutions have lower capital costs due to operational expense models, while premise-based requires significant upfront hardware investment.
- D. Cloud solutions offer reduced deployment times; premise-based solutions require procurement and installation of physical infrastructure.
Question 254
Which Quality of Service (QoS) mechanism allows the network administrator to control the maximum rate of traffic received or sent on a given interface?
Show answer and explanation
Correct answer: A. Policing
Policing is the QoS mechanism that allows network administrators to control and enforce the maximum rate of traffic that can be received or sent on a given interface. It uses token bucket algorithms to monitor traffic rates and takes actions (such as dropping or marking packets) when traffic exceeds the configured rate limit, ensuring bandwidth compliance and traffic shaping.
Why the other options are wrong
- B. Marking sets priority values on packets but does not control the maximum rate of traffic.
- C. Queueing manages how traffic is buffered and transmitted but does not enforce maximum rates.
- D. Classification identifies and categorizes traffic but does not control traffic rates.
Question 255
Which Quality of Service (QoS) mechanism is used to identify traffic flow and to use DSCP, IP Precedence values, and MPLS EXP bits to create different priority levels?
Show answer and explanation
Correct answer: D. Classification
Classification is the QoS mechanism that identifies traffic flows and assigns them to priority levels using DSCP (Differentiated Services Code Point), IP Precedence values, and MPLS EXP bits. It is the first step in QoS implementation where traffic is identified and categorized based on various criteria. The resulting classifications are then used by other QoS mechanisms like marking and queueing.
Why the other options are wrong
- A. Policing controls the maximum rate of traffic, not the identification and classification process.
- B. Marking sets QoS values on packets but does not identify or classify traffic flows.
- C. Queueing manages traffic buffers but is applied after classification has occurred.
Question 256
An administrator is configuring NETCONF using the following XML string. What must the administrator end the request with? <?xml version="1.0" encoding="UTF-8" ?> <rpc message-id="9.0">
Show answer and explanation
Correct answer: A. </rpc>]]>]]>
NETCONF RPC messages must be terminated with </rpc>]]>]]> sequence, where ]]>]]> is the message terminator used in NETCONF 1.0 protocol. This signals the end of the XML message to the NETCONF server.
Why the other options are wrong
- B. This is not valid NETCONF syntax and notification-off is not a proper closing element.
- C. This is incorrect; </rpc-reply> is used in responses from the server, not to close a client request.
- D. This lacks the required message terminator sequence ]]>]]> that NETCONF protocol mandates.
Question 257
In a Cisco Catalyst switch equipped with two supervisor modules an administrator must temporarily remove the active supervisor from the chassis to perform hardware maintenance on it. Which mechanism ensures that the active supervisor removal is not disruptive to the network operation?
Show answer and explanation
Correct answer: D. SSO
Stateful Switchover (SSO) ensures that when an active supervisor module is removed, the standby supervisor takes over without disrupting network operation by maintaining state information and continuing packet forwarding without control plane restart.
Why the other options are wrong
- A. VRRP is a protocol for router redundancy, not supervisor module redundancy in switches.
- B. HSRP is for virtual router redundancy in routed environments, not supervisor module failover.
- C. NSF/NSR assists with graceful restarts but SSO is the specific mechanism for supervisor removal without disruption.
Question 258
A network engineer must configure a switch to allow remote access for all feasible protocols Only a password must be requested for device authentication and all idle sessions must be terminated in 30 minutes. Which configuration must be applied?
Show answer and explanation
Correct answer: B. line vty 0 15 password cisco transport input all exec-timeout 0 30
Option B correctly configures VTY lines for remote access with the required parameters: 'transport input all' enables all feasible remote access protocols (SSH and Telnet), 'password cisco' sets password-only authentication without local username validation, and 'exec-timeout 0 30' sets the idle session timeout to 30 minutes. The timeout format is minutes followed by seconds, so 0 minutes 30 seconds equals 30 minutes total.
Why the other options are wrong
- A. The exec-timeout syntax is reversed (30 0 means 30 minutes 0 seconds, but the order should be 0 30); also uses specific protocols rather than 'all'.
- C. Uses 'login local' which requires username configuration, but the requirement specifies only a password for authentication.
- D. Configures console access instead of VTY lines for remote access, and does not enable remote protocols.
Question 259
Which Quality of Service (QoS) mechanism allows for the creation of multiple levels of QoS policy, providing a more granular degree of traffic management?
Show answer and explanation
Correct answer: B. H-QoS
H-QoS (Hierarchical QoS) is the QoS mechanism that allows creation of multiple levels or hierarchies of QoS policy, enabling more granular traffic management. It provides nested policy structures that can be applied at different points in the network, allowing administrators to implement complex, multi-level QoS strategies that address different traffic types and service requirements.
Why the other options are wrong
- A. Policing controls maximum traffic rates but does not create hierarchical policy levels.
- C. Congestion avoidance is a mechanism like WRED that prevents queue overflow, not a hierarchical policy structure.
- D. Dual Policy is not a recognized QoS mechanism in Cisco systems.
Question 260
In a Cisco SD-WAN network, which VPN Identifier is reserved for carrying out-of-band network management traffic?
Show answer and explanation
Correct answer: C. VPN 512
VPN 512 is reserved in Cisco SD-WAN for carrying out-of-band network management traffic, allowing management plane communications to be isolated and secure from user data traffic.
Why the other options are wrong
- A. VPN 0 is the transport VPN for control traffic, not management traffic.
- B. VPN 1 is the default data VPN for user traffic.
- D. VPN 514 is not a standard reserved VPN identifier in SD-WAN.
Question 261
"HTTP/1.1 204 No Content" is returned when the curl -i -X DELETE command is issued. Which situation has occurred?
Show answer and explanation
Correct answer: A. The command succeeded in deleting the object.
HTTP 204 No Content indicates a successful request where the server has fulfilled the request but is not returning any content in the response body. When issued in response to a DELETE command, this status code specifically indicates that the deletion operation succeeded. The object has been deleted and the server is confirming success with no content to return.
Why the other options are wrong
- B. HTTP 204 indicates success, not a failed deletion; a failed deletion would return a different status code like 400, 403, or 500.
- C. HTTP 404 Not Found would be returned if the object could not be located; 204 indicates the operation succeeded.
- D. HTTP 400 Bad Request would typically indicate an invalid URI; 204 indicates successful processing of a valid request.
Question 262
How do stratum levels relate to the distance from a time source?
Show answer and explanation
Correct answer: B. Stratum 1 devices are connected directly to an authoritative time source.
Stratum 1 devices are directly connected to an authoritative time source (such as an atomic clock, GPS receiver, or radio clock). Stratum 0 represents the actual authoritative time source itself (not a network device), and each higher stratum number indicates one additional hop away from the authoritative source. Stratum 15 is the maximum and represents an unsynchronized or unreliable time source.
Why the other options are wrong
- A. Stratum 0 is the authoritative time source itself, not a device connected to one; it is not a network device level.
- C. Stratum 15 is the lowest quality level representing unsynchronized time; it is not directly connected to authoritative sources.
- D. Stratum 15 is an unsynchronized time source, not an authoritative source; Stratum 1 devices are directly connected to authoritative sources.
Question 263
Which of the following are valid statements when configuring Nonstop Forwarding (NSF) with Stateful Switchover (SSO) on a Cisco device? (Choose two.)
Show answer and explanation
Correct answer: C, D. Nonstop Forwarding requires SSO to also be configured; HSRP is not supported with NSF/SSO
Nonstop Forwarding (NSF) with Stateful Switchover (SSO) allows graceful recovery during control plane failures. Option C is correct: NSF requires SSO to be configured to function properly, as NSF relies on the stateful information maintained by SSO. Option D is correct: HSRP (Hot Standby Router Protocol) is not supported in conjunction with NSF/SSO because HSRP and NSF/SSO serve overlapping redundancy purposes and have compatibility constraints. These two statements accurately reflect the technical requirements and limitations of NSF/SSO implementation.
Why the other options are wrong
- A. NSF does not support multicast routing protocols in general; multicast support depends on specific protocol implementations and is not a blanket feature of NSF.
- B. While NSF/SSO can support both IPv4 and IPv6 in some configurations, this is not universally guaranteed across all Cisco device types and IOS versions.
- E. Although improper implementation could theoretically cause issues, routing loops are not a standard or documented risk specifically tied to NSF/SSO misconfiguration as a primary concern.
Question 264
Which technology reduces the implementation of STP and leverages both unicast and multicast?
Show answer and explanation
Correct answer: C. VXLAN
VXLAN (Virtual Extensible LAN) reduces STP implementation by using overlay network virtualization that leverages both unicast and multicast traffic to encapsulate layer 2 frames. This allows networks to scale beyond traditional STP limitations while supporting both unicast MAC learning and multicast group replication for BUM (Broadcast, Unknown unicast, Multicast) traffic.
Why the other options are wrong
- A. VLAN does not reduce STP; it requires STP for multiple VLANs.
- B. VPC (Virtual Port Channel) is a Cisco proprietary technology for link aggregation and doesn't specifically leverage both unicast and multicast for STP reduction.
- D. VSS (Virtual Switching System) enables active-active redundancy but does not reduce STP implementation through unicast and multicast leveraging.
Question 265
Which function does a fabric AP perform in a Cisco SD-Access deployment?
Show answer and explanation
Correct answer: B. It connects wireless clients to the fabric.
A fabric AP (Access Point) in Cisco SD-Access acts as a fabric edge node that connects wireless clients to the SD-Access fabric network, providing the integration point for wireless clients into the fabric topology.
Why the other options are wrong
- A. Location updates are handled by other fabric components, not the AP's primary function.
- C. Membership information management is handled by fabric control plane nodes, not APs.
- D. Security policy enforcement occurs at multiple fabric points, but the AP's core function is client connectivity.
Question 266
Which QoS feature uses the IP Precedence bits in the ToS field of the IP packet header to partition traffic into different priority levels?
Show answer and explanation
Correct answer: A. marking
Marking is the QoS feature that sets (marks) the IP Precedence bits in the Type of Service (ToS) field of the IP packet header. This marking assigns packets to different priority levels for differential treatment. Classification identifies traffic, while shaping and policing manage traffic rates; marking specifically deals with setting precedence values in packet headers.
Why the other options are wrong
- B. Shaping controls the rate of traffic output, not the marking of IP Precedence bits
- C. Policing enforces rate limits and typically drops excess traffic, rather than marking precedence bits
- D. Classification identifies and categorizes traffic types but does not directly modify the ToS field
That was 266 of 1,066.
The full Cisco 350-401 ENCOR pack has all 1,066 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 533 free as one PDF by email. Get the Half Pack →