100 Free CCNP ENCOR 350-401 Practice Questions and Answers
100 questions for the CCNP ENCOR 350-401 exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A masterless minion still runs the salt-minion daemon on the target, so it is not agentless.
Right, B is the answer.
Why B is right
Salt SSH executes Salt execution modules and states on a target over an SSH connection and does not require a salt-minion process on that system, which makes it an agentless alternative to the normal master and minion model. The target still needs a supported Python installation unless raw commands are used. It trades speed for convenience because the traffic runs over SSH instead of the ZeroMQ transport.
Not this one. Try another answer.
Why C is wrong
salt-cloud provisions and manages instances on cloud providers and does not run states over SSH on existing servers.
Not this one. Try another answer.
Why D is wrong
salt-syndic lets a master of masters control lower-level masters and does not connect to targets over SSH.
Question 2 Play from 01:49
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Stratum is the NTP metric that indicates an NTP server's closeness to an authoritative time source. Stratum 0 is the reference clock itself, Stratum 1 devices are directly connected to Stratum 0, and each subsequent level increases by one hop away from the authoritative source. Lower stratum values indicate greater closeness to accurate time.
Not this one. Try another answer.
Why B is wrong
Time zone defines geographic offset from UTC but does not indicate closeness to an authoritative time source.
Not this one. Try another answer.
Why C is wrong
Latency measures network delay but is not the specific NTP metric for indicating proximity to authoritative time.
Not this one. Try another answer.
Why D is wrong
Hop count is not an NTP concept; stratum serves the equivalent purpose in the NTP hierarchy.
Question 3 Play from 03:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
auto/desirable works because desirable actively initiates negotiation.
Not this one. Try another answer.
Why B is wrong
desirable/desirable works because both sides actively negotiate.
Not this one. Try another answer.
Why C is wrong
desirable/auto works because desirable actively initiates negotiation.
Right, D is the answer.
Why D is right
PAgP has three modes: on, desirable, and auto. For EtherChannel to form using PAgP, at least one side must be in desirable mode. The auto/auto combination means both sides are passively waiting for the other to initiate negotiation, so neither side actively negotiates the EtherChannel formation, preventing it from forming.
Question 4 Play from 04:47
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
DTLS (Datagram Transport Layer Security) is the protocol used to encrypt control plane traffic between SD-WAN controllers and SD-WAN endpoints. DTLS provides the security equivalent of TLS but operates over UDP, which is suitable for the control plane communications in SD-WAN architectures.
Not this one. Try another answer.
Why B is wrong
IPsec is used for data plane encryption, not control plane traffic encryption in SD-WAN.
Not this one. Try another answer.
Why C is wrong
PGP is a legacy encryption standard not used in modern SD-WAN architectures.
Not this one. Try another answer.
Why D is wrong
HTTPS operates over TCP and is not the protocol used for SD-WAN controller-to-endpoint control plane encryption.
Question 5 Play from 06:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IP first-hop redundancy is provided by protocols like HSRP/VRRP, not by SSO.
Not this one. Try another answer.
Why B is wrong
Communication between nodes for cluster setup is a separate function not directly related to SSO benefits.
Not this one. Try another answer.
Why C is wrong
Physical link redundancy is achieved through redundant physical connections, not through SSO.
Right, D is the answer.
Why D is right
SSO (Stateful Switchover) enables a standby processor to take over without losing sessions or state information, resulting in minimal network downtime during RP (Route Processor) switchover events. This is the primary benefit of implementing SSO on routing platforms.
Question 6 Play from 08:02
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Trust action lets matching traffic pass through the firewall without deep inspection or network discovery, which suits high-volume traffic from sources that are fully trusted. Trusted traffic is still subject to identity requirements and rate limiting. Allow permits the traffic but can attach intrusion and file inspection, Monitor logs the connection and keeps evaluating rules, and Interactive Block only affects web traffic by offering the user a choice.
Not this one. Try another answer.
Why B is wrong
Allowed traffic can still be examined by file and intrusion policies and is subject to network discovery.
Not this one. Try another answer.
Why C is wrong
Monitor only forces connection logging, and the matching traffic continues to be evaluated against later rules.
Not this one. Try another answer.
Why D is wrong
This action shows a block page to web users and acts like a block rule unless the user chooses to continue.
Question 7 Play from 09:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This format does not match the standard HSRP virtual MAC address structure.
Not this one. Try another answer.
Why B is wrong
This uses an incorrect OUI and format for HSRP MAC addresses.
Right, C is the answer.
Why C is right
HSRP group 16 uses the default virtual MAC address 00:00:0c:07:ac:10. The HSRP virtual MAC address format is 00:00:0c:07:ac:XX where XX is the group number in hexadecimal (16 decimal = 0x10 in hexadecimal), resulting in 00:00:0c:07:ac:10.
Not this one. Try another answer.
Why D is wrong
This uses an incorrect OUI prefix (05:00 instead of 00:00) for HSRP.
Question 8 Play from 11:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While XML is one possible encoding format, data modeling languages are not defined by XML style alone.
Not this one. Try another answer.
Why B is wrong
Data modeling languages enable interoperability but do not allow unlimited implementations; they actually constrain implementations to defined schemas.
Not this one. Try another answer.
Why C is wrong
This describes a characteristic of programming languages rather than a key benefit of data modeling languages for interpretation.
Right, D is the answer.
Why D is right
A primary benefit of data modeling languages is that they provide a conceptual representation of data structures that is easier for humans to interpret and understand, facilitating better communication between stakeholders and technical teams.
Question 9 Play from 13:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Inline tap is a deployment mode (traffic visibility method) but does not inherently provide scalability.
Not this one. Try another answer.
Why B is wrong
High availability provides redundancy and failover capability but does not scale capacity in the same way clustering does.
Right, C is the answer.
Why C is right
Clustering is the Cisco NGFW deployment option that provides scalability by allowing multiple firewall units to work together as a single logical entity, distributing traffic load and providing horizontal scaling. This enables the solution to handle increased traffic volumes and provide redundancy while scaling performance.
Not this one. Try another answer.
Why D is wrong
Tap is a passive traffic monitoring mode that does not provide scalability for throughput or performance.
Question 10 Play from 14:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
OSPF does not support autosummarization; only EIGRP does.
Right, B is the answer.
Why B is right
Both EIGRP and OSPF use hello packets as a neighbor discovery and keepalive mechanism. Hello packets are essential in both protocols for establishing and maintaining adjacencies between routers. EIGRP does support autosummarization but OSPF does not. EIGRP supports unequal-cost load balancing, but OSPF does not. Both protocols use multicast addresses for updates, not unicast.
Not this one. Try another answer.
Why C is wrong
OSPF does not support unequal-cost load balancing; only EIGRP does.
Not this one. Try another answer.
Why D is wrong
Both protocols send updates using multicast addresses, not unicast.
Show all 100 questionsShow fewer questions
Question 11 Play from 16:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
VPN 0 is the transport VPN for control traffic, not management traffic.
Not this one. Try another answer.
Why B is wrong
VPN 1 is the default data VPN for user traffic.
Right, C is the answer.
Why C is right
VPN 512 is reserved in Cisco SD-WAN for carrying out-of-band network management traffic, allowing management plane communications to be isolated and secure from user data traffic.
Not this one. Try another answer.
Why D is wrong
VPN 514 is not a standard reserved VPN identifier in SD-WAN.
Question 12 Play from 17:51
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
A JSON Web Token (JWT) consists of three components: the Header (containing token type and hashing algorithm), the Payload (containing claims and data), and the Signature (verifying integrity and authenticity). These three parts are separated by dots and together form a complete JWT.
Not this one. Try another answer.
Why B is wrong
Trailer is not a component of JWT structure; JWTs have only three parts.
Right, C is one of the answers.
Why C is right
A JSON Web Token (JWT) consists of three components: the Header (containing token type and hashing algorithm), the Payload (containing claims and data), and the Signature (verifying integrity and authenticity). These three parts are separated by dots and together form a complete JWT.
Not this one. Try another answer.
Why D is wrong
Sequence number is not part of JWT architecture; JWTs use header, payload, and signature only.
Right, E is one of the answers.
Why E is right
A JSON Web Token (JWT) consists of three components: the Header (containing token type and hashing algorithm), the Payload (containing claims and data), and the Signature (verifying integrity and authenticity). These three parts are separated by dots and together form a complete JWT.
Question 13 Play from 19:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This MAC address does not follow the standard HSRP virtual MAC address format and is not associated with any HSRP group.
Not this one. Try another answer.
Why B is wrong
This is not a valid HSRP virtual MAC address; it does not follow the required 00:00:0c:07:ac:XX pattern.
Right, C is the answer.
Why C is right
HSRP group 32 uses the virtual MAC address 00:00:0c:07:ac:20 by default. HSRP virtual MAC addresses follow the pattern 00:00:0c:07:ac:XX where XX is the group number in hexadecimal. Group 32 converts to 0x20 in hexadecimal, resulting in this specific MAC address.
Not this one. Try another answer.
Why D is wrong
While this is close to the correct format, the fifth octet is incorrect; HSRP uses 07 not 0c in that position.
Question 14 Play from 21:10
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
UDP jitter is an IP SLA operation that requires configuration of an IP SLA responder on the remote end device to generate response packets and measure latency, jitter, and packet loss. The responder must be actively running to collect the necessary bidirectional performance metrics that UDP jitter operations require.
Not this one. Try another answer.
Why B is wrong
ICMP jitter operates using standard ICMP echo requests and does not require a responder configuration
Not this one. Try another answer.
Why C is wrong
TCP connect establishes connections using standard TCP three-way handshakes and does not require an IP SLA responder
Not this one. Try another answer.
Why D is wrong
ICMP echo uses standard ping mechanism and does not require remote responder configuration
Question 15 Play from 22:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A project is an organizational container for templates but is not itself a template type for sequential execution.
Not this one. Try another answer.
Why B is wrong
A regular template is a single configuration template, not a grouping mechanism.
Not this one. Try another answer.
Why C is wrong
Configuration template is a generic term but does not specifically refer to grouped templates running in succession.
Right, D is the answer.
Why D is right
A composite template in Cisco DNA Center is created by grouping multiple templates together to run in succession. This allows administrators to apply a series of configuration templates in a defined order as a single deployment unit, simplifying complex configuration workflows.
Question 16 Play from 24:11
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The enable secret password uses MD5 hashing (type 5) by default in IOS devices to encrypt the password. PAP and CHAP are authentication protocols for remote access, not password encryption methods. While newer devices may support AES (type 8), the traditional and standard method for enable secret has been MD5.
Not this one. Try another answer.
Why B is wrong
PAP (Password Authentication Protocol) is used for authentication, not for encrypting stored passwords.
Not this one. Try another answer.
Why C is wrong
CHAP (Challenge Handshake Authentication Protocol) is an authentication protocol, not a password encryption method.
Not this one. Try another answer.
Why D is wrong
AES is a newer encryption standard supported on some IOS versions but is not the default method for enable secret.
Question 17 Play from 25:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
QoS groups mark traffic but don't directly prioritize on egress interfaces without changing CoS values.
Right, B is the answer.
Why B is right
A policy map is used to classify traffic and apply QoS actions on an egress interface without modifying the CoS value. Policy maps allow you to prioritize database traffic based on classification criteria (via class maps) and apply actions like queuing and scheduling. QoS groups, while useful for marking, would still involve changing values. CoS maps change the CoS value, which violates the requirement. Class maps only define traffic classification criteria, not the actions.
Not this one. Try another answer.
Why C is wrong
CoS maps explicitly change CoS values, violating the requirement not to change CoS.
Not this one. Try another answer.
Why D is wrong
Class maps only classify traffic; they don't apply prioritization actions on egress interfaces.
Question 18 Play from 27:29
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
EIGRP uniquely supports unequal-cost load balancing through its variance feature, allowing the router to load balance across paths with different metrics. OSPF only supports equal-cost load balancing. Options B and C are supported by both protocols, and option D (per-packet load balancing) is not a standard feature of either protocol in modern implementations.
Not this one. Try another answer.
Why B is wrong
OSPF supports load balancing over multiple equal-cost paths.
Not this one. Try another answer.
Why C is wrong
OSPF uses cost (derived from interface bandwidth) to determine the best path.
Not this one. Try another answer.
Why D is wrong
Per-packet load balancing is not a standard feature of OSPF or modern EIGRP implementations; flow-based load balancing is standard.
Question 19 Play from 29:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Round robin distributes traffic equally among all gateways regardless of their capabilities.
Not this one. Try another answer.
Why B is wrong
Host dependent uses MAC addresses to make consistent forwarding decisions but doesn't account for different throughput capabilities.
Right, C is the answer.
Why C is right
Weighted load balancing in GLBP allows different members of the group to handle traffic proportional to their capabilities. This method assigns different weights to each gateway based on throughput capacity, enabling the architect to account for heterogeneous hardware with varying performance levels.
Not this one. Try another answer.
Why D is wrong
Least connection is not a GLBP load balancing method.
Question 20 Play from 30:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Authentication and authorization are handled by other components like vManage and ISE, not vSmart.
Right, B is the answer.
Why B is right
The vSmart controller is the centralized control plane component in Cisco SD-WAN that manages all control plane functions, including policy distribution, routing decisions, and network intelligence. It communicates with WAN Edge nodes to direct how they should forward traffic and handle network operations.
Not this one. Try another answer.
Why C is wrong
While vSmart is centralized, it specifically manages the control plane, not the overall network management system (that role belongs to vManage).
Not this one. Try another answer.
Why D is wrong
The data plane is managed by WAN Edge nodes; vSmart manages the control plane.
Question 21 Play from 32:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IPsec is a network layer security protocol, not an authorization framework for HTTP services.
Not this one. Try another answer.
Why B is wrong
GRE is a tunneling protocol used for encapsulation, not for application-level authorization.
Not this one. Try another answer.
Why C is wrong
Basic Auth is an authentication mechanism, not an authorization framework for limiting third-party application access.
Right, D is the answer.
Why D is right
OAuth 2.0 is an authorization framework specifically designed to give third-party applications limited, scoped access to HTTP services and APIs without sharing user credentials. It uses tokens and delegation to provide fine-grained access control. IPsec is a network security protocol, GRE is a tunneling protocol, and Basic Auth is a simple authentication mechanism that is not an authorization framework for limiting third-party access.
Question 22 Play from 34:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The underlay network is the physical infrastructure layer, not the logical network layer.
Not this one. Try another answer.
Why B is wrong
VPN routing/forwarding (VRF) is a routing technique but does not specifically describe the SD-Access L2/L3 logical network architecture.
Not this one. Try another answer.
Why C is wrong
Easy Virtual Network (EVN) is not the technology used in SD-Access for creating logical networks.
Right, D is the answer.
Why D is right
The overlay network in Cisco SD-Access provides Layer 2 and Layer 3 logical network segments that operate on top of the physical underlay network infrastructure. It uses technologies like VXLAN to create scalable, multi-tenant virtual networks that are independent of the physical topology.
Question 23 Play from 35:55
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
DHCP is a data plane protocol used for IP address assignment, not for endpoint mapping in SD-Access.
Not this one. Try another answer.
Why B is wrong
VXLAN is an encapsulation protocol used for data plane tunneling, not for endpoint mapping and resolution.
Not this one. Try another answer.
Why C is wrong
SXP (Scalable Group Tag eXchange Protocol) is used for tag propagation in SD-Access, not for endpoint mapping.
Right, D is the answer.
Why D is right
LISP (Locator/ID Separation Protocol) is the control plane protocol used in Cisco SD-Access fabric for mapping and resolving endpoints. LISP provides the mechanism to map endpoint identifiers (EIDs) to routing locators (RLOCs), enabling dynamic endpoint location discovery and mobility across the fabric.
Question 24 Play from 37:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SSL is an encryption protocol, not a hashing algorithm used by NTP.
Right, B is the answer.
Why B is right
NTP uses MD5 (Message Digest 5) as its hashing algorithm for authentication. MD5 creates a cryptographic hash that is used to authenticate NTP packets and verify the identity of NTP servers and clients. This is the standard hashing mechanism employed in NTP authentication schemes.
Not this one. Try another answer.
Why C is wrong
AES128 is an encryption algorithm, not a hashing algorithm; NTP does not use AES for authentication hashing.
Not this one. Try another answer.
Why D is wrong
AES256 is an encryption algorithm, not the hashing algorithm NTP uses for authentication.
Question 25 Play from 39:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
VRRP selects based on highest priority, not lowest.
Right, B is the answer.
Why B is right
In VRRP, when the master router fails, the backup router with the highest priority value becomes the new master router. If priorities are equal, the router with the highest IP address becomes master. Priority-based selection ensures the administrator can control which router is preferred as master.
Not this one. Try another answer.
Why C is wrong
Loopback address is not used in VRRP master selection; interface IP addresses matter only when priorities are tied.
Not this one. Try another answer.
Why D is wrong
VRRP uses highest priority and highest IP address, not lowest values.
Question 26 Play from 40:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Managing endpoint-to-device relationships is a controller function, not an Edge Node function.
Not this one. Try another answer.
Why B is wrong
Connecting external Layer 3 networks is the role of the Fabric Border Node, not the Edge Node.
Right, C is the answer.
Why C is right
In Cisco Software-Defined Access (SDA) architecture, the Fabric Edge Node is the access layer device that directly connects wired endpoints (devices, computers, printers) to the SDA fabric. It provides the connection point for wired clients into the network.
Not this one. Try another answer.
Why D is wrong
Connecting wireless endpoints is handled by wireless access points integrated with the fabric, not the wired Fabric Edge Node.
Question 27 Play from 42:20
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
HSRP group 12 uses the default virtual MAC address 00:00:0c:07:ac:0c. The HSRP virtual MAC address format is 00:00:0c:07:ac:XX where XX is the hexadecimal representation of the group number (12 in decimal = 0c in hexadecimal).
Not this one. Try another answer.
Why B is wrong
This format 00:05:5e:00:0c:12 is incorrect; 00:05:5e is not the HSRP OUI.
Not this one. Try another answer.
Why C is wrong
This format 00:5e:0c:07:ac:12 uses incorrect OUI; HSRP OUI is 00:00:0c.
Not this one. Try another answer.
Why D is wrong
This MAC address does not follow the HSRP virtual MAC address format at all.
Question 28 Play from 44:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Bridge domains are layer 2 forwarding domains but not the segmentation technology specific to VXLAN.
Not this one. Try another answer.
Why B is wrong
VLANs are limited to 4094 segments; VXLAN uses VNI for its segmentation capability.
Right, C is the answer.
Why C is right
The VNI (VXLAN Network Identifier) is the technology VXLAN uses to provide segmentation for both Layer 2 and Layer 3 traffic. The 24-bit VNI enables up to 16 million separate network segments, providing isolation comparable to VLAN segmentation but at much greater scale.
Not this one. Try another answer.
Why D is wrong
VRF (Virtual Routing and Forwarding) provides Layer 3 segmentation in traditional networks, not the VXLAN-specific segmentation mechanism.
Question 29 Play from 45:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In Cisco DNA Center, the Developer Toolkit is where API documentation is organized and presented by functional area. This toolkit provides a comprehensive reference for all available API calls, organized logically by their functional domains, allowing developers to find and understand APIs relevant to their needs.
Not this one. Try another answer.
Why B is wrong
Platform management is a general management area, not specifically the location for API documentation organization.
Not this one. Try another answer.
Why C is wrong
Platform bundles refer to collections of features or services, not the documentation repository.
Not this one. Try another answer.
Why D is wrong
Runtime Dashboard is used for monitoring and operational visibility, not for API documentation.
Question 30 Play from 47:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
High availability refers to system uptime and redundancy, not the specific process of moving VMs between hosts.
Not this one. Try another answer.
Why B is wrong
Disaster recovery involves recovery from failures, not the planned movement of VMs with no downtime.
Right, C is the answer.
Why C is right
Live migration is the specific technology and process that allows virtual machines to move from one physical host to another while maintaining continuous operation and zero downtime. The VM's memory, state, and connections are transferred seamlessly during operation.
Not this one. Try another answer.
Why D is wrong
Multisite replication involves copying data across multiple geographic sites, not moving individual VMs with zero downtime.
Question 31 Play from 48:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
XML encryption and signatures are more applicable to SOAP-based web services rather than REST APIs, which typically use JSON.
Right, B is the answer.
Why B is right
HTTPS with TLS encryption is the standard and most practical method for securing REST APIs. It provides encryption in transit, protecting the API endpoints and data from interception and eavesdropping, which is fundamental to REST API security.
Not this one. Try another answer.
Why C is wrong
MD5 hashes are unsuitable for security purposes due to collision vulnerabilities and do not provide encryption.
Not this one. Try another answer.
Why D is wrong
Web Services Security (WS-Security) is a standard for SOAP-based services, not the primary method for REST API security.
Question 32 Play from 50:51
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Platform as a Service gives developers a managed environment in which the provider handles hardware, virtualization, operating system and runtime, and the customer supplies only application code and data. Infrastructure as a Service stops at virtual machines, networking and storage, leaving operating system and middleware patching to the customer. Software as a Service delivers a complete application that the customer simply uses and configures.
Not this one. Try another answer.
Why B is wrong
With IaaS the customer installs and patches the operating system and runtime, which the provider manages in this scenario.
Not this one. Try another answer.
Why C is wrong
With SaaS the customer consumes a finished application and does not deploy its own code.
Not this one. Try another answer.
Why D is wrong
Colocation provides space, power and cooling for customer-owned hardware and is not a cloud service model.
Question 33 Play from 52:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
PUT replaces an existing resource entirely (equivalent to NETCONF merge/replace), not creation
Not this one. Try another answer.
Why B is wrong
CREATE is not a standard RESTCONF HTTP method
Not this one. Try another answer.
Why C is wrong
GET is used for retrieving data, not creating new resources
Right, D is the answer.
Why D is right
In NETCONF, the <edit-config> operation with operation="create" is used to create new data. When migrating to RESTCONF, the POST method is the equivalent operation for creating new resources. POST in REST semantics creates new items, whereas PUT replaces entire resources. CREATE and GET are not valid RESTCONF HTTP methods.
Question 34 Play from 54:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While TLS secures both HTTP and HTTPS, this statement is too general and doesn't specifically address RESTCONF authentication requirements
Right, B is the answer.
Why B is right
TLS (Transport Layer Security) requires certificates for proper authentication and encryption when using RESTCONF to write configurations on network devices. These certificates establish the secure identity of both client and server, ensuring authenticated and encrypted communication channels for sensitive configuration changes.
Not this one. Try another answer.
Why C is wrong
NGINX proxy is an optional architectural component, not a requirement of TLS itself in RESTCONF implementations
Not this one. Try another answer.
Why D is wrong
Cisco devices fully support TLS with RESTCONF; this statement is factually incorrect
Question 35 Play from 56:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Host hardware is present in both Type 1 and Type 2 hypervisors; it is not unique to Type 2.
Not this one. Try another answer.
Why B is wrong
Memory is used by both Type 1 and Type 2 hypervisors; it is not a unique element.
Right, C is the answer.
Why C is right
The host operating system is the unique element to Type 2 hypervisors. Type 2 hypervisors are installed on top of a pre-existing host OS and depend on it for hardware abstraction and resource management. Type 1 hypervisors run directly on bare metal without a host OS, making this the key distinguishing feature.
Not this one. Try another answer.
Why D is wrong
Virtual machine operating systems are used in both Type 1 and Type 2 environments; this is not unique to Type 2.
Question 36 Play from 57:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The process ID must come before the vrf keyword, so this ordering is not valid syntax.
Right, B is the answer.
Why B is right
OSPFv2 supports VRFs by creating a separate process for each VRF with router ospf process-id vrf vrf-name. The process then forms adjacencies only on interfaces that belong to that VRF and installs its routes into the matching routing table. Other protocols use different syntax: EIGRP named mode and BGP use address-family ipv4 vrf vrf-name under the routing process. Keeping routing processes separate per VRF is what allows overlapping address space.
Not this one. Try another answer.
Why C is wrong
The interface-level ip ospf command enables a process on an interface but does not accept a vrf keyword.
Not this one. Try another answer.
Why D is wrong
This form is used under BGP and EIGRP named mode, not as the way to start a classic OSPFv2 process.
Question 37 Play from 1:00:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The hypervisor is the overall virtualization platform, not the specific component managing VM-to-VM communication.
Not this one. Try another answer.
Why B is wrong
A virtual router handles Layer 3 routing, not Layer 2 switching for VM communication.
Right, C is the answer.
Why C is right
A vSwitch (virtual switch) is the component that enables communication between guest VMs by providing Layer 2 switching functionality within the hypervisor. It forwards frames between VMs connected to the same virtual network, allowing intra-VM communication within the virtualized environment.
Not this one. Try another answer.
Why D is wrong
A pNIC (physical NIC) connects to the external network, not directly enables guest-to-guest VM communication.
Question 38 Play from 1:01:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
VLAN information is retrieved through network configuration APIs, not the Authentication API.
Not this one. Try another answer.
Why B is wrong
Client health status is provided by client health or device health APIs, not the Authentication API.
Right, C is the answer.
Why C is right
The Cisco DNA Center Authentication API provides an access token that enables authorized users and applications to make subsequent API calls to Cisco DNA Center, serving as the authentication mechanism for API access.
Not this one. Try another answer.
Why D is wrong
Global issues are retrieved through issue reporting APIs, not the Authentication API.
Question 39 Play from 1:03:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Bandwidth is managed at the network level, not directly provisioned by the hypervisor as a discrete resource
Not this one. Try another answer.
Why B is wrong
IP addresses are assigned by DHCP or static configuration within the guest OS, not provisioned by the hypervisor itself
Right, C is the answer.
Why C is right
A hypervisor must make storage available to virtual machines to enable them to function. This includes both boot storage for the operating system and data storage for applications. While bandwidth, IP addresses, and secure access are important for VM operations, storage is a fundamental resource that the hypervisor must provision and manage for each VM.
Not this one. Try another answer.
Why D is wrong
Secure access is handled through authentication and authorization mechanisms, not directly provisioned by the hypervisor
Question 40 Play from 1:04:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The site ID identifies a location and the VLAN ID is a local value, and neither is part of the TLOC identity.
Not this one. Try another answer.
Why B is wrong
The site ID and service VPN number describe the site and the segment, not the transport.
Right, C is the answer.
Why C is right
A transport location (TLOC) is the point at which a WAN Edge attaches to a transport network, and it is uniquely identified by a tuple of the device system IP address, a color that names the transport such as mpls or biz-internet, and the encapsulation type, which is IPsec or GRE. OMP advertises TLOCs through the Controllers, and each OMP route uses a TLOC as its next hop, much like a BGP next hop.
Not this one. Try another answer.
Why D is wrong
MAC addresses and tunnel keys are not used to identify a TLOC.
Question 41 Play from 1:06:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Python requests is a library, not a command-line tool.
Not this one. Try another answer.
Why B is wrong
Postman is a GUI application, not a command-line tool.
Right, C is the answer.
Why C is right
cURL is a command-line tool specifically designed for consuming REST APIs by making HTTP requests. It is lightweight, widely available on most systems, and doesn't require additional installation. While Python requests is a library for API consumption, Postman is a GUI application, and Firefox is a web browser-none of these are primarily command-line tools for REST APIs like cURL is.
Not this one. Try another answer.
Why D is wrong
Firefox is a web browser, not a command-line REST API consumption tool.
Question 42 Play from 1:08:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Policing controls maximum traffic rates but does not create hierarchical policy levels.
Right, B is the answer.
Why B is right
H-QoS (Hierarchical QoS) is the QoS mechanism that allows creation of multiple levels or hierarchies of QoS policy, enabling more granular traffic management. It provides nested policy structures that can be applied at different points in the network, allowing administrators to implement complex, multi-level QoS strategies that address different traffic types and service requirements.
Not this one. Try another answer.
Why C is wrong
Congestion avoidance is a mechanism like WRED that prevents queue overflow, not a hierarchical policy structure.
Not this one. Try another answer.
Why D is wrong
Dual Policy is not a recognized QoS mechanism in Cisco systems.
Question 43 Play from 1:09:41
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Fail-safe defaults is a primary REST security design principle, meaning the system should deny access by default and only grant permissions explicitly. While password hashing, timestamps, and OAuth are all security-related, fail-safe defaults is the foundational design principle that ensures secure-by-default behavior in REST API design.
Not this one. Try another answer.
Why B is wrong
Password hashing is an implementation detail for credential storage, not a REST design principle.
Not this one. Try another answer.
Why C is wrong
Adding timestamps helps prevent replay attacks but is not a primary design principle.
Not this one. Try another answer.
Why D is wrong
OAuth is an authentication mechanism, not a design principle for REST APIs.
Question 44 Play from 1:11:14
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In a Cisco StackWise stack, the primary switch is determined by priority value-the switch with the highest priority becomes the primary. When a new switch with a higher priority is added to an existing stack, the election process is triggered and the new switch with higher priority assumes the primary role, causing the previous primary to lose its role.
Not this one. Try another answer.
Why B is wrong
When a stack member fails, the primary role is not transferred; the primary remains primary unless it is the failed member.
Not this one. Try another answer.
Why C is wrong
Changing a stack member's priority value to higher does not automatically cause role change unless the entire stack is reset.
Not this one. Try another answer.
Why D is wrong
While a reset could cause role changes, it is not the specific event that causes a primary to lose its role; adding a higher-priority switch is.
Question 45 Play from 1:13:01
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The map resolver in LISP is responsible for processing Map-Request packets from ingress tunnel routers (ITRs) seeking EID-to-RLOC mappings. When an ITR does not have a mapping, it queries the map resolver to find the correct mapping for the destination.
Not this one. Try another answer.
Why B is wrong
Egress tunnel routers (ETRs) receive and process traffic; they do not resolve mappings.
Not this one. Try another answer.
Why C is wrong
Map servers register and store mappings from authoritative sources but do not perform the lookup function.
Not this one. Try another answer.
Why D is wrong
Ingress tunnel routers (ITRs) query for mappings; they do not find or resolve them themselves.
Question 46 Play from 1:14:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IGMPv2 is compatible with IGMPv1, not only with itself.
Not this one. Try another answer.
Why B is wrong
IGMPv3 is not compatible with IGMPv1 or IGMPv2.
Right, C is the answer.
Why C is right
IGMPv2 is backward compatible with IGMPv1. When IGMPv2 is present on a network, it can interoperate with IGMPv1 hosts and routers. IGMPv3 is not backward compatible with earlier versions; if IGMPv3 is present, all devices must support IGMPv3. Therefore, IGMPv2's compatibility is limited to IGMPv1.
Not this one. Try another answer.
Why D is wrong
IGMPv3 is not compatible with IGMPv1.
Question 47 Play from 1:16:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
TCP is a transport layer protocol and is not the dedicated control protocol between routers and controllers in SD-WAN.
Right, B is the answer.
Why B is right
OMP (Overlay Management Protocol) is the control plane protocol used between Cisco SD-WAN routers and vSmart controllers. OMP carries routing information, policy, and control messages across the SD-WAN overlay network, enabling centralized policy distribution and dynamic routing.
Not this one. Try another answer.
Why C is wrong
UDP is used for data plane encapsulation but not as the primary control plane protocol between routers and vSmart controllers.
Not this one. Try another answer.
Why D is wrong
BGP is a routing protocol but not the control protocol used between SD-WAN routers and vSmart controllers; OMP serves this function.
Question 48 Play from 1:17:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Traffic shaping supports marking and remarking of packets.
Not this one. Try another answer.
Why B is wrong
Traffic shaping can be applied to both inbound and outbound traffic.
Not this one. Try another answer.
Why C is wrong
Traffic shaping queues packets in buffers; it does not apply in both directions as stated.
Right, D is the answer.
Why D is right
Traffic shaping queues out-of-profile packets in a buffer until they can be transmitted at the conforming rate. This is the fundamental mechanism that allows traffic shaping to smooth traffic flows. Option A is incorrect because traffic shaping supports marking. Option B is incorrect because traffic shaping can be applied bidirectionally. Option C is incorrect because traffic shaping specifically buffers excess traffic rather than allowing it to pass uncontrolled.
Question 49 Play from 1:19:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An ITR sends a Map-Request to resolve a destination EID, not to publish the prefixes of an ETR.
Right, B is the answer.
Why B is right
An ETR publishes its EID prefixes and the RLOCs that reach them by sending Map-Register messages to the map server, and it repeats them periodically to keep the registration active. The map server stores the mapping in its database. Later, an ITR sends a Map-Request through the map resolver, and the mapping system returns the RLOCs in a Map-Reply. The map-cache is a table on the ITR, not a protocol message.
Not this one. Try another answer.
Why C is wrong
A Map-Reply answers a Map-Request and does not register EID prefixes with the map server.
Not this one. Try another answer.
Why D is wrong
The map-cache is the local table where an ITR stores resolved mappings, and it is not a LISP message.
Question 50 Play from 1:21:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Least privilege refers to granting users only the minimum permissions needed for their role, not the default deny posture.
Right, B is the answer.
Why B is right
Fail-safe defaults is the security principle stating that access should be denied by default unless explicitly granted. This is also known as the principle of default deny. While least privilege is related, it describes minimizing permissions for users who do have access, whereas fail-safe defaults specifically addresses the default state of all resources before any grants are made.
Not this one. Try another answer.
Why C is wrong
Economy of mechanism refers to keeping security designs simple and understandable to reduce implementation errors.
Not this one. Try another answer.
Why D is wrong
Complete mediation requires that all access requests be checked against security policy, but doesn't define the default state.
Question 51 Play from 1:23:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
NGFWs are required throughout network architecture, not only at the perimeter, for comprehensive protection.
Not this one. Try another answer.
Why B is wrong
While NGFWs can be deployed in multiple layers, this is not their defining characteristic.
Not this one. Try another answer.
Why C is wrong
NGFWs go beyond Layer 3 and 4; they perform deep packet inspection and application-layer filtering.
Right, D is the answer.
Why D is right
A next-generation firewall (NGFW) is characterized by its ability to provide advanced threat protection beyond traditional Layer 3/4 filtering. Intrusion prevention is a core characteristic of NGFWs, as they can detect and block malicious traffic patterns and exploits in real-time. This distinguishes them from traditional firewalls.
Question 52 Play from 1:24:50
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
vSmart is the control plane component in Cisco SD-WAN architecture responsible for distributing centralized policies to all edge devices. It collects telemetry, runs path computation algorithms, and pushes policy-based configurations throughout the network to ensure consistent enforcement of security and traffic management rules.
Not this one. Try another answer.
Why B is wrong
Policy execution is performed by vEdge devices (data plane), not vSmart
Not this one. Try another answer.
Why C is wrong
OMP redistribution is not a vSmart function; OMP is the overlay management protocol used by vSmart for communication
Not this one. Try another answer.
Why D is wrong
NAT traversal is handled by vEdge devices and edge control components, not by vSmart
Question 53 Play from 1:26:34
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To match odd-numbered hosts in 10.0.0.0/24, we need a wildcard mask that matches addresses ending in 1, 3, 5, 7, etc. The wildcard mask 0.0.0.1 means "ignore the last bit," which when applied to 10.0.0.0 matches all addresses where the last octet has the least significant bit set to 1 (odd numbers: 1, 3, 5, 7, 9, etc.). This is the correct syntax for matching odd-numbered hosts.
Not this one. Try another answer.
Why B is wrong
The wildcard 0.0.0.254 is inverted logic and does not correctly specify odd hosts; it would match even numbers.
Not this one. Try another answer.
Why C is wrong
This syntax is invalid; a wildcard mask cannot be 0.0.0.0 as it would match only the single host 10.0.0.1.
Not this one. Try another answer.
Why D is wrong
This uses standard netmask notation (255.255.255.254) instead of wildcard mask notation; ACLs require wildcard masks, not subnet masks.
Question 54 Play from 1:28:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Application policy configuration is part of DNA Center Intent-Based Networking, not the Assurance module.
Not this one. Try another answer.
Why B is wrong
Device onboarding and configuration is handled by DNA Center Provisioning, not Assurance.
Not this one. Try another answer.
Why C is wrong
Software upgrade and management is a provisioning and lifecycle management function, not an Assurance capability.
Right, D is the answer.
Why D is right
Cisco DNA Center Assurance provides data correlation and analysis capabilities, collecting and analyzing network telemetry, device metrics, and behavioral data to provide insights into network health, performance, and security issues. It correlates data from multiple sources to identify problems and their root causes.
Question 55 Play from 1:30:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Password hashing protects stored credentials but does not prevent interception of API communications in transit.
Right, B is the answer.
Why B is right
SSL certificates establish encrypted communication channels between client and server, preventing attackers from intercepting or modifying data in transit. This directly mitigates man-in-the-middle attacks by ensuring that communications cannot be eavesdropped on or altered without detection.
Not this one. Try another answer.
Why C is wrong
Nonrepudiation ensures users cannot deny their actions but does not prevent an attacker from intercepting communications.
Not this one. Try another answer.
Why D is wrong
Biometric authentication verifies user identity but does not encrypt data in transit to prevent interception.
Question 56 Play from 1:31:55
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The range 172.16.32.0 through 172.16.47.255 is the 172.16.32.0/20 block. The first two octets and the upper four bits of the third octet must match, which leaves the lower four bits of the third octet and the whole fourth octet as do-not-care bits. A do-not-care bit is written as 1 in a wildcard mask, so the third octet becomes 15 and the fourth becomes 255, giving 0.0.15.255.
Not this one. Try another answer.
Why B is wrong
This wildcard mask matches third octet values 32 through 63, which is twice the required range.
Not this one. Try another answer.
Why C is wrong
This wildcard mask matches only the addresses 172.16.32.0 through 172.16.32.15.
Not this one. Try another answer.
Why D is wrong
This wildcard mask ignores the upper four bits of the third octet and so matches values such as 0, 16, 32, and 48, not the required range.
Question 57 Play from 1:34:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Weighted Fair Queuing (WFQ) uses dynamic queue allocation based on flow weight, not static queues.
Not this one. Try another answer.
Why B is wrong
Custom queuing allows configuration of multiple queues with configurable bandwidth allocation, not a fixed four-queue model.
Not this one. Try another answer.
Why C is wrong
Low Latency Queuing (LLQ) combines priority and fair queuing mechanisms with custom queue configurations, not fixed static queues.
Right, D is the answer.
Why D is right
Priority queuing uses four static queues: high, medium, normal, and low. Packets are classified into these four priority levels, and the router services higher priority queues before lower priority ones, making it a simple but effective queuing method for differentiating traffic by priority.
Question 58 Play from 1:36:01
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
TCP window size does not directly prevent fragmentation; it controls flow control, not packet size.
Right, B is one of the answers.
Why B is right
To prevent fragmentation in GRE tunnels, two key configurations are needed: IP MTU (set on the tunnel interface to account for GRE header overhead) and TCP MSS (configured on tunnel interfaces to clamp the maximum segment size for TCP packets). Both work together to ensure that packets do not exceed the tunnel's effective MTU and cause fragmentation.
Right, C is one of the answers.
Why C is right
To prevent fragmentation in GRE tunnels, two key configurations are needed: IP MTU (set on the tunnel interface to account for GRE header overhead) and TCP MSS (configured on tunnel interfaces to clamp the maximum segment size for TCP packets). Both work together to ensure that packets do not exceed the tunnel's effective MTU and cause fragmentation.
Not this one. Try another answer.
Why D is wrong
The DF (Don't Fragment) bit being clear actually allows fragmentation, which contradicts the goal of prevention.
Not this one. Try another answer.
Why E is wrong
MTU ignore is not a standard GRE fragmentation prevention feature; the correct approach is configuring IP MTU.
Question 59 Play from 1:37:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IPsec is not a standard NTP security mechanism; NTP has its own authentication methods.
Not this one. Try another answer.
Why B is wrong
IP prefix lists are not used for NTP security; ACLs are used instead.
Right, C is one of the answers.
Why C is right
NTP can be secured using encrypted authentication (MD5 or SHA-based keys) and IP access lists (ACLs) to restrict which sources can synchronize with the NTP server. Encrypted authentication verifies the source's authenticity, while IP access lists control which hosts are allowed to communicate with the NTP service.
Not this one. Try another answer.
Why D is wrong
TACACS-based authentication is not a NTP security mechanism; TACACS is for device access control.
Right, E is one of the answers.
Why E is right
NTP can be secured using encrypted authentication (MD5 or SHA-based keys) and IP access lists (ACLs) to restrict which sources can synchronize with the NTP server. Encrypted authentication verifies the source's authenticity, while IP access lists control which hosts are allowed to communicate with the NTP service.
Question 60 Play from 1:39:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A router in the Learn state does not yet know the virtual IP address and waits for a hello from the active router.
Not this one. Try another answer.
Why B is wrong
A router in the Listen state receives hellos but does not send them or take part in the election.
Right, C is the answer.
Why C is right
In the Speak state a router knows the virtual IP address and both sends and receives hello messages while it takes part in the election of the active and standby routers. A router moves to Standby or Active after it wins the election. A router in the Learn state has not yet learned the virtual IP address, and a router in the Listen state knows the address and receives hellos but is not sending them.
Not this one. Try another answer.
Why D is wrong
The Standby state is reached only after the router wins the election as the next router to become active.
Question 61 Play from 1:41:10
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A device is labeled as unclaimed in Cisco DNA Center Plug and Play when it has not been assigned a workflow. The device has been discovered and registered but awaits assignment to a configuration workflow before provisioning can proceed. Once a workflow is assigned, the device moves from unclaimed to claimed status.
Not this one. Try another answer.
Why B is wrong
Failure to be added to fabric results in different error states, not simply an unclaimed status.
Not this one. Try another answer.
Why C is wrong
Provisioning errors result in failed or error states, not an unclaimed designation.
Not this one. Try another answer.
Why D is wrong
Third-party devices can be claimed and managed in DNA Center Plug and Play; vendor origin does not determine claimed status.
Question 62 Play from 1:42:53
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Path Trace is the Cisco DNA Center Assurance feature that verifies host reachability by tracing the end-to-end path between devices and providing detailed hop-by-hop information, latency, and packet loss to confirm connectivity.
Not this one. Try another answer.
Why B is wrong
Application Experience monitors application performance and quality but does not specifically verify host reachability.
Not this one. Try another answer.
Why C is wrong
Detail Information is a general category and not the specific feature name for host reachability verification.
Not this one. Try another answer.
Why D is wrong
Network Time Travel is a feature for historical network state analysis, not for verifying current host reachability.
Question 63 Play from 1:44:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This code reports missing or invalid authentication credentials and does not describe an exceeded request quota.
Not this one. Try another answer.
Why B is wrong
This code reports that the server refuses to authorize the request even though it understood it, and not that a rate limit was exceeded.
Right, C is the answer.
Why C is right
Rate limiting protects an API from brute-force attempts, scraping, and denial of service by capping how many requests each client may make in a time window. When a client goes over the cap, the standard response is status 429 Too Many Requests, defined in RFC 6585, and the response often includes a Retry-After header that tells the client when to try again. Codes such as 401 and 403 describe authentication and authorization problems instead.
Not this one. Try another answer.
Why D is wrong
This code reports that the server is temporarily unable to handle requests, such as during overload, and not that one client exceeded its quota.
Question 64 Play from 1:46:19
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
In Cisco SD-Access fabric architecture, edge nodes and border nodes are the two primary device roles. Edge nodes connect endpoints to the fabric, while border nodes connect the fabric to external networks. Access and core switches are legacy terminology; the fabric uses a unified architecture based on these two primary role types.
Not this one. Try another answer.
Why B is wrong
vBond controller is part of SD-WAN, not SD-Access; it is not a device role in the SD-Access fabric.
Not this one. Try another answer.
Why C is wrong
Access switches are not a defined role in the SD-Access fabric; edge nodes serve the function of accessing endpoints.
Not this one. Try another answer.
Why D is wrong
Core switches are not a defined role in SD-Access fabric; the architecture uses edge and border nodes instead of traditional core/access layers.
Right, E is one of the answers.
Why E is right
In Cisco SD-Access fabric architecture, edge nodes and border nodes are the two primary device roles. Edge nodes connect endpoints to the fabric, while border nodes connect the fabric to external networks. Access and core switches are legacy terminology; the fabric uses a unified architecture based on these two primary role types.
Question 65 Play from 1:47:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IPsec is used for secure tunneling between SD-WAN devices, not for vManage-to-device management communication.
Not this one. Try another answer.
Why B is wrong
Northbound APIs are used by external systems to query and manage vManage itself, not for vManage to manage devices.
Not this one. Try another answer.
Why C is wrong
RESTCONF is a protocol that could be part of southbound API implementation, but the correct architectural answer is southbound API.
Right, D is the answer.
Why D is right
vManage uses southbound APIs to interact with and control Cisco SD-WAN devices in the fabric. Southbound APIs are used by a management controller to communicate with and manage devices below it in the hierarchy. This is the standard architectural pattern where vManage (the management plane) sends commands and receives telemetry from edge routers and other fabric devices.
Question 66 Play from 1:49:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
HTTP 200 OK indicates successful authentication, not a failed authentication attempt.
Not this one. Try another answer.
Why B is wrong
HTTP 302 Found is a redirect status code used for URL redirection, not for authentication failures.
Right, C is the answer.
Why C is right
HTTP 401 Unauthorized is the correct response when authentication credentials are invalid or incorrect, such as when a wrong password is submitted to a REST API. This status code indicates that the request lacks valid authentication credentials and the client should provide proper credentials to access the resource.
Not this one. Try another answer.
Why D is wrong
HTTP 504 Gateway Timeout indicates a server connectivity issue, not an authentication problem.
Question 67 Play from 1:51:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Command Runner is used to execute ad-hoc commands on devices, not to create reusable configuration templates.
Not this one. Try another answer.
Why B is wrong
Application Policies are used for managing application-specific network policies, not for building generic device configurations.
Right, C is the answer.
Why C is right
The Template Editor is the tool used in Cisco DNA Center to build generic configurations (templates) that can be applied to multiple devices with similar network settings. Templates enable standardization and rapid deployment of consistent configurations across devices.
Not this one. Try another answer.
Why D is wrong
Authentication Template is not a feature in DNA Center; Template Editor is the correct tool for building generic configurations.
Question 68 Play from 1:52:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Establishing IPsec tunnels is handled by vBond (orchestrator) and vSmart (controller), not vManage.
Right, B is the answer.
Why B is right
vManage is the management and orchestration component in Cisco SD-WAN that handles configuration, monitoring, and software upgrades across all fabric nodes including WAN Edge routers, vSmart controllers, and vBond orchestrators. While option C mentions policy distribution, that is actually handled by vSmart controllers. vManage's primary operational function is lifecycle management including remote software upgrades. Option A describes vBond, Option C describes vSmart, and Option D describes the data plane nodes' responsibilities.
Not this one. Try another answer.
Why C is wrong
Distributing forwarding policies is the responsibility of vSmart controllers, not vManage.
Not this one. Try another answer.
Why D is wrong
BFD session establishment is performed by WAN Edge and vSmart nodes in the data plane, not by vManage.
Question 69 Play from 1:54:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While devices may integrate with ISE, policy deployment is not limited to all ISE-integrated devices only.
Not this one. Try another answer.
Why B is wrong
Policies are deployed at the site level rather than to individually selected devices, which would not scale effectively.
Right, C is the answer.
Why C is right
When deploying an IP-based access control policy in Cisco DNA Center, the policy is applied to all devices in selected sites. This site-based approach allows for scalable and organized policy deployment across groups of network devices within defined physical or logical locations.
Not this one. Try another answer.
Why D is wrong
IP-based access control policies are not limited to wired devices only; they apply to all device types within selected sites.
Question 70 Play from 1:56:34
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Security Group Tags (SGTs) are the core policy feature used with Cisco TrustSec to provide endpoint entitlement in enterprise networks. SGTs classify users and devices, allowing enforcement of Security Group Access Control Lists (SGACLs) based on identity rather than IP addresses.
Not this one. Try another answer.
Why B is wrong
Access control lists are used to enforce policies but are not the primary entitlement mechanism; SGTs provide the classification that ACLs then enforce.
Not this one. Try another answer.
Why C is wrong
VLANs are layer 2 network segmentation tools and are not the TrustSec entitlement mechanism.
Not this one. Try another answer.
Why D is wrong
Virtual routing and forwarding is a layer 3 segmentation technology and does not serve as the TrustSec entitlement feature.
Question 71 Play from 1:58:14
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Application awareness (A) and deep packet inspection (D) are signature features of next-generation firewalls (NGFWs) that allow inspection and control based on actual application types and content, not just ports and protocols. Packet filtering, stateful inspection, and VPN are older technologies available in traditional firewalls.
Not this one. Try another answer.
Why B is wrong
Packet filtering is a basic feature available in traditional firewalls, not exclusive to NGFWs.
Not this one. Try another answer.
Why C is wrong
Stateful inspection is a traditional firewall feature, not specific to next-generation firewalls.
Right, D is one of the answers.
Why D is right
Application awareness (A) and deep packet inspection (D) are signature features of next-generation firewalls (NGFWs) that allow inspection and control based on actual application types and content, not just ports and protocols. Packet filtering, stateful inspection, and VPN are older technologies available in traditional firewalls.
Not this one. Try another answer.
Why E is wrong
VPN capabilities exist in traditional firewalls and are not a next-generation firewall exclusive feature.
Question 72 Play from 1:59:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Intent API is used for provisioning and policy intent, not for publishing events to third-party systems.
Not this one. Try another answer.
Why B is wrong
Southbound SDK interfaces with network devices below DNA Center, not third-party external systems.
Right, C is the answer.
Why C is right
The integration API is used to publish events and notifications from DNA Center to third-party products such as IPAM systems. This API enables bidirectional integration with external platforms for enhanced management capabilities.
Not this one. Try another answer.
Why D is wrong
RESTful API is a general protocol; the specific answer is integration API which is a particular RESTful implementation for third-party integration.
Question 73 Play from 2:01:29
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
An Ansible-managed node must have an SSH server running to allow Ansible to connect and execute commands remotely. SSH is the primary communication protocol that Ansible uses to connect to and manage target nodes, making it a fundamental requirement.
Not this one. Try another answer.
Why B is wrong
Ansible can manage many types of devices beyond just Linux and Cisco devices, including Windows servers and various network equipment.
Not this one. Try another answer.
Why C is wrong
Ad hoc commands are a feature of Ansible, not a requirement for managed nodes; nodes only need SSH connectivity.
Not this one. Try another answer.
Why D is wrong
Ansible Tower is an optional management interface; it is not required for nodes to be managed by Ansible.
Question 74 Play from 2:03:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Stateful packet inspection is a traditional firewall capability, not a new feature of next-generation firewalls.
Right, B is one of the answers.
Why B is right
Next-generation firewalls introduce integrated intrusion prevention (IPS) capabilities and application-level inspection as new security features beyond traditional firewalls. These capabilities allow detection and prevention of threats at the application layer and automated response to intrusions, significantly advancing network security posture.
Not this one. Try another answer.
Why C is wrong
NAT (Network Address Translation) is a basic networking function found in traditional firewalls, not a new NGFW capability.
Not this one. Try another answer.
Why D is wrong
VPN is a traditional security mechanism that predates next-generation firewalls and is not a new capability they introduce.
Right, E is one of the answers.
Why E is right
Next-generation firewalls introduce integrated intrusion prevention (IPS) capabilities and application-level inspection as new security features beyond traditional firewalls. These capabilities allow detection and prevention of threats at the application layer and automated response to intrusions, significantly advancing network security posture.
Question 75 Play from 2:04:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A JSON Web Token consists of three parts separated by dots: the header (containing token type and hashing algorithm), the payload (containing claims and user data), and the signature (for verification). This three-part structure is the standard JWT format.
Not this one. Try another answer.
Why B is wrong
Version is not a standard JWT component; the three parts are header, payload, and signature
Not this one. Try another answer.
Why C is wrong
JWT requires three parts, not two; the signature is essential for token verification
Not this one. Try another answer.
Why D is wrong
JWT requires three parts including the header; payload and signature alone are insufficient
Question 76 Play from 2:06:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
RAID storage is provided by storage controllers, not virtual switches.
Right, B is the answer.
Why B is right
A virtual switch provides Layer 2 connectivity between virtual machines within a hypervisor, enabling them to communicate with each other and with external networks. It functions similarly to a physical switch but operates entirely in software.
Not this one. Try another answer.
Why C is wrong
CPU context switching is handled by the hypervisor scheduler, not the virtual switch.
Not this one. Try another answer.
Why D is wrong
Power emulation is not a function of virtual switches; virtual machines use virtualized power management.
Question 77 Play from 2:08:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This MAC address format does not match the standard HSRP virtual MAC address pattern.
Not this one. Try another answer.
Why B is wrong
While this contains the correct HSRP OUI prefix, it uses an incorrect encoding of the group number (14 in decimal is 0e in hex, not 14 in the last octet).
Right, C is the answer.
Why C is right
HSRP group 14 uses the virtual MAC address 00:00:0c:07:ac:0e by default. The HSRP virtual MAC address format is 00:00:0c:07:ac:XX, where XX is the hexadecimal representation of the group number. For group 14 (0x0e in hexadecimal), this results in 00:00:0c:07:ac:0e.
Not this one. Try another answer.
Why D is wrong
This format uses 5e instead of the correct 0c in the third octet, deviating from the standard HSRP MAC address structure.
Question 78 Play from 2:09:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Root guard stops the port from becoming a root port when it receives superior BPDUs and does not shorten the time to forwarding.
Right, B is the answer.
Why B is right
Standard virtual switches do not participate in Spanning Tree Protocol and do not send BPDUs of their own, so the physical port facing the host behaves as an edge port. Because the connected port is a trunk, the spanning-tree portfast trunk command is needed to apply PortFast and move the port straight to forwarding. A plain spanning-tree portfast command affects only access ports unless the global default for trunks is set. BPDU guard is often added as protection against loops.
Not this one. Try another answer.
Why C is wrong
A shared link type disables the rapid transition behavior and does not make a trunk port forward immediately.
Not this one. Try another answer.
Why D is wrong
This command stops DTP frames from being sent and has no effect on spanning tree state transitions.
Question 79 Play from 2:11:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Ansible uses a declarative approach, but Chef uses an imperative approach with recipes, so this is not a common trait.
Right, B is the answer.
Why B is right
Both Ansible and Chef are used for managing mutable infrastructure, where systems are continuously updated and modified in place rather than replaced. Both tools support applying configuration changes to existing infrastructure and updating system state over time.
Not this one. Try another answer.
Why C is wrong
Ansible is agentless and does not require client installation, while Chef typically requires an agent, so this is not shared.
Not this one. Try another answer.
Why D is wrong
Neither Ansible nor Chef fundamentally rely on NETCONF; they use their own protocols and frameworks for device management.
Question 80 Play from 2:13:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Bare metal servers are not a supported backup destination for DNA Center Assurance databases.
Right, B is one of the answers.
Why B is right
Cisco DNA Center Assurance database can be backed up to either a remote server or an NFS (Network File System) share. These are the two supported backup locations for the Assurance database. NFS shares provide network-based storage, while remote servers offer off-site backup capabilities, both meeting enterprise backup requirements.
Right, C is one of the answers.
Why C is right
Cisco DNA Center Assurance database can be backed up to either a remote server or an NFS (Network File System) share. These are the two supported backup locations for the Assurance database. NFS shares provide network-based storage, while remote servers offer off-site backup capabilities, both meeting enterprise backup requirements.
Not this one. Try another answer.
Why D is wrong
Local server backups alone do not provide adequate redundancy and are not recommended as a primary backup solution.
Not this one. Try another answer.
Why E is wrong
Non-Linux servers are not supported backup targets; DNA Center infrastructure requires Linux-based systems.
Question 81 Play from 2:15:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
MTU size is determined by underlying physical network configuration and is not increased by virtual switching.
Not this one. Try another answer.
Why B is wrong
VM-level isolation is more of a security consideration than a benefit of virtual switching specifically.
Not this one. Try another answer.
Why C is wrong
The 802.1Q VLAN range is not extended by virtual switching; it remains limited to 4094 VLANs regardless of switching method.
Right, D is one of the answers.
Why D is right
Virtual switches provide hardware independence by abstracting network switching from physical hardware, allowing flexible reconfiguration without hardware changes. They also offer increased flexibility through software-based configuration, dynamic resource allocation, and the ability to implement advanced networking policies at the VM level. These benefits enable efficient network resource management in virtualized environments.
Right, E is one of the answers.
Why E is right
Virtual switches provide hardware independence by abstracting network switching from physical hardware, allowing flexible reconfiguration without hardware changes. They also offer increased flexibility through software-based configuration, dynamic resource allocation, and the ability to implement advanced networking policies at the VM level. These benefits enable efficient network resource management in virtualized environments.
Question 82 Play from 2:17:01
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Layer 2 frame Type fields are used for protocol identification, not QoS classification.
Not this one. Try another answer.
Why B is wrong
The Options field in Layer 3 headers is for miscellaneous IP options, not standard QoS classification.
Right, C is the answer.
Why C is right
The TOS (Type of Service) field in the Layer 3 header is used to perform QoS packet classification. The TOS field, which includes the DSCP (Differentiated Services Code Point) bits, allows devices to identify and classify packets for differential treatment based on quality of service requirements.
Not this one. Try another answer.
Why D is wrong
The Flags field in Layer 3 headers is used for fragmentation control, not QoS classification.
Question 83 Play from 2:18:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SNMP uses its own data modeling approach (MIBs) and is not associated with YANG.
Right, B is the answer.
Why B is right
RESTCONF is the protocol that infers the use of YANG data models. RESTCONF is specifically designed as a RESTful API that uses YANG models to define the structure of configuration and operational data, making YANG usage inherent to RESTCONF.
Not this one. Try another answer.
Why C is wrong
REST is a general architectural style; while RESTCONF (which uses YANG) is built on REST principles, REST itself does not infer YANG usage.
Not this one. Try another answer.
Why D is wrong
NX-API is a Cisco API that may support various data models but does not specifically infer YANG usage.
Question 84 Play from 2:20:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Local preference is not evaluated before weight; weight takes precedence.
Right, B is the answer.
Why B is right
The BGP best-path algorithm evaluates paths in this specific order for EBGP: weight (highest), local preference (highest), AS path (shortest), MED (lowest), and other criteria. Weight is the first criterion evaluated as it is a Cisco-specific attribute that takes precedence before the standardized BGP attributes.
Not this one. Try another answer.
Why C is wrong
AS path is not evaluated before local preference in the standard BGP algorithm.
Not this one. Try another answer.
Why D is wrong
MED is evaluated after AS path, not before local preference.
Question 85 Play from 2:21:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The source address is used for the RPF check of an (S,G) entry, not for a (*,G) entry.
Not this one. Try another answer.
Why B is wrong
The group address is a multicast address and is not looked up in the unicast routing table for the RPF check.
Right, C is the answer.
Why C is right
A (*,G) entry belongs to the shared tree, which is rooted at the rendezvous point. The RPF check for that entry therefore uses the unicast route toward the RP address, and the incoming interface is the interface toward the RP. For an (S,G) entry on the source tree, the check uses the route toward the source address instead.
Not this one. Try another answer.
Why D is wrong
The IGMP querier serves hosts on a LAN and has no role in the RPF check.
Question 86 Play from 2:23:41
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A Type 1 hypervisor (bare-metal hypervisor) runs directly on hardware without requiring a host operating system. The correct layering is Hardware at the base, followed by the Hypervisor, which then manages Guest Operating Systems. This direct hardware access is what distinguishes Type 1 from Type 2 hypervisors.
Not this one. Try another answer.
Why B is wrong
Type 1 hypervisors do not require a Host OS; that configuration describes a Type 2 hypervisor.
Not this one. Try another answer.
Why C is wrong
This omits the Hardware layer, which is foundational to Type 1 hypervisors.
Not this one. Try another answer.
Why D is wrong
This omits the Hypervisor layer entirely and is not the correct stacking for any hypervisor type.
Question 87 Play from 2:25:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A proposal defines only the encryption, integrity, and Diffie-Hellman group algorithms that are offered during negotiation.
Not this one. Try another answer.
Why B is wrong
A policy groups one or more proposals and selects them for a negotiation; it does not match peer identities or define authentication.
Right, C is the answer.
Why C is right
In IKEv2 on IOS XE, the proposal holds the negotiable algorithms, the policy attaches proposals to a negotiation, and the keyring holds pre-shared keys. The IKEv2 profile holds the nonnegotiable parameters of the security association: the match identity statements for the remote peer, the local and remote authentication methods, and the keyring that supplies the keys. The IPsec profile or crypto map then points to the IKEv2 profile.
Not this one. Try another answer.
Why D is wrong
A keyring stores the pre-shared keys for the peers but does not match identities or select the authentication methods.
Question 88 Play from 2:27:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A next-generation firewall provides perimeter security but does not specifically protect credentials in transit.
Right, B is the answer.
Why B is right
TLS or SSL encryption protects credentials from sniffer attacks in basic API authentication by encrypting the communication channel end-to-end. This prevents attackers from capturing credentials in transit through network sniffing.
Not this one. Try another answer.
Why C is wrong
While a VPN provides additional protection, TLS/SSL is the standard direct protection for API credentials.
Not this one. Try another answer.
Why D is wrong
AAA services authenticate users but do not inherently protect credentials from sniffer attacks during transmission.
Question 89 Play from 2:28:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
RSPAN operates only on Layer 2 switched infrastructure and cannot cross Layer 3 boundaries.
Right, B is the answer.
Why B is right
ERSPAN (Encapsulated Remote SPAN) must be configured to allow packet capture over Layer 3 infrastructure. Unlike RSPAN which is limited to Layer 2 switched networks, ERSPAN encapsulates mirrored traffic in GRE packets, allowing it to traverse Layer 3 routed networks and reach remote monitoring destinations.
Not this one. Try another answer.
Why C is wrong
VSPAN is not a standard Cisco monitoring feature for Layer 3 packet capture.
Not this one. Try another answer.
Why D is wrong
IPSPAN is not a recognized Cisco feature for packet capture over Layer 3.
Question 90 Play from 2:30:31
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
VXLAN (Virtual Extensible LAN) is the foundational technology for the Cisco SD-Access fabric data plane, providing overlay network virtualization across the underlay network. LISP is used for the control plane and endpoint discovery, Cisco TrustSec provides policy and segmentation, and IS-IS is the underlay routing protocol, but VXLAN specifically forms the basis of the data plane.
Not this one. Try another answer.
Why B is wrong
LISP is used for control plane functions and endpoint location services, not the data plane.
Not this one. Try another answer.
Why C is wrong
Cisco TrustSec provides policy and segmentation capabilities but is not the data plane technology.
Not this one. Try another answer.
Why D is wrong
IS-IS is the underlay routing protocol used to build the fabric infrastructure, not the data plane itself.
Question 91 Play from 2:32:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A value not equal to 999 would keep the loop running, not terminate it.
Not this one. Try another answer.
Why B is wrong
Values less than or equal to 999 include many values that would still satisfy the != condition and keep the loop running.
Right, C is the answer.
Why C is right
The while loop condition 'while loop != 999:' continues executing as long as the loop variable is NOT equal to 999. The loop terminates when the condition becomes false, which occurs when loop equals 999. At that point, the inequality (loop != 999) evaluates to false and the loop exits.
Not this one. Try another answer.
Why D is wrong
Values greater than or equal to 999 include values other than 999 that would keep the loop running since they still satisfy the != condition.
Question 92 Play from 2:33:50
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
DSCP (Differentiated Services Code Point) and MPLS EXP bits are both QoS marking mechanisms used to classify and identify traffic types in a network. These are traffic descriptors that indicate service level requirements. Packet size and bandwidth are characteristics or metrics, not descriptors, and ToS is largely superseded by DSCP.
Right, B is one of the answers.
Why B is right
DSCP (Differentiated Services Code Point) and MPLS EXP bits are both QoS marking mechanisms used to classify and identify traffic types in a network. These are traffic descriptors that indicate service level requirements. Packet size and bandwidth are characteristics or metrics, not descriptors, and ToS is largely superseded by DSCP.
Not this one. Try another answer.
Why C is wrong
Packet size is a characteristic of traffic but not a QoS traffic descriptor used for classification.
Not this one. Try another answer.
Why D is wrong
Bandwidth is a resource metric, not a traffic descriptor mechanism.
Not this one. Try another answer.
Why E is wrong
ToS (Type of Service) is an older field that has been replaced by DSCP for modern QoS descriptors.
Question 93 Play from 2:35:24
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
GLBP (Gateway Load Balancing Protocol) is a Cisco-proprietary protocol that maximizes uplink utilization by allowing multiple virtual gateways within a single group. Unlike HSRP and VRRP where only the master actively forwards traffic, GLBP distributes traffic across multiple routers, improving bandwidth utilization while minimizing configuration complexity compared to managing multiple groups.
Not this one. Try another answer.
Why B is wrong
HSRP v2 uses only a single active router and does not maximize uplink utilization.
Not this one. Try another answer.
Why C is wrong
VRRP uses a single master router and does not maximize uplink utilization.
Not this one. Try another answer.
Why D is wrong
HSRP v1 is older, uses a single active router, and requires more configuration than GLBP.
Question 94 Play from 2:37:08
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The RP (Rendezvous Point) in PIM receives IGMP joins from multicast receivers and sends join messages upstream toward the multicast source to build the shared tree (RPT). This allows the RP to serve as a central meeting point for multicast flows, enabling receivers to discover and join multicast groups through the RP.
Not this one. Try another answer.
Why B is wrong
Ensuring the shortest path to the receiver is the responsibility of the SPT (Shortest Path Tree), not the RP, though the RP may facilitate SPT switchover.
Not this one. Try another answer.
Why C is wrong
While the RP does receive IGMP joins from receivers as part of its function, sending join messages toward the source is the more complete and accurate primary purpose.
Not this one. Try another answer.
Why D is wrong
The RP does not secure communication channels; security in multicast is handled through other mechanisms like authentication and encryption policies.
Question 95 Play from 2:39:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A file policy inspects files in connections that an access control rule has already allowed, so it does not block by reputation before rule evaluation.
Not this one. Try another answer.
Why B is wrong
Network discovery passively gathers information about hosts and applications and does not block connections.
Not this one. Try another answer.
Why C is wrong
An intrusion policy inspects traffic that an access control rule has allowed, so it is evaluated after rule matching.
Right, D is the answer.
Why D is right
Security Intelligence is the earliest line of defense in the access control process. It compares the source and destination of a connection with lists and feeds of IP addresses, URLs, and domains that have a poor reputation, including the feeds that Cisco Talos maintains, and blocks matching traffic before the access control rules and deeper inspection run. This saves resources, because traffic known to be bad is never analyzed further.
Question 96 Play from 2:41:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
TLOC refers to a tunnel locator in some LISP implementations but is not a primary namespace designation.
Right, B is one of the answers.
Why B is right
LISP uses two namespaces: the EID (Endpoint ID) namespace, which identifies the actual endpoints and is used within LISP sites, and the RLOC (Routing Locator) namespace, which identifies the network infrastructure and is used for routing packets through the underlay network. These separate namespaces enable LISP's core function of decoupling identity from location.
Not this one. Try another answer.
Why C is wrong
DNS is not a namespace used by LISP protocol architecture itself.
Not this one. Try another answer.
Why D is wrong
VTEP (VXLAN Tunnel Endpoint) is associated with VXLAN, not a LISP namespace.
Right, E is one of the answers.
Why E is right
LISP uses two namespaces: the EID (Endpoint ID) namespace, which identifies the actual endpoints and is used within LISP sites, and the RLOC (Routing Locator) namespace, which identifies the network infrastructure and is used for routing packets through the underlay network. These separate namespaces enable LISP's core function of decoupling identity from location.
Question 97 Play from 2:42:43
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Cisco DNA Center provides simplified management through a centralized platform, policy-driven provisioning that automates network configuration based on business policies, and ensures network and appliance performance through analytics and monitoring. These capabilities reduce manual intervention and improve operational efficiency across the network infrastructure.
Not this one. Try another answer.
Why B is wrong
While DNA Center integrates with SD-WAN for VPN capabilities, automatic VPN tunneling is not listed as a primary benefit of DNA Center itself.
Not this one. Try another answer.
Why C is wrong
DNA Center provides policy-driven automation rather than simple one-click configuration; configurations are more sophisticated and context-aware.
Right, D is one of the answers.
Why D is right
Cisco DNA Center provides simplified management through a centralized platform, policy-driven provisioning that automates network configuration based on business policies, and ensures network and appliance performance through analytics and monitoring. These capabilities reduce manual intervention and improve operational efficiency across the network infrastructure.
Right, E is one of the answers.
Why E is right
Cisco DNA Center provides simplified management through a centralized platform, policy-driven provisioning that automates network configuration based on business policies, and ensures network and appliance performance through analytics and monitoring. These capabilities reduce manual intervention and improve operational efficiency across the network infrastructure.
Question 98 Play from 2:44:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The session layer is a lower OSI layer that is not specific to where DNA Center exposes its REST controls.
Right, B is the answer.
Why B is right
Cisco DNA Center supports REST controls at the northbound APIs layer. Northbound APIs are the interface through which external applications and management systems interact with DNA Center to manage and monitor network devices and services.
Not this one. Try another answer.
Why C is wrong
EEM applets or scripts are used for event-driven automation but are not the layer where DNA Center REST controls operate.
Not this one. Try another answer.
Why D is wrong
YAML output from API responses is a format for returning data, not a layer where REST controls are supported.
Question 99 Play from 2:46:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Email attachment ransomware detection is part of email security, not the endpoint security aspect of Threat Defense.
Not this one. Try another answer.
Why B is wrong
Outbound URL analysis and data controls are typically handled by web and data loss prevention gateways.
Not this one. Try another answer.
Why C is wrong
User context analysis is more associated with identity and access management rather than endpoint threat defense.
Right, D is the answer.
Why D is right
The Cisco Threat Defense architecture includes real-time detection and blocking of fileless malware at the endpoint level. Fileless malware executes in memory without writing to disk, making it particularly dangerous; Threat Defense provides behavioral and memory-based detection to block it.
Question 100 Play from 2:47:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A Router Locator is a routing address identifier, not a processing component that decapsulates and forwards messages.
Right, B is the answer.
Why B is right
The Map Resolver is the LISP component that receives decapsulated messages (ELP requests) from the Ingress Tunnel Router and forwards them to the appropriate Map Server responsible for the egress tunnel routers. It acts as an intermediary in the LISP mapping system, resolving location identities to routing locators.
Not this one. Try another answer.
Why C is wrong
A Proxy ETR (Egress Tunnel Router) encapsulates and forwards traffic on behalf of non-LISP sites, but does not handle message decapsulation and forwarding to map servers.
Not this one. Try another answer.
Why D is wrong
An Ingress Tunnel Router sends encapsulated packets and initiates map requests, but does not decapsulate messages intended for map servers.
Transcript
Play from 00:00 Question 1. A team standardizes on SaltStack, but it cannot install a minion on certain Linux servers. Which Salt component runs states on these servers over SSH without a minion daemon? Here are the options. Option A. salt-minion in masterless mode. Option B. salt-ssh. Option C. salt-cloud. Option D. salt-syndic. Pause the video now if you want time to think about the answer.
The correct answer is B. salt-ssh. Salt SSH executes Salt execution modules and states on a target over an SSH connection and does not require a salt-minion process on that system, which makes it an agentless alternative to the normal master and minion model. The target still needs a supported Python installation unless raw commands are used. It trades speed for convenience because the traffic runs over SSH instead of the ZeroMQ transport. Now, why are the other options incorrect? Option A is incorrect. A masterless minion still runs the salt-minion daemon on the target, so it is not agentless. Option C is incorrect. salt-cloud provisions and manages instances on cloud providers and does not run states over SSH on existing servers. Option D is incorrect. salt-syndic lets a master of masters control lower-level masters and does not connect to targets over SSH. Therefore, B, salt-ssh, is the correct answer.
Play from 01:49 Question 2. Which measure is used by an NTP server to indicate its closeness to the authoritative time source? Here are the options. Option A. stratum. Option B. time zone. Option C. latency. Option D. hop count. Pause the video now if you want time to think about the answer.
The correct answer is A. stratum. Stratum is the NTP metric that indicates an NTP server's closeness to an authoritative time source. Stratum 0 is the reference clock itself, Stratum 1 devices are directly connected to Stratum 0, and each subsequent level increases by one hop away from the authoritative source. Lower stratum values indicate greater closeness to accurate time. Now, why are the other options incorrect? Option B is incorrect. Time zone defines geographic offset from UTC but does not indicate closeness to an authoritative time source. Option C is incorrect. Latency measures network delay but is not the specific NTP metric for indicating proximity to authoritative time. Option D is incorrect. Hop count is not an NTP concept; stratum serves the equivalent purpose in the NTP hierarchy. Therefore, A, stratum, is the correct answer.
Play from 03:21 Question 3. Which PAgP mode combination prevents an EtherChannel from forming? Here are the options. Option A. auto/desirable. Option B. desirable/desirable. Option C. desirable/auto. Option D. auto/auto. Pause the video now if you want time to think about the answer.
The correct answer is D. auto/auto. PAgP has three modes: on, desirable, and auto. For EtherChannel to form using PAgP, at least one side must be in desirable mode. The auto/auto combination means both sides are passively waiting for the other to initiate negotiation, so neither side actively negotiates the EtherChannel formation, preventing it from forming. Now, why are the other options incorrect? Option A is incorrect. auto/desirable works because desirable actively initiates negotiation. Option B is incorrect. desirable/desirable works because both sides actively negotiate. Option C is incorrect. desirable/auto works because desirable actively initiates negotiation. Therefore, D, auto/auto, is the correct answer.
Show full transcriptShow less
Play from 04:47 Question 4. Which protocol is used to encrypt control plane traffic between SD-WAN controllers and SD-WAN endpoints? Here are the options. Option A. DTLS. Option B. IPsec. Option C. PGP. Option D. HTTPS. Pause the video now if you want time to think about the answer.
The correct answer is A. DTLS. DTLS (Datagram Transport Layer Security) is the protocol used to encrypt control plane traffic between SD-WAN controllers and SD-WAN endpoints. DTLS provides the security equivalent of TLS but operates over UDP, which is suitable for the control plane communications in SD-WAN architectures. Now, why are the other options incorrect? Option B is incorrect. IPsec is used for data plane encryption, not control plane traffic encryption in SD-WAN. Option C is incorrect. PGP is a legacy encryption standard not used in modern SD-WAN architectures. Option D is incorrect. HTTPS operates over TCP and is not the protocol used for SD-WAN controller-to-endpoint control plane encryption. Therefore, A, DTLS, is the correct answer.
Play from 06:21 Question 5. Which benefit is realized by implementing SSO? Here are the options. Option A. IP first-hop redundancy. Option B. communication between different nodes for cluster setup. Option C. physical link redundancy. Option D. minimal network downtime following an RP switchover. Pause the video now if you want time to think about the answer.
The correct answer is D. minimal network downtime following an RP switchover. SSO (Stateful Switchover) enables a standby processor to take over without losing sessions or state information, resulting in minimal network downtime during RP (Route Processor) switchover events. This is the primary benefit of implementing SSO on routing platforms. Now, why are the other options incorrect? Option A is incorrect. IP first-hop redundancy is provided by protocols like HSRP/VRRP, not by SSO. Option B is incorrect. Communication between nodes for cluster setup is a separate function not directly related to SSO benefits. Option C is incorrect. Physical link redundancy is achieved through redundant physical connections, not through SSO. Therefore, D, minimal network downtime following an RP switchover, is the correct answer.
Play from 08:02 Question 6. An engineer configures an access control rule on Cisco Secure Firewall Management Center for nightly backup traffic between a trusted data center subnet and a storage array. The traffic must pass without deep inspection and without network discovery. Which rule action meets the requirement? Here are the options. Option A. Trust. Option B. Allow. Option C. Monitor. Option D. Interactive Block. Pause the video now if you want time to think about the answer.
The correct answer is A. Trust. The Trust action lets matching traffic pass through the firewall without deep inspection or network discovery, which suits high-volume traffic from sources that are fully trusted. Trusted traffic is still subject to identity requirements and rate limiting. Allow permits the traffic but can attach intrusion and file inspection, Monitor logs the connection and keeps evaluating rules, and Interactive Block only affects web traffic by offering the user a choice. Now, why are the other options incorrect? Option B is incorrect. Allowed traffic can still be examined by file and intrusion policies and is subject to network discovery. Option C is incorrect. Monitor only forces connection logging, and the matching traffic continues to be evaluated against later rules. Option D is incorrect. This action shows a block page to web users and acts like a block rule unless the user chooses to continue. Therefore, A, Trust, is the correct answer.
Play from 09:49 Question 7. By default, which virtual MAC address does HSRP group 16 use? Here are the options. Option A. c0:41:41:43:07:10. Option B. 00:05:5c:07:0c:16. Option C. 00:00:0c:07:ac:10. Option D. 05:00:0c:07:ac:16. Pause the video now if you want time to think about the answer.
The correct answer is C. 00:00:0c:07:ac:10. HSRP group 16 uses the default virtual MAC address 00:00:0c:07:ac:10. The HSRP virtual MAC address format is 00:00:0c:07:ac:XX where XX is the group number in hexadecimal (16 decimal = 0x10 in hexadecimal), resulting in 00:00:0c:07:ac:10. Now, why are the other options incorrect? Option A is incorrect. This format does not match the standard HSRP virtual MAC address structure. Option B is incorrect. This uses an incorrect OUI and format for HSRP MAC addresses. Option D is incorrect. This uses an incorrect OUI prefix (05:00 instead of 00:00) for HSRP. Therefore, C, 00:00:0c:07:ac:10, is the correct answer.
Play from 11:37 Question 8. What is one benefit of implementing a data modeling language? Here are the options. Option A. use XML style of data formatting. Option B. interoperability to allow unlimited implementations. Option C. machine-oriented logic and language-facilitated processing. Option D. conceptual representation makes interpretation simple. Pause the video now if you want time to think about the answer.
The correct answer is D. conceptual representation makes interpretation simple. A primary benefit of data modeling languages is that they provide a conceptual representation of data structures that is easier for humans to interpret and understand, facilitating better communication between stakeholders and technical teams. Now, why are the other options incorrect? Option A is incorrect. While XML is one possible encoding format, data modeling languages are not defined by XML style alone. Option B is incorrect. Data modeling languages enable interoperability but do not allow unlimited implementations; they actually constrain implementations to defined schemas. Option C is incorrect. This describes a characteristic of programming languages rather than a key benefit of data modeling languages for interpretation. Therefore, D, conceptual representation makes interpretation simple, is the correct answer.
Play from 13:19 Question 9. Which deployment option of Cisco NGFW provides scalability? Here are the options. Option A. inline tap. Option B. high availability. Option C. clustering. Option D. tap. Pause the video now if you want time to think about the answer.
The correct answer is C. clustering. Clustering is the Cisco NGFW deployment option that provides scalability by allowing multiple firewall units to work together as a single logical entity, distributing traffic load and providing horizontal scaling. This enables the solution to handle increased traffic volumes and provide redundancy while scaling performance. Now, why are the other options incorrect? Option A is incorrect. Inline tap is a deployment mode (traffic visibility method) but does not inherently provide scalability. Option B is incorrect. High availability provides redundancy and failover capability but does not scale capacity in the same way clustering does. Option D is incorrect. Tap is a passive traffic monitoring mode that does not provide scalability for throughput or performance. Therefore, C, clustering, is the correct answer.
Play from 14:47 Question 10. In which way are EIGRP and OSPF similar? Here are the options. Option A. Both protocols support autosummarization. Option B. Both protocols use hello packets to discover neighbors. Option C. Both protocols support unequal-cost load balancing. Option D. Both protocols send updates using unicast addresses. Pause the video now if you want time to think about the answer.
The correct answer is B. Both protocols use hello packets to discover neighbors. Both EIGRP and OSPF use hello packets as a neighbor discovery and keepalive mechanism. Hello packets are essential in both protocols for establishing and maintaining adjacencies between routers. EIGRP does support autosummarization but OSPF does not. EIGRP supports unequal-cost load balancing, but OSPF does not. Both protocols use multicast addresses for updates, not unicast. Now, why are the other options incorrect? Option A is incorrect. OSPF does not support autosummarization; only EIGRP does. Option C is incorrect. OSPF does not support unequal-cost load balancing; only EIGRP does. Option D is incorrect. Both protocols send updates using multicast addresses, not unicast. Therefore, B, Both protocols use hello packets to discover neighbors, is the correct answer.
Play from 16:29 Question 11. In a Cisco SD-WAN network, which VPN Identifier is reserved for carrying out-of-band network management traffic? Here are the options. Option A. VPN 0. Option B. VPN 1. Option C. VPN 512. Option D. VPN 514. Pause the video now if you want time to think about the answer.
The correct answer is C. VPN 512. VPN 512 is reserved in Cisco SD-WAN for carrying out-of-band network management traffic, allowing management plane communications to be isolated and secure from user data traffic. Now, why are the other options incorrect? Option A is incorrect. VPN 0 is the transport VPN for control traffic, not management traffic. Option B is incorrect. VPN 1 is the default data VPN for user traffic. Option D is incorrect. VPN 514 is not a standard reserved VPN identifier in SD-WAN. Therefore, C, VPN 512, is the correct answer.
Play from 17:51 Question 12. JSON web tokens (JWT) are used to secure JSON based communications. Which of the following fields make up a JWT? (Choose three.) Here are the options. Option A. Header. Option B. Trailer. Option C. Payload. Option D. Sequence number. Option E. Signature. Pause the video now if you want time to think about the answer.
The correct answers are A. Header, and C. Payload, and E. Signature. A JSON Web Token (JWT) consists of three components: the Header (containing token type and hashing algorithm), the Payload (containing claims and data), and the Signature (verifying integrity and authenticity). These three parts are separated by dots and together form a complete JWT. Now, why are the other options incorrect? Option B is incorrect. Trailer is not a component of JWT structure; JWTs have only three parts. Option D is incorrect. Sequence number is not part of JWT architecture; JWTs use header, payload, and signature only. Therefore, A and C and E are the correct answers.
Play from 19:17 Question 13. By default, which virtual MAC address does HSRP group 32 use? Here are the options. Option A. 04:19:01:05:2e:32. Option B. 05:5e:5c:ac:0c:32. Option C. 00:00:0c:07:ac:20. Option D. 00:5e:0c:07:ac:20. Pause the video now if you want time to think about the answer.
The correct answer is C. 00:00:0c:07:ac:20. HSRP group 32 uses the virtual MAC address 00:00:0c:07:ac:20 by default. HSRP virtual MAC addresses follow the pattern 00:00:0c:07:ac:XX where XX is the group number in hexadecimal. Group 32 converts to 0x20 in hexadecimal, resulting in this specific MAC address. Now, why are the other options incorrect? Option A is incorrect. This MAC address does not follow the standard HSRP virtual MAC address format and is not associated with any HSRP group. Option B is incorrect. This is not a valid HSRP virtual MAC address; it does not follow the required 00:00:0c:07:ac:XX pattern. Option D is incorrect. While this is close to the correct format, the fifth octet is incorrect; HSRP uses 07 not 0c in that position. Therefore, C, 00:00:0c:07:ac:20, is the correct answer.
Play from 21:10 Question 14. Which IP SLA operation requires the IP SLA responder to be configured on the remote end? Here are the options. Option A. UDP jitter. Option B. ICMP jitter. Option C. TCP connect. Option D. ICMP echo. Pause the video now if you want time to think about the answer.
The correct answer is A. UDP jitter. UDP jitter is an IP SLA operation that requires configuration of an IP SLA responder on the remote end device to generate response packets and measure latency, jitter, and packet loss. The responder must be actively running to collect the necessary bidirectional performance metrics that UDP jitter operations require. Now, why are the other options incorrect? Option B is incorrect. ICMP jitter operates using standard ICMP echo requests and does not require a responder configuration Option C is incorrect. TCP connect establishes connections using standard TCP three-way handshakes and does not require an IP SLA responder Option D is incorrect. ICMP echo uses standard ping mechanism and does not require remote responder configuration Therefore, A, UDP jitter, is the correct answer.
Play from 22:47 Question 15. Which template is used when multiple templates are grouped together to run in succession in Cisco DNA Center? Here are the options. Option A. project. Option B. regular. Option C. configuration. Option D. composite. Pause the video now if you want time to think about the answer.
The correct answer is D. composite. A composite template in Cisco DNA Center is created by grouping multiple templates together to run in succession. This allows administrators to apply a series of configuration templates in a defined order as a single deployment unit, simplifying complex configuration workflows. Now, why are the other options incorrect? Option A is incorrect. A project is an organizational container for templates but is not itself a template type for sequential execution. Option B is incorrect. A regular template is a single configuration template, not a grouping mechanism. Option C is incorrect. Configuration template is a generic term but does not specifically refer to grouped templates running in succession. Therefore, D, composite, is the correct answer.
Play from 24:11 Question 16. Which method does the enable secret password option use to encrypt device passwords? Here are the options. Option A. MD5. Option B. PAP. Option C. CHAP. Option D. AES. Pause the video now if you want time to think about the answer.
The correct answer is A. MD5. The enable secret password uses MD5 hashing (type 5) by default in IOS devices to encrypt the password. PAP and CHAP are authentication protocols for remote access, not password encryption methods. While newer devices may support AES (type 8), the traditional and standard method for enable secret has been MD5. Now, why are the other options incorrect? Option B is incorrect. PAP (Password Authentication Protocol) is used for authentication, not for encrypting stored passwords. Option C is incorrect. CHAP (Challenge Handshake Authentication Protocol) is an authentication protocol, not a password encryption method. Option D is incorrect. AES is a newer encryption standard supported on some IOS versions but is not the default method for enable secret. Therefore, A, MD5, is the correct answer.
Play from 25:47 Question 17. What gives priority on an egress interface, for database traffic that connected on an ingress interface, without changing the CoS value? Here are the options. Option A. QoS group. Option B. policy map. Option C. CoS map. Option D. class map. Pause the video now if you want time to think about the answer.
The correct answer is B. policy map. A policy map is used to classify traffic and apply QoS actions on an egress interface without modifying the CoS value. Policy maps allow you to prioritize database traffic based on classification criteria (via class maps) and apply actions like queuing and scheduling. QoS groups, while useful for marking, would still involve changing values. CoS maps change the CoS value, which violates the requirement. Class maps only define traffic classification criteria, not the actions. Now, why are the other options incorrect? Option A is incorrect. QoS groups mark traffic but don't directly prioritize on egress interfaces without changing CoS values. Option C is incorrect. CoS maps explicitly change CoS values, violating the requirement not to change CoS. Option D is incorrect. Class maps only classify traffic; they don't apply prioritization actions on egress interfaces. Therefore, B, policy map, is the correct answer.
Play from 27:29 Question 18. Which feature of EIGRP is not supported in OSPF? Here are the options. Option A. load balancing of unequal-cost paths. Option B. load balance over four equal-cost paths. Option C. uses interface bandwidth to determine best path. Option D. per-packet load balancing over multiple paths. Pause the video now if you want time to think about the answer.
The correct answer is A. load balancing of unequal-cost paths. EIGRP uniquely supports unequal-cost load balancing through its variance feature, allowing the router to load balance across paths with different metrics. OSPF only supports equal-cost load balancing. Options B and C are supported by both protocols, and option D (per-packet load balancing) is not a standard feature of either protocol in modern implementations. Now, why are the other options incorrect? Option B is incorrect. OSPF supports load balancing over multiple equal-cost paths. Option C is incorrect. OSPF uses cost (derived from interface bandwidth) to determine the best path. Option D is incorrect. Per-packet load balancing is not a standard feature of OSPF or modern EIGRP implementations; flow-based load balancing is standard. Therefore, A, load balancing of unequal-cost paths, is the correct answer.
Play from 29:14 Question 19. A customer requests a design that includes GLBP as the FHRP. The network architect discovers that the members of the GLBP group have different throughput capabilities. Which GLBP load balancing method supports this environment? Here are the options. Option A. round robin. Option B. host dependent. Option C. weighted. Option D. least connection. Pause the video now if you want time to think about the answer.
The correct answer is C. weighted. Weighted load balancing in GLBP allows different members of the group to handle traffic proportional to their capabilities. This method assigns different weights to each gateway based on throughput capacity, enabling the architect to account for heterogeneous hardware with varying performance levels. Now, why are the other options incorrect? Option A is incorrect. Round robin distributes traffic equally among all gateways regardless of their capabilities. Option B is incorrect. Host dependent uses MAC addresses to make consistent forwarding decisions but doesn't account for different throughput capabilities. Option D is incorrect. Least connection is not a GLBP load balancing method. Therefore, C, weighted, is the correct answer.
Play from 30:48 Question 20. What is the role of the vSmart controller in a Cisco SD-WAN environment? Here are the options. Option A. It performs authentication and authorization. Option B. It manages the control plane. Option C. It is the centralized network management system. Option D. It manages the data plane. Pause the video now if you want time to think about the answer.
The correct answer is B. It manages the control plane. The vSmart controller is the centralized control plane component in Cisco SD-WAN that manages all control plane functions, including policy distribution, routing decisions, and network intelligence. It communicates with WAN Edge nodes to direct how they should forward traffic and handle network operations. Now, why are the other options incorrect? Option A is incorrect. Authentication and authorization are handled by other components like vManage and ISE, not vSmart. Option C is incorrect. While vSmart is centralized, it specifically manages the control plane, not the overall network management system (that role belongs to vManage). Option D is incorrect. The data plane is managed by WAN Edge nodes; vSmart manages the control plane. Therefore, B, It manages the control plane, is the correct answer.
Play from 32:24 Question 21. Which authorization framework gives third-party applications limited access to HTTP services? Here are the options. Option A. IPsec. Option B. GRE. Option C. Basic Auth. Option D. OAuth 2.0. Pause the video now if you want time to think about the answer.
The correct answer is D. OAuth 2.0. OAuth 2.0 is an authorization framework specifically designed to give third-party applications limited, scoped access to HTTP services and APIs without sharing user credentials. It uses tokens and delegation to provide fine-grained access control. IPsec is a network security protocol, GRE is a tunneling protocol, and Basic Auth is a simple authentication mechanism that is not an authorization framework for limiting third-party access. Now, why are the other options incorrect? Option A is incorrect. IPsec is a network layer security protocol, not an authorization framework for HTTP services. Option B is incorrect. GRE is a tunneling protocol used for encapsulation, not for application-level authorization. Option C is incorrect. Basic Auth is an authentication mechanism, not an authorization framework for limiting third-party application access. Therefore, D, OAuth 2.0, is the correct answer.
Play from 34:10 Question 22. Which technology is used to provide Layer 2 and Layer 3 logical networks in the Cisco SD-Access architecture? Here are the options. Option A. underlay network. Option B. VPN routing/forwarding. Option C. easy virtual network. Option D. overlay network. Pause the video now if you want time to think about the answer.
The correct answer is D. overlay network. The overlay network in Cisco SD-Access provides Layer 2 and Layer 3 logical network segments that operate on top of the physical underlay network infrastructure. It uses technologies like VXLAN to create scalable, multi-tenant virtual networks that are independent of the physical topology. Now, why are the other options incorrect? Option A is incorrect. The underlay network is the physical infrastructure layer, not the logical network layer. Option B is incorrect. VPN routing/forwarding (VRF) is a routing technique but does not specifically describe the SD-Access L2/L3 logical network architecture. Option C is incorrect. Easy Virtual Network (EVN) is not the technology used in SD-Access for creating logical networks. Therefore, D, overlay network, is the correct answer.
Play from 35:55 Question 23. In a Cisco SD-Access fabric, which control plane protocol is used for mapping and resolving endpoints? Here are the options. Option A. DHCP. Option B. VXLAN. Option C. SXP. Option D. LISP. Pause the video now if you want time to think about the answer.
The correct answer is D. LISP. LISP (Locator/ID Separation Protocol) is the control plane protocol used in Cisco SD-Access fabric for mapping and resolving endpoints. LISP provides the mechanism to map endpoint identifiers (EIDs) to routing locators (RLOCs), enabling dynamic endpoint location discovery and mobility across the fabric. Now, why are the other options incorrect? Option A is incorrect. DHCP is a data plane protocol used for IP address assignment, not for endpoint mapping in SD-Access. Option B is incorrect. VXLAN is an encapsulation protocol used for data plane tunneling, not for endpoint mapping and resolution. Option C is incorrect. SXP (Scalable Group Tag eXchange Protocol) is used for tag propagation in SD-Access, not for endpoint mapping. Therefore, D, LISP, is the correct answer.
Play from 37:34 Question 24. Which encryption hashing algorithm does NTP use for authentication? Here are the options. Option A. SSL. Option B. MD5. Option C. AES128. Option D. AES256. Pause the video now if you want time to think about the answer.
The correct answer is B. MD5. NTP uses MD5 (Message Digest 5) as its hashing algorithm for authentication. MD5 creates a cryptographic hash that is used to authenticate NTP packets and verify the identity of NTP servers and clients. This is the standard hashing mechanism employed in NTP authentication schemes. Now, why are the other options incorrect? Option A is incorrect. SSL is an encryption protocol, not a hashing algorithm used by NTP. Option C is incorrect. AES128 is an encryption algorithm, not a hashing algorithm; NTP does not use AES for authentication hashing. Option D is incorrect. AES256 is an encryption algorithm, not the hashing algorithm NTP uses for authentication. Therefore, B, MD5, is the correct answer.
Play from 39:04 Question 25. If a VRRP master router fails, which router is selected as the new master router? Here are the options. Option A. router with the lowest priority. Option B. router with the highest priority. Option C. router with the highest loopback address. Option D. router with the lowest loopback address. Pause the video now if you want time to think about the answer.
The correct answer is B. router with the highest priority. In VRRP, when the master router fails, the backup router with the highest priority value becomes the new master router. If priorities are equal, the router with the highest IP address becomes master. Priority-based selection ensures the administrator can control which router is preferred as master. Now, why are the other options incorrect? Option A is incorrect. VRRP selects based on highest priority, not lowest. Option C is incorrect. Loopback address is not used in VRRP master selection; interface IP addresses matter only when priorities are tied. Option D is incorrect. VRRP uses highest priority and highest IP address, not lowest values. Therefore, B, router with the highest priority, is the correct answer.
Play from 40:37 Question 26. In a Cisco SD-Access network architecture, what is the role of the Fabric Edge Node? Here are the options. Option A. It manages endpoint to device relationships. Option B. It connects external layer 3 networks to the SDA fabric. Option C. It connects wired endpoints to the SDA fabric. Option D. It connects wireless endpoints to the SDA fabric. Pause the video now if you want time to think about the answer.
The correct answer is C. It connects wired endpoints to the SDA fabric. In Cisco Software-Defined Access (SDA) architecture, the Fabric Edge Node is the access layer device that directly connects wired endpoints (devices, computers, printers) to the SDA fabric. It provides the connection point for wired clients into the network. Now, why are the other options incorrect? Option A is incorrect. Managing endpoint-to-device relationships is a controller function, not an Edge Node function. Option B is incorrect. Connecting external Layer 3 networks is the role of the Fabric Border Node, not the Edge Node. Option D is incorrect. Connecting wireless endpoints is handled by wireless access points integrated with the fabric, not the wired Fabric Edge Node. Therefore, C, It connects wired endpoints to the SDA fabric, is the correct answer.
Play from 42:20 Question 27. By default, which virtual MAC address does HSRP group 12 use? Here are the options. Option A. 00:00:0c:07:ac:0c. Option B. 00:05:5e:00:0c:12. Option C. 00:5e:0c:07:ac:12. Option D. 05:43:84:57:29:2c. Pause the video now if you want time to think about the answer.
The correct answer is A. 00:00:0c:07:ac:0c. HSRP group 12 uses the default virtual MAC address 00:00:0c:07:ac:0c. The HSRP virtual MAC address format is 00:00:0c:07:ac:XX where XX is the hexadecimal representation of the group number (12 in decimal = 0c in hexadecimal). Now, why are the other options incorrect? Option B is incorrect. This format 00:05:5e:00:0c:12 is incorrect; 00:05:5e is not the HSRP OUI. Option C is incorrect. This format 00:5e:0c:07:ac:12 uses incorrect OUI; HSRP OUI is 00:00:0c. Option D is incorrect. This MAC address does not follow the HSRP virtual MAC address format at all. Therefore, A, 00:00:0c:07:ac:0c, is the correct answer.
Play from 44:12 Question 28. Which technology does VXLAN use to provide segmentation for Layer 2 and Layer 3 traffic? Here are the options. Option A. bridge domain. Option B. VLAN. Option C. VNI. Option D. VRF. Pause the video now if you want time to think about the answer.
The correct answer is C. VNI. The VNI (VXLAN Network Identifier) is the technology VXLAN uses to provide segmentation for both Layer 2 and Layer 3 traffic. The 24-bit VNI enables up to 16 million separate network segments, providing isolation comparable to VLAN segmentation but at much greater scale. Now, why are the other options incorrect? Option A is incorrect. Bridge domains are layer 2 forwarding domains but not the segmentation technology specific to VXLAN. Option B is incorrect. VLANs are limited to 4094 segments; VXLAN uses VNI for its segmentation capability. Option D is incorrect. VRF (Virtual Routing and Forwarding) provides Layer 3 segmentation in traditional networks, not the VXLAN-specific segmentation mechanism. Therefore, C, VNI, is the correct answer.
Play from 45:52 Question 29. Where in Cisco DNA Center is documentation of each API call organized by its functional area? Here are the options. Option A. Developer Toolkit. Option B. platform management. Option C. platform bundles. Option D. Runtime Dashboard. Pause the video now if you want time to think about the answer.
The correct answer is A. Developer Toolkit. In Cisco DNA Center, the Developer Toolkit is where API documentation is organized and presented by functional area. This toolkit provides a comprehensive reference for all available API calls, organized logically by their functional domains, allowing developers to find and understand APIs relevant to their needs. Now, why are the other options incorrect? Option B is incorrect. Platform management is a general management area, not specifically the location for API documentation organization. Option C is incorrect. Platform bundles refer to collections of features or services, not the documentation repository. Option D is incorrect. Runtime Dashboard is used for monitoring and operational visibility, not for API documentation. Therefore, A, Developer Toolkit, is the correct answer.
Play from 47:25 Question 30. What is the process for moving a virtual machine from one host machine to another with no downtime? Here are the options. Option A. high availability. Option B. disaster recovery. Option C. live migration. Option D. multisite replication. Pause the video now if you want time to think about the answer.
The correct answer is C. live migration. Live migration is the specific technology and process that allows virtual machines to move from one physical host to another while maintaining continuous operation and zero downtime. The VM's memory, state, and connections are transferred seamlessly during operation. Now, why are the other options incorrect? Option A is incorrect. High availability refers to system uptime and redundancy, not the specific process of moving VMs between hosts. Option B is incorrect. Disaster recovery involves recovery from failures, not the planned movement of VMs with no downtime. Option D is incorrect. Multisite replication involves copying data across multiple geographic sites, not moving individual VMs with zero downtime. Therefore, C, live migration, is the correct answer.
Play from 48:58 Question 31. What is one method for achieving REST API security? Here are the options. Option A. using a combination of XML encryption and XML signatures. Option B. using HTTPS and TLS encryption. Option C. using a MDS hash to verify the integrity. Option D. using built-in protocols known as Web Services Security. Pause the video now if you want time to think about the answer.
The correct answer is B. using HTTPS and TLS encryption. HTTPS with TLS encryption is the standard and most practical method for securing REST APIs. It provides encryption in transit, protecting the API endpoints and data from interception and eavesdropping, which is fundamental to REST API security. Now, why are the other options incorrect? Option A is incorrect. XML encryption and signatures are more applicable to SOAP-based web services rather than REST APIs, which typically use JSON. Option C is incorrect. MD5 hashes are unsuitable for security purposes due to collision vulnerabilities and do not provide encryption. Option D is incorrect. Web Services Security (WS-Security) is a standard for SOAP-based services, not the primary method for REST API security. Therefore, B, using HTTPS and TLS encryption, is the correct answer.
Play from 50:51 Question 32. A company wants its developers to deploy application code to a cloud platform. The provider manages the servers, the operating system and the runtime patching, and the developers manage only their code and data. Which cloud service model does this describe? Here are the options. Option A. Platform as a Service. Option B. Infrastructure as a Service. Option C. Software as a Service. Option D. Colocation hosting. Pause the video now if you want time to think about the answer.
The correct answer is A. Platform as a Service. Platform as a Service gives developers a managed environment in which the provider handles hardware, virtualization, operating system and runtime, and the customer supplies only application code and data. Infrastructure as a Service stops at virtual machines, networking and storage, leaving operating system and middleware patching to the customer. Software as a Service delivers a complete application that the customer simply uses and configures. Now, why are the other options incorrect? Option B is incorrect. With IaaS the customer installs and patches the operating system and runtime, which the provider manages in this scenario. Option C is incorrect. With SaaS the customer consumes a finished application and does not deploy its own code. Option D is incorrect. Colocation provides space, power and cooling for customer-owned hardware and is not a cloud service model. Therefore, A, Platform as a Service, is the correct answer.
Play from 52:47 Question 33. A company recently decided to use RESTCONF instead of NETCONF, and many of their NETCONF scripts contain the operation <edit-config> (operation="create"). Which RESTCONF operation must be used to replace these statements? Here are the options. Option A. PUT. Option B. CREATE. Option C. GET. Option D. POST. Pause the video now if you want time to think about the answer.
The correct answer is D. POST. In NETCONF, the <edit-config> operation with operation="create" is used to create new data. When migrating to RESTCONF, the POST method is the equivalent operation for creating new resources. POST in REST semantics creates new items, whereas PUT replaces entire resources. CREATE and GET are not valid RESTCONF HTTP methods. Now, why are the other options incorrect? Option A is incorrect. PUT replaces an existing resource entirely (equivalent to NETCONF merge/replace), not creation Option B is incorrect. CREATE is not a standard RESTCONF HTTP method Option C is incorrect. GET is used for retrieving data, not creating new resources Therefore, D, POST, is the correct answer.
Play from 54:34 Question 34. Which statement about TLS is accurate when using RESTCONF to write configurations on network devices? Here are the options. Option A. It is used for HTTP and HTTPS requests. Option B. It requires certificates for authentication. Option C. It is provided using NGINX acting as a proxy web server. Option D. It is not supported on Cisco devices. Pause the video now if you want time to think about the answer.
The correct answer is B. It requires certificates for authentication. TLS (Transport Layer Security) requires certificates for proper authentication and encryption when using RESTCONF to write configurations on network devices. These certificates establish the secure identity of both client and server, ensuring authenticated and encrypted communication channels for sensitive configuration changes. Now, why are the other options incorrect? Option A is incorrect. While TLS secures both HTTP and HTTPS, this statement is too general and doesn't specifically address RESTCONF authentication requirements Option C is incorrect. NGINX proxy is an optional architectural component, not a requirement of TLS itself in RESTCONF implementations Option D is incorrect. Cisco devices fully support TLS with RESTCONF; this statement is factually incorrect Therefore, B, It requires certificates for authentication, is the correct answer.
Play from 56:22 Question 35. Which element is unique to a Type 2 hypervisor? Here are the options. Option A. host hardware. Option B. memory. Option C. host OS. Option D. VM OS. Pause the video now if you want time to think about the answer.
The correct answer is C. host OS. The host operating system is the unique element to Type 2 hypervisors. Type 2 hypervisors are installed on top of a pre-existing host OS and depend on it for hardware abstraction and resource management. Type 1 hypervisors run directly on bare metal without a host OS, making this the key distinguishing feature. Now, why are the other options incorrect? Option A is incorrect. Host hardware is present in both Type 1 and Type 2 hypervisors; it is not unique to Type 2. Option B is incorrect. Memory is used by both Type 1 and Type 2 hypervisors; it is not a unique element. Option D is incorrect. Virtual machine operating systems are used in both Type 1 and Type 2 environments; this is not unique to Type 2. Therefore, C, host OS, is the correct answer.
Play from 57:51 Question 36. An engineer must run OSPFv2 in VRF CUST_A on a Cisco IOS XE router that uses VRF-lite. The VRF is defined, and the customer-facing interface is already assigned to it. Which command starts an OSPF process that is bound to VRF CUST_A? Here are the options. Option A. router ospf vrf CUST_A 10. Option B. router ospf 10 vrf CUST_A. Option C. ip ospf 10 vrf CUST_A area 0. Option D. address-family ipv4 vrf CUST_A. Pause the video now if you want time to think about the answer.
The correct answer is B. router ospf 10 vrf CUST_A. OSPFv2 supports VRFs by creating a separate process for each VRF with router ospf process-id vrf vrf-name. The process then forms adjacencies only on interfaces that belong to that VRF and installs its routes into the matching routing table. Other protocols use different syntax: EIGRP named mode and BGP use address-family ipv4 vrf vrf-name under the routing process. Keeping routing processes separate per VRF is what allows overlapping address space. Now, why are the other options incorrect? Option A is incorrect. The process ID must come before the vrf keyword, so this ordering is not valid syntax. Option C is incorrect. The interface-level ip ospf command enables a process on an interface but does not accept a vrf keyword. Option D is incorrect. This form is used under BGP and EIGRP named mode, not as the way to start a classic OSPFv2 process. Therefore, B, router ospf 10 vrf CUST_A, is the correct answer.
Play from 1:00:04 Question 37. Which element enables communication between guest VMs within a virtualized environment? Here are the options. Option A. hypervisor. Option B. virtual router. Option C. vSwitch. Option D. pNIC. Pause the video now if you want time to think about the answer.
The correct answer is C. vSwitch. A vSwitch (virtual switch) is the component that enables communication between guest VMs by providing Layer 2 switching functionality within the hypervisor. It forwards frames between VMs connected to the same virtual network, allowing intra-VM communication within the virtualized environment. Now, why are the other options incorrect? Option A is incorrect. The hypervisor is the overall virtualization platform, not the specific component managing VM-to-VM communication. Option B is incorrect. A virtual router handles Layer 3 routing, not Layer 2 switching for VM communication. Option D is incorrect. A pNIC (physical NIC) connects to the external network, not directly enables guest-to-guest VM communication. Therefore, C, vSwitch, is the correct answer.
Play from 1:01:31 Question 38. What does the Cisco DNA Center Authentication API provide? Here are the options. Option A. list of VLAN names. Option B. client health status. Option C. access token to make calls to Cisco DNA Center. Option D. list of global issues that are logged in Cisco DNA Center. Pause the video now if you want time to think about the answer.
The correct answer is C. access token to make calls to Cisco DNA Center. The Cisco DNA Center Authentication API provides an access token that enables authorized users and applications to make subsequent API calls to Cisco DNA Center, serving as the authentication mechanism for API access. Now, why are the other options incorrect? Option A is incorrect. VLAN information is retrieved through network configuration APIs, not the Authentication API. Option B is incorrect. Client health status is provided by client health or device health APIs, not the Authentication API. Option D is incorrect. Global issues are retrieved through issue reporting APIs, not the Authentication API. Therefore, C, access token to make calls to Cisco DNA Center, is the correct answer.
Play from 1:03:10 Question 39. Which resource must a hypervisor make available to the virtual machines? Here are the options. Option A. bandwidth. Option B. IP address. Option C. storage. Option D. secure access. Pause the video now if you want time to think about the answer.
The correct answer is C. storage. A hypervisor must make storage available to virtual machines to enable them to function. This includes both boot storage for the operating system and data storage for applications. While bandwidth, IP addresses, and secure access are important for VM operations, storage is a fundamental resource that the hypervisor must provision and manage for each VM. Now, why are the other options incorrect? Option A is incorrect. Bandwidth is managed at the network level, not directly provisioned by the hypervisor as a discrete resource Option B is incorrect. IP addresses are assigned by DHCP or static configuration within the guest OS, not provisioned by the hypervisor itself Option D is incorrect. Secure access is handled through authentication and authorization mechanisms, not directly provisioned by the hypervisor Therefore, C, storage, is the correct answer.
Play from 1:04:38 Question 40. An engineer is reviewing how Cisco Catalyst SD-WAN identifies a transport attachment point on a WAN Edge router. Which three attributes together uniquely identify a TLOC? Here are the options. Option A. Interface IP address, VLAN ID, and site ID. Option B. System IP address, site ID, and VPN number. Option C. System IP address, color, and encapsulation type. Option D. Interface MAC address, color, and tunnel key. Pause the video now if you want time to think about the answer.
The correct answer is C. System IP address, color, and encapsulation type. A transport location (TLOC) is the point at which a WAN Edge attaches to a transport network, and it is uniquely identified by a tuple of the device system IP address, a color that names the transport such as mpls or biz-internet, and the encapsulation type, which is IPsec or GRE. OMP advertises TLOCs through the Controllers, and each OMP route uses a TLOC as its next hop, much like a BGP next hop. Now, why are the other options incorrect? Option A is incorrect. The site ID identifies a location and the VLAN ID is a local value, and neither is part of the TLOC identity. Option B is incorrect. The site ID and service VPN number describe the site and the segment, not the transport. Option D is incorrect. MAC addresses and tunnel keys are not used to identify a TLOC. Therefore, C, System IP address, color, and encapsulation type, is the correct answer.
Play from 1:06:42 Question 41. What is a command-line tool for consuming REST APIs? Here are the options. Option A. Python requests. Option B. Postman. Option C. cURL. Option D. Firefox. Pause the video now if you want time to think about the answer.
The correct answer is C. cURL. cURL is a command-line tool specifically designed for consuming REST APIs by making HTTP requests. It is lightweight, widely available on most systems, and doesn't require additional installation. While Python requests is a library for API consumption, Postman is a GUI application, and Firefox is a web browser-none of these are primarily command-line tools for REST APIs like cURL is. Now, why are the other options incorrect? Option A is incorrect. Python requests is a library, not a command-line tool. Option B is incorrect. Postman is a GUI application, not a command-line tool. Option D is incorrect. Firefox is a web browser, not a command-line REST API consumption tool. Therefore, C, cURL, is the correct answer.
Play from 1:08:10 Question 42. Which Quality of Service (QoS) mechanism allows for the creation of multiple levels of QoS policy, providing a more granular degree of traffic management? Here are the options. Option A. Policing. Option B. H-QoS. Option C. Congestion avoidance. Option D. Dual Policy. Pause the video now if you want time to think about the answer.
The correct answer is B. H-QoS. H-QoS (Hierarchical QoS) is the QoS mechanism that allows creation of multiple levels or hierarchies of QoS policy, enabling more granular traffic management. It provides nested policy structures that can be applied at different points in the network, allowing administrators to implement complex, multi-level QoS strategies that address different traffic types and service requirements. Now, why are the other options incorrect? Option A is incorrect. Policing controls maximum traffic rates but does not create hierarchical policy levels. Option C is incorrect. Congestion avoidance is a mechanism like WRED that prevents queue overflow, not a hierarchical policy structure. Option D is incorrect. Dual Policy is not a recognized QoS mechanism in Cisco systems. Therefore, B, H-QoS, is the correct answer.
Play from 1:09:41 Question 43. What is one primary REST security design principle? Here are the options. Option A. fail-safe defaults. Option B. password hash. Option C. adding a timestamp in requests. Option D. OAuth. Pause the video now if you want time to think about the answer.
The correct answer is A. fail-safe defaults. Fail-safe defaults is a primary REST security design principle, meaning the system should deny access by default and only grant permissions explicitly. While password hashing, timestamps, and OAuth are all security-related, fail-safe defaults is the foundational design principle that ensures secure-by-default behavior in REST API design. Now, why are the other options incorrect? Option B is incorrect. Password hashing is an implementation detail for credential storage, not a REST design principle. Option C is incorrect. Adding timestamps helps prevent replay attacks but is not a primary design principle. Option D is incorrect. OAuth is an authentication mechanism, not a design principle for REST APIs. Therefore, A, fail-safe defaults, is the correct answer.
Play from 1:11:14 Question 44. When does a Cisco StackWise primary switch lose its role? Here are the options. Option A. when a switch with a higher priority is added to the stack. Option B. when a stack member fails. Option C. when the priority value of a stack member is changed to a higher value. Option D. when the stack primary is reset. Pause the video now if you want time to think about the answer.
The correct answer is A. when a switch with a higher priority is added to the stack. In a Cisco StackWise stack, the primary switch is determined by priority value-the switch with the highest priority becomes the primary. When a new switch with a higher priority is added to an existing stack, the election process is triggered and the new switch with higher priority assumes the primary role, causing the previous primary to lose its role. Now, why are the other options incorrect? Option B is incorrect. When a stack member fails, the primary role is not transferred; the primary remains primary unless it is the failed member. Option C is incorrect. Changing a stack member's priority value to higher does not automatically cause role change unless the entire stack is reset. Option D is incorrect. While a reset could cause role changes, it is not the specific event that causes a primary to lose its role; adding a higher-priority switch is. Therefore, A, when a switch with a higher priority is added to the stack, is the correct answer.
Play from 1:13:01 Question 45. Which device is responsible for finding EID-to-RLOC mapping when traffic is sent to a LISP-capable site? Here are the options. Option A. map resolver. Option B. egress tunnel router. Option C. map server. Option D. ingress tunnel router. Pause the video now if you want time to think about the answer.
The correct answer is A. map resolver. The map resolver in LISP is responsible for processing Map-Request packets from ingress tunnel routers (ITRs) seeking EID-to-RLOC mappings. When an ITR does not have a mapping, it queries the map resolver to find the correct mapping for the destination. Now, why are the other options incorrect? Option B is incorrect. Egress tunnel routers (ETRs) receive and process traffic; they do not resolve mappings. Option C is incorrect. Map servers register and store mappings from authoritative sources but do not perform the lookup function. Option D is incorrect. Ingress tunnel routers (ITRs) query for mappings; they do not find or resolve them themselves. Therefore, A, map resolver, is the correct answer.
Play from 1:14:30 Question 46. How are the different versions of IGMP compatible? Here are the options. Option A. IGMPv2 is compatible only with IGMPv2. Option B. IGMPv3 is compatible only with IGMPv3. Option C. IGMPv2 is compatible only with IGMPv1. Option D. IGMPv3 is compatible only with IGMPv1. Pause the video now if you want time to think about the answer.
The correct answer is C. IGMPv2 is compatible only with IGMPv1. IGMPv2 is backward compatible with IGMPv1. When IGMPv2 is present on a network, it can interoperate with IGMPv1 hosts and routers. IGMPv3 is not backward compatible with earlier versions; if IGMPv3 is present, all devices must support IGMPv3. Therefore, IGMPv2's compatibility is limited to IGMPv1. Now, why are the other options incorrect? Option A is incorrect. IGMPv2 is compatible with IGMPv1, not only with itself. Option B is incorrect. IGMPv3 is not compatible with IGMPv1 or IGMPv2. Option D is incorrect. IGMPv3 is not compatible with IGMPv1. Therefore, C, IGMPv2 is compatible only with IGMPv1, is the correct answer.
Play from 1:16:14 Question 47. Which control plane protocol is used between Cisco SD-WAN routers and vSmart controllers? Here are the options. Option A. TCP. Option B. OMP. Option C. UDP. Option D. BGP. Pause the video now if you want time to think about the answer.
The correct answer is B. OMP. OMP (Overlay Management Protocol) is the control plane protocol used between Cisco SD-WAN routers and vSmart controllers. OMP carries routing information, policy, and control messages across the SD-WAN overlay network, enabling centralized policy distribution and dynamic routing. Now, why are the other options incorrect? Option A is incorrect. TCP is a transport layer protocol and is not the dedicated control protocol between routers and controllers in SD-WAN. Option C is incorrect. UDP is used for data plane encapsulation but not as the primary control plane protocol between routers and vSmart controllers. Option D is incorrect. BGP is a routing protocol but not the control protocol used between SD-WAN routers and vSmart controllers; OMP serves this function. Therefore, B, OMP, is the correct answer.
Play from 1:17:52 Question 48. What is a characteristic of traffic shaping? Here are the options. Option A. lacks support for marking or remarking. Option B. must be applied only to outgoing traffic. Option C. can be applied in both traffic directions. Option D. queues out-of-profile packets until the buffer is full. Pause the video now if you want time to think about the answer.
The correct answer is D. queues out-of-profile packets until the buffer is full. Traffic shaping queues out-of-profile packets in a buffer until they can be transmitted at the conforming rate. This is the fundamental mechanism that allows traffic shaping to smooth traffic flows. Option A is incorrect because traffic shaping supports marking. Option B is incorrect because traffic shaping can be applied bidirectionally. Option C is incorrect because traffic shaping specifically buffers excess traffic rather than allowing it to pass uncontrolled. Now, why are the other options incorrect? Option A is incorrect. Traffic shaping supports marking and remarking of packets. Option B is incorrect. Traffic shaping can be applied to both inbound and outbound traffic. Option C is incorrect. Traffic shaping queues packets in buffers; it does not apply in both directions as stated. Therefore, D, queues out-of-profile packets until the buffer is full, is the correct answer.
Play from 1:19:29 Question 49. A new branch site comes online with an ETR that has the EID prefix 10.50.0.0/16 and the RLOC 192.0.2.50. The map server must learn this mapping so that remote ITRs can resolve it. Which LISP control plane message does the ETR send to the map server? Here are the options. Option A. Map-Request. Option B. Map-Register. Option C. Map-Reply. Option D. Map-Cache. Pause the video now if you want time to think about the answer.
The correct answer is B. Map-Register. An ETR publishes its EID prefixes and the RLOCs that reach them by sending Map-Register messages to the map server, and it repeats them periodically to keep the registration active. The map server stores the mapping in its database. Later, an ITR sends a Map-Request through the map resolver, and the mapping system returns the RLOCs in a Map-Reply. The map-cache is a table on the ITR, not a protocol message. Now, why are the other options incorrect? Option A is incorrect. An ITR sends a Map-Request to resolve a destination EID, not to publish the prefixes of an ETR. Option C is incorrect. A Map-Reply answers a Map-Request and does not register EID prefixes with the map server. Option D is incorrect. The map-cache is the local table where an ITR stores resolved mappings, and it is not a LISP message. Therefore, B, Map-Register, is the correct answer.
Play from 1:21:28 Question 50. Which design principle states that a user has no access by default to any resource, and unless a resource is explicitly granted, it should be denied? Here are the options. Option A. least privilege. Option B. fail-safe defaults. Option C. economy of mechanism. Option D. complete mediation. Pause the video now if you want time to think about the answer.
The correct answer is B. fail-safe defaults. Fail-safe defaults is the security principle stating that access should be denied by default unless explicitly granted. This is also known as the principle of default deny. While least privilege is related, it describes minimizing permissions for users who do have access, whereas fail-safe defaults specifically addresses the default state of all resources before any grants are made. Now, why are the other options incorrect? Option A is incorrect. Least privilege refers to granting users only the minimum permissions needed for their role, not the default deny posture. Option C is incorrect. Economy of mechanism refers to keeping security designs simple and understandable to reduce implementation errors. Option D is incorrect. Complete mediation requires that all access requests be checked against security policy, but doesn't define the default state. Therefore, B, fail-safe defaults, is the correct answer.
Play from 1:23:11 Question 51. What is a characteristic of a next-generation firewall? Here are the options. Option A. only required at the network perimeter. Option B. required in each layer of the network. Option C. filters traffic using Layer 3 and Layer 4 information only. Option D. provides intrusion prevention. Pause the video now if you want time to think about the answer.
The correct answer is D. provides intrusion prevention. A next-generation firewall (NGFW) is characterized by its ability to provide advanced threat protection beyond traditional Layer 3/4 filtering. Intrusion prevention is a core characteristic of NGFWs, as they can detect and block malicious traffic patterns and exploits in real-time. This distinguishes them from traditional firewalls. Now, why are the other options incorrect? Option A is incorrect. NGFWs are required throughout network architecture, not only at the perimeter, for comprehensive protection. Option B is incorrect. While NGFWs can be deployed in multiple layers, this is not their defining characteristic. Option C is incorrect. NGFWs go beyond Layer 3 and 4; they perform deep packet inspection and application-layer filtering. Therefore, D, provides intrusion prevention, is the correct answer.
Play from 1:24:50 Question 52. Which function is performed by vSmart in the Cisco SD-WAN architecture? Here are the options. Option A. distribution of centralized policies. Option B. execution of localized policies. Option C. redistribution between OMP and other routing protocols. Option D. facilitation of NAT detection and traversal. Pause the video now if you want time to think about the answer.
The correct answer is A. distribution of centralized policies. vSmart is the control plane component in Cisco SD-WAN architecture responsible for distributing centralized policies to all edge devices. It collects telemetry, runs path computation algorithms, and pushes policy-based configurations throughout the network to ensure consistent enforcement of security and traffic management rules. Now, why are the other options incorrect? Option B is incorrect. Policy execution is performed by vEdge devices (data plane), not vSmart Option C is incorrect. OMP redistribution is not a vSmart function; OMP is the overlay management protocol used by vSmart for communication Option D is incorrect. NAT traversal is handled by vEdge devices and edge control components, not by vSmart Therefore, A, distribution of centralized policies, is the correct answer.
Play from 1:26:34 Question 53. Which standard access control entry permits traffic from odd-numbered hosts in the 10.0.0.0/24 subnet? Here are the options. Option A. permit 10.0.0.0 0.0.0.1. Option B. permit 10.0.0.1 0.0.0.254. Option C. permit 10.0.0.1 0.0.0.0. Option D. permit 10.0.0.0 255.255.255.254. Pause the video now if you want time to think about the answer.
The correct answer is A. permit 10.0.0.0 0.0.0.1. To match odd-numbered hosts in 10.0.0.0/24, we need a wildcard mask that matches addresses ending in 1, 3, 5, 7, etc. The wildcard mask 0.0.0.1 means "ignore the last bit," which when applied to 10.0.0.0 matches all addresses where the last octet has the least significant bit set to 1 (odd numbers: 1, 3, 5, 7, 9, etc.). This is the correct syntax for matching odd-numbered hosts. Now, why are the other options incorrect? Option B is incorrect. The wildcard 0.0.0.254 is inverted logic and does not correctly specify odd hosts; it would match even numbers. Option C is incorrect. This syntax is invalid; a wildcard mask cannot be 0.0.0.0 as it would match only the single host 10.0.0.1. Option D is incorrect. This uses standard netmask notation (255.255.255.254) instead of wildcard mask notation; ACLs require wildcard masks, not subnet masks. Therefore, A, permit 10.0.0.0 0.0.0.1, is the correct answer.
Play from 1:28:48 Question 54. Which feature does Cisco DNA Center Assurance provide? Here are the options. Option A. application policy configuration. Option B. device onboarding and configuration. Option C. software upgrade and management. Option D. data correlation and analysis. Pause the video now if you want time to think about the answer.
The correct answer is D. data correlation and analysis. Cisco DNA Center Assurance provides data correlation and analysis capabilities, collecting and analyzing network telemetry, device metrics, and behavioral data to provide insights into network health, performance, and security issues. It correlates data from multiple sources to identify problems and their root causes. Now, why are the other options incorrect? Option A is incorrect. Application policy configuration is part of DNA Center Intent-Based Networking, not the Assurance module. Option B is incorrect. Device onboarding and configuration is handled by DNA Center Provisioning, not Assurance. Option C is incorrect. Software upgrade and management is a provisioning and lifecycle management function, not an Assurance capability. Therefore, D, data correlation and analysis, is the correct answer.
Play from 1:30:25 Question 55. Which security measure mitigates a man-in-the-middle attack of a REST API? Here are the options. Option A. password hash. Option B. SSL certificates. Option C. nonrepudiation feature. Option D. biometric authentication. Pause the video now if you want time to think about the answer.
The correct answer is B. SSL certificates. SSL certificates establish encrypted communication channels between client and server, preventing attackers from intercepting or modifying data in transit. This directly mitigates man-in-the-middle attacks by ensuring that communications cannot be eavesdropped on or altered without detection. Now, why are the other options incorrect? Option A is incorrect. Password hashing protects stored credentials but does not prevent interception of API communications in transit. Option C is incorrect. Nonrepudiation ensures users cannot deny their actions but does not prevent an attacker from intercepting communications. Option D is incorrect. Biometric authentication verifies user identity but does not encrypt data in transit to prevent interception. Therefore, B, SSL certificates, is the correct answer.
Play from 1:31:55 Question 56. An engineer must write one access control entry that matches every host in the address range 172.16.32.0 through 172.16.47.255. Which entry accomplishes this? Here are the options. Option A. permit 172.16.32.0 0.0.15.255. Option B. permit 172.16.32.0 0.0.31.255. Option C. permit 172.16.32.0 0.0.0.15. Option D. permit 172.16.32.0 0.0.240.255. Pause the video now if you want time to think about the answer.
The correct answer is A. permit 172.16.32.0 0.0.15.255. The range 172.16.32.0 through 172.16.47.255 is the 172.16.32.0/20 block. The first two octets and the upper four bits of the third octet must match, which leaves the lower four bits of the third octet and the whole fourth octet as do-not-care bits. A do-not-care bit is written as 1 in a wildcard mask, so the third octet becomes 15 and the fourth becomes 255, giving 0.0.15.255. Now, why are the other options incorrect? Option B is incorrect. This wildcard mask matches third octet values 32 through 63, which is twice the required range. Option C is incorrect. This wildcard mask matches only the addresses 172.16.32.0 through 172.16.32.15. Option D is incorrect. This wildcard mask ignores the upper four bits of the third octet and so matches values such as 0, 16, 32, and 48, not the required range. Therefore, A, permit 172.16.32.0 0.0.15.255, is the correct answer.
Play from 1:34:26 Question 57. Which congestion queuing method on Cisco IOS based routers uses four static queues? Here are the options. Option A. weighted fair. Option B. custom. Option C. low latency. Option D. priority. Pause the video now if you want time to think about the answer.
The correct answer is D. priority. Priority queuing uses four static queues: high, medium, normal, and low. Packets are classified into these four priority levels, and the router services higher priority queues before lower priority ones, making it a simple but effective queuing method for differentiating traffic by priority. Now, why are the other options incorrect? Option A is incorrect. Weighted Fair Queuing (WFQ) uses dynamic queue allocation based on flow weight, not static queues. Option B is incorrect. Custom queuing allows configuration of multiple queues with configurable bandwidth allocation, not a fixed four-queue model. Option C is incorrect. Low Latency Queuing (LLQ) combines priority and fair queuing mechanisms with custom queue configurations, not fixed static queues. Therefore, D, priority, is the correct answer.
Play from 1:36:01 Question 58. Which two GRE features are configured to prevent fragmentation? (Choose two.) Here are the options. Option A. TCP window size. Option B. IP MTU. Option C. TCP MSS. Option D. DF bit clear. Option E. MTU ignore. Pause the video now if you want time to think about the answer.
The correct answers are B. IP MTU, and C. TCP MSS. To prevent fragmentation in GRE tunnels, two key configurations are needed: IP MTU (set on the tunnel interface to account for GRE header overhead) and TCP MSS (configured on tunnel interfaces to clamp the maximum segment size for TCP packets). Both work together to ensure that packets do not exceed the tunnel's effective MTU and cause fragmentation. Now, why are the other options incorrect? Option A is incorrect. TCP window size does not directly prevent fragmentation; it controls flow control, not packet size. Option D is incorrect. The DF (Don't Fragment) bit being clear actually allows fragmentation, which contradicts the goal of prevention. Option E is incorrect. MTU ignore is not a standard GRE fragmentation prevention feature; the correct approach is configuring IP MTU. Therefore, B and C are the correct answers.
Play from 1:37:46 Question 59. Which two mechanisms are available to secure NTP? (Choose two.) Here are the options. Option A. IPsec. Option B. IP prefix list-based. Option C. encrypted authentication. Option D. TACACS-based authentication. Option E. IP access list-based. Pause the video now if you want time to think about the answer.
The correct answers are C. encrypted authentication, and E. IP access list-based. NTP can be secured using encrypted authentication (MD5 or SHA-based keys) and IP access lists (ACLs) to restrict which sources can synchronize with the NTP server. Encrypted authentication verifies the source's authenticity, while IP access lists control which hosts are allowed to communicate with the NTP service. Now, why are the other options incorrect? Option A is incorrect. IPsec is not a standard NTP security mechanism; NTP has its own authentication methods. Option B is incorrect. IP prefix lists are not used for NTP security; ACLs are used instead. Option D is incorrect. TACACS-based authentication is not a NTP security mechanism; TACACS is for device access control. Therefore, C and E are the correct answers.
Play from 1:39:29 Question 60. An HSRP router has learned the virtual IP address of the group. It is sending and receiving hello messages while it participates in the election of the active and standby routers. In which HSRP state is the router? Here are the options. Option A. Learn. Option B. Listen. Option C. Speak. Option D. Standby. Pause the video now if you want time to think about the answer.
The correct answer is C. Speak. In the Speak state a router knows the virtual IP address and both sends and receives hello messages while it takes part in the election of the active and standby routers. A router moves to Standby or Active after it wins the election. A router in the Learn state has not yet learned the virtual IP address, and a router in the Listen state knows the address and receives hellos but is not sending them. Now, why are the other options incorrect? Option A is incorrect. A router in the Learn state does not yet know the virtual IP address and waits for a hello from the active router. Option B is incorrect. A router in the Listen state receives hellos but does not send them or take part in the election. Option D is incorrect. The Standby state is reached only after the router wins the election as the next router to become active. Therefore, C, Speak, is the correct answer.
Play from 1:41:10 Question 61. In a Cisco DNA Center Plug and Play environment, why would a device be labeled unclaimed? Here are the options. Option A. The device has not been assigned a workflow. Option B. The device could not be added to the fabric. Option C. The device had an error and could not be provisioned. Option D. The device is from a third-party vendor. Pause the video now if you want time to think about the answer.
The correct answer is A. The device has not been assigned a workflow. A device is labeled as unclaimed in Cisco DNA Center Plug and Play when it has not been assigned a workflow. The device has been discovered and registered but awaits assignment to a configuration workflow before provisioning can proceed. Once a workflow is assigned, the device moves from unclaimed to claimed status. Now, why are the other options incorrect? Option B is incorrect. Failure to be added to fabric results in different error states, not simply an unclaimed status. Option C is incorrect. Provisioning errors result in failed or error states, not an unclaimed designation. Option D is incorrect. Third-party devices can be claimed and managed in DNA Center Plug and Play; vendor origin does not determine claimed status. Therefore, A, The device has not been assigned a workflow, is the correct answer.
Play from 1:42:53 Question 62. Which Cisco DNA Center Assurance feature verifies host reachability? Here are the options. Option A. path trace. Option B. application experience. Option C. detail information. Option D. network time travel. Pause the video now if you want time to think about the answer.
The correct answer is A. path trace. Path Trace is the Cisco DNA Center Assurance feature that verifies host reachability by tracing the end-to-end path between devices and providing detailed hop-by-hop information, latency, and packet loss to confirm connectivity. Now, why are the other options incorrect? Option B is incorrect. Application Experience monitors application performance and quality but does not specifically verify host reachability. Option C is incorrect. Detail Information is a general category and not the specific feature name for host reachability verification. Option D is incorrect. Network Time Travel is a feature for historical network state analysis, not for verifying current host reachability. Therefore, A, path trace, is the correct answer.
Play from 1:44:18 Question 63. A client application sends a large number of requests in a short time to a REST API behind a gateway that enforces a per-client rate limit. Which HTTP status code does the gateway return to indicate that the client exceeded the limit? Here are the options. Option A. 401 Unauthorized. Option B. 403 Forbidden. Option C. 429 Too Many Requests. Option D. 503 Service Unavailable. Pause the video now if you want time to think about the answer.
The correct answer is C. 429 Too Many Requests. Rate limiting protects an API from brute-force attempts, scraping, and denial of service by capping how many requests each client may make in a time window. When a client goes over the cap, the standard response is status 429 Too Many Requests, defined in RFC 6585, and the response often includes a Retry-After header that tells the client when to try again. Codes such as 401 and 403 describe authentication and authorization problems instead. Now, why are the other options incorrect? Option A is incorrect. This code reports missing or invalid authentication credentials and does not describe an exceeded request quota. Option B is incorrect. This code reports that the server refuses to authorize the request even though it understood it, and not that a rate limit was exceeded. Option D is incorrect. This code reports that the server is temporarily unable to handle requests, such as during overload, and not that one client exceeded its quota. Therefore, C, 429 Too Many Requests, is the correct answer.
Play from 1:46:19 Question 64. What are two device roles in Cisco SD-Access fabric? (Choose two.) Here are the options. Option A. edge node. Option B. vBond controller. Option C. access switch. Option D. core switch. Option E. border node. Pause the video now if you want time to think about the answer.
The correct answers are A. edge node, and E. border node. In Cisco SD-Access fabric architecture, edge nodes and border nodes are the two primary device roles. Edge nodes connect endpoints to the fabric, while border nodes connect the fabric to external networks. Access and core switches are legacy terminology; the fabric uses a unified architecture based on these two primary role types. Now, why are the other options incorrect? Option B is incorrect. vBond controller is part of SD-WAN, not SD-Access; it is not a device role in the SD-Access fabric. Option C is incorrect. Access switches are not a defined role in the SD-Access fabric; edge nodes serve the function of accessing endpoints. Option D is incorrect. Core switches are not a defined role in SD-Access fabric; the architecture uses edge and border nodes instead of traditional core/access layers. Therefore, A and E are the correct answers.
Play from 1:47:56 Question 65. What is used by vManage to interact with Cisco SD-WAN devices in the fabric? Here are the options. Option A. IPsec. Option B. northbound API. Option C. RESTCONF. Option D. southbound API. Pause the video now if you want time to think about the answer.
The correct answer is D. southbound API. vManage uses southbound APIs to interact with and control Cisco SD-WAN devices in the fabric. Southbound APIs are used by a management controller to communicate with and manage devices below it in the hierarchy. This is the standard architectural pattern where vManage (the management plane) sends commands and receives telemetry from edge routers and other fabric devices. Now, why are the other options incorrect? Option A is incorrect. IPsec is used for secure tunneling between SD-WAN devices, not for vManage-to-device management communication. Option B is incorrect. Northbound APIs are used by external systems to query and manage vManage itself, not for vManage to manage devices. Option C is incorrect. RESTCONF is a protocol that could be part of southbound API implementation, but the correct architectural answer is southbound API. Therefore, D, southbound API, is the correct answer.
Play from 1:49:37 Question 66. Which HTTP status code is the correct response for a request with an incorrect password applied to a REST API session? Here are the options. Option A. HTTP Status Code: 200. Option B. HTTP Status Code: 302. Option C. HTTP Status Code: 401. Option D. HTTP Status Code: 504. Pause the video now if you want time to think about the answer.
The correct answer is C. HTTP Status Code: 401. HTTP 401 Unauthorized is the correct response when authentication credentials are invalid or incorrect, such as when a wrong password is submitted to a REST API. This status code indicates that the request lacks valid authentication credentials and the client should provide proper credentials to access the resource. Now, why are the other options incorrect? Option A is incorrect. HTTP 200 OK indicates successful authentication, not a failed authentication attempt. Option B is incorrect. HTTP 302 Found is a redirect status code used for URL redirection, not for authentication failures. Option D is incorrect. HTTP 504 Gateway Timeout indicates a server connectivity issue, not an authentication problem. Therefore, C, HTTP Status Code: 401, is the correct answer.
Play from 1:51:21 Question 67. Which tool is used in Cisco DNA Center to build generic configurations that are able to be applied on devices with similar network settings? Here are the options. Option A. Command Runner. Option B. Application Policies. Option C. Template Editor. Option D. Authentication Template. Pause the video now if you want time to think about the answer.
The correct answer is C. Template Editor. The Template Editor is the tool used in Cisco DNA Center to build generic configurations (templates) that can be applied to multiple devices with similar network settings. Templates enable standardization and rapid deployment of consistent configurations across devices. Now, why are the other options incorrect? Option A is incorrect. Command Runner is used to execute ad-hoc commands on devices, not to create reusable configuration templates. Option B is incorrect. Application Policies are used for managing application-specific network policies, not for building generic device configurations. Option D is incorrect. Authentication Template is not a feature in DNA Center; Template Editor is the correct tool for building generic configurations. Therefore, C, Template Editor, is the correct answer.
Play from 1:52:56 Question 68. Which function is handled by vManage in the Cisco SD-WAN fabric? Here are the options. Option A. Establishes IPsec tunnels with nodes. Option B. Performs remote software upgrades for WAN Edge, vSmart, and vBond. Option C. Distributes policies that govern data forwarding. Option D. Establishes BFD sessions to test liveliness of links and nodes. Pause the video now if you want time to think about the answer.
The correct answer is B. Performs remote software upgrades for WAN Edge, vSmart, and vBond. vManage is the management and orchestration component in Cisco SD-WAN that handles configuration, monitoring, and software upgrades across all fabric nodes including WAN Edge routers, vSmart controllers, and vBond orchestrators. While option C mentions policy distribution, that is actually handled by vSmart controllers. vManage's primary operational function is lifecycle management including remote software upgrades. Option A describes vBond, Option C describes vSmart, and Option D describes the data plane nodes' responsibilities. Now, why are the other options incorrect? Option A is incorrect. Establishing IPsec tunnels is handled by vBond (orchestrator) and vSmart (controller), not vManage. Option C is incorrect. Distributing forwarding policies is the responsibility of vSmart controllers, not vManage. Option D is incorrect. BFD session establishment is performed by WAN Edge and vSmart nodes in the data plane, not by vManage. Therefore, B, Performs remote software upgrades for WAN Edge, vSmart, and vBond, is the correct answer.
Play from 1:54:52 Question 69. Which devices does Cisco DNA Center configure when deploying an IP-based access control policy? Here are the options. Option A. all devices integrating with ISE. Option B. selected individual devices. Option C. all devices in selected sites. Option D. all wired devices. Pause the video now if you want time to think about the answer.
The correct answer is C. all devices in selected sites. When deploying an IP-based access control policy in Cisco DNA Center, the policy is applied to all devices in selected sites. This site-based approach allows for scalable and organized policy deployment across groups of network devices within defined physical or logical locations. Now, why are the other options incorrect? Option A is incorrect. While devices may integrate with ISE, policy deployment is not limited to all ISE-integrated devices only. Option B is incorrect. Policies are deployed at the site level rather than to individually selected devices, which would not scale effectively. Option D is incorrect. IP-based access control policies are not limited to wired devices only; they apply to all device types within selected sites. Therefore, C, all devices in selected sites, is the correct answer.
Play from 1:56:34 Question 70. Which policy feature is used with TrustSec to provide endpoint entitlement in an enterprise network? Here are the options. Option A. security group tags. Option B. access control lists. Option C. virtual local area network. Option D. virtual routing and forwarding. Pause the video now if you want time to think about the answer.
The correct answer is A. security group tags. Security Group Tags (SGTs) are the core policy feature used with Cisco TrustSec to provide endpoint entitlement in enterprise networks. SGTs classify users and devices, allowing enforcement of Security Group Access Control Lists (SGACLs) based on identity rather than IP addresses. Now, why are the other options incorrect? Option B is incorrect. Access control lists are used to enforce policies but are not the primary entitlement mechanism; SGTs provide the classification that ACLs then enforce. Option C is incorrect. VLANs are layer 2 network segmentation tools and are not the TrustSec entitlement mechanism. Option D is incorrect. Virtual routing and forwarding is a layer 3 segmentation technology and does not serve as the TrustSec entitlement feature. Therefore, A, security group tags, is the correct answer.
Play from 1:58:14 Question 71. Which two features are available only in next-generation firewalls? (Choose two.) Here are the options. Option A. application awareness. Option B. packet filtering. Option C. stateful inspection. Option D. deep packet inspection. Option E. virtual private network. Pause the video now if you want time to think about the answer.
The correct answers are A. application awareness, and D. deep packet inspection. Application awareness (A) and deep packet inspection (D) are signature features of next-generation firewalls (NGFWs) that allow inspection and control based on actual application types and content, not just ports and protocols. Packet filtering, stateful inspection, and VPN are older technologies available in traditional firewalls. Now, why are the other options incorrect? Option B is incorrect. Packet filtering is a basic feature available in traditional firewalls, not exclusive to NGFWs. Option C is incorrect. Stateful inspection is a traditional firewall feature, not specific to next-generation firewalls. Option E is incorrect. VPN capabilities exist in traditional firewalls and are not a next-generation firewall exclusive feature. Therefore, A and D are the correct answers.
Play from 1:59:50 Question 72. In Cisco DNA Center, what is used to publish events and notifications to a third-party product such as IPAM? Here are the options. Option A. intent API. Option B. southbound SDK. Option C. integration API. Option D. RESTful API. Pause the video now if you want time to think about the answer.
The correct answer is C. integration API. The integration API is used to publish events and notifications from DNA Center to third-party products such as IPAM systems. This API enables bidirectional integration with external platforms for enhanced management capabilities. Now, why are the other options incorrect? Option A is incorrect. Intent API is used for provisioning and policy intent, not for publishing events to third-party systems. Option B is incorrect. Southbound SDK interfaces with network devices below DNA Center, not third-party external systems. Option D is incorrect. RESTful API is a general protocol; the specific answer is integration API which is a particular RESTful implementation for third-party integration. Therefore, C, integration API, is the correct answer.
Play from 2:01:29 Question 73. What is a requirement for an Ansible-managed node? Here are the options. Option A. It must have an SSH server running. Option B. It must be a Linux server or a Cisco device. Option C. It must support ad hoc commands. Option D. It must have an Ansible Tower installed. Pause the video now if you want time to think about the answer.
The correct answer is A. It must have an SSH server running. An Ansible-managed node must have an SSH server running to allow Ansible to connect and execute commands remotely. SSH is the primary communication protocol that Ansible uses to connect to and manage target nodes, making it a fundamental requirement. Now, why are the other options incorrect? Option B is incorrect. Ansible can manage many types of devices beyond just Linux and Cisco devices, including Windows servers and various network equipment. Option C is incorrect. Ad hoc commands are a feature of Ansible, not a requirement for managed nodes; nodes only need SSH connectivity. Option D is incorrect. Ansible Tower is an optional management interface; it is not required for nodes to be managed by Ansible. Therefore, A, It must have an SSH server running, is the correct answer.
Play from 2:03:08 Question 74. Which two new security capabilities are introduced by using a next-generation firewall at the Internet edge? (Choose two.) Here are the options. Option A. stateful packet inspection. Option B. integrated intrusion prevention. Option C. NAT. Option D. VPN. Option E. application-level inspection. Pause the video now if you want time to think about the answer.
The correct answers are B. integrated intrusion prevention, and E. application-level inspection. Next-generation firewalls introduce integrated intrusion prevention (IPS) capabilities and application-level inspection as new security features beyond traditional firewalls. These capabilities allow detection and prevention of threats at the application layer and automated response to intrusions, significantly advancing network security posture. Now, why are the other options incorrect? Option A is incorrect. Stateful packet inspection is a traditional firewall capability, not a new feature of next-generation firewalls. Option C is incorrect. NAT (Network Address Translation) is a basic networking function found in traditional firewalls, not a new NGFW capability. Option D is incorrect. VPN is a traditional security mechanism that predates next-generation firewalls and is not a new capability they introduce. Therefore, B and E are the correct answers.
Play from 2:04:52 Question 75. What is the structure of a JSON web token? Here are the options. Option A. three parts separated by dots: header, payload, and signature. Option B. three parts separated by dots: version, header, and signature. Option C. header and payload. Option D. payload and signature. Pause the video now if you want time to think about the answer.
The correct answer is A. three parts separated by dots: header, payload, and signature. A JSON Web Token consists of three parts separated by dots: the header (containing token type and hashing algorithm), the payload (containing claims and user data), and the signature (for verification). This three-part structure is the standard JWT format. Now, why are the other options incorrect? Option B is incorrect. Version is not a standard JWT component; the three parts are header, payload, and signature Option C is incorrect. JWT requires three parts, not two; the signature is essential for token verification Option D is incorrect. JWT requires three parts including the header; payload and signature alone are insufficient Therefore, A, three parts separated by dots: header, payload, and signature, is the correct answer.
Play from 2:06:32 Question 76. Which function does a virtual switch provide? Here are the options. Option A. RAID storage for virtual machines. Option B. connectivity between virtual machines. Option C. CPU context switching for multitasking between virtual machines. Option D. emulation of power for virtual machines. Pause the video now if you want time to think about the answer.
The correct answer is B. connectivity between virtual machines. A virtual switch provides Layer 2 connectivity between virtual machines within a hypervisor, enabling them to communicate with each other and with external networks. It functions similarly to a physical switch but operates entirely in software. Now, why are the other options incorrect? Option A is incorrect. RAID storage is provided by storage controllers, not virtual switches. Option C is incorrect. CPU context switching is handled by the hypervisor scheduler, not the virtual switch. Option D is incorrect. Power emulation is not a function of virtual switches; virtual machines use virtualized power management. Therefore, B, connectivity between virtual machines, is the correct answer.
Play from 2:08:02 Question 77. By default, which virtual MAC address does HSRP group 14 use? Here are the options. Option A. 04:17:01:05:7c:0e. Option B. 00:05:0c:07:ac:14. Option C. 00:00:0c:07:ac:0e. Option D. 00:05:5e:19:0c:14. Pause the video now if you want time to think about the answer.
The correct answer is C. 00:00:0c:07:ac:0e. HSRP group 14 uses the virtual MAC address 00:00:0c:07:ac:0e by default. The HSRP virtual MAC address format is 00:00:0c:07:ac:XX, where XX is the hexadecimal representation of the group number. For group 14 (0x0e in hexadecimal), this results in 00:00:0c:07:ac:0e. Now, why are the other options incorrect? Option A is incorrect. This MAC address format does not match the standard HSRP virtual MAC address pattern. Option B is incorrect. While this contains the correct HSRP OUI prefix, it uses an incorrect encoding of the group number (14 in decimal is 0e in hex, not 14 in the last octet). Option D is incorrect. This format uses 5e instead of the correct 0c in the third octet, deviating from the standard HSRP MAC address structure. Therefore, C, 00:00:0c:07:ac:0e, is the correct answer.
Play from 2:09:59 Question 78. A Catalyst 9300 trunk port connects to an ESXi host that runs standard virtual switches. The virtual switches do not run Spanning Tree Protocol, and the port should start forwarding as soon as the link comes up. Which interface command meets this requirement? Here are the options. Option A. spanning-tree guard root. Option B. spanning-tree portfast trunk. Option C. spanning-tree link-type shared. Option D. switchport nonegotiate. Pause the video now if you want time to think about the answer.
The correct answer is B. spanning-tree portfast trunk. Standard virtual switches do not participate in Spanning Tree Protocol and do not send BPDUs of their own, so the physical port facing the host behaves as an edge port. Because the connected port is a trunk, the spanning-tree portfast trunk command is needed to apply PortFast and move the port straight to forwarding. A plain spanning-tree portfast command affects only access ports unless the global default for trunks is set. BPDU guard is often added as protection against loops. Now, why are the other options incorrect? Option A is incorrect. Root guard stops the port from becoming a root port when it receives superior BPDUs and does not shorten the time to forwarding. Option C is incorrect. A shared link type disables the rapid transition behavior and does not make a trunk port forward immediately. Option D is incorrect. This command stops DTP frames from being sent and has no effect on spanning tree state transitions. Therefore, B, spanning-tree portfast trunk, is the correct answer.
Play from 2:11:54 Question 79. What is a common trait between Ansible and Chef? Here are the options. Option A. Both rely on a declarative approach. Option B. Both are used for mutable infrastructure. Option C. Both require a client to be installed on hosts. Option D. Both rely on NETCONF. Pause the video now if you want time to think about the answer.
The correct answer is B. Both are used for mutable infrastructure. Both Ansible and Chef are used for managing mutable infrastructure, where systems are continuously updated and modified in place rather than replaced. Both tools support applying configuration changes to existing infrastructure and updating system state over time. Now, why are the other options incorrect? Option A is incorrect. Ansible uses a declarative approach, but Chef uses an imperative approach with recipes, so this is not a common trait. Option C is incorrect. Ansible is agentless and does not require client installation, while Chef typically requires an agent, so this is not shared. Option D is incorrect. Neither Ansible nor Chef fundamentally rely on NETCONF; they use their own protocols and frameworks for device management. Therefore, B, Both are used for mutable infrastructure, is the correct answer.
Play from 2:13:31 Question 80. Which two solutions are used for backing up a Cisco DNA Center Assurance database? (Choose two.) Here are the options. Option A. bare metal server. Option B. remote server. Option C. NFS share. Option D. local server. Option E. non-linux server. Pause the video now if you want time to think about the answer.
The correct answers are B. remote server, and C. NFS share. Cisco DNA Center Assurance database can be backed up to either a remote server or an NFS (Network File System) share. These are the two supported backup locations for the Assurance database. NFS shares provide network-based storage, while remote servers offer off-site backup capabilities, both meeting enterprise backup requirements. Now, why are the other options incorrect? Option A is incorrect. Bare metal servers are not a supported backup destination for DNA Center Assurance databases. Option D is incorrect. Local server backups alone do not provide adequate redundancy and are not recommended as a primary backup solution. Option E is incorrect. Non-Linux servers are not supported backup targets; DNA Center infrastructure requires Linux-based systems. Therefore, B and C are the correct answers.
Play from 2:15:11 Question 81. What are two benefits of virtual switching when compared to hardware switching? (Choose two.) Here are the options. Option A. increased MTU size. Option B. VM-level isolation. Option C. extended 802.1Q VLAN range. Option D. hardware independence. Option E. increased flexibility. Pause the video now if you want time to think about the answer.
The correct answers are D. hardware independence, and E. increased flexibility. Virtual switches provide hardware independence by abstracting network switching from physical hardware, allowing flexible reconfiguration without hardware changes. They also offer increased flexibility through software-based configuration, dynamic resource allocation, and the ability to implement advanced networking policies at the VM level. These benefits enable efficient network resource management in virtualized environments. Now, why are the other options incorrect? Option A is incorrect. MTU size is determined by underlying physical network configuration and is not increased by virtual switching. Option B is incorrect. VM-level isolation is more of a security consideration than a benefit of virtual switching specifically. Option C is incorrect. The 802.1Q VLAN range is not extended by virtual switching; it remains limited to 4094 VLANs regardless of switching method. Therefore, D and E are the correct answers.
Play from 2:17:01 Question 82. What is used to perform QoS packet classification? Here are the options. Option A. the Type field in the Layer 2 frame. Option B. the Options field in the Layer 3 header. Option C. the TOS field in the Layer 3 header. Option D. the Flags field in the Layer 3 header. Pause the video now if you want time to think about the answer.
The correct answer is C. the TOS field in the Layer 3 header. The TOS (Type of Service) field in the Layer 3 header is used to perform QoS packet classification. The TOS field, which includes the DSCP (Differentiated Services Code Point) bits, allows devices to identify and classify packets for differential treatment based on quality of service requirements. Now, why are the other options incorrect? Option A is incorrect. Layer 2 frame Type fields are used for protocol identification, not QoS classification. Option B is incorrect. The Options field in Layer 3 headers is for miscellaneous IP options, not standard QoS classification. Option D is incorrect. The Flags field in Layer 3 headers is used for fragmentation control, not QoS classification. Therefore, C, the TOS field in the Layer 3 header, is the correct answer.
Play from 2:18:40 Question 83. Which protocol infers that a YANG data model is being used? Here are the options. Option A. SNMP. Option B. RESTCONF. Option C. REST. Option D. NX-API. Pause the video now if you want time to think about the answer.
The correct answer is B. RESTCONF. RESTCONF is the protocol that infers the use of YANG data models. RESTCONF is specifically designed as a RESTful API that uses YANG models to define the structure of configuration and operational data, making YANG usage inherent to RESTCONF. Now, why are the other options incorrect? Option A is incorrect. SNMP uses its own data modeling approach (MIBs) and is not associated with YANG. Option C is incorrect. REST is a general architectural style; while RESTCONF (which uses YANG) is built on REST principles, REST itself does not infer YANG usage. Option D is incorrect. NX-API is a Cisco API that may support various data models but does not specifically infer YANG usage. Therefore, B, RESTCONF, is the correct answer.
Play from 2:20:07 Question 84. What is the correct EBGP path attribute list, ordered from most preferred to least preferred, that the BGP best-path algorithm uses? Here are the options. Option A. local preference, weight, AS path, MED. Option B. weight, local preference, AS path, MED. Option C. weight, AS path, local preference, MED. Option D. local preference, weight, MED, AS path. Pause the video now if you want time to think about the answer.
The correct answer is B. weight, local preference, AS path, MED. The BGP best-path algorithm evaluates paths in this specific order for EBGP: weight (highest), local preference (highest), AS path (shortest), MED (lowest), and other criteria. Weight is the first criterion evaluated as it is a Cisco-specific attribute that takes precedence before the standardized BGP attributes. Now, why are the other options incorrect? Option A is incorrect. Local preference is not evaluated before weight; weight takes precedence. Option C is incorrect. AS path is not evaluated before local preference in the standard BGP algorithm. Option D is incorrect. MED is evaluated after AS path, not before local preference. Therefore, B, weight, local preference, AS path, MED, is the correct answer.
Play from 2:21:54 Question 85. A PIM sparse mode router holds a (*,G) entry for a group, and a packet for the group arrives from the direction of the shared tree. Toward which address does the router perform the RPF check for the (*,G) entry? Here are the options. Option A. The source address of the sender. Option B. The group address. Option C. The address of the rendezvous point. Option D. The address of the IGMP querier. Pause the video now if you want time to think about the answer.
The correct answer is C. The address of the rendezvous point. A (*,G) entry belongs to the shared tree, which is rooted at the rendezvous point. The RPF check for that entry therefore uses the unicast route toward the RP address, and the incoming interface is the interface toward the RP. For an (S,G) entry on the source tree, the check uses the route toward the source address instead. Now, why are the other options incorrect? Option A is incorrect. The source address is used for the RPF check of an (S,G) entry, not for a (*,G) entry. Option B is incorrect. The group address is a multicast address and is not looked up in the unicast routing table for the RPF check. Option D is incorrect. The IGMP querier serves hosts on a LAN and has no role in the RPF check. Therefore, C, The address of the rendezvous point, is the correct answer.
Play from 2:23:41 Question 86. Please select the correct option that shows the correct combination for the Type 1 Hypervisor. Here are the options. Option A. Hardware; Hypervisor; Guest OS. Option B. Hardware; Host OS; Hypervisor; Guest OS. Option C. Host OS; Hypervisor; Guest OS. Option D. Hardware; Host OS; Guest OS. Pause the video now if you want time to think about the answer.
The correct answer is A. Hardware; Hypervisor; Guest OS. A Type 1 hypervisor (bare-metal hypervisor) runs directly on hardware without requiring a host operating system. The correct layering is Hardware at the base, followed by the Hypervisor, which then manages Guest Operating Systems. This direct hardware access is what distinguishes Type 1 from Type 2 hypervisors. Now, why are the other options incorrect? Option B is incorrect. Type 1 hypervisors do not require a Host OS; that configuration describes a Type 2 hypervisor. Option C is incorrect. This omits the Hardware layer, which is foundational to Type 1 hypervisors. Option D is incorrect. This omits the Hypervisor layer entirely and is not the correct stacking for any hypervisor type. Therefore, A, Hardware; Hypervisor; Guest OS, is the correct answer.
Play from 2:25:20 Question 87. An engineer is configuring a site-to-site IPsec VPN on a Cisco IOS XE router that uses IKEv2 with pre-shared keys. Which IKEv2 configuration object matches the remote peer identity, defines the local and remote authentication methods, and references the keyring? Here are the options. Option A. IKEv2 proposal. Option B. IKEv2 policy. Option C. IKEv2 profile. Option D. IKEv2 keyring. Pause the video now if you want time to think about the answer.
The correct answer is C. IKEv2 profile. In IKEv2 on IOS XE, the proposal holds the negotiable algorithms, the policy attaches proposals to a negotiation, and the keyring holds pre-shared keys. The IKEv2 profile holds the nonnegotiable parameters of the security association: the match identity statements for the remote peer, the local and remote authentication methods, and the keyring that supplies the keys. The IPsec profile or crypto map then points to the IKEv2 profile. Now, why are the other options incorrect? Option A is incorrect. A proposal defines only the encryption, integrity, and Diffie-Hellman group algorithms that are offered during negotiation. Option B is incorrect. A policy groups one or more proposals and selects them for a negotiation; it does not match peer identities or define authentication. Option D is incorrect. A keyring stores the pre-shared keys for the peers but does not match identities or select the authentication methods. Therefore, C, IKEv2 profile, is the correct answer.
Play from 2:27:25 Question 88. Which security option protects credentials from sniffer attacks in a basicAPI authentication? Here are the options. Option A. next-generation firewall. Option B. TLS or SSL for communication. Option C. VPN connection between client and server. Option D. AAA services to authenticate the API. Pause the video now if you want time to think about the answer.
The correct answer is B. TLS or SSL for communication. TLS or SSL encryption protects credentials from sniffer attacks in basic API authentication by encrypting the communication channel end-to-end. This prevents attackers from capturing credentials in transit through network sniffing. Now, why are the other options incorrect? Option A is incorrect. A next-generation firewall provides perimeter security but does not specifically protect credentials in transit. Option C is incorrect. While a VPN provides additional protection, TLS/SSL is the standard direct protection for API credentials. Option D is incorrect. AAA services authenticate users but do not inherently protect credentials from sniffer attacks during transmission. Therefore, B, TLS or SSL for communication, is the correct answer.
Play from 2:28:59 Question 89. Which feature must be configured to allow packet capture over Layer 3 infrastructure? Here are the options. Option A. RSPAN. Option B. ERSPAN. Option C. VSPAN. Option D. IPSPAN. Pause the video now if you want time to think about the answer.
The correct answer is B. ERSPAN. ERSPAN (Encapsulated Remote SPAN) must be configured to allow packet capture over Layer 3 infrastructure. Unlike RSPAN which is limited to Layer 2 switched networks, ERSPAN encapsulates mirrored traffic in GRE packets, allowing it to traverse Layer 3 routed networks and reach remote monitoring destinations. Now, why are the other options incorrect? Option A is incorrect. RSPAN operates only on Layer 2 switched infrastructure and cannot cross Layer 3 boundaries. Option C is incorrect. VSPAN is not a standard Cisco monitoring feature for Layer 3 packet capture. Option D is incorrect. IPSPAN is not a recognized Cisco feature for packet capture over Layer 3. Therefore, B, ERSPAN, is the correct answer.
Play from 2:30:31 Question 90. On which protocol or technology is the fabric data plane based in Cisco SD-Access fabric? Here are the options. Option A. VXLAN. Option B. LISP. Option C. Cisco TrustSec. Option D. IS-IS. Pause the video now if you want time to think about the answer.
The correct answer is A. VXLAN. VXLAN (Virtual Extensible LAN) is the foundational technology for the Cisco SD-Access fabric data plane, providing overlay network virtualization across the underlay network. LISP is used for the control plane and endpoint discovery, Cisco TrustSec provides policy and segmentation, and IS-IS is the underlay routing protocol, but VXLAN specifically forms the basis of the data plane. Now, why are the other options incorrect? Option B is incorrect. LISP is used for control plane functions and endpoint location services, not the data plane. Option C is incorrect. Cisco TrustSec provides policy and segmentation capabilities but is not the data plane technology. Option D is incorrect. IS-IS is the underlay routing protocol used to build the fabric infrastructure, not the data plane itself. Therefore, A, VXLAN, is the correct answer.
Play from 2:32:00 Question 91. A script contains the statement "while loop != 999:" Which value terminates the loop? Here are the options. Option A. A value not equal to 999. Option B. A value less than or equal to 999. Option C. A value equal to 999. Option D. A value greater than or equal to 999. Pause the video now if you want time to think about the answer.
The correct answer is C. A value equal to 999. The while loop condition 'while loop != 999:' continues executing as long as the loop variable is NOT equal to 999. The loop terminates when the condition becomes false, which occurs when loop equals 999. At that point, the inequality (loop != 999) evaluates to false and the loop exits. Now, why are the other options incorrect? Option A is incorrect. A value not equal to 999 would keep the loop running, not terminate it. Option B is incorrect. Values less than or equal to 999 include many values that would still satisfy the != condition and keep the loop running. Option D is incorrect. Values greater than or equal to 999 include values other than 999 that would keep the loop running since they still satisfy the != condition. Therefore, C, A value equal to 999, is the correct answer.
Play from 2:33:50 Question 92. Which two parameters are examples of a QoS traffic descriptor? (Choose two.) Here are the options. Option A. DSCP. Option B. MPLS EXP bits. Option C. packet size. Option D. bandwidth. Option E. ToS. Pause the video now if you want time to think about the answer.
The correct answers are A. DSCP, and B. MPLS EXP bits. DSCP (Differentiated Services Code Point) and MPLS EXP bits are both QoS marking mechanisms used to classify and identify traffic types in a network. These are traffic descriptors that indicate service level requirements. Packet size and bandwidth are characteristics or metrics, not descriptors, and ToS is largely superseded by DSCP. Now, why are the other options incorrect? Option C is incorrect. Packet size is a characteristic of traffic but not a QoS traffic descriptor used for classification. Option D is incorrect. Bandwidth is a resource metric, not a traffic descriptor mechanism. Option E is incorrect. ToS (Type of Service) is an older field that has been replaced by DSCP for modern QoS descriptors. Therefore, A and B are the correct answers.
Play from 2:35:24 Question 93. Which First Hop Redundancy Protocol maximizes uplink utilization and minimizes the amount of configuration that is necessary? Here are the options. Option A. GLBP. Option B. HSRP v2. Option C. VRRP. Option D. HSRP v1. Pause the video now if you want time to think about the answer.
The correct answer is A. GLBP. GLBP (Gateway Load Balancing Protocol) is a Cisco-proprietary protocol that maximizes uplink utilization by allowing multiple virtual gateways within a single group. Unlike HSRP and VRRP where only the master actively forwards traffic, GLBP distributes traffic across multiple routers, improving bandwidth utilization while minimizing configuration complexity compared to managing multiple groups. Now, why are the other options incorrect? Option B is incorrect. HSRP v2 uses only a single active router and does not maximize uplink utilization. Option C is incorrect. VRRP uses a single master router and does not maximize uplink utilization. Option D is incorrect. HSRP v1 is older, uses a single active router, and requires more configuration than GLBP. Therefore, A, GLBP, is the correct answer.
Play from 2:37:08 Question 94. What is the purpose of an RP in PIM? Here are the options. Option A. send join messages toward a multicast source SPT. Option B. ensure the shortest path from the multicast source to the receiver. Option C. receive IGMP joins from multicast receivers. Option D. secure the communication channel between the multicast sender and receiver. Pause the video now if you want time to think about the answer.
The correct answer is A. send join messages toward a multicast source SPT. The RP (Rendezvous Point) in PIM receives IGMP joins from multicast receivers and sends join messages upstream toward the multicast source to build the shared tree (RPT). This allows the RP to serve as a central meeting point for multicast flows, enabling receivers to discover and join multicast groups through the RP. Now, why are the other options incorrect? Option B is incorrect. Ensuring the shortest path to the receiver is the responsibility of the SPT (Shortest Path Tree), not the RP, though the RP may facilitate SPT switchover. Option C is incorrect. While the RP does receive IGMP joins from receivers as part of its function, sending join messages toward the source is the more complete and accurate primary purpose. Option D is incorrect. The RP does not secure communication channels; security in multicast is handled through other mechanisms like authentication and encryption policies. Therefore, A, send join messages toward a multicast source SPT, is the correct answer.
Play from 2:39:06 Question 95. An administrator wants a Cisco Secure Firewall to block connections to and from IP addresses, URLs, and domains that Cisco Talos has identified as malicious, before the traffic is evaluated by the access control rules. Which feature should the administrator configure? Here are the options. Option A. A file policy with malware defense. Option B. Network discovery. Option C. An intrusion policy. Option D. Security Intelligence. Pause the video now if you want time to think about the answer.
The correct answer is D. Security Intelligence. Security Intelligence is the earliest line of defense in the access control process. It compares the source and destination of a connection with lists and feeds of IP addresses, URLs, and domains that have a poor reputation, including the feeds that Cisco Talos maintains, and blocks matching traffic before the access control rules and deeper inspection run. This saves resources, because traffic known to be bad is never analyzed further. Now, why are the other options incorrect? Option A is incorrect. A file policy inspects files in connections that an access control rule has already allowed, so it does not block by reputation before rule evaluation. Option B is incorrect. Network discovery passively gathers information about hosts and applications and does not block connections. Option C is incorrect. An intrusion policy inspects traffic that an access control rule has allowed, so it is evaluated after rule matching. Therefore, D, Security Intelligence, is the correct answer.
Play from 2:41:02 Question 96. Which two namespaces does the LISP network architecture and protocol use? (Choose two.) Here are the options. Option A. TLOC. Option B. RLOC. Option C. DNS. Option D. VTEP. Option E. EID. Pause the video now if you want time to think about the answer.
The correct answers are B. RLOC, and E. EID. LISP uses two namespaces: the EID (Endpoint ID) namespace, which identifies the actual endpoints and is used within LISP sites, and the RLOC (Routing Locator) namespace, which identifies the network infrastructure and is used for routing packets through the underlay network. These separate namespaces enable LISP's core function of decoupling identity from location. Now, why are the other options incorrect? Option A is incorrect. TLOC refers to a tunnel locator in some LISP implementations but is not a primary namespace designation. Option C is incorrect. DNS is not a namespace used by LISP protocol architecture itself. Option D is incorrect. VTEP (VXLAN Tunnel Endpoint) is associated with VXLAN, not a LISP namespace. Therefore, B and E are the correct answers.
Play from 2:42:43 Question 97. Select the benefits of implementing Cisco DNA Center. (Choose all that apply.) Here are the options. Option A. Simplified management. Option B. Automatic VPN tunnelling. Option C. One click Configuration. Option D. Policy Driven Provisioning. Option E. Ensure Network & Appliance performance. Pause the video now if you want time to think about the answer.
The correct answers are A. Simplified management, and D. Policy Driven Provisioning, and E. Ensure Network & Appliance performance. Cisco DNA Center provides simplified management through a centralized platform, policy-driven provisioning that automates network configuration based on business policies, and ensures network and appliance performance through analytics and monitoring. These capabilities reduce manual intervention and improve operational efficiency across the network infrastructure. Now, why are the other options incorrect? Option B is incorrect. While DNA Center integrates with SD-WAN for VPN capabilities, automatic VPN tunneling is not listed as a primary benefit of DNA Center itself. Option C is incorrect. DNA Center provides policy-driven automation rather than simple one-click configuration; configurations are more sophisticated and context-aware. Therefore, A and D and E are the correct answers.
Play from 2:44:27 Question 98. At which layer does Cisco DNA Center support REST controls? Here are the options. Option A. session layer. Option B. northbound APIs. Option C. EEM applets or scripts. Option D. YAML output from responses to API calls. Pause the video now if you want time to think about the answer.
The correct answer is B. northbound APIs. Cisco DNA Center supports REST controls at the northbound APIs layer. Northbound APIs are the interface through which external applications and management systems interact with DNA Center to manage and monitor network devices and services. Now, why are the other options incorrect? Option A is incorrect. The session layer is a lower OSI layer that is not specific to where DNA Center exposes its REST controls. Option C is incorrect. EEM applets or scripts are used for event-driven automation but are not the layer where DNA Center REST controls operate. Option D is incorrect. YAML output from API responses is a format for returning data, not a layer where REST controls are supported. Therefore, B, northbound APIs, is the correct answer.
Play from 2:46:02 Question 99. Which characteristic applies to the endpoint security aspect of the Cisco Threat Defense architecture? Here are the options. Option A. detect and block ransomware in email attachments. Option B. outbound URL analysis and data transfer controls. Option C. user context analysis. Option D. blocking of fileless malware in real time. Pause the video now if you want time to think about the answer.
The correct answer is D. blocking of fileless malware in real time. The Cisco Threat Defense architecture includes real-time detection and blocking of fileless malware at the endpoint level. Fileless malware executes in memory without writing to disk, making it particularly dangerous; Threat Defense provides behavioral and memory-based detection to block it. Now, why are the other options incorrect? Option A is incorrect. Email attachment ransomware detection is part of email security, not the endpoint security aspect of Threat Defense. Option B is incorrect. Outbound URL analysis and data controls are typically handled by web and data loss prevention gateways. Option C is incorrect. User context analysis is more associated with identity and access management rather than endpoint threat defense. Therefore, D, blocking of fileless malware in real time, is the correct answer.
Play from 2:47:44 Question 100. Which LISP component decapsulates messages and forwards them to the map server responsible for the egress tunnel routers? Here are the options. Option A. Router Locator. Option B. Map Resolver. Option C. Proxy ETR. Option D. Ingress Tunnel Router. Pause the video now if you want time to think about the answer.
The correct answer is B. Map Resolver. The Map Resolver is the LISP component that receives decapsulated messages (ELP requests) from the Ingress Tunnel Router and forwards them to the appropriate Map Server responsible for the egress tunnel routers. It acts as an intermediary in the LISP mapping system, resolving location identities to routing locators. Now, why are the other options incorrect? Option A is incorrect. A Router Locator is a routing address identifier, not a processing component that decapsulates and forwards messages. Option C is incorrect. A Proxy ETR (Egress Tunnel Router) encapsulates and forwards traffic on behalf of non-LISP sites, but does not handle message decapsulation and forwarding to map servers. Option D is incorrect. An Ingress Tunnel Router sends encapsulated packets and initiates map requests, but does not decapsulate messages intended for map servers. Therefore, B, Map Resolver, is the correct answer.
More Cisco videos
See all videos- CCNA Cybersecurity 200-201
100 Free CCNA Cybersecurity 200-201 Practice Questions and Answers
