WorksheetsTest 1-100
Total questions: 100
Worksheet time: 52mins
What does a YANG model provide?
standardized data structure that can be used only with NETCONE or RESTCONF transport protocols
creation of transport protocols and their interaction with the OS
user access to interact directly with the CLI of the device to receive or modify network configurations
standardized data structure independent of the transport protocols
Refer to the exhibit. Which two commands are required on router R1 to block TP and allow all other traffic from the Branch 2 network? (Choose two)
interface GigabitEthernet0/0
ip address 10.0.0.1 255.255.255.252
ip access-group 101 out
access-list 101 deny tcp 10.0.2.0 0.0.0.255 host 10.0.101.3 eq ftp-data
access-list 101 permit ip any any
access-list 101 deny tcp 10.0.2.0 0.0.0.255 host 10.0.101.3 eg ft
access-list 101 permit ip any any
interface GigabitEthernet0/0
ip address 10.0.101.1 255.255.255.252
ip access-group 101 in
access-list 101 deny tcp 10.0.2.0 0.0.0.255 host 10.0.101.3 eq ftp
access-list 101 deny tcp 10.0.2.0 0.0.0.255 host 10.0.101.3 eq ftp-data
access-list 101 permit ip any any
What is a fact about Cisco EAP-FAST?
It is an lET standard.
It does not require a RADIUS server certificate.
It operates in transparent mode
It requires a client certificate.
A company plans to implement intent-based networking in its campus infrastructure. Which design facilitates a migration from a traditional campus design to a programmable fabric design?
three-tier
routed access
two-tier
Layer 2 access
Refer to the exhibit. Which privilege level is assigned to VTY users?
13
7
15
1
Which resource must a hypervisor make available to the virtual machines?
Storage
secure acc
IP address
Bandwidth
In a Cisco Catalyst switch equipped with two supervisor modules, an administrator must temporarily remove the active supervisor from the chassis to perform hardware maintenance on it. Which mechanism ensures that the active supervisor removal is not disruptive to the network operation?
SSO
NSF/NSR
HSRP
VRRP
An engineer must configure interface and sensor monitoring on a router. The NMS server is located in a trusted zone with IP address 10.15.2.19. Communication between the router and the NMS server must be encrypted and password-protected using the most secure algorithms. Access must be allowed only for the NMS server and with the minimum permission levels needed. Which configuration must the engineer apply?
ip access-list standard nms
permit 10.15.2.19 0.0.0.0
shmp-server view ro iso included
snmp-server view ro ifEntry included
snmp-server group ms v3 priv read ro access nms
snmp-server user user1 nms v3 auth sha Password1 pri aes 256 Password 123
ip access-list extended nms
permit 1 host 10.15.2.19 any
snmp-server view ro internet included
snmp-server view ro ifEntry included
snmp-server group ms v3 priv notify ro access nms
snmp-server user user1 nms v3 encrypted auth md5 Password1 pri 3des Password 123
ip access-list standard nms
permit 10.15.2.19 0.0.0.0
snmp-server view rw iso included
Mehn
2024.
snmp-server view.w ifEntry included
snmp-server group nms v3 auth write w access nms
ip access-list standard nms
permit 10.15.2.19 255.255.255.255
snmp-server view ro cisco included
snmp-server view ro ifEntry included
snmp-server group nms v3 priv read ro access nms
snmp-server user user1 nms v3 auth 3des Password1 pri aes 192 Password123
What is the difference between a RIB and a FIB?
The FIB is where all IP routing information is stored.
The RIB is used to make IP source prefix-based switching decisions
The FIB is populated based on RIB content
The RIB maintains a mirror image of the FIB
Refer to the exhibit. What does the error message relay to the administrator who is trying to configure a Cisco IOS device?
The NETCONF running datastore is currently locked.
NETCONF message with valid content based on the YANG data models was made, but the request failed
A NETCONF request was made for a data model that does not exist.
The device received a valid NETCONF request and serviced it without error.
Refer to the exhibit. The WLC administrator sees that the controller to which a roaming client associates has Mobility Role Anchor configured under Clients > Detail. Which type of roaming is supported?
intracontroller
Layer 3 intercontroller
Layer 2 intercontroller
indirect
Which technology is used to provide Layer 2 and Layer 3 logical networks in the Cisco SD-Access architecture?
VPN routing/forwarding
overlay network
easy virtual network
underlay network
Refer to the exhibit. The IP SLA is configured in a router: An engineer must configure an EEM applet to shut down the interface and bring it back up when there is a problem with the IP SLA Which configuration should the engineer use?
event manager applet EEM_IP_SLA
event sla 10 state down
event manager applet EEM_IP_SLA
event sla 10 state unreachable
event manager applet EEM_IP_SLA
event track 10 state unreachable
event manager applet EEM_IP_SLA
event track 10 state down
What is the recommended MTU size for a Cisco SD-Access Fabric?
4464
1791
9100
1500
What is one characteristic of Cisco DNA Center and Manage northbound APls?
They push configuration changes down to devices.
They are RESTful APls.
They implement the NETCONF protocol
They exchange XML-formatted content
A network engineer is enabling HTTPS access to the core switch, which requires a certificate to be installed on the switch signed by the corporate certificate authority. Which configuration commands are required to issue a certificate signing request from the core switch?
Core-Switch(config)# ip http secure-trustpoint Core-Switch
Core-Switch(config)# crypto pki enroll Core-Switch
Core-Switch(config)# crypto pki enroll Core-Switch
Core-Switch(config)# ip http secure-trustpoint Core-Switch
Core-Switch(config)# crypto pki trustpoint Core-Switch
Core-Switch(ca-trustpoint)# enrollment terminal
Core-Switch(config)# crypto pki enroll Core-Switch
Core-Switch(config)# crypto pki trustpoint Core-Switch
Core-Switch(ca-trustpoint)# enrollment terminall
Core-Switch(config)# ip http secure-trustpoint Core-Switch
Which devices does Cisco DNA Center configure when deploying an IP-based access control policy?
all devices integrating with ISE
all devices in selected sites
selected individual devices
all wired devices
What is a characteristic of VXLAN?
It has a 12-byte packet header
It extends Layer 2 and Layer 3 overlay networks over a Layer 2 underlay
It uses TCP for transport.
It is a multi-tenant solution.
Which device makes the decision for a wireless client to roam?
WCS location server
wireless LAN controller
access point
wireless client
Refer to the exhibit. Clients are reporting an issue with the voice traffic from the branch site to the central site. What is the cause of this issue?
There is a routing loop on the network
The voice traffic is using the link with less available bandwidth
Traffic is load-balancing over both links, causing packets to arrive out of order
There is a high delay on the WAN links
What is one difference between SaltStack and Ansible?
SaltStack uses SSH to interact with Cisco devices, whereas Ansible uses an event bus.
SaltStack uses the Ansible agent on the box, whereas Ansible uses a Telnet server on the box
SaltStack is constructed with minion, whereas Ansible is constructed with YAML
SaltStack uses an API proxy agent to program Cisco boxes in agent mode, whereas Ansible uses a Telnet connection.
Refer to the exhibit. An engineer applies this configuration to R1:
ip nat inside source static 192.168.10.17192.168.27.42
Which command set should be added to complete the configuration?
R1(config)# interface GigabitEthernet 0/0
R1 (config-if)# ip nat outside
R1(config)# interface GigabitEthernet 0/1
R1 (config-if)# ip nat inside
R1(config)# interface GigabitEthernet 0/0
R1(config)# ip pat inside
R1 (config)# interface GigabitEthernet 0/1
R1(config)# ip pat outside
R1(config)# interface GigabitEthernet 0/0
R1 (config)# ip pat outside
R1(config)# interface GigabitEthernet 0/1
R1(config)# ip pat inside
R1 (config)# interface GigabitEthernet 0/0
R1 (config-if)# ip nat inside
R1(config)# interface GigabitEthernet 0/1
R1 (config-if)# ip nat outside
Which version of NetFlow does Cisco Threat Defense utilize to obtain visibility into the network?
8
NBAR2
flexible
IPFIX
In a campus network design, what are two benefits of using BFD for failure detection? (Choose two.)
BFD speeds up routing convergence time.
BFD enables network peers to continue forwarding packets in the event of a restart.
BFD provides fault tolerance by enabling multiple routers to appear as a single virtual router.
BFD provides path failure detection in less than a second
BFD is an efficient way to reduce memory and CPU usage.
Where is the wireless LAN controller located in a mobility express deployment?
The wireless LAN controller is embedded into the access point.
The wireless LAN controller exists in a server that is dedicated for this purpose
The wireless LAN controller exists in the cloud
There is no wireless LAN controller in the network.
Which two methods are used by an AP that is trying to discover a wireless LAN controller? (Choose two.)
DHCP Option 43
Cisco Discovery Protocol neighbor
broadcasting on the local subnet
DNS lookup CISCO-DNA-PRIMARY.localdomain
querying other APs
A system must validate access rights to all its resources and must not rely on a cached permission matrix. If the access level to a given resource is revoked but is not reflected in the permission matrix, the security is violated. Which term refers to this REST security design principle?
economy of mechanism
least common mechanism
complete mediation
separation of privilege
Refer to the exhibit. PC-1 must access the web server on port 8080. To allow this traffic, which statement must be added to an access control list that is applied on SW2 port GO/0 in the inbound direction?
permit tcp host 172.16.0.2 host 192.168.0.5 eq 8080
permit tcp host 192.168.0.5 It 8080 host 172.16.0.2
permit tcp host 192.168.0.5 eq 8080 host 172.16.0.2
permit tcp host 192.168.0.5 host 172.16.0.2 eq 8080
An engineer must configure an ACL that permits packets which include an ACK in the TCP header. Which entry must be included in the ACL?
access-list 110 permit tcp any any eq 21 tcp-ack
access-list 110 permit tcp any any eq 21 established
access-list 10 permit ip any any eq 21 tcp-ack
access-list 10 permit tcp any any eq 21 established
Which feature is provided by Cisco Mobility Services Engine in a Cisco Wireless Unified Network architecture?
It adds client tracking and location API
It adds client packet capturing
It enables NetFlow data collection
It identifies authentication problems
Refer to the exhibit. An engineer must allow the FTP traffic from users on 172.16.1.0/24 to 172.16.2.0/24 and block all other traffic. Which configuration must be applied?
R1 (config)# access-list 120 deny any any
R1(config)# access-list 120 permit tcp 172.16.1.0 0.0.0.255 172. 16.2.00.0.0.255 21
R1(config)# interface giga 0/0
R1(config-if)# ip access-group 120 out
R1(config)# access-list 120 permit tcp 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255 20
R1 (config)# access-list 120 permit tcp 172.16.1.00.0.0.255 172.16.2.0 0.0.0.255 21
R1 (config)# interface giga 0/2
R1(config-if)# ip access-group 120 in
R1(config)# access-list 120 permit tcp 172.16.1.0 0.0.0.255 21 172.16.2.0 0.0.0.255
R1(config)# access-list 120 permit udp 172.16.1.0 0.0.0.255 21 172.16.2.0 0.0.0.255
R1(config)# interface giga 0/2
R1 (config-if)# ip access-group 120 out
R1(config)# access-list 120 permit tcp 172.16,1.00.0.0.255 21 172.16.2.0 0.0.0.255
R1 (config)# interface giga 0/2
R1 (config-if)# ip access-group 120 in
A wireless administrator must create a new web authentication corporate SSID that will be using ISE as the external RADIUS server. The guest VLAN must be specified after the authentication completes. Which action must be performed to allow the ISE server to specify the guest VLAN?
Enable AAA Override
Set AAA Policy name
Enable Network Access Control State
Set RADIUS Profiling
Which exhibit displays a valid JSON file?
{
"hostname": "edge_router_1",
"interfaces": {
"GigabitEthernet1/1"
"GigabitEthernet1/2"
"GigabitEthernet1/3"
}
}
{
"hostname": "edge_router_1",
"interfaces": {
"GigabitEthernet1/1",
"GigabitEthernet1/2",
"GigabitEthernet1/3",
}
}
{
"hostname": "edge_router_1",
"interfaces": [
"GigabitEthernet1/1",
"GigabitEthernet1/2",
"GigabitEthernet1/3"
]
}
{
"hostname": "edge_router_1",
"interfaces": {
"GigabitEthernet1/1"
"GigabitEthernet1/2"
"GigabitEthernet1/3"
}
}
If the noise floor is -90 dBm and the wireless client is receiving a signal of -75 dBm, what is the SNR?
15
83
-165
1.2
Refer to the exhibit. Which commands are required to allow SSH connections to the router?
Router(config)#access-list 100 permit udp any any eq 22
Router(config)#access-list 101 permit tcp any any eq 22
Router(config)#class-map class-ssh
Router(config-cmap)#match access-group 101
Router(config)#policy-map CoPP
Router(config-pmap)#police 100000 conform-action transmit
Router(config)#access-list 100 permit tcp any any eq 22
Router(config)#access-list 101 permit tcp any any eq 22
Router(config)#class-map class-ssh
Router(config-cmap)#match access-group 101
Router(config)#policy-map CoPP
Router(config-pmap)#class class-ssh
Router(config-pmap-c#police 100000 conform-action transmit
Router(config)#access-list 100 permit tcp any eq 22 any
Router(config)#class-map class-ssh
Router(config-cmap)#match access-group 10
Router(config)#policy-map CoPP
Router(config-pmap)#class class-ssh
Router(config-pmap-c)#police 100000 conform-action transmit
Router(config)#access-list 10 permit tcp any eq 22 any
Router(config)#class-map class-ssh
Router(config-cmap)#match access-group 10
Router(config)#policy-map CoPP
Router(config-pmap)#class class-ssh
Router(config-pmap-c)#police 100000 conform-action transmit
A customer wants to provide wireless access to contractors using a guest portal on Cisco ISE. The portal is also used by employees. A solution is implemented, but contractors receive a certificate error when they attempt to access the portal. Employees can access the portal without any errors. Which change must be implemented to allow the contractors and employees to access the portal?
Install a trusted third-party certificate on the contractor devices
Install an Internal CA signed certificate on the Cisco ISE
Install an internal CA signed certificate on the contractor devices
Install a trusted third-party certificate on the Cisco ISE
Which Python library is used to work with YANG data models via NETCONF?
cURL
ncclient
Postman
requests
What is one role of the VTEP in a VXLAN environment?
to maintain VLAN configuration consistency
to forward packets to non-LISP sites
to provide EID-to-RLOC mapping
to encapsulate the tunnel
Which behavior can be expected when the HSRP version is changed from 1 to 2?
Each HSRP group reinitializes because the virtual MAC address has changed
No changes occur because version 1 and 2 use the same virtual MAC OUI
Each HSRP group reinitializes because the multicast address has changed
No changes occur because the standby router is upgraded before the active router
Refer to the exhibit. Hosts PC1, PC2, and PC3 must access resources on Server1. An engineer configures NAT on Router R1 to enable the communication and enters the show command to verity operation. Which IP address is used by the hosts when they communicate globally to Server1?
their own address in the 10.10.10.0/24 range
155.1.1.1
155.1.1.5
random addresses in the 155.1.1.0/24 range
What is the function of the LISP map resolver?
to send traffic to non-LISP sites when connected to a service provider that does not accept nonroutable ElDs as packet sources
to connect a site to the LISP-capable part of a core network, publish the EID-to-RLOC mappings for the site and respond to map-
request messages
to decapsulate map-request messages from ITRs and forward the messages to the MS
to advertise routable non-USP traffic from one address family to LISP sites in a different address family
What is used to perform QoS packet classification?
the TOS field in the Layer 3 header
the Options field in the Layer 3 header
the Flags field in the Layer 3 header
the Type field in the Layer 2 frame
Refer to the exhibit. An engineer must configure an ERSPAN tunnel that mirrors traffic from Linux1 on Switch1 to Linux2 on Switch2.Which command must be added to the source configuration to enable the ERSPAN tunnel?
(config-mon-erspan-src-dst)#traffic bidirectional
(config-mon-erspan-src-dst)#no shut
(config-mon-erspan-src-dst)#ip address 10.10.10.10
(config-mon-erspan-src-dst)monitor session 1 activate
When a DNS host record is configured for a new Cisco AireOS WLC, which hostname must be added to allow APs to successfully discover the WLC?
CISCO-CAPWAP-CONTROLLER
CISCO-CONTROLLER-CAPWAP
CAPWAP-CISCO-CONTROLLER
CONTROLLER-CAPWAP-CISCO
An engineer must create an EEM script to enable OSPF debugging in the event the OSPF neighborship goes down. Which script must the engineer apply?
event manager applet ENABLE OSPF DEBUG
event syslog pattern "%OSPF-5-ADJCHG: Process 6, Nbr 1,1.1.1 on Serlal0/0 from FULL to DOWN"
action 1.0 cli command "enable"
action 2.0 cli command "debug ip ospf event"
action 3.0 cli command "debug ip ospf adi"
action 4.0 syslog priority informational msg "ENABLE_OSPF_DEBUG"
event manager applet ENABLE OSPF DEBUG
event syslog pattern "%OSPF-5-ADJCHG: Process 5, Nbr 1.1.1,1 on Serlal0/0 from LOADING to FUL!
action 1.0 cli command "debug ip ospf event"
action 2.0 cli command "debug ip ospf adj"o
action 3.0 syslog priority informational msg "ENABLE_OSPF_DEBUG"
event manager applet ENABLE_OSPE-DEBUG
event syslog pattern "%OSPE-1-ADJCHG: Process 5, Nbr 1.1.1.1 on Serial0/0 from FULL to DOWN°
action 1.0 cli command "debug ip ospf event"
action 2.0 cll command "debug ip ospf adi"
action 3.0 syslog priority informational msg "ENABLE_OSPF_ DEBUG"
event manager applet ENABLE_OSPF-DEBUG
event syslog pattern"%OSPF-5-ADJCFG. Process 5, Nbr 1.1,1.1 on SerialO/0 from LOADING to FULL"
action 1.0 cli command "enable"
action 2.0 cli command "debug ip ospf event"
action 3.0 cli command "debug ip ospf adj"
action 4.0 syslog priority informational msg "ENABLE_OSPF_DEBUG"
Which LISP component is required for a LISP site to communicate with a non-LISP site?
ITR
ETR
Proxy ITR
Proxy ETR
When configuring WPA2 Enterprise on a WLAN, which additional security component configuration is required?
RADIUS server
TACACS server
PKI server
NTP server
Refer to the exhibit. An engineer is troubleshooting an mDNS issue in an environment where Cisco ISE is used to dynamically assign mDNS roles to users. The engineer has confirmed that ISE is sending the correct values, but name resolution is not functioning as expected. Which WLC configuration change resolves the issue?
Enable Aironet IE
Enable AAA Override.
Change NAC state to ISE NAC.
Set MFP client protection to Required
Refer to the exhibit: Which action completes the configuration to achieve a dynamic continuous mapped NAT for all users?
Reconfigure the pool to use the 192.168.1.0 address range
Increase the NAT pool size to support 254 usable addresses
Configure a match-host type NAT pool.
Configure a one-to-one type NAT pool
Which capability does a distributed virtual switch have?
to use floating static routes
to provide centralized management for virtual switches
to use advanced IPsec encryption algorithms
to run dynamic routing protocols
Using the EIRP formula, what parameter is subtracted to determine the EIRP value?
antenna gain
signal-to-noise ratio
antenna cable loss
transmitter power
An engineer is configuring RADIUS-Based Authentication with EAP. MS-CHAPV2 is configured on a client device. Which outer method protocol must be configured on the ISE to support this authentication type?
LDAP
EAP-TLSO
EAP-FAST
PEAP
An engineer must configure an EXEC authorization list that first checks a AAA server then a local username. If both methods fail, the user is denied. Which configuration should be applied?
aaa authorization exec default group radius local
aaa authorization exec default group radius local none
aaa authorization exec default local group radius none
aaa authorization exec default local group tacacs+
A network engineer is configuring Flexible NetFlow and enters these commands:
sampler NetFlow1
mode random one-out-of 100
interface fastethernet 1/0
flow-sampler NetFlow1
What are two results of implementing this feature instead of traditional NetFlow? (Choose two.)
The accuracy of the data to be analyzed is improved
CPU and memory utilization are reduced
Only the flows of top 100 talkers are exported
The data export flow is more secure
The number of packets to be analyzed are reduced
Which function is performed by Smart in the Cisco SD-WAN architecture?
facilitation of NAT detection and traversal
distribution of IPsec keys
redistribution between
OMP and other routing protocols
execution of localized policies
What is a consideration when designing a Cisco SD-Access underlay network?
End user subnets and endpoints are part of the underlay network
It must support IPv4 and IPv6 underlay networks
The underlay switches provide endpoint physical connectivity for users
Static routing is a requirement
What is a characteristic of a Type 1 hypervisor?
It is installed on an operating system and supports other operating systems above it
It is completely independent of the operating system
Problems in the base operating system can affect the entire system
It is referred to as a hosted hypervisor
A company recently decided to use RESTCONF instead of NETCONF, and many of their NETCONF Scripts contain the operation < edit-config> (operation="create"). Which RESTCONF operation must be used to replace these statements?
PUT
CREATE
POST
GET
In a Cisco SD-Access solution, what is the role of the Identity Services Engine?
It provides GUl management and abstraction via apps that share context
It is used to analyze endpoint to app flows and monitor fabric status
It is leveraged for dynamic endpoint to group mapping and policy definition
It manages the LISP EID database
A client requests a wireless solution for remote branch offices to eliminate the need for a local controller at each branch. The branch users require local termination in a specific VLAN for local internet breakout. Which solution must be deployed?
FlexConnect local switching
central switched
auto-anchor mobility
asymmetric tunneling
Which outbound access list, applied to the WAN interface of a router, permits all traffic except for http traffic sourced from the workstation with IP address 10.10.10.1?
ip access-list extended NO_HTTP
deny tcp host 10,10.10.1 any eq 80
ip access-list extended 200
deny tcp host 10.10.10.1 eq 80 any
permit ip any any
ip access-list extended 10
deny tcp host 10.10.10.1 any eq 80
permit ip any any
ip access-list extended 100
deny tcp host 10.10.10.1 any eq 80
permit ip any any
Which option must be used to support a WLC with an IPv6 management address and 100 Cisco Aironet 2800 Series access points that will use DHCP to register?
82
43
52
60
Refer to the exhibit. What is output by this code?
for x in range(6):
print(x)
0 1 2 3 4
0 1 2 3 4 5
0 5
(0,5)
Refer to the exhibit. A network administrator must configure router B to allow traffic only from network 10.100.2.0 to networks outside of router B. Which configuration must be applied?
RouterB(config)#access-list 101 permit ip 10.100.2.0 0.0.0.255 any
RouterB(config)#int g0/0/0
RouterB(config-if#ip access-group 101 out
RouterB (config)#int g0/0/1
RouterB(config-if)#ip access-group 101 out
RouterB(config)#access-list 101 permit ip 10.100.2.0 0.0.0.255 any
RouterB(config)#access-list 101 deny any
RouterB(config)#int g0/0/0
RouterB(config-if)#ip access-group 101 out
RouterB(config)#access-list 101 permit ip 10.100.2.0 0.0.0.255 any
RouterB(config)#access-list 101 deny any
RouterB (config)#int g0/0/2
RouterB(config-if)#ip access-group 101 in
RouterB(config)#access-list 101 permit ip 10.100.3.0 0.0.0.255 any
RouterB(config)#access-list 101 deny any
RouterB(config)int g0/0/0
RouterB(config-if)#ip access-group 101 out
RouterB(config)#int g0/0/1
RouterB(config-if#ip access-group 101 out
Refer to the exhibit. An engineer must modify the access control list EGRESS to allow all IP traffic from subnet 10.1.10.0/24 to 10.1.2.0/24. The access control list is applied in the outbound direction on router interface Gigabit Ethernet 0/1. Which configuration commands can the engineer use to allow this traffic without disrupting existing traffic flows?
config t
ip access-list extended EGRESS2
permit ip 10.1.10.0 0.0.0.255 10.1.2.0 0.0.0.255
permit ip 10.1.100.0 0.0.0.255 10.1.2.0 0.0.0.255
deny ip any any
!
interface g0/1
no ip access-group EGRESS out
ip access-group EGRESS2 out
config t
ip access-list extended EGRESS
5 permit ip 10.1.10.0 0.0.0.255 10.1.2.0 0.0.0.255
config t
ip access-list extended EGRESS
permit ip 10.1.10.0 0.0.0.255 10.1.2.0 0.0.0.255
config t
ip access-list extended EGRESS
permit ip 10.1.10.0 255.255.255.0 10.1.2.0 255.255.255.0
Refer to the exhibit. How does the router handle traffic after the CoPP policy is configured on the router?
Traffic generated by R1 that matches access list SNMP is policed
Traffic coming to R1 that does not match access list SNMP is dropped
Traffic passing through R1 that matches access list SNMP is policed
Traffic coming to R1 that matches access list SNMP is policed
Which QoS feature uses the IP Precedence bits in the ToS field of the IP packet header to partition traffic into different priority levels?
shaping
marking
classification
policing
What are two characteristics of a directional antenna? (Choose two.)
receive signals equally from all directions
provides the most focused and narrow beam-width
high gain
commonly used to cover large areas
low gain
Which HTTP status code is the correct response for a request with an incorrect password applied to a REST API session?
HTTP Status Code:401
HTTP Status Code: 504
HTTB Status Code:200
HTTP Status Code:302
In a Cisco SD-Access wireless environment, which device is responsible for hosting the anycast gateway?
fabric edge node
fusion router
control plane node
fabric border node
An engineer is configuring Local WebAuth on a Cisco Wireless LAN Controller. According to RFC 5737, which virtual IP address must be used in this configuration?
1.1.1.1
192.0.2.1
192.168.0.1
172.20.10.1
Refer to the exhibit. Users cannot reach the web server at 192.168. 100.1. What is the root cause for the failure?
The gateway cannot translate the server domain name
The server is attempting to load balance between links 10.100.100.1 and 10.100.200.1
The server is out of service
There is a loop in the path to the server
An engineer must provide wireless coverage in a square office. The engineer has only one AP and believes that it should be placed it in the middle of the room. Which antenna type should the engineer use?
Yagi
directional
Omnidirectional
Polarized
Which characteristic distinguishes Ansible from Chef?
The Ansible server can run on Linux, Unix or Windows. The Chef server must run on Linux or Unix
Ansible pushes the configuration to the client. Chef client pulls the configuration from the server
Ansible lacks redundancy support for the master server. Chef runs two masters in an active/active mode
Ansible uses Ruby to manage configurations, Chef uses YAML to manage configurations
Refer to the exhibit. What is output by this code?
count = 8
while count > 4:
print (count)
count -= 1
8 7 6 5
-1 -2 -3 -4
4 5 6 7 0
-4 -5 -6 -7
Which Cisco SD-WAN component authenticates the routers and the Smart controllers?
Bond orchestrator
Manage NMS
vEdge
vAnalytics
How does policy-based routing function?
It processes traffic based on the destination IP address
It processes packets entering an interface and overrides the logic in the routing table
It processes egress packets and changes the next hop based on the destination IP address
It schedules traffic based on policies applied to queues
Which algorithms are used to secure REST API from brute force attacks and minimize the impact?
PBKDF2, BCrypt, and SCrypt
SHA-512 and SHA-384
MD5 algorithm-128 and SHA-384
SHA-1, SHA-256, and SHA-512
What are two benefits of implementing a Cisco SD-WAN architecture? (Choose two.)
It enforces a single, scalable, hub-and-spoke topology
It simplifies endpoint provisioning through standalone router management
It provides resilient and effective traffic flow using MPLS
It allows configuration of applicatlon-aware policies with real time enforcement
It improves endpoint protection by Integrating embedded and cloud security features
Which encryption hashing algorithm does NTP use for authentication?
SSL
MD5
AES256
AES128
Which virtualization component creates VMs and performs hardware abstraction that allows multiple VMs to run at the same time?
Docker
Container
rkt
hypervisor
Refer to the exhibit. A network engineer configures NAT on R1 and enters the show command to verity the configuration. What does the output confirm?
A Telnet session from 160.1.1.1 to 10. 11.10 has been initiated
R1 is configured with PAT overload parameters
The first packet triggered NAT to add an entry to the NAT table
R1 is configured with NAT overload parameters
Refer to the exhibit. A company has an internal wireless network with a hidden SSID and RADIUS-based client authentic ation for increased security. An employee attempts to manually add the company network to a laptop, but the laptop does not attempt to connect to the network. The regulatory domains of the access points and the laptop are identical. Which action resolves this issue
Change the security type to WPA2-Personal AES
Limit the enabled wireless channels on the laptop to the maximum channel range that is supported by the access points
Ensure that the "Connect even if this network is not broadcasting" option is selected
Use the empty string as the hidden SSID network name
What is the function of the fabric control plane node In a Cisco SD-Access deployment?
It performs traffic encapsulation and security profiles enforcement in the fabric
It holds a comprehensive database that tracks endpoints and networks in the fabric
It provides Integration with legacy nonfabric-enabled environments
It is responsible for policy application and network segmentation in the fabric
A customer has recently implemented a new wireless infrastructure using WLC-5520s at a site directly next to a large commercial airport. Users report that they intermittently lose Wi-Fi connectivity, and troubleshooting reveals it is due to frequent channel changes. Which two actions fix this issue? (Choose two.)
Disable DFS channels to prevent interference with Doppler radar
Configure channels on the UNII-2 and the Extended UNII-2 sub bands of the 5 Ghz band only
Restore the DCA default settings because this automatically avoids channel interference
Remove UNII-2 and Extended UNII-2 channels from the 5 Ghz channel list
Enable DFS channels because they are immune to radar interference
A network engineer configures a WLAN controller with increased security for web access. There is IP connectivity with the WLAN controller, but the engineer cannot start a management session from a web browser. Which action resolves the issue?
Use a private or incognito session
Disable Adobe Flash Player
Use a browser that supports 128-bit or larger ciphers
Disable JavaScript on the web browser
Refer to the exhibit. An engineer must configure a Cisco WLC with WPA2 Enterprise mode and avoid global server lists. Which action is required?
Enable EAP parameters
Select a RADIUS authentication server
Disable the RADIUS server accounting interim update
Apply CISCO ISE default settings
Refer to the exhibit. What is displayed when the code is run?
The answer is 100
The answer is 25
The answer is 5
The answer is 70
An engineer modifies the existing ISE guest portal URL to use a static FQDN. Users immediately report that they receive certificate errors when they are redirected to the new page. Which two additional configuration steps are needed to implement the change? (Choose two.)
Add the FQDN entry under the WLC virtual interface
Add a new DNS record to resolve the FQDN to the PSN IP address
Disable HTTPS on the WLC under the Management menu
Manualy configure the hosts file on each user device
Create and sign a new CSR that contains the static FQDN entry
Which TLV value must be added to Option 43 when DHCP is used to ensure that APs join the WLC?
0x77
642
AAA
0xf1
Refer to the exhibit. Which two facts does the device output confirm? (Choose two.)
The device is using the default HSRP hello timer
The standby device is configured with the default HSRP priority
The device sends unicast messages to its peers
The device is configured with the default HSRP priority
The device's HSRP group uses the virtual IP address 10.0.3.242
How does EIGRP differ from OSPF?
EIGRP uses more CPU and memory than OSPF
EIGRP supports equal or unequal path cost, and OSPF supports only equal path cost
EIGRP is more prone to routing loops than OSPF
EIGRP has a full map of the topology, and OSPF only knows directly connected neighbors
An engineer must configure a multicast UDP jitter operation. Which configuration should be applied?
Router(config)#ip sla 1
Router(config)#udp jitter 10.0.0.1 source-ip 192. 168. 1.1
Router(config)#ip sla 1
Router(config)#udp-jitter 192.0.2.115 65051 num-packets 20
Router(config)#ip sla 1
Router(config)#udp jitter 239.1.1.1 65051 end-point list List source-ip 192.168.1.1
Router(config)#ip sla 1
Router(config)#udp-jitter 192.0.2.115 65051
Refer to the exhibit. A network engineer must log in to the router via the console, but the RADIUS servers are not reachable. Which credentials allow console access?
no username and only the password "cisco 123"
the username "cisco" and the password "cisco 123"
no username and only the password "test 123"
the username "cisco" and the password "cisco"
What is a characteristic of a type 2 hypervisor?
referred to as bare-metal
ideal for client/end-user system
ideal for data center
complicated deployment
Which activity requires access to Cisco DNA Center CLI?
provisioning a wireless LAN controller
graceful shutdown of Cisco DNA Center
upgrading the Cisco DNA Center software
creating a configuration template
What is the responsibility of a secondary WLC?
It registers the LAPs if the primary controller fails
It shares the traffic load of the LAPs with the primary controller
It enables Layer 2 and Layer 3 roaming between itself and the primary controller
It avoids congestion on the primary controller by sharing the registration load on the LAPs
Refer to the exhibit. Which command filters the ERSPAN session packets only to interface GigabitEthernet1?
source interface gigabitethernet1 ip 10.10.10.1
destination ip 10.10.10.1
source ip 10.10.10.1
filter access-group 10
When is GLBP preferred over HSRP?
When the gateway routers are a mix of Cisco and non-Cisco routers
When the traffic load needs to be shared between multiple gateways using a single virtual IP
When clients need the gateway MAC address to be the same between multiple gateways
When encrypted hellos are required between gateways in a single group
Which action is a LISP ITR responsible for?
accepting registration requests from ETRs
responding to map-request messages
forwarding user data traffic
finding EID-to-RLOC mappings
