Cisco 300-115 Online Practice Questions and Exam Preparation

Cisco 300-115 Online Questions & Answers

• Question 751:

  A Switch has been configured with the Vlan dot1q tag native command. Which statement describes what the switch does with untagged frames that it receives on a trunked interface

  A. Untagged frames are forwarded via the default VLAN
  B. it drops the untagged frames
  C. The trunked port is put in err-disabled state
  D. Untagged frames are forwarded via the native VLAN
  B. it drops the untagged frames

• Question 752:

  Which keyword must you use with the storm-control command to set both upper and lower thresholds for unicast, multicast, and broadcast?

  A. limit
  B. pps
  C. set
  D. level
  D. level

• Question 753:

  Refer to the exhibit.

  

  When troubleshooting a network problem, a network analyzer is connected to Port f0/1 of a LAN switch. Which command can prevent BPDU transmission on this port?

  A. spanning-tree portfast bpduguard enable
  B. spanning-tree bpduguard default
  C. spanning-tree portfast bpdufilter default
  D. no spanning-tree link-type shared
  C. spanning-tree portfast bpdufilter default

• Question 754:

  Drag and Drop

  Select and Place:

  

  

• Question 755:

  Under which two circumstances does a stack master lose its role? (Choose two.)

  A. When the stack master is rese
  B. When the priority value of a stack member is changed to a higher value.
  C. When a switch with a higher priority is added to the stack.
  D. When a stack member fails.
  E. When switch stack resets.
  B. When the priority value of a stack member is changed to a higher value.
  E. When switch stack resets.

• Question 756:

  What would happen if IEEE was VLAN 99 as native? (Choose two.)

  A. VLAN 1 tagged as 99
  B. VLAN 1 untagged as 99
  C. VLAN 99 tagged as 1
  D. VLAN 99 untagged as 1
  A. VLAN 1 tagged as 99
  B. VLAN 1 untagged as 99

• Question 757:

  What does the command vlan dot1q tag native accomplish when configured under global configuration?

  A. All frames within the native VLAN are tagged, except when the native VLAN is set to 1.
  B. It allows control traffic to pass using the non-default VLAN.
  C. It removes the 4-byte dot1q tag from every frame that traverses the trunk interface(s).
  D. Control traffic is tagged.
  D. Control traffic is tagged.

  ---

  The "vlan dot1q tag native" will tag all untagged frames, including control traffic, with the defined native VLAN.

• Question 758:

  Which AAA Authorization type includes PPP, SLIP, and ARAP connections?

  A. network
  B. IP mobile
  C. EXEC
  D. auth-proxy
  A. network

  ---

  Explanation: Method lists for authorization define the ways that authorization will be performed and the sequence in which these methods will be performed. A method list is simply a named list describing the authorization methods to be

  queried (such as RADIUS or TACACS+), in sequence. Method lists enable you to designate one or more security protocols to be used for authorization, thus ensuring a backup system in case the initial method fails. Cisco IOS software uses

  the first method listed to authorize users for specific network services; if that method fails to respond, the Cisco IOS software selects the next method listed in the method list. This process continues until there is successful communication

  with a listed authorization method, or all methods defined are exhausted. Method lists are specific to the authorization type requested:

  Auth-proxy--Applies specific security policies on a per-user basis. For detailed information on the authentication proxy feature, refer to the chapter "Configuring Authentication Proxy" in the "Traffic Filtering and Firewalls" part of this book.

  Commands--Applies to the EXEC mode commands a user issues. Command authorization attempts authorization for all EXEC mode commands, including global configuration commands, associated with a specific privilege level.

  EXEC--Applies to the attributes associated with a user EXEC terminal session. etwork--Applies to network connections. This can include a PPP, SLIP, or ARAP connection.

  Reverse Access--Applies to reverse Telnet sessions.

  When you create a named method list, you are defining a particular list of authorization methods for the indicated authorization type.

  Reference:

  http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfathor.ht ml

• Question 759:

  Lab Simulation - AAA dot1x

  SWITCH.com is an IT company that has an existing enterprise network comprised of two layer 2 only switches; DSW1 and ASW1. The topology diagram indicates their layer 2 mapping. VLAN 20 is a new VLAN that will be used to provide the

  shipping personnel access to the server. Corporate polices do not allow layer 3 functionality to be enabled on the switches.

  For security reasons, it is necessary to restrict access to VLAN 20 in the following manner:

  - Users connecting to VLAN 20 via portfO/1 on ASW1 must be authenticated before they are given access to the network. Authentication is to be done via a Radius server:

  -

  Radius server host: 172.120.40.46

  -

  Radius key: rad123

  -

  Authentication should be implemented as close to the host as possible.

  -

  Devices on VLAN 20 are restricted to the subnet of 172.120.40.0/24.

  -

  Packets from devices in the subnet of 172.120.40.0/24 should be allowed on VLAN 20.

  -

  Packets from devices in any other address range should be dropped on VLAN 20.

  -

  Filtering should be implemented as close to the serverfarm as possible The Radius server and application servers will be installed at a future date. You have been tasked with implementing the above access control as a pre-condition to installing the servers. You must use the available IOS switch features.

  

  A. Check the answer below
  A. Check the answer below

  ---

  1. Verification of Pre-configuration:

  a.

  Check that the denoted vlan [vlan20] is created in both switches and ports [fa0/1 of ASW1] are assigned.

  b.

  Take down the radius-server ip [172.120.39.46] and the key [rad123].

  c.

  Take down the IP range [172.120.40.0/24] to be allowed the given vlan [vlan20]

  2.

  Configure the Port based authentication on ASW1: Enable AAA on the switch: ASW1> enable ASW1# conf t ASW1(config)# aaa new-model The new-model keyword refers to the use of method lists, by which authentication methods and sources can be grouped or organized. Define the server along with its secret shared password: ASW1(config)# aaa authentication dot1x default group radius ASW1(config)# radius-server host 172.120.39.46 key rad123 This command causes the RADIUS server defined on the switch to be used for 802.1x authentication. Enable 802.1x on the switch: ASW1(config)# dot1x system-auth-control Configure Fa0/1 to use 802.1x: ASW1(config)# interface fastEthernet 0/1 ASW1(config-if)# switchport mode access ASW1(config-if)# dot1x port-control auto Notice that the word "auto" will force connected PC to authenticate through the 802.1x exchange. ASW1(config-if)# exit ASW1# copy running-config startup-config

  3.

  Filter the traffic and create vlan access-map to restrict the traffic only for a range on DSW1 Define an access-list: DSW1> enable DSW1# conf t (syntax: ip access-list {standard | extended} acl-name) DSW1(config)# ip access-list standard 10

  DSW1(config-ext-nacl)# permit 172.120.40.0 0.0.0.255

  DSW1(config-ext-nacl)# exit

  Define an access-map which uses the access-list above:

  (syntax: vlan access-map map_name [0-65535] )

  DSW1(config)# vlan access-map MYACCMAP 10

  (syntax: match ip address {acl_number | acl_name})

  DSW1(config-access-map)# match ip address 10

  DSW1(config-access-map)# action forward

  DSW1(config-access-map)# exit

  DSW1(config)# vlan access-map MYACCMAP 20

  (drop other networks)

  DSW1(config-access-map)# action drop

  DSW1(config-access-map)# exit

  Apply a vlan-map into a vlan:

  (syntax: vlan filter mapname vlan-list list)

  DSW1(config)# vlan filter MYACCMAP vlan-list 20

  DSW1# copy running-config startup-config

  4. Note:

  It is not possible to verify the configuration in this lab. All we have do the correct configurations. Most of the exam takers report that " copy running-config startup- config" is not working. It does not a matter.

  Do not try unwanted/wrong commands in the consoles. They are not real switches.

• Question 760:

  A question in relation to spanning-tree.

  (A question with an exhibit showing a port with about 5 VLANs on it asking what command had been ran on it.)

  A. spanning-tree portfast access
  B. spanning-tree portfast trunk
  C. spanning-tree trunk portfast
  D. spanning-tree access portfast
  B. spanning-tree portfast trunk