Cisco CCNP Enterprise 300-410 Questions & Answers

• Question 671:

  DRAG DROP

  Drag and drop the MPLS VPN device types from me left onto the definitions on the right.

  Select and Place:

  

  Correct Answer:

  

  +

  device in the enterprise network that connects to other customer devices: Customer (C) device

  +

  device in the core of the provider network that switches MPLS packets: Provider (P) device

  +

  device that attaches and detaches the VPN labels to the packets in the provider network: PEdevice

  +

  device at the edge of the enterprise network that connects to the SP network: CE device

• Question 672:

  DRAG DROP

  Drag and Drop the IPv6 First-Hop Security features from the left onto the definitions on the right.

  Select and Place:

  

  Correct Answer:

  

  +

  Block reply and advertisement messages from unauthorized DHCP servers and relay agents: IPv6 DHCPv6 Guard

  +

  Create a binding table that is based on NS and NA messages: IPv6 ND Inspection

  +

  Filter inbound traffic on Layer 2 switch port that are not in the IPv6 binding table: IPv6 Source Guard

  +

  Block a malicious host and permit the router from a legitimate route: IPv6 RA Guard

  +

  Create IPv6 neighbors connected to the device from information sources such as NDP snooping: IPv6 Binding Table

• Question 673:

  DRAG DROP

  Drag and drop the actions from the left into the correct order on the right to configure a policy to avoid following packet forwarding based on the normal routing path.

  Select and Place:

  

  Correct Answer:

  

  Step 1 – configure ACLs Step 2 – configure route map instances Step 3 – configure match commands Step 4 – configure set commands Step 5 – configure PBR on the interface Step 6 – configure fast switching for PBR

  Reference: https://community.cisco.com/t5/networking-documents/how-to-configure-pbr/ta-p/3122774

• Question 674:

  DRAG DROP

  Drag and drop the BGP states from the left to the matching definitions on the right.

  Select and Place:

  

  Correct Answer:

  

  

• Question 675:

  DRAG DROP

  Click and drag the associated set of OSPF LEAs on the left to the corresponding area type on the right where this set of LEAs may be seen.

  Select and Place:

  

  Correct Answer:

  

• Question 676:

  DRAG DROP Refer to the exhibit.

  

  Drag and drop the credentials from the left onto the remote login information on the right to resolve a failed login attempt to vtys. Not all credentials are used.

  Select and Place:

  

  Correct Answer:

  

  vty 0:

  +

  cisco

  +

  0csic

  vty 1:

  +

  no username

  +

  no password

  The command “aaa authentication login default none” means no authentication is required when access to the device via Console/VTY/AUX so if one interface does not specify another login authentication method (via the “login authentication …” command), it will allow to access without requiring username or password. In this case VTY 1 does not specify another authentication login method so it will use the default method (which is “none” in this case).

• Question 677:

  DRAG DROP

  Drag and drop the SNMP attributes in Cisco IOS devices from the left onto the correct SNMPv2c or SNMPV3 categories on the right.

  Select and Place:

  

  Correct Answer:

  

  Both SNMPv1 and v2 did not focus much on security and they provide security based on community string only. Community string is really just a clear text password (without encryption). Any data sent in clear text over a network is vulnerable to packet sniffing and interception. There are two types of community strings in SNMPv2c:

  +

  Read-only (RO): gives read-only access to the MIB objects which is safer and preferred to other method.

  +

  Read-write (RW): gives read and write access to the MIB objects. This method allows SNMP Manager to change the

  configuration of the managed router/switch so be careful with this type.

  The community string defined on the SNMP Manager must match one of the community strings on the Agents in order

  for the Manager to access the Agents.

  SNMPv3 provides significant enhancements to address the security weaknesses existing in the earlier versions. The concept of community string does not exist in this version. SNMPv3 provides a far more secure communication using entities, users and groups. This is achieved by implementing three new major features:

  +

  Message integrity: ensuring that a packet has not been modified in transit.

  +

  Authentication: by using password hashing (based on the HMAC-MD5 or HMAC-SHA algorithms) to ensure the message is from a valid source on the network.

  +

  Privacy (Encryption): by using encryption (56-bit DES encryption, for example) to encrypt the contents of a packet.

• Question 678:

  DRAG DROP

  Drag and drop the MPLS terms from the left onto the correct definitions on the right.

  Select and Place:

  

  Correct Answer:

  

  +

  device that forwards traffic based on labels: P

  +

  path that the labeled packet takes: LSP

  +

  device that is unaware of MPLS labeling: CE

  +

  device that removes and adds the MPLS labeling: PE

• Question 679:

  DRAG DROP

  Drag and drop the MPLS VPN concepts from the left onto the correct descriptions on the right.

  Select and Place:

  

  Correct Answer:

  

  +

  propagates VPN reachability information: multiprotocol BGP

  +

  distributes labels for traffic engineering: Resource Reservation Protocol

  +

  uniquely identifies a customer prefix: route distinguisher

  +

  controls the import/export of customer prefixes: route target

  Reference: https://www.rogerperkin.co.uk/featured/route-distinguisher-vs-route-target/

• Question 680:

  DRAG DROP

  Drag and drop the packet types from the left onto the correct descriptions on the right.

  Select and Place:

  

  Correct Answer:

  

  Unlike legacy network technologies such as ISDN, Frame Relay, and ATM that defined separate data and control channels, IP carries all packets within a single pipe. Thus, IP network devices such as routers and switches must be able to distinguish between data plane, control plane, and management plane packets to treat each packet appropriately. From an IP traffic plane perspective, packets may be divided into four distinct, logical groups:

  1.

  Data plane packets -End-station, user-generated packets that are always forwarded by network devices to other end-station devices. From the perspective of the network device, data plane packets always have a transit destination IP address and can be handled by normal, destination IP address- based forwarding processes.

  2.

  Control plane packets -Network device generated or received packets that are used for the creation and operation of the network itself. From the perspective of the network device, control plane packets always have a receive destination IP address and are handled by the CPU in the network device route processor. Examples include protocols such as ARP, BGP, OSPF, and other protocols that glue the network together.

  3.

  Management plane packets -Network device generated or received packets, or management station generated or received packets that are used to manage the network. From the perspective of the network device, management plane packets always have a receive destination IP address and are handled by the CPU in the network device route processor. Examples include protocols such as Telnet, Secure Shell (SSH), TFTP, SNMP, FTP, NTP, and other protocols used to manage the device and/or network.

  4.

  Services plane packets -A special case of data plane packets, services plane packets are also user- generated packets that are also forwarded by network devices to other end-station devices, but that require high-touch handling by the network device (above and beyond normal, destination IP address-based forwarding) to forward the packet.

  Examples of high-touch handling include such functions as GRE encapsulation, QoS, MPLS VPNs, and SSL/IPsec encryption/decryption, etc. From the perspective of the network device, services plane packets may have a transit destination IP address, or may have a receive destination IP address (for example, in the case of a VPN tunnel endpoint).

  Reference: https://tools.cisco.com/security/center/resources/copp_best_practices