Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 1041:

  How does CEF switching differ from process switching on Cisco devices?

  A. CEF switching saves memory by sorting adjacency tables in dedicate memory on the line cards, and process switching stores all tables in the main memory

  B. CEF switching uses adjacency tables built by the CDP protocol, and process switching uses the routing table

  C. CEF switching uses dedicated hardware processors, and process switching uses the main processor

  D. CEF switching uses proprietary protocol based on IS-IS for MAC address lookup, and process switching uses in MAC address table

  Correct Answer: B

  Cisco Express Forwarding (CEF) switching is a proprietary form of scalable switching intended to tackle the problems associated with demand caching. With CEF switching, the information which is conventionally stored in a route cache is split up over several data structures. The CEF code is able to maintain these data structures in the Gigabit Route Processor (GRP), and also in slave processors such as the line cards in the 12000 routers. The data structures that provide optimized lookup for efficient packet forwarding include:

  1.

  The Forwarding Information Base (FIB) table - CEF uses a FIB to make IP destination prefix-based switching decisions. The FIB is conceptually similar to a routing table or information base. It maintains a mirror image of the forwarding information contained in the IP routing table. When routing or topology changes occur in the network, the IP routing table is updated, and these changes are reflected in the FIB. The FIB maintains next-hop address information based on the information in the IP routing table.

  2.

  Because there is a one-to-one correlation between FIB entries and routing table entries, the FIB contains all known routes and eliminates the need for route cache maintenance that is associated with switching paths such as fast switching and optimum switching.

  3.

  Adjacency table - Nodes in the network are said to be adjacent if they can reach each other with a single hop across a link layer. In addition to the FIB, CEF uses adjacency tables to prepend Layer 2 addressing information. The adjacency table maintains Layer 2 next-hop addresses for all FIB entries.

  CEF can be enabled in one of two modes:

  1.

  Central CEF mode - When CEF mode is enabled, the CEF FIB and adjacency tables reside on the route processor, and the route processor performs the express forwarding. You can use CEF mode when line cards are not available for CEF switching, or when you need to use features not compatible with distributed CEF switching.

  2.

  Distributed CEF (dCEF) mode - When dCEF is enabled, line cards maintain identical copies of the FIB and adjacency tables. The line cards can perform the express forwarding by themselves, relieving the main processor - Gigabit Route Processor (GRP) - of involvement in the switching operation. This is the only switching method available on the Cisco 12000 Series Router.

  CEF uses an Inter-Process Communication (IPC) mechanism to ensure synchronization of FIBs and adjacency tables on the route processor and line cards.

  For more information about CEF switching, see Cisco Express Forwarding (CEF) White Paper.

• Question 1042:

  Refer to the exhibit. An engineer configures the BGP adjacency between R1 and R2, however, it fails to establish Which action resolves the issue?

  

  A. Change the network statement on R1 to 172.16 10.0

  B. Change the remote-as number for 192 168.100.11.

  C. Enable synchronization on R1 and R2

  D. Change the remote-as number on R1 to 6500.

  Correct Answer: D

  The EBGP neighbor for R1 is in the AS 6500, and not the same AS 5500

• Question 1043:

  Which technology uses network traffic telemetry, contextual information, and file reputation to provide insight into cyber threats?

  A. threat defense

  B. security services

  C. security intelligence

  D. segmentation

  Correct Answer: A

  The initial version of the Cisco Cyber Threat Defense solution was introduced in 2013, with a Cisco Validated Design (CVD) to bring together NetFlow telemetry from the Cisco network infrastructure, the Cisco Identity Services Engine (ISE) for user and device identity, and the StealthWatch System through a partnership with Lancope, Inc. to provide network behavior analysis and threat detection in the interior of the network.

• Question 1044:

  Which technology is used as the basis for the cisco SD-Access data plane?

  A. IPsec

  B. LISP

  C. VXLAN

  D. 802.1Q

  Correct Answer: C

  A virtual network identifier (VNI) is a value that identifies a specific virtual network in the data plane.

• Question 1045:

  Refer to the exhibit.

  

  Communication between London and New York is down. Which command set must be applied to the NewYork switch to resolve the issue?

  A. NewYork(config)#no interface po1 NewYork(config)#interface range fa0/1-2 NewYork(config-if)#channel-group 1 mode negotiate NewYork(config-if)#end NewYork#

  B. NewYork(config)#no interface po1 NewYork(config)#interface range fa0/1-2 NewYork(config-if)#channel-group 1 mode on NewYork(config-if)#end NewYork#

  C. NewYork(config)#no interface po1 NewYork(config)#interface range fa0/1-2 NewYork(config-if)#channel-group 1 mode passive NewYork(config-if)#end NewYork#

  D. NewYork(config)#no interface po1 NewYork(config)#interface range fa0/1-2 NewYork(config-if)#channel-group 1 mode auto NewYork(config-if)#end NewYork#

  Correct Answer: C

• Question 1046:

  Refer to the exhibit.

  

  Assuming the WLC's interfaces are not in the same subnet as the RADIUS server, which interface would the WLC use as the source for all RADIUS-related traffic?

  A. the interface specified on the WLAN configuration

  B. any interface configured on the WLC

  C. the controller management interface

  D. the controller virtual interface

  Correct Answer: A

  From the guide, the the tick box wasn't checked it would be A. - Check the RADIUS Server Overwrite interface check box to enable the per-WLAN RADIUS source support. When enabled, the controller uses the interface specified on the WLAN configuration as identity and source for all RADIUS related traffic on that WLAN

• Question 1047:

  Refer to the Exhibit.

  

  An engineer is installing a new pair of routers in a redundant configuration. When checking on the standby status of each router the engineer notices that the routers are not functioning as expected. Which action will resolve the configuration error?

  A. configure matching hold and delay timers

  B. configure matching key-strings

  C. configure matching priority values

  D. configure unique virtual IP addresses

  Correct Answer: D

  The most situable for this question is D (configure unique virtual address) as is one of requirements for a group to work, as seeing in the image. The others are wrong for the following reason. (so Wrong based in the question) A) Not

  mandatory the timers must match to work on HSRP. on HSRP negotiation the active router will override the standby timers.

  https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9000/nb-06-cat-9k-stack-wp-cte-en.pdf

  B) On the image key string match so is not this reason HSRP cant be seen each other

  C) Wrong, priority is for selecing the active router, the best practice is should be different thus (WRONG)

  D) Different virtual Gateway configured on the same group number indeed will make HSRP routers negotiation fail for that group thus (CORRECT)

• Question 1048:

  What is the function of a fabric border node in a Cisco SD-Access environment?

  A. To collect traffic flow information toward external networks.

  B. To connect the Cisco SD-Access fabric to another fabric or external Layer 3 networks.

  C. To attach and register clients to the fabric.

  D. To handle an ordered list of IP addresses and locations for endpoints in the fabric.

  Correct Answer: B

  Border Node is an Entry and Exit point for data traffic going Into and Out of a Fabric

  Referenced: https://www.cisco.com/c/dam/m/hr_hr/training-events/2019/cisco-connect/pdf/VH-Cisco-SD-Access-Connecting.pdf

• Question 1049:

  A customer has several small braches and wants to deploy a WI-FI solution with local management using CAPWAP. Which deployment model meets this requirement?

  A. Autonomous

  B. Mobility express

  C. SD-Access wireless

  D. Local mode

  Correct Answer: B

  Correct answer is Mobility Express. From Encor Cert guide: "As you might have guessed, it is also possible to move the WLC even below the access layer and into an AP. Figure 18-7 illustrates the Mobility Express topology, where a fully functional Cisco AP also runs software that acts as a WLC. This can be useful in small scale environments,such as small, midsize, or multi-site branch locations, where you might not want to invest in dedicated WLCs at all. The AP that hosts the WLC forms a CAPWAP tunnel with the WLC, as do any other APs at the same location. A Mobility Express WLC can support up to 100 APs."

• Question 1050:

  Which technology provides a secure communication channel for all traffic at Layer 2 of the OSI model?

  A. MACsec

  B. IPsec

  C. SSL

  D. Cisco Trustsec

  Correct Answer: A

  MACsec, defined in 802.1AE, provides MAC-layer encryption over wired networks by using out- ofband methods for encryption keying. The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys. MKA and MACsec are implemented after successful authentication using the 802.1x Extensible Authentication Protocol (EAP-TLS) or Pre Shared Key (PSK) framework. A switch using MACsec accepts either MACsec or non-MACsec frames, depending on the policy associated with the MKA peer. MACsec frames are encrypted and protected with an integrity check value (ICV). When the switch receives frames from the MKA peer, it decrypts them and calculates the correct ICV by using session keys provided by MKA. The switch compares that ICV to the ICV within the frame. If they are not identical, the frame is dropped. The switch also encrypts and adds an ICV to any frames sent over the secured port (the access point used to provide the secure MAC service to a MKA peer) using the current session key.

  Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/1 6-9/configuration_guide/sec/b_169_sec_9300_cg/macsec_encryption.html

  Note: Cisco Trustsec is the solution which includes MACsec.