Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 1061:

  Refer to the exhibit.

  

  An engineer is troubleshooting a connectivity issue and executes a traceoute. What does the result confirm?

  A. The destination server reported it is too busy

  B. The protocol is unreachable

  C. The destination port is unreachable

  D. The probe timed out

  Correct Answer: D

  In Cisco routers, the codes for a traceroute command reply are:

  ! -- success * -- time out N -- network unreachable H -- host unreachable P -- protocol unreachable A -- admin denied Q -- source quench received (congestion) ? -- unknown (any other ICMP message)

• Question 1062:

  An engineer runs the code against an API of Cisco DMA Center, and the platform returns this output What does the response indicate?

  

  A. The authentication credentials are incorrect.

  B. The URl string is incorrect.

  C. The Cisco DNA Center API port is incorrect.

  D. The HTTP method is incorrect.

  Correct Answer: D

  Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/405 https://developer.mozilla.org/en-US/docs/Web/HTTP/Status Invalid authentication credentials would return code 401

• Question 1063:

  What is a consideration when designing a Cisco SD-Access underlay network?

  A. End user subnets and endpoints are part of the underlay network.

  B. The underlay switches provide endpoint physical connectivity for users.

  C. Static routing is a requirement,

  D. It must support IPv4 and IPv6 underlay networks.

  Correct Answer: B

  https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html#Underlay

• Question 1064:

  In a wireless Cisco SD-Access deployment, which roaming method is used when a user moves from one access point to another on a different access switch using a single WLC?

  A. Layer 3

  B. inter-xTR

  C. auto anchor

  D. fast roam

  Correct Answer: B

  SDA RoamingSDA supports two additional types of roaming, which are Intra-xTR and Inter-xTR. In SDA, xTR stands for an access-switch that is a fabric edge node. It serves both as an ingress tunnel router as well as an egress tunnel router.

  Intra-xTR

  When a client on a fabric enabled WLAN, roams from an access point to another access point on the same access-switch, it is called Intra-xTR. Here, the local client database and client history table are updated with the information of the

  newly associated access point.

  Inter-xTR.

  When a client on a fabric enabled WLAN, roams from an access point to another access point on a different access-switch, it is called Inter-xTR.

  https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/mobility.html

• Question 1065:

  How is Layer 3 roaming accomplished in a unified wireless deployment?

  A. An EoIP tunnel is created between the client and the anchor controller to provide seamless connectivity as the client is associated with the new AP.

  B. The client entry on the original controller is passed to the database on the new controller.

  C. The new controller assigns an IP address from the new subnet to the client

  D. The client database on the original controller is updated the anchor entry, and the new controller database is updated with the foreign entry.

  Correct Answer: D

• Question 1066:

  Which features does Cisco EDR use to provide threat detection and response protection?

  A. containment, threat intelligence, and machine learning

  B. firewalling and intrusion prevention

  C. container-based agents

  D. cloud analysis and endpoint firewall controls

  Correct Answer: A

  https://www.cisco.com/c/en/us/products/security/endpoint-security/what-is-endpoint-detection-response-edr.html

• Question 1067:

  Which design principle slates that a user has no access by default to any resource, and unless a resource is explicitly granted, it should be denied?

  A. least privilege

  B. fail-safe defaults

  C. economy of mechanism

  D. complete mediation

  Correct Answer: B

  The Principle of Fail-Safe Defaults states that, unless a subject is given explicit access to an object, it should be denied access to that object

• Question 1068:

  Which measurement is used from a post wireless survey to depict the cell edge of the access points?

  A. SNR

  B. Noise

  C. RSSI

  D. CCI

  Correct Answer: C

  Coverage defines the ability of wireless clients to connect to a wireless AP with a signal strength and quality high enough to overcome the effects of RF interference. The edge of the coverage for an AP is based on the signal strength and

  SNR measured as the client device moves away from the AP.

  The signal strength required for good coverage varies dependent on the specific type of client devices and applications on the network.

  To accommodate the requirement to support wireless Voice over IP (VoIP), refer to the RF guidelines specified in the Cisco 7925G Wireless IP Phone Deployment Guide. The minimum recommended wireless signal strength for voice

  applications is -67 dBm and the minimum SNR is 25 dB.

  The first step in the analysis of a post site survey is to verify the `Signal Coverage'. The signal coverage is measured in dBm. You can adjust the color-coded signal gauge to your minimum-allowed signal level to view areas where there are

  sufficient and insufficient coverage. The example in Figure 8 shows blue, green, and yellow areas in the map have signal coverage at -67 dBm or better. The areas in grey on the coverage maps have deficient coverage. Source from Cisco

  https://www.cisco.com/c/en/us/td/docs/wireless/technology/vowlan/troubleshooting/vowlan_troubleshoot/8_Site_Survey_RF_Design_Valid.html

• Question 1069:

  Refer to the exhibit.

  

  After configurating an IPsec VPN, an engineer enters the show command to verify the ISAKMP SA status. What does the status show?

  A. ISAKMP SA is authenticated and can be used for Quick Mode.

  B. Peers have exchanged keys, but ISAKMP SA remains unauthenticated.

  C. VPN peers agreed on parameters for the ISAKMP SA

  D. ISAKMP SA has been created, but it has not continued to form.

  Correct Answer: A

  The ISAKMP SA has been authenticated. If the router initiated this exchange, this state transitions immediately to QM_IDLE, and a Quick Mode exchange begins. https://www.ciscopress.com/articles/article.asp?p=606584

• Question 1070:

  Which entity is a Type 1 hypervisor?

  A. Oracle VM VirtualBox

  B. VMware server

  C. Citrix XenServer

  D. Microsoft Virtual PC

  Correct Answer: C