Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 1121:

  Refer to the exhibit. An engineer configures CoPP and enters the show command to verify the implementation. What is the result of the configuration?

  

  A. All traffic will be policed based on access-list 120.

  B. If traffic exceeds the specified rate, it will be transmitted and remarked.

  C. Class-default traffic will be dropped.

  D. ICMP will be denied based on this configuration.

  Correct Answer: A

• Question 1122:

  What is a characteristic of a virtual machine?

  A. It must be aware of other virtual machines, in order to allocate physical resources for them

  B. It is deployable without a hypervisor to host it

  C. It must run the same operating system as its host

  D. It relies on hypervisors to allocate computing resources for it

  Correct Answer: D

• Question 1123:

  Which characteristic distinguishes Ansible from Chef?

  A. Ansible lacs redundancy support for the master server. Chef runs two masters in an active/active mode.

  B. Ansible uses Ruby to manage configurations. Chef uses YAML to manage configurations.

  C. Ansible pushes the configuration to the client. Chef client pulls the configuration from the server.

  D. The Ansible server can run on Linux, Unix or Windows. The Chef server must run on Linux or Unix.

  Correct Answer: C

  Ansible works by connecting to your nodes and pushing out small programs, called "Ansible modules" to them. These programs are written to be resource models of the desired state of the system. Ansible then executes these modules (over

  SSH by default), and removes them when finished.

  Chef is a much older, mature solution to configure management. Unlike Ansible, it does require an installation of an agent on each server, named chef-client. Also, unlike Ansible, it has a Chef server that each client pulls configuration from.

• Question 1124:

  What is the function of the LISP map resolver?

  A. to send traffic to non-LISP sites when connected to a service provider that does not accept nonroutable EIDs as packet sources

  B. to connect a site to the LISP-capable part of a core network, publish the EID-to-RLOC mappings for the site and respond to map-request messages

  C. to decapsulate map-request messages from ITRs and forward the messages to the MS

  D. to advertise routable non-USP traffic from one address family to LISP sites in a different address family

  Correct Answer: C

  Like an MS, a LISP MR connects to the ALT. The function of the LISP MR is to accept encapsulated Map-Request messages from ingress tunnel routers (ITRs), decapsulate those messages, and then forward the messages to the MS

  responsible for the egress tunnel routers (ETRs) that are authoritative for the requested EIDs.

  When an MR is implemented concurrently with an MS in a private mapping system deployment, the concurrent MS forwards the encapsulated Map-Request messages to the authoritative ETRs. When a LISP ALT is present in the deployment,

  the MR forwards the Map-Request messages directly over the ALT to the MS responsible for the ETRs that are authoritative for the requested EIDs. An MR also sends Negative Map-Replies to ITRs in response to queries for non-LISP

  addresses.

  source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_lisp/configuration/xe-3s/irl-xe-3s-book/irl-overview.html#GUID-89BB8D34-63BF-43DE-8743-5572D357CDB3

• Question 1125:

  Refer to the exhibit.

  

  Which troubleshooting a routing issue, an engineer issues a ping from S1 to S2. When two actions from the initial value of the TTL? (Choose two.)

  A. The packet reaches R3, and the TTL expires

  B. R2 replies with a TTL exceeded message

  C. R3 replies with a TTL exceeded message.

  D. The packet reaches R2, and the TTL expires.

  E. R1 replies with a TTL exceeded message

  F. The packet reaches R1 and the TTL expires.

  Correct Answer: BD

  When a labeled packet is received with a TTL of 1, the receiving LSR drops the packet and sends an ICMP message "time exceeded" (type 11, code 0) to the originator of the IP packet. This is the same behavior that a router would exhibit with an IP packet that had an expiring TTL.

  https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_010111000.html#:~:text=The%20local%20and%20FlexConnect%20mode% 20access%20points,spend%20about%2050%20milliseconds%20on%20each%20channel.

• Question 1126:

  SIMULATION

  Guidelines

  This is a lab item in which tasks will be performed on virtual devices.

  1.

  Refer to the Tasks tab to view the tasks for this lab item.

  2.

  Refer to the Topology tab to access the device console(s) and perform the tasks.

  3.

  Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.

  4.

  All necessary preconfigurations have been applied.

  5.

  Do not change the enable password or hostname for any device.

  6.

  Save your configurations to NVRAM before moving to the next item.

  7.

  Click Next at the bottom of the screen to submit this lab and move to the next question.

  8.

  When Next is clicked, the lab closes and cannot be reopened.

  Topology Tasks

  

  The operations team started configuring network devices for a new site. R10 and R20 are preconfigured with the CORP VRF. R10 has network connectivity to R20. Complete the configurations to achieve these goals:

  1.

  Extend the CORP VRF between R10 and R20 using Tunnel0.

  2.

  Protect Tunnel0 using the preconfigured profile.

  

  A. See the solution below in Explanation.

  B. Place Holder

  C. Place Holder

  D. Place Holder

  Correct Answer: A

  Configuration on R10:

  interface Tunnel0 ip tunnel source e0/1 ip tunnel destination 10.10.2.1 ip tunnel mode gre tunnel protection ipsec profile myprofile ip address 10.100.100.1 255.255.255.252 ip vrf forwarding CORP

  Configuration on R20:

  interface Tunnel0 ip tunnel source e0/1 ip tunnel destination 10.10.1.1 ip tunnel mode gre tunnel protection ipsec profile myprofile ip address 10.100.100.2 255.255.255.252 ip vrf forwarding CORP

• Question 1127:

  SIMULATION

  Guidelines

  This is a lab item in which tasks will be performed on virtual devices.

  1.

  Refer to the Tasks tab to view the tasks for this lab item.

  2.

  Refer to the Topology tab to access the device console(s) and perform the tasks.

  3.

  Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.

  4.

  All necessary preconfigurations have been applied.

  5.

  Do not change the enable password or hostname for any device.

  6.

  Save your configurations to NVRAM before moving to the next item.

  7.

  Click Next at the bottom of the screen to submit this lab and move to the next question.

  8.

  When Next is clicked, the lab closes and cannot be reopened.

  Topology Tasks

  

  The operations team started configuring network devices for a new site. Complete the configurations to achieve these goals:

  1.

  Ensure that port channel Po1 between DISTRO-SW01 and DISTRO-SW02 is operational using the LACP protocol. Configuration changes for this task must be made on DISTRO-SW01.

  2.

  Ensure that traffic on VLAN 10 is carried as untagged traffic between DISTRO-SW01 and DISTRO-SW02.

  3.

  Complete the Rapid-PVST+ configuration on DISTRO-SW2 by ensuring it it the secondary root switch for all VLANs in the range of 1 to 1005.

  DISTRO-SW01

  

  

  DISTRO-SW02

  

  

  A. See the solution below in Explanation.

  B. Place Holder

  C. Place Holder

  D. Place Holder

  Correct Answer: A

  Task 1. Ensure that port channel Po1 between DISTRO-SW01 and DISTRO-SW02 is operational using the LACP protocol. Configuration changes

  for this task must be made on DISTRO-SW01.

  The port towards to ACCESS-SW1 was part of port channel 1 which was used towards to DISTRO-SW02, so remove the port channel config pointing to the ACCESS-SW1 first.

  DISTRO-SW01(config)#int e0/0

  DISTRO-SW01(config-if)#no channel-group 1

  Set the LACP mode active on this switch:

  DISTRO-SW01(config-if)#int range e0/2 - 3

  DISTRO-SW01(config-if)#channel-group 1 mode active

  Verification:

  We can verify if the Port-channel was formed with the “show etherchannel summary” command

  DISTRO-SW01# show etherchannel summary

  -- output omitted -

  Number of channel-groups in use: 1

  Number of aggregators: 1

  Group Port-channel Protocol Ports

  ------+------------- +-----------+-----------------------------------------------

  1 Po1(SU) LACP Et0/2(P) Et0/3(P)

  If we see the “Po1(SU)” means our configuration worked correctly.

  Task 2. Ensure that traffic on VLAN 10 is carried as untagged traffic between DISTRO-SW01 and DISTRO-SW02.

  DISTRO-SW01,DISTRO-SW02(config)#interface port-channel 1

  DISTRO-SW01,DISTRO-SW02(config-if)#switchport trunk native vlan 10

  Task 3. Complete the Rapid-PVST+ configuration on DISTRO-SW2 by ensuring it is the secondary root switch for all VLANs in the range of 1 to 1005.

  DISTRO-SW02(config)#spanning-tree vlan 1-1005 root secondary

  Save the configuration

  DSW1,DSW2(config)#copy running-config startup-config

• Question 1128:

  SIMULATION

  Guidelines

  

  This is a lab item in which tasks will be performed on virtual devices.

  1.

  Refer to the Tasks tab to view the tasks for this lab item.

  2.

  Refer to the Topology tab to access the device console(s) and perform the tasks.

  3.

  Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.

  4.

  All necessary preconfigurations have been applied.

  5.

  Do not change the enable password or hostname for any device.

  6.

  Save your configurations to NVRAM before moving to the next item.

  7.

  Click Next at the bottom of the screen to submit this lab and move to the next question.

  8.

  When Next is clicked, the lab closes and cannot be reopened.

  Topology

  

  Tasks

  The operations team started configuring network devices for a new site. R10 and R20 are preconfigured with the CORP VRF. R10 has network connectivity to R20. Complete the configurations to achieve these goals:

  1.

  Extend the CORP VRF between R10 and R20 using Tunnel0.

  2.

  Protect Tunnel0 using the preconfigured profile

  3.

  Configure static routing on R10 and R20 so that users in VLANs100 and 101 that belong to the CORP VRF are able to communicate with each other. Tunnel0 should be the only interface used to route traffic for the CORP VRF

  A. See the solution below in Explanation.

  B. Place Holder

  C. Place Holder

  D. Place Holder

  Correct Answer: A

  We need to find out the IP addresses of e0/1 of R10 and e0/2 of R20 first with the “show ip interface brief” command on these two routers. Supposethey are 10.10.1.10 and 10.10.2.20 respectively. We will use them in the “tunnel destination

  …” commands

  R10

  interface Tunnel 0

  ip vrf forwarding CORP

  tunnel source e0/1

  tunnel destination 10.10.2.20

  tunnel vrf TECH

  R20

  interface Tunnel 0

  ip vrf forwarding CORP

  tunnel source e0/2

  tunnel destination 10.10.1.10

  tunnel vrf TECH

  We are not sure if “TECH” is another VRF configured on both routers. If yes then maybe this sim wants us to configure a “front-door VRF”.On a tunnel interface you use the ip vrf forwarding command to place the tunnel interface in that

  particular routing table.The tunnel vrf command instructs the router to use the specified VRFs routing table for the tunnel source and destination IP addresses.

  Static route:

  R10:

  ip route vrf TECH 10.100.1.0 255.255.255.0 tunnel0

  R20:

  ip route vrf TECH 10.101.2.0 255.255.255.0 tunnel0

• Question 1129:

  Refer to the exhibit.

  

  Which configuration change will force BR2 to reach 209 165 201 0/27 via BR1?

  A. Set the weight attribute to 65.535 on BR1 toward PE1.

  B. Set the local preference to 150 on PE1 toward BR1 outbound

  C. Set the MED to 1 on PE2 toward BR2 outbound.

  D. Set the origin to igp on BR2 toward PE2 inbound.

  Correct Answer: C

  (laboratory validated) BR2#show ip bgp Network Next Hop Metric LocPrf Weight Path

  *

  i209.165.201.0/27 172.24.109.2 0 100 0 200 i *> 209.165.200.230 0 0 300 i BR2#show ip bgp Network Next Hop Metric LocPrf Weight Path

  *

  i209.165.201.0/27 172.24.109.2 0 100 0 200 i *> 209.165.200.230 1 0 300 i

• Question 1130:

  Refer to the exhibit.

  

  What does the snippet of code achieve?

  A. It creates a temporary connection to a Cisco Nexus device and retrieves a token to be used for API calls.

  B. It opens a tunnel and encapsulates the login information, if the host key is correct.

  C. It opens an ncclient connection to a Cisco Nexus device and maintains it for the duration of the context.

  D. It creates an SSH connection using the SSH key that is stored, and the password is ignored.

  Correct Answer: C

  ncclient is a Python library that facilitates client-side scripting and application development around the NETCONF protocol. The above Python snippet uses the ncclient to connect and establish a NETCONF session to a Nexus device (which is also a NETCONF server).