Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 1161:

  What is one benefit of implementing a VSS architecture?

  A. It provides multiple points of management for redundancy and improved support.

  B. It uses GLBP to balance traffic between gateways.

  C. It provides a single point of management for improved efficiency.

  D. It uses a single database to manage configuration for multiple switches.

  Correct Answer: C

  Support Virtual Switching System (VSS) to provide resiliency, and increased operational efficiency with a single point of management; VSS increases operational efficiency by simplifying the network, reducing switch management overhead by at least 50 percent. ?Single configuration file and node to manage. Removes the need to configure redundant switches twice with identical policies.

• Question 1162:

  What is used to perform OoS packet classification?

  A. the Options field in the Layer 3 header

  B. the Type field in the Layer 2 frame

  C. the Flags field in the Layer 3 header

  D. the TOS field in the Layer 3 header

  Correct Answer: D

  Type of service, when we talk about PACKET, means layer 3

• Question 1163:

  Which method should an engineer use to deal with a long-standing contention issue between any two VMs on the same host?

  A. Adjust the resource reservation limits

  B. Live migrate the VM to another host

  C. Reset the VM

  D. Reset the host

  Correct Answer: A

• Question 1164:

  What is the function of a VTEP in VXLAN?

  A. provide the routing underlay and overlay for VXLAN headers

  B. dynamically discover the location of end hosts in a VXLAN fabric

  C. encapsulate and de-encapsulate traffic into and out of the VXLAN fabric

  D. statically point to end host locations of the VXLAN fabric

  Correct Answer: C

  VXLAN Tunnel Endpoint

  The VTEP device uses this IP address to encapsulate Ethernet frames and transmits the encapsulated packets to the transport network through the IP interface.

• Question 1165:

  Refer to exhibit.

  

  VLANs 50 and 60 exist on the trunk links between all switches All access ports on SW3 are configured for VLAN 50 and SW1 is the VTP server. Which command ensures that SW3 receives frames only from VLAN 50?

  A. SW1 (config)#vtp pruning

  B. SW3(config)#vtp mode transparent

  C. SW2(config)=vtp pruning

  D. SW1 (config >tp mode transparent

  Correct Answer: A

  SW3 does not have VLAN 60 so it should not receive traffic for this VLAN (sent from SW2). Therefore we should configure VTP Pruning on SW3 so that SW2 does not forward VLAN 60 traffic to SW3. Also notice that we need to configure pruning on SW1 (the VTP Server), not SW2.

  Reference: https://www.orbit-computer-solutions.com/vtp-pruning/

• Question 1166:

  Which two methods are used to reduce the AP coverage area? (Choose two.)

  A. Increase minimum mandatory data rate

  B. Reduce AP transmit power

  C. Disable 2.4 GHz and use only 5 GHz.

  D. Enable Fastlane.

  E. Reduce channel width from 40 MHz to 20 MHz

  Correct Answer: AB

  Reducing the channel width does not affect directly the coverage area. Settings the transmit power and increases the minimum data rate do.

• Question 1167:

  What is a characteristic of a next-generation firewall?

  A. only required at the network perimeter

  B. required in each layer of the network

  C. filters traffic using Layer 3 and Layer 4 information only

  D. provides intrusion prevention

  Correct Answer: D

  The feature set for NGFWs build upon traditional firewall features by including critical security functions like intrusion prevention, VPN, and anti-virus, and even encrypted web traffic inspection to help prevent packets containing malicious content from entering the network

• Question 1168:

  Running the script causes the output in the exhibit. Which change to the first line of the script resolves the error?

  

  A. from ncclient import manager

  B. import manager

  C. from ncclient import *

  D. ncclient manager import

  Correct Answer: C

  "from module_name import * "

  All the functions and constants can be imported using *.

• Question 1169:

  Refer to the exhibit.

  

  Which action completes the configuration to achieve a dynamic continuous mapped NAT for all users?

  A. Configure a match-host type NAT pool

  B. Reconfigure the pool to use the 192.168 1 0 address range

  C. Increase the NAT pool size to support 254 usable addresses

  D. Configure a one-to-one type NAT pool

  Correct Answer: C

  Why would you want to chose match-host option? This is just to ensure that you're matching the host portion of the IP range given of the Inside local to the inside global, which is not very applicable here. Go for C, this is much more applicable, if we assume we need to use the whole IP range of /24 and not just 1-100.

• Question 1170:

  What is a characteristic of MACsec?

  A. 802.1AE provides encryption and authentication services

  B. 802.1AE is bult between the host and switch using the MKA protocol, which negotiates encryption keys based on the master session key from a successful 802 1X session

  C. 802.1AE is bult between the host and switch using the MKA protocol using keys generated via the Diffie-Hellman algorithm (anonymous encryption mode)

  D. 802.1AE is negotiated using Cisco AnyConnect NAM and the SAP protocol

  Correct Answer: B

  MACsec, defined in 802.1AE, provides MAC-layer encryption over wired networks by using out-of-band methods for encryption keying. The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys. MKA and MACsec are implemented after successful authentication using the 802.1x Extensible Authentication Protocol (EAP-TLS) or Pre Shared Key (PSK) framework.

  Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-9/configuration_guide/sec/b_169_sec_9300_cg/macsec_encryption.html