Cisco CCNP 350-401 Questions & Answers

• Question 11:

  The following system log message is presented after a network administrator configures a GRE tunnel:

  %TUN-RECURDOWN Interface Tunnel 0 temporarily disabled due to recursive routing.

  Why is Tunnel 0 disabled?

  A. Because dynamic routing is not enabled

  B. Because the tunnel cannot reach its tunnel destination

  C. Because the best path to the tunnel destination is through the tunnel itself

  D. Because the router cannot recursively identify its egress forwarding interface.

  Correct Answer: C

  The %TUN-5-RECURDOWN: Tunnel0 temporarily disabled due to recursive routing error message means that the generic routing encapsulation (GRE) tunnel router has discovered a recursive routing problem. This condition is usually due to one of these causes:

  + A misconfiguration that causes the router to try to route to the tunnel destination address using the tunnel interface itself (recursive routing) + A temporary instability caused by route flapping elsewhere in the network Reference: https://www.cisco.com/c/en/us/support/docs/ip/enhan

• Question 12:

  A customer has completed the installation of a Wi-Fi 6 greenfield deployment at their new campus. They want to leverage Wi-Fi 6 enhanced speeds on the trusted employee WLAN. To configure the employee WLAN, which two Layer 2 security policies should be used? (Choose two.)

  A. WPA2 (AES)

  B. 802.1X

  C. OPEN

  D. WEP

  E. WPA (AES)

  Correct Answer: AB

  If some devices experience problems connecting to the Wi-Fi 6 network, the problem may be in missing WPA3 support or the "WPA3/WPA2 mixed mode" feature. Mixed mode is intended to ensure that older clients can still connect, but in

  practice there are some clients who do not recognize this setting and refuse to connect at all. As WP3 is much safer than WPA2, we do not recommend downgrading the security of WPA2 to let older clients connect.

  Well WPA2 always better than OPEN.

• Question 13:

  In a Cisco SD-Access solution, what is the role of the Identity Services Engine?

  A. It is leveraged for dynamic endpoint to group mapping and policy definition.

  B. It provides GUI management and abstraction via apps that share context.

  C. it is used to analyze endpoint to app flows and monitor fabric status.

  D. It manages the LISP EID database.

  Correct Answer: A

  DNA Controller ?Enterprise SDN Controller (e.g. DNA Center) provides GUI management and abstraction via Apps that share context Identity Services ?External ID System(s) (e.g. ISE) are leveraged for dynamic Endpoint to Group mapping and Policy definition Analytics Engine ?External Data Collector(s) (e.g. NDP) are leveraged to analyze Endpoint to App flows and monitor fabric status

  Reference: https://www.cisco.com/c/dam/global/da_dk/assets/training/seminaria-materials/Software_Defined_Access_2017.pdf

• Question 14:

  Which two network problems indicate a need to implement QoS in a campus network? (Choose two)

  A. port flapping

  B. excess jitter

  C. misrouted network packets

  D. duplicate IP addresses

  E. bandwidth-related packet loss

  Correct Answer: BE

• Question 15:

  Which deployment option of Cisco NQFW provides scalability?

  A. clustering

  B. Inline tap

  C. high availability

  D. tap

  Correct Answer: C

• Question 16:

  In a three-tier hierarchical campus network design, which action is a design best-practice for the core layer?

  A. provide QoS prioritization services such as marking, queueing, and classification for critical network traffic

  B. provide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence

  C. provide advanced network security features such as 802. IX, DHCP snooping, VACLs, and port security

  D. provide redundant aggregation for access layer devices and first-hop redundancy protocols such as VRRP

  Correct Answer: B

  All policies are configured an the access and distribution layer, CORE must be use ony to forward packets and be highly redundant an usually be on L3

• Question 17:

  Which encryption hashing algorithm does NTP use for authentication?

  A. SSL

  B. MD5

  C. AES128

  D. AES256

  Correct Answer: B

  An example of configuring NTP authentication is shown below: Router1(config)#ntp authentication-key 2 md5 certbus Router1(config)#ntp authenticate Router1(config)#ntp trusted-key 2

• Question 18:

  What is a VPN in a Cisco SD-WAN deployment?

  A. common exchange point between two different services

  B. attribute to identify a set of services offered in specific places in the SD-WAN fabric

  C. virtualized environment that provides traffic isolation and segmentation in the SD-WAN fabric

  D. virtual channel used to carry control plane information

  Correct Answer: C

  Ref: Cisco SD-WAN (Viptela) Configuration Guide, Release 18.1

  "...

  Segmentation (VPN) Overview

  This article illustrates the segmentation and VPN capabilities of the Viptela overlay network solution.

  Network segmentation has existed for over a decade and has been implemented in multiple forms and shapes. At its most rudimentary level, segmentation provides traffic isolation. The most common forms of network segmentation are virtual

  LANs, or VLANs, for Layer 2 solutions, and virtual routing and forwarding, or VRF, for Layer 3 solutions.

  ..."

• Question 19:

  Which two methods are used to reduce the AP coverage area? (Choose two.)

  A. Increase minimum mandatory data rate

  B. Reduce AP transmit power

  C. Disable 2.4 GHz and use only 5 GHz.

  D. Enable Fastlane.

  E. Reduce channel width from 40 MHz to 20 MHz

  Correct Answer: AB

  Reducing the channel width does not affect directly the coverage area. Settings the transmit power and increases the minimum data rate do.

• Question 20:

  What is an emulated machine that has dedicated compute, memory, and storage resources and a fully installed operating system?

  A. host

  B. mainframe

  C. container

  D. virtual machine

  Correct Answer: D

  Mainframe + Host are Hardware Devices and they do not EMULATE but rather EXECUTE.

  Virtual Machine is the only "EMULATION" capable thing in the list.

  A container is a software wrapper that allows programs to run inside it, but itself it still needs to be executed and not emulated.