Cisco CCNP 350-401 Questions & Answers

• Question 41:

  What is a characteristic of MACsec?

  A. 802.1AE provides encryption and authentication services

  B. 802.1AE is bult between the host and switch using the MKA protocol, which negotiates encryption keys based on the master session key from a successful 802 1X session

  C. 802.1AE is bult between the host and switch using the MKA protocol using keys generated via the Diffie-Hellman algorithm (anonymous encryption mode)

  D. 802.1AE is negotiated using Cisco AnyConnect NAM and the SAP protocol

  Correct Answer: B

  MACsec, defined in 802.1AE, provides MAC-layer encryption over wired networks by using out-of-band methods for encryption keying. The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys. MKA and MACsec are implemented after successful authentication using the 802.1x Extensible Authentication Protocol (EAP-TLS) or Pre Shared Key (PSK) framework.

  Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-9/configuration_guide/sec/b_169_sec_9300_cg/macsec_encryption.html

• Question 42:

  Refer to the exhibit. A network engineer configures OSPF and reviews the router configuration Which interface or interfaces are able to establish OSPF adjacency?

  

  A. GigabitEthemet0/1 and GigabitEthernet0/1.40

  B. only GigabitEthernet0/1

  C. only GigabttEthernet0/0

  D. Gigabit Ethernet0/0 and GigabitEthemet0/1

  Correct Answer: C

• Question 43:

  What is a characteristic of a next-generation firewall?

  A. only required at the network perimeter

  B. required in each layer of the network

  C. filters traffic using Layer 3 and Layer 4 information only

  D. provides intrusion prevention

  Correct Answer: D

  The feature set for NGFWs build upon traditional firewall features by including critical security functions like intrusion prevention, VPN, and anti-virus, and even encrypted web traffic inspection to help prevent packets containing malicious content from entering the network

• Question 44:

  Which two components are supported by LISP? (choose two )

  A. proxy ETR

  B. egress tunnel router

  C. route reflector

  D. HMAC algorithm

  E. spoke

  Correct Answer: AB

  https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_lisp/configuration/xe-3s/irl-xe-3s-book/irl-overview.html

• Question 45:

  A customer has recently implemented a new wireless infrastructure using WLC-5520S at a site directly next to a large commercial airport Users report that they intermittently lose Wi-Fi connectivity, and troubleshooting reveals it is due to frequent channel changes Which two actions fix this issue? (Choose two)

  A. Remove UNII-2 and Extended UNII-2 channels from the 5 Ghz channel list

  B. Restore the OCA default settings because this automatically avoids channel interference

  C. Disable DFS channels to prevent interference writ) Doppler radar

  D. Enable DFS channels because they are immune to radar interference E. Configure channels on the UNII-2 and the Extended UNII-2 sub-bands of the 5 Ghz band only

  Correct Answer: AC

• Question 46:

  An engineer must configure HSRP group 300 on a Cisco IOS router. When the router is functional, it must be the active HSRP router. The peer router has been configured using the default priority value. Which command set is required?

  A. standby version 2 standby 300 priority 110 standby 300 preempt

  B. standby 300 priority 110 standby 300 timers 1 110

  C. standby version 2 standby 300 priority 90 standby 300 preempt

  D. standby 300 priority 90 standby 300 preempt

  Correct Answer: A

  In HSRP version 1, group numbers are supported the range from 0 to 255 and HSRP version 2 expands the group number range from 0 to 4095.

  *

  So it should HSRP v2 to assign the group no. 300 (So. the ans should A or C).

  *

  Default priority of the HSRP is 100 and the Router with higher priority no. will become Active Router. So the priority set over 100 for active router.

• Question 47:

  Which level message does the WLC send to the syslog server?

  A. syslog level errors and less severity messages

  B. syslog level errors messages

  C. all syslog levels messages

  D. syslog level errors and greater severity messages

  Correct Answer: D

• Question 48:

  What is the differences between TCAM and the MAC address table?

  A. The MAC address table is contained in CAM. ACL and QoS information is stored in TCAM.

  B. The MAC address table supports partial matches. TCAM requires an exact match

  C. Router prefix lookups happens in CAM. MAC address table lookups happen in TCAM.

  D. TCAM is used to make Layer 2 forwarding decisions CAM is used to build routing tables

  Correct Answer: A

  https://community.cisco.com/t5/networking-documents/cam-content-addressable-memory-vs-tcam-ternary-content/ta-p/3107938

  When using Ternary Content Addressable Memory (TCAM) inside routers it's used for faster address lookup that enables fast routing. In switches Content Addressable Memory (CAM) is used for building and lookup of mac address table that enables L2 forwarding decisions. Besides Longest-Prefix Matching, TCAM in today's routers and multilayer Switch devices are used to store ACL, QoS and other things from upper-layer processing.

• Question 49:

  Which measure is used by an NTP server to indicate its closeness to the authoritative time source?

  A. time zone

  B. hop count

  C. stratum

  D. latency

  Correct Answer: C

  NTP uses a stratum to describe the distance between a network device and an authoritative time source: A stratum 1 time server is directly attached to an authoritative time source (such as a radio or atomic clock or a GPS time source)

• Question 50:

  Which two southbound interfaces originate from Cisco DMA Center and terminate at fabric underlay switches? (Choose two)

  A. ICMP: Discovery

  B. UDP 67: DHCP

  C. TCP 23: Telnet

  D. UDP 6007: NetFlow

  E. UDP 162: SNMP

  Correct Answer: AC

  In the figure below, we can see ICMP and SNMP can reach to underlay switches.