Cisco CCIE Enterprise Wireless 350-401 Questions & Answers

• Question 771:

  What is a benefit of using a Type 2 hypervisor instead of a Type 1 hypervisor?

  A. better application performance

  B. Improved security because the underlying OS is eliminated

  C. Improved density and scalability

  D. ability to operate on hardware that is running other OSs

  Correct Answer: D

  There are two types of hypervisors: type 1 and type 2 hypervisor.

  In type 1 hypervisor (or native hypervisor), the hypervisor is installed directly on the physical server.

  Then instances of an operating system (OS) are installed on the hypervisor. Type 1 hypervisor has direct access to the hardware resources. Therefore they are more efficient than hosted architectures.

  Some examples of type 1 hypervisor are VMware vSphere/ESXi, Oracle VM Server, KVM and Microsoft Hyper-V.

  In contrast to type 1 hypervisor, a type 2 hypervisor (or hosted hypervisor) runs on top of an operating system and not the physical hardware directly. A big advantage of Type 2 hypervisors is that management console software is not

  required. Examples of type 2 hypervisor are VMware Workstation (which can run on Windows, Mac and Linux) or Microsoft Virtual PC (only runs on Windows). Type 1 is more efficient and well performing, it is also more secure than type 2

  because the flaws and vulnerabilities that are endemic to Operating Systems are often absent from Type 1, bare metal hypervisors.

  Type 1 has better performance, scalability and stability but supported by limited hardware.

• Question 772:

  Refer to the exhibit.

  

  The port channel between the switches does not work as expected. Which action resolves the issue?

  A. Interface Gi0/0 on Switch2 must be configured as passive.

  B. Interface Gi0/1 on Switch1 must be configured as desirable.

  C. interface Gi0/1 on Switch2 must be configured as active.

  D. Trucking must be enabled on both Interfaces on Switch2.

  Correct Answer: C

• Question 773:

  A system must validate access rights to all its resources and must not rely on a cached permission matrix. If the access level to a given resource is revoked but is not reflected in the permission matrix, the security is violates Which term refers to this REST security design principle?

  A. economy of mechanism

  B. complete mediation

  C. separation of privilege

  D. least common mechanism

  Correct Answer: B

  A system should validate access rights to all its resources to ensure that they are allowed and should not rely on the cached permission matrix. If the access level to a given resource is being revoked, but that is not being reflected in the permission matrix, it would be violating security.

  https://medium.com/strike-sh/rest-security-design-principles-434bd6ee57ea

• Question 774:

  Which two features does the Cisco SD-Access architecture add to a traditional campus network? (Choose two.)

  A. software-defined segmentation

  B. private VLANs

  C. SD-WAN

  D. modular QoS

  E. identity services

  Correct Answer: AE

  https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/CVD-Software-Defined-Access-Segmentation-Design-Guide-2018MAY.pdf

• Question 775:

  Refer to the exhibit. A network engineer must block Telnet traffic from hosts in the range of 10.100 2.248 to 10.100.2 255 to the network 10.100.3.0 and permit everything else.

  

  Which configuration must the engineer apply?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: C

• Question 776:

  What does the number in an NTP stratum level represent?

  A. The number of hops it takes to reach the master time server.

  B. The number of hops it takes to reach the authoritative time source.

  C. The amount of offset between the device clock and true time.

  D. The amount of drift between the device clock and true time.

  Correct Answer: B

  NTP uses the concept of a stratum to describe how many hops (routers) away a machine is from an authoritative time source, usually a reference clock. A reference clock is a stratum 0 device that is assumed to be accurate and has little or no delay associated with it. Stratum 0 servers cannot be used on the network but they are directly connected to computers which then operate as stratum-1 servers. A stratum 1 time server acts as a primary network time standard.

  

• Question 777:

  Which method displays text directly into the active console with a synchronous EEM applet policy?

  A. event manager applet boom event syslog pattern 'UP' action 1.0 gets 'logging directly to console'

  B. event manager applet boom

  event syslog pattern 'UP'

  action 1.0 syslog priority direct msg 'log directly to console'

  C. event manager applet boom event syslog pattern 'UP' action 1.0 puts 'logging directly to console'

  D. event manager applet boom event syslog pattern 'UP' action 1.0 string 'logging directly to console'

  Correct Answer: C

  "Writing Input to the Active Console When a synchronous policy is triggered, the related console is stored in the publish information specification. The policy director will query this information in an event_reqinfo call, and store the given console information for use by the action puts command.

  The action puts command will write the string to the active console. A new line will be displayed unless the nonewline keyword is specified. The output from the action puts command for a synchronous applet is displayed directly to the console, bypassing the system logger. The output of the action puts command for an asynchronous applet is directed to the system logger."

  https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/configuration/xe-3s/eem-xe-3s-book/eem-policy-cli.html

• Question 778:

  Which two solutions are used for backing up a Cisco DNA Center Assurance database? (Choose two)

  A. NFS share

  B. local server

  C. non-linux server

  D. remote server

  E. bare metal server

  Correct Answer: AD

  Cisco DNA Center creates the backup files and posts them to a remote server. Each backup is uniquely stored using the UUID as the directory name.To support Assurance data backups, the server must be a Linux-based NFS server that

  meets the following requirements:

  ?Support NFS v4 and NFS v3.

  ?Cisco DNA Center stores backup copies of Assurance data on an external NFS device and automation data on an external remote sync (rsync) target location.

  ?The remote share for backing up an Assurance database (NDP) must be an NFS share.

  Reference: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/2-1-2/admin_guide/b_cisco_dna_center_admin_guide_2_1_2/

  b_cisco_dna_center_admin_guide_2_1_1_chapter_0110.html

• Question 779:

  Which resource is able to be shared among virtual machines deployed on the same physical server?

  A. disk

  B. operating system

  C. VM configuration file

  D. applications

  Correct Answer: A

• Question 780:

  Which Cisco FlexConnect state allows wireless users that are connected to the network to continue working after the connection to the WLC has been lost?

  A. Authentication Down/Switching Down

  B. Authentication-Central/Switch-Local

  C. Authentication- Down/Switch-Local

  D. Authentication-Central/Switch-Central

  Correct Answer: C

  Operation Modes

  There are two modes of operation for the FlexConnect AP.

  *

  Connected mode: The WLC is reachable. In this mode the FlexConnect AP has CAPWAP connectivity with its WLC.

  *

  Standalone mode: The WLC is unreachable. The FlexConnect has lost or failed to establish CAPWAP connectivity with its WLC. A WAN-link outage between a branch and its central site is a example of such a mode of operation.

  FlexConnect States

  A FlexConnect WLAN, depending on its configuration and network connectivity, is classified as being in one of the following defined states.

  *

  Authentication-Central/Switch-Central: This state represents a WLAN that uses a centralized authentication method such as 802.1X, VPN, or web. User traffic is sent to the WLC via CAPWAP (Central switching). This state is supported only

  when FlexConnect is in connected mode.

  *

  Authentication Down/Switching Down: Central switched WLANs no longer beacon or respond to probe requests when the FlexConnect AP is in standalone mode. Existing clients are disassociated.

  *

  Authentication-Central/Switch-Local: This state represents a WLAN that uses centralized authentication, but user traffic is switched locally. This state is supported only when the FlexConnect AP is in connected mode.

  *

  Authentication-Down/Switch-Local: A WLAN that requires central authentication rejects new users.

  Existing authenticated users continue to be switched locally until session time-out if configured. The WLAN continues to beacon and respond to probes until there are no more existing users associated to the WLAN. This state occurs as a

  result of the AP going into standalone mode.

  *

  Authentication-local/switch-local: This state represents a WLAN that uses open, static WEP, shared, or WPA2 PSK security methods. User traffic is switched locally. These are the only security methods supported locally if a FlexConnect

  goes into standalone mode. The WLAN continues to beacon and respond to probes. Existing users remain connected and new user associations are accepted. If the AP is in connected mode, authentication information for these security

  types is forwarded to the WLC.