Cisco CCIE Enterprise Wireless 350-401 Questions & Answers

• Question 831:

  What do Cisco DNA southbound APIs provide?

  A. Interface between the controller and the network devices

  B. NETCONF API interface for orchestration communication

  C. RESful API interface for orchestrator communication

  D. Interface between the controller and the consumer

  Correct Answer: A

  The Southbound API is used to communicate with network devices.

  

• Question 832:

  What is a type 2 hypervisor?

  A. Installed as an application on an already installed operating system.

  B. Runs directly on a physical server and includes its own operating system.

  C. Supports over-allocation of physical resources.

  D. Also referred to as a "bare metal hypervisor" because it sits directly on the physical server.

  Correct Answer: A

• Question 833:

  Refer to the exhibit. An engineer configures OSPF and wants to verify the configuration

  

  Which configuration is applied to this device?

  A. R1(config)#router ospf 1 R1(config-router)#network 192.168.50.0 0.0.0.255 area 0

  B. R1(config)#router ospf 1 R1(config-router)#network 0.0.0.0 0.0.0.0 area 0 R1(config-router)#no passive-interface Gi0/1

  C. R1(config)#interface Gi0/1 R1(config-if)#ip ospf enable R1(config-if)#ip ospf network broadcast R1(config-if)#no shutdown

  D. R1(config)#interface Gi01 R1(config-if)#ip ospf 1 area 0 R1(config-if)#no shutdown

  Correct Answer: D

  When you ue the "show ip ospf interface intx/x/x" command, what difference will you see in the old vs new OSPFv2 config?

  - One will say attached via Interface Enable, the other will say Attached via Network Statement https://www.chegg.com/flashcards/chapter-20-implementing-ospf-61b573b4-141b-4f63-bac9-ee35462d315e/deck

• Question 834:

  A customer wants to use a single SSID to authenticate loT devices using different passwords. Which Layer 2 security type must be configured in conjunction with Cisco ISE to achieve this requirement?

  A. Fast Transition

  B. Central Web Authentication

  C. Cisco Centralized Key Management

  D. Identity PSK

  Correct Answer: D

  With the advent of internet of things, the number of devices that connect to the internet is increased multifold. Not all of these devices support 802.1x supplicant and need an alternate mechanism to connect to the internet. One of the security mechanisms, WPA-PSK could be considered as an alternative. With the current configuration, the pre-shared-key is the same for all clients that connect to the same WLAN. In certain deployments such as Educational Institutions, this results in the key being shared to unauthorized users resulting in security breach. Therefore, above mentioned and other requirements lead to the need for provisioning unique pre-shared keys for different clients on a large scale.

  Identity PSKs are unique pre-shared keys created for individuals or groups of users on the same SSID.

  No complex configuration required for clients. The same simplicity of PSK, making it ideal for IoT, BYOD, and guest deployments.

  Supported on most devices, where 802.1X may not, enabling stronger security for IoT.

  Easily revoke access, for a single device or individual, without affecting everyone else.

  Thousands of keys can easily be managed and distributed via the AAA server.

• Question 835:

  Refer to the exhibit. After the code is run on a Cisco IOS-XE router, the response code is 204. What is the result of the script?

  

  A. The configuration fails because another interface is already configured with IP address 10.10.10.1/24.

  B. The configuration fails because interface GigabitEthernet2 is missing on the target device.

  C. The configuration is successfully sent to the device in cleartext.

  D. Interface GigabitEthernet2 is configured with IP address 10.10.10.1/24

  Correct Answer: D

  https://ultraconfig.com.au/blog/restconf-tutorial-everything-you-need-to-know-about-restconf-in-2020/

• Question 836:

  Which HHTP status code is the correct response for a request with an incorrect password applied to a REST API session?

  A. HTTP Status Code 200

  B. HTTP Status Code 302

  C. HTTP Status Code 401

  D. HTTP Status Code: 504

  Correct Answer: C

  A 401 error response indicates that the client tried to operate on a protected resource without providing the proper authorization. It may have provided the wrong credentials or none at all. Note: answer 'HTTP Status Code 200' 4xx code

  indicates a "client error" while a 5xx code indicates a "server error".

  Reference: https://restfulapi.net/http-status-codes/

• Question 837:

  Refer to the exhibit.

  

  What are two effect of this configuration? (Choose two.)

  A. Inside source addresses are translated to the 209.165.201.0/27 subnet.

  B. It establishes a one-to-one NAT translation.

  C. The 10.1.1.0/27 subnet is assigned as the inside global address range.

  D. The 209.165.201.0/27 subnet is assigned as the outside local address range.

  E. The 10.1.1.0/27 subnet is assigned as the inside local addresses.

  Correct Answer: AE

• Question 838:

  Refer to the exhibit. Which commands are required to allow SSH connection to the router?

  

  A. Router(config)#access-list 100 permit udp any any eq 22 Router(config)#access-list 101 permit top any any eq 22 Router(config)#class-map class-ssh ONU Router(config-cmap)#match access-group 101 Router(config)#policy-map COPP Router(config-pmap)#police 100000 conform-action transmit

  B. Router(config)#access-list 100 permit top any eq 22 any Router(config)#class-map class-ssh Router(config-cmap)#match access-group 10 Router(config)#policy-map COPP Router(config-pmap)#class class-ssh Router(config-pmap-c)#police 100000 conform-action transmit

  C. Router(config)#access-list 10 permit top any eq 22 any Router(config)#class-map class-ssh Router(config-cmap)#match access-group 10 Router(config)#policy-map COPP

  Router(config-pmap)#class class-ssh

  Router(config-pmap-c)#police 100000 conform-action transmit

  D. Router(config)#access-list 100 permit tcp any any eq 22 Router(config)#access-list 101 permit tcp any any eq 22 Router(config)#class-map class-ssh Router(config-cmap)#match access-group 101 Router(config)#policy-map COPP Router(config-pmap)#class class-ssh Router(config-pmap-c)#police 100000 conform-action transmit

  Correct Answer: D

  the ACL itself is wrong, the eq keyword should be placed at the end because we want to match incoming ssh requests so the destination "ssh server" will use port 22, and the source "ssh client" will use a random port number.

• Question 839:

  Refer to the exhibit.

  

  An attacker can advertise OSPF fake routes from 172.16.20.0 network to the OSPF domain and black hole traffic. Which action must be taken to avoid this attack and still be able to advertise this subnet into OSPF?

  A. Configure 172.16.20.0 as a stub network.

  B. Apply a policy to filter OSPF packets on R2.

  C. Configure a passive Interface on R2 toward 172.16.20.0.

  D. Configure graceful restart on the 172.16.20.0 interface.

  Correct Answer: C

  agree with passive interface reference: https://networklessons.com/ospf/ospf-passive-interface

• Question 840:

  What is a characteristic of a type 2 hypervisor?

  A. ideal for data center

  B. complicated deployment

  C. ideal for client/end-user system

  D. referred to as bare-metal

  Correct Answer: C