Cisco CCIE Enterprise Wireless 350-401 Questions & Answers

• Question 881:

  A network is being migrated from IPV4 to IPV6 using a dual-stack approach. Network management is already 100% IPV6 enabled.

  In a dual-stack network with two dual-stack NetFlow collections, how many flow exporters are needed per network device in the flexible NetFlow configuration?

  A. 1

  B. 2

  C. 4

  D. 8

  Correct Answer: B

  A dual-stack device is a device with network interfaces that can originate and understand both IPv4 and IPv6 packets.

  It is because each flow collector can only send to a single destination. In this question there are two NetFlow collectors... thus two destination. Thus the need for 2 flow exporters. Each flow exporter supports only one destination. If you want to export the data to multiple destinations, you must configure multiple flow exporters and assign them to the flow monitor.

  You can export to a destination using either an IPv4 or IPv6 address. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/15-mt/fnf-15-mt-book/cfg-de-fnflow-exprts.html Look under the section "Configuring the Flow Exporter"

• Question 882:

  How does Cisco Trustsec enable more access controls for dynamic networking environments and data centers?

  A. uses flexible NetFlow

  B. assigns a VLAN to the endpoint

  C. classifies traffic based an the contextual identity of the endpoint rather than its IP address

  D. classifies traffic based on advanced application recognition

  Correct Answer: C

  The Cisco TrustSec solution simplifies the provisioning and management of network access control through the use of software-defined segmentation to classify network traffic and enforce policies for more flexible access controls. Traffic classification is based on endpoint identity, not IP address, enabling policy change without net-work redesign.

• Question 883:

  A customer transitions a wired environment to a Cisco SD-Access solution. The customer does not want to integrate the wireless network with the fabric. Which wireless deployment approach enables the two systems to coexist and meets the customer requirement?

  A. Deploy a separate network for the wireless environment.

  B. Implement a Cisco DNA Center to manage the two networks.

  C. Deploy the wireless network over the top of the fabric.

  D. Deploy the APs in autonomous mode.

  Correct Answer: C

  Looking at the SD-Access Design Considerations > Wireless Design Section:

  SD-Access supports two options for integrating wireless access into the network. One option is to use traditional Cisco Unified Wireless Network (CUWN) local-mode configurations over-the-top as a non-native service. In this mode, the SD-Access fabric is simply a transport network for the wireless traffic, which can be useful during migrations to transport CAPWAP-tunneled endpoint traffic from the APs to the WLCs.

• Question 884:

  Which two characteristics define the Intent API provided by Cisco DNA Center? (Choose two.)

  A. northbound API

  B. business outcome oriented

  C. device-oriented

  D. southbound API

  E. procedural

  Correct Answer: AB

  The Intent API is a Northbound REST API that exposes specific capabilities of the Cisco DNA Center platform. The Intent API provides policy-based abstraction of business intent, allowing focus on an outcome rather than struggling with individual mechanisms steps.

  Reference: https://developer.cisco.com/docs/dna-center/#!cisco-dna-center-platform-overview/intent-api-northbound

• Question 885:

  A network engineer is enabling HTTPS access to the core switch, which requires a certificate to be installed on the switch signed by the corporate certificate authority

  Which configuration commands are required to issue a certificate signing request from the core switch?

  A. Core-Switch(config)#crypto pki enroll Core-Switch Core-Switch(config)#ip http secure-trustpoint Core-Switch

  B. Core-Switch(config)#crypto pki trustpoint Core-Switch Core-Switch(ca-trustpoint)#enrollment terminal Core-Switch(config)#crypto pki enroll Core-Switch

  C. Core-Switch(config)#crypto pki trustpoint Core-Switch Core-Switch(ca-trustpoint)#enrollment terminal Core-Switch(config)#ip http secure-trustpoint Core-Switch

  D. Core-Switch(config)#ip http secure-trustpoint Core-Switch Core-Switch(config)#crypto pki enroll Core-Switch

  Correct Answer: B

  1.

  generate an RSA key

  2.

  Create a trust point.

  3.

  Enter the command "Crypto PKI enroll"

  https://community.cisco.com/t5/vpn/certificate-signing-request-csr-guideline/td-p/2778928

• Question 886:

  An engineer must configure HSRP for VLAN 1000 on SW2. The secondary switch must immediately take over the role of active router If the interlink with the primary switch fails. Which command set completes this task?

  SW2(config)#track 1000 interface gigabitEthernet0/0 line-protocol SW2(config-track)#exit SW2(config)#interface vlan 1000 SW2(config-if)#ip address 10.23.87.3 255.255.255.0

  A. SW2(config-if)# standby version 2 SW2(config-if)# standby 1000 ip 10.23.87.1 SW2(config-if)# standby 1000 priority 95 SW2(config-if)# standby 1000 preelept SW2(config-if)# standby 1000 track gigabitethernet0/0

  B. SW2(config-if)# standby 1000 ip 10.23.87.1 SW2(config-if)# standby 1000 priority 95 SW2(config-if)# standby 1000 preempt SW2(config-if)# standby 1000 track 1000

  C. SW2(config-if)# standby version 2 SW2(config-if)# standby 1000 ip 10.23.87.1 SW2(config-if)# standby 1000 priority 95 SW2(config-if)# standby 1000 preempt SW2(config-if)# standby 1000 track 1000

  D. SW2(config if)# standby version 2 SW2(config-if)# standby 1000 ip 10.23.87.1 SW2(config-if)# standby 1000 priority 95 SW2(config-if)# standby 1000 track 1000

  Correct Answer: C

• Question 887:

  In which two ways does TCAM differ from CAM? (Choose two.)

  A. CAM is used to make Layer 2 forwarding decisions, and TCAM is used for Layer 3 address lookups.

  B. The MAC address table is contained in CAM, and ACL and QoS Information Is stored in TCAM.

  C. CAM Is used by routers for IP address lookups, and TCAM is used to make Layer 2 forwarding decisions.

  D. CAM is used for software switching mechanisms, and TCAM Is used for hardware switching mechanisms.

  E. The MAC address table Is contained in TCAM, and ACL and QoS information is stored in CAM.

  Correct Answer: AB

• Question 888:

  In a Cisco SD-Access solution, which protocol is used by an extended node to connect to a single edge node?

  A. VXLAN

  B. IS-IS

  C. 802 1Q

  D. CTS

  Correct Answer: C

  SD-Access Extended Nodes provide the ability to extend the enterprise network by providing connectivity to non-carpeted spaces of an enterprise ?commonly called the Extended Enterprise. This allows network connectivity and management of IoT devices and the deployment of traditional enterprise end devices in outdoor and non-carpeted environments such as distribution centers, warehouses, or Campus parking lots. This feature extends consistent, policy-based automation to Cisco Industrial Ethernet, Catalyst 3560-CX Compact, and Digital Building Series switches and enables segmentation for user endpoints and IoT devices connected to these nodes. Using Cisco DNA Center automation, switches in the extended node role are onboarded to their connected edge node using an 802.1Q trunk over an EtherChannel with one or multiple physical link members. Extended nodes are discovered using zero-touch Plug-and-Play.

  Reference: https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html#Network_Components

• Question 889:

  Refer to the exhibit.

  

  Which code results in the working python script displaying a list of network devices from the Cisco DNA center?

  A. network_device_list(dnac["host"], dnac["username"],dnac["password"]) login = dnac_login(dnac) print(dnac_devices)

  B. login = dnac_login(dnac["host"], dnac["username"], dnac["password"]) network_device_list(dnac, login) print(dnac_devices)

  C. login = dnac_login(dnac["host"], dnac["username"], dnac["password"]) network_device_list(dnac, login) for item in dnac_devices: print(dnac_devices.item)

  D. network_device_list(dnac["host"], dnac["username"], dnac["password"]) login = dnac_login(dnac) for item in dnac_devices: print(dnac_devices.item)

  Correct Answer: B

  https://github.com/bigevilbeard/dnac-device-info/blob/master/get_dnac_devices.py

• Question 890:

  What is provided by the Stealthwatch component of the Cisco Cyber Threat Defense solution?

  A. real-time threat management to stop DDoS attacks to the core and access networks

  B. real-time awareness of users, devices and traffic on the network

  C. malware control

  D. dynamic threat control for web traffic

  Correct Answer: B

  Cisco Stealthwatch is a comprehensive, network telemetry-based, security monitoring and analytics solution that streamlines incident response through behavioral analysis; detecting denial of service attacks, anomalous behaviour, malicious activity and insider threats. Based on a scalable enterprise architecture, Stealthwatch provides near real-time situational awareness of all users and devices on the network.

  Reference: https://www.endace.com/cisco-stealthwatch-solution-brief.pdf

  Note: Although answer A seems to be correct but in fact, Stealthwatch does not provide real-time protection for DDoS attack. It just helps detect DDoS attack only.

  Stealthwatch aggregates observed network activity and performs behavioral and policy driven analytics against what it sees in order to surface problematic activities. While we don't position our self as a DDOS solution, we're going to leverage our analytical capabilities to identify a DDoS attack against an internal host using the WebUI.

  Reference: https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2016/pdf/LTRSEC-8421-LG.pdf