Cisco CCIE Enterprise Wireless 350-401 Questions & Answers

• Question 901:

  What is the role of the RP in PIM sparse mode?

  A. The RP responds to the PIM join messes with the source of requested multicast group

  B. The RP maintains default aging timeouts for all multicast streams requested by the receivers.

  C. The RP acts as a control-plane node and does not receive or forward multicast packets.

  D. The RP is the multicast that is the root of the PIM-SM shared multicast distribution tree.

  Correct Answer: D

  Multicast Distribution Shared Tree - Unlike source trees that have their root at the source, shared trees use a single common root placed at some chosen point in the network. This shared root is called a rendezvous point (RP).

  Source:

  https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-5/configuration_guide/ip_mcast_rtng/b_165_ip_mcast_rtng_9300_cg/b_165_ip_mcast_rtng _9300_9500_cg_chapter_0100.html https://netcraftsmen.com/

  pim-sparse-mode/

• Question 902:

  How must network management traffic be treated when defining QoS policies?

  A. as delay-sensitive traffic in a low latency queue

  B. using minimal bandwidth guarantee

  C. using the same marking as IP routing

  D. as best effort

  Correct Answer: A

  Low latency queuing (LLQ) adds a priority queue to CBWFQ from which delay-sensitive traffic, such as voice traffic, can be transmitted ahead of packets in other queues. By configuring the quality of service (QoS), you can provide

  preferential treatment to specific types of traffic at the expense of other traffic types. Without QoS, the device offers best-effort service for each packet, regardless of the packet contents or size. The device sends the packets without any

  assurance of reliability, delay bounds, or throughput.

  The following are specific features provided by QoS:

  *

  Low latency

  *

  Bandwidth guarantee

  *

  Buffering capabilities and dropping disciplines

  *

  Traffic policing

  *

  Enables the changing of the attribute of the frame or packet header

  *

  Relative services

  *

  Modular QoS Command-Line Interface

  *

  Supported QoS Features for Wired Access

  *

  Hierarchical QoS

• Question 903:

  An administrator must enable Telnet access to Router X using the router username and password database for authentication. Which configuration should be applied?

  A. RouterX(config)# line aux 0 RouterX(config line)# password cisco RouterX(config-line)# login

  B. RouterX(config)# aaa new-model RouterX(config)# aaa authentication login auth-list local

  C. RouterX(config)# line vty 0 4 RouterX(config-line)# login local RouterX(config-line)# end

  D. RouterX(config)# line vty 0 4 RouterX(config-line)# login RouterX(config-line)# end

  Correct Answer: C

• Question 904:

  Refer to the exhibit.

  

  Which result does the python code achieve?

  A. The code encrypts a base64 decrypted password.

  B. The code converts time to the "year/month/day" time format.

  C. The code converts time to the yyyymmdd representation.

  D. The code converts time to the Epoch LINUX time format.

  Correct Answer: C

  print(str(10000*d.year + 100*d.month + d.day))

• Question 905:

  An engineer must configure a GRE tunnel interface in the default mode. The engineer has assigned an IPv4 address on the tunnel and sourced the tunnel from an ethernet interface. Which additional configuration must be made on the tunnel interface?

  A. (config-if)#tunnel destination

  B. (config-if)#keepalive

  C. (config-if)#ip mtu

  D. (config-if)#ip tcp adjust-mss

  Correct Answer: A

  A GRE interface definition includes:

  + An IPv4 address on the tunnel + A tunnel source + A tunnel destination

  Below is an example of how to configure a basic GRE tunnel:

  interface Tunnel 0 ip address 10.10.10.1 255.255.255.0 tunnel source fa0/0 tunnel destination 172.16.0.2

  In this case the "IPv4 address on the tunnel" is 10.10.10.1/24 and "sourced the tunnel from an Ethernet interface" is the command "tunnel source fa0/0". Therefore it only needs a tunnel destination, which is 172.16.0.2.

  Note: A multiple GRE (mGRE) interface does not require a tunnel destination address.

• Question 906:

  An engineer must configure the strongest password authentication to locally authenticate on a router. Which configuration must be used?

  A. username netadmin secret 5 $1$b1JUSkZbBS1Pyh4OzwXyZ1kSZ2

  B. username netadmin secret $15b1JuSk404850110QzwXyZ1k SZ2

  C. line Console 0 password $15b1Ju$

  D. username netadmin secret 9 $9$vFpMfBelbRVV8SseX/bDAxtuV

  Correct Answer: D

  Scrypt is safer than MD5, so answer A is wrong and answer D is correct

  R1(config)#username user secret 0 Specifies an UNENCRYPTED secret will follow5 Specifies a MD5 HASHED secret will follow8 Specifies a PBKDF2 HASHED secret will follow9 Specifies a SCRYPT HASHED secret will follow<0-9> Encryption types not explicitly specifiedLINE The UNENCRYPTED (cleartext) user secretLINE The UNENCRYPTED (cleartext) user secret

• Question 907:

  An engineer must protect their company against ransom ware attacks. Which solution allows the engineer to block the execution stage and prevent file encryption?

  A. Use Cisco AMP deployment with the Malicious Activity Protection engineer enabled.

  B. Use Cisco AMP deployment with the Exploit Prevention engine enabled.

  C. Use Cisco Firepower and block traffic to TOR networks.

  D. Use Cisco Firepower with Intrusion Policy and snort rules blocking SMB exploitation.

  Correct Answer: A

  Ransomware are malicious software that locks up critical resources of the users. Ransomware uses well-established public/private key cryptography which leaves the only way of recovering the files being the payment of the ransom, or restoring files from backups.

  Cisco Advanced Malware Protection (AMP) for Endpoints Malicious Activity Protection (MAP) engine defends your endpoints by monitoring the system and identifying processes that exhibit malicious activities when they execute and stops them from running. Because the MAP engine detects threats by observing the behavior of the process at run time, it can generically determine if a system is under attack by a new variant of ransomware or malware that may have eluded other security products and detection technology, such as legacy signature-based malware detection. The first release of the MAP engine targets identification, blocking, and quarantine of ransomware attacks on the endpoint.

  https://www.cisco.com/c/dam/en/us/products/collateral/security/amp-for-endpoints/white-paper-c11-740980.pdf

• Question 908:

  A client device roams between wireless LAN controllers that are mobility peers, Both controllers have dynamic interface on the same client VLAN which type of roam is described?

  A. intra-VLAN

  B. inter-controller

  C. intra-controller

  D. inter-subnet

  Correct Answer: B

• Question 909:

  Refer to the exhibit. An engineer troubleshoots connectivity issues with an application. Testing is performed from the server gateway, and traffic with the DF bit set is dropped along the path after increasing packet size. Removing the DF bit setting at the gateway prevents the packets from being dropped. What is the cause of this issue?

  

  A. PMTUD does not work due to ICMP Packet Too Big messages being dropped by an ACL

  B. The remote router drops the traffic due to high CPU load.

  C. The server should not set the DF bit in any type of traffic that is sent toward the network

  D. There is a CoPP policy in place protecting the WAN router CPU from this type of traffic

  Correct Answer: C

• Question 910:

  Which solution do laaS service providers use to extend a Layer 2 segment across a Layer 3 network?

  A. VLAN

  B. VTEP

  C. VXLAN

  D. VRF

  Correct Answer: C