Cisco CCIE Enterprise Wireless 350-401 Questions & Answers

• Question 981:

  In a Cisco SD-WAN solution, which two functions are performed by OMP? (Choose two.)

  A. advertisement of network prefixes and their attributes

  B. configuration of control and data policies

  C. gathering of underlay infrastructure data

  D. delivery of crypto keys

  E. segmentation and differentiation of traffic

  Correct Answer: AD

  Service routes orginated from vEdges/vSmarts

  Reachability [vRoutes, TLOCs]

  Security [Encryption Keys]

  Service routes [Firewall/IDS]

  Policies throughout the fabric [Data/App-route Policies]

  https://www.grandmetric.com/knowledge-base/design_and_configure/sd-wan-overlay-management-protocol-omp/

  OMP is the control protocol that is used to exchange routing, policy, and management information between Cisco vSmart Controllers and Cisco IOS XE SD-WAN devices in the overlay network. These devices automatically initiate OMP

  peering sessions between themselves, and the two IP end points of the OMP session are the system IP addresses of the two devices.

• Question 982:

  How can an engineer prevent basic replay attacks from people who try to brute force a system via REST API?

  A. Add a timestamp to the request In the API header.

  B. Use a password hash

  C. Add OAuth to the request in the API header.

  D. UseHTTPS

  Correct Answer: A

  Reference: https://security.stackexchange.com/questions/221708/golang-rest-api-security-checks

• Question 983:

  Which access point mode allows a supported AP to function like a WLAN client would, associating and identifying client connectivity issues?

  A. client mode

  B. SE-connect mode

  C. sensor mode

  D. sniffer mode

  Correct Answer: C

  As these wireless networks grow especially in remote facilities where IT professionals may not always be onsite, it becomes even more important to be able to quickly identify and resolve potential connectivity issuesideally before the users complain or notice connectivity degradation. To address these issues we have created Cisco's Wireless Service Assurance and a new AP mode called "sensor"mode. Cisco's Wireless Service Assurance platform has three components, namely, Wireless PerformanceAnalytics, Real-time Client Troubleshooting, and Proactive Health Assessment. Using a supported AP ordedicated sensor the device can actually function much like a WLAN client would associating andidentifying client connectivity issues within the network in real time without requiring an IT or technician to beon site.

  Reference: https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/dam/en/us/td/docs/wireless/controller/technotes/8-5/b_Cisco_Aironet_Sensor_Deployment_Guide.html.xml

• Question 984:

  What is the difference between a RIB and a FIB?

  A. The RIB is used to make IP source prefix-based switching decisions.

  B. The FIB is where all IP routing information is stored.

  C. The RIB maintains a mirror image of the FIB.

  D. The FIB is populated based on RIB content.

  Correct Answer: D

  CEF uses a Forwarding Information Base (FIB) to make IP destination prefix-based switching decisions. The FIB is conceptually similar to a routing table or information base. It maintains a mirror image of the forwarding information contained in the IP routing table. When routing or topology changes occur in the network, the IP routing table is updated, and those changes are reflected in the FIB. The FIB maintains next-hop address information based on the information in the IP routing table. Because there is a one-to-one correlation between FIB entries and routing table entries, the FIB contains all known routes and eliminates the need for route cache maintenance that is associated with earlier switching paths such as fast switching and optimum switching. Note: In order to view the Routing information base (RIB) table, use the "show ip route" command. To view the Forwarding Information Base (FIB), use the "show ip cef" command. RIB is in Control plane while FIB is in Data plane.

• Question 985:

  An engineer is implementing a Cisco MPLS TE tunnel to improve the streaming experience for the clients of a video-on-demand server.

  Which action must the engineer perform to configure extended discovery to support the MPLS LDP session between the headend and tailend routers?

  A. Configure the interface bandwidth to handle TCP and UDP traffic between the LDP peers

  B. Configure a Cisco MPLS TE tunnel on both ends of the session

  C. Configure an access list on the interface to permit TCP and UDP traffic

  D. Configure a targeted neighbor session.

  Correct Answer: B

• Question 986:

  What is required for a virtual machine to run?

  A. a Type 1 hypervisor and a host operating system

  B. a hypervisor and physical server hardware

  C. only a Type 1 hypervisor

  D. only a Type 2 hypervisor

  Correct Answer: B

• Question 987:

  Which outcome is achieved with this Python code?

  client.connect (ip, port= 22, username= usr, password= pswd )

  stdin, stdout, stderr = client.exec_command ( 'show ip bgp 192.168.101.0 bestpath\n ' )

  print (stdout)

  A. connects to a Cisco device using SSH and exports the routing table information

  B. displays the output of the show command in a formatted way

  C. connects to a Cisco device using SSH and exports the BGP table for the prefix

  D. connects to a Cisco device using Telnet and exports the routing table information

  Correct Answer: C

• Question 988:

  Refer to the exhibit. R2 is the neighboring router of R1. R2 receives an advertisement for network 192 168.10.50/32. Which configuration should be applied for the subnet to be advertised with the original /24 netmask?

  

  A. R1(config)# router ospf 1 R1(config-router)# network 192.168.10.0 255.255.255.0 area 0

  B. R1(config)#interface loopback0 R1(confia-if)# ip ospf 1 area 0

  C. R1(config)# interface loopback0 R1(config-if)# ip ospf network point-to-point

  D. R1(config)# interface loopback0 R1(config-if)# ip ospf network non-broadcast

  Correct Answer: C

  Loopback Networks The OSPF network type loopback is enabled by default for loopback interfaces and can be used only on loopback interfaces. The OSPF loopback network type states that the IP address is always advertised with a /32 prefix length, even if the IP address configured on the loopback interface does not have a /32 prefix length. It is possible to demonstrate this behavior by reusing Figure 8-11 and advertising a Loopback 0 interface. Example 8-21 provides the updated configuration. Notice that the network type for R2's loopback interface is set to the OSPF point-to-point network type.

• Question 989:

  A customer wants to provide wireless access to contractors using a guest portal on Cisco ISE. The portal is also used by employees. A solution is implemented, but contractors receive a certificate error when they attempt to access the portal. Employees can access the portal without any errors. Which change must be implemented to allow the contractors and employees to access the portal?

  A. Install a trusted third-party certificate on the Cisco ISE

  B. Install an internal CA signed certificate on the Cisco ISE.

  C. Install a trusted third-party certificate on the contractor devices.

  D. Install an internal CA signed certificate on the contractor devices.

  Correct Answer: A

  "It is recommended to use the Company Internal CA for Admin and EAP certificates, and a publicly-signed certificate for Guest/Sponsor/Hotspot/etc portals. The reason is that if a user or guest comes onto the network and ISE portal uses a privately-signed certificate for the Guest Portal, they get certificate errors or potentially have their browser block them from the portal page. To avoid all that, use a publicly-signed certificate for Portal use to ensure better user experience".

  https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215621-tls-ssl-certificates-in-ise.html

• Question 990:

  What is the function of a control-plane node in a Cisco SD-Access solution?

  A. to run a mapping system that manages endpoint to network device relationships

  B. to implement policies and communicate with networks outside the fabric

  C. to connect external Layer 3 networks to the SD Access fabric.

  D. to connect APs and wireless endpoints to the SD-Access fabric

  Correct Answer: A