Cisco 351-001 Online Practice Questions and Exam Preparation

Cisco 351-001 Online Questions & Answers

• Question 341:

  Refer to the exhibit.

  

  IPv6 SLAAC clients that are connected to the router are unable to acquire IPv6 addresses. What is the reason for this issue?

  A. Router advertisements are not sent by the router.
  B. Duplicate address detection is disabled but is required on multiaccess networks.
  C. The interface is configured to support DHCPv6 clients only.
  D. The configured interface MTU is too low for IPv6 to be operational.
  A. Router advertisements are not sent by the router.

• Question 342:

  What is the maximum number of secondary IP addresses that can be configured on a router interface?

  B. 2
  C. 4
  D. 1024
  E. 65535
  F. no limit to the number of addresses
  F. no limit to the number of addresses

  ---

  From "IP Routing Frequently Asked Questions"

  Q. What are the maximum number of secondary IP addesses that can be configured on a router interface? A. There are no limits on configuring secondary IP addresses on a router interface.

  Reference: http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol- bgp/28745-44.html#q21

• Question 343:

  Which two options are required parts of an EEM policy? (Choose two.)

  A. event register keyword
  B. body
  C. environment must defines
  D. namespace import
  E. entry status
  F. exit status
  A. event register keyword
  B. body

  ---

  EEM policies require two parts: the event register keyword and the body. The remaining parts of the policy are optional: environment must defines, namespace import, entry status, and exit status (Figure 5). Figure 5. EEM Policy Parts

  

  Reference: http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios- embedded-event-manager- eem/config_guide_eem_configuration_for_cisco_integrated_services_router_platforms.htm l

• Question 344:

  Refer to the exhibit.

  

  Which two options are possible states for the interface configured with the given OSPFv3 authentication? (Choose two.)

  A. GOING UP
  B. DOWN
  C. UNCONFIGURED
  D. GOING DOWN
  A. GOING UP
  B. DOWN

  ---

  To configure IPsec, you configure a security policy, which is a combination of the security policy index (SPI) and the key (the key is used to create and validate the hash value). IPsec for OSPFv3 can be configured on an interface or on an OSPFv3 area. For higher security, you should configure a different policy on each interface configured with IPsec. If you configure IPsec for an OSPFv3 area, the policy is applied to all of the interfaces in that area, except for the interfaces that have IPsec configured directly. Once IPsec is configured for OSPFv3, IPsec is invisible to you. The secure socket API is used by applications to secure traffic. The API needs to allow the application to open, listen, and close secure sockets. The binding between the application and the secure socket layer also allows the secure socket layer to inform the application of changes to the socket, such as connection open and close events. The secure socket API is able to identify the socket; that is, it can identify the local and remote addresses, masks, ports, and protocol that carry the traffic requiring security. Each interface has a secure socket state, which can be one of the following: NULL: Do not create a secure socket for the interface if authentication is configured for the area. DOWN: IPsec has been configured for the interface (or the area that contains the interface), but OSPFv3 either has not requested IPsec to create a secure socket for this interface, or there is an error condition. GOING UP: OSPFv3 has requested a secure socket from IPsec and is waiting for a CRYPTO_SS_SOCKET_UP message from IPsec. UP: OSPFv3 has received a CRYPTO_SS_SOCKET_UP message from IPsec. CLOSING: The secure socket for the interface has been closed. A new socket may be opened for the interface, in which case the current secure socket makes the transition to the DOWN state. Otherwise, the interface will become UNCONFIGURED. UNCONFIGURED. Authentication is not configured on the interface. OSPFv3 will not send or accept packets while in the DOWN state.

  Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/15- sy/iro-15-sy-book/ip6-route-ospfv3-auth-ipsec.html

• Question 345:

  In IPv6 Path MTU Discovery, which ICMP message is sent by an intermediary router that requires a smaller MTU?

  A. Time Exceeded, with code 1 (fragment reassembly time exceeded)
  B. Packet Too Big
  C. Destination Unreachable, with code 4 (the datagram is too big)
  D. Multicast Termination Router
  B. Packet Too Big

• Question 346:

  In a Catalyst 6500 VSS setup, what is the function of RRP?

  A. It determines link integrity and rejects any unidirectional links.
  B. It determines which chassis becomes active and which chassis becomes standby.
  C. It determines which links in an Ether Channel forward traffic.
  D. It prepares the configuration file and brings up the VSL interfaces.
  B. It determines which chassis becomes active and which chassis becomes standby.

• Question 347:

  Refer to the exhibit.

  

  Why is the OSPF state in 2WAY/DROTHER?

  A. This is the expected output when the interface Ethernet0/0 of R1 is configured with OSPF Priority 0.
  B. There is a duplicate router ID.
  C. There is an MTU mismatch.
  D. There is an OSPF timer (hello/dead) mismatch.
  E. This is the expected output when R1 is the DR.
  A. This is the expected output when the interface Ethernet0/0 of R1 is configured with OSPF Priority 0.

  ---

  Sometimes it is desirable for a router to be configured so that it is not eligible to become the DR or BDR. You can do this by setting the OSPF priority to zero with the ip ospf priority priority# interface subcommand. If two OSPF neighbors both have their OSPF interface priority set to zero, they establish two-way adjacency instead of full adjacency.

  Reference: http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first- ospf/13683-11.html

• Question 348:

  Which two statements about IPv4 and IPv6 packet fragmentation are true?

  A. An IPv6 host can drop any fragments larger than 1440 bytes.
  B. An IPv4 host can drop any fragments larger than 576 bytes.
  C. IPv6 fragmentation is performed only on the source of the traffic.
  D. The fixed header of an IPv6 packet can be fragmented.
  E. The extension header of an IPV4 packet can be fragmented.
  F. The Extension header of an IPv4 packet can be fragmented.
  G. IPV6 fragmentation is performed on all devide in the forwarding path.
  B. An IPv4 host can drop any fragments larger than 576 bytes.
  C. IPv6 fragmentation is performed only on the source of the traffic.

• Question 349:

  What is the most secure way to store ISAKMP/IPSec preshared keys in Cisco IOS?

  A. Use the service password-encryption command.
  B. Encrypt the ISAKMP preshared key in secure type 5 format.
  C. Encrypt the ISAKMP preshared key in secure type 7 format.
  D. Encrypt the ISAKMP preshared key in secure type 6 format.
  D. Encrypt the ISAKMP preshared key in secure type 6 format.

  ---

  Using the Encrypted Preshared Key feature, you can securely store plain text passwords in type 6 format in NVRAM using a command-line interface (CLI). Type 6 passwords are encrypted. Although the encrypted passwords can be seen or retrieved, it is difficult to decrypt them to find out the actual password. This is currently the most secure way to store keys.

  Reference: http://www.cisco.com/c/en/us/td/docs/ios- xml/ios/sec_conn_ikevpn/configuration/xe-3s/asr1000/sec-ike-for-ipsec-vpns-xe-3s- asr1000-book/sec- encrypt-preshare.html

• Question 350:

  DRAG DROP

  Drag and drop each policy command on the left to the function it performs on the right.

  Select and Place: