Cisco 351-001 Online Practice Questions and Exam Preparation

Cisco 351-001 Online Questions & Answers

• Question 561:

  What is the function of an EIGRP sequence TLV packet?

  A. to acknowledge a set of sequence numbers during the startup update process
  B. to list the peers that should listen to the next multicast packet during the reliable multicast process
  C. to list the peers that should not listen to the next multicast packet during the reliable multicast process
  D. to define the initial sequence number when bringing up a new peer
  C. to list the peers that should not listen to the next multicast packet during the reliable multicast process

  ---

  EIGRP sends updates and other information between routers using multicast packets to 224.0.0.10. For example in the topology below, R1 made a change in the topology and it needs to send updates to R2 and R3. It sends multicast packets

  to EIGRP multicast address 224.0.0.10. Both R2 and R3 can receive the updates and acknowledge back to R1 using unicast. Simple, right?

  But what if R1 sends out updates, only R2 replies but R3 never does? In the case a router sends out a multicast packet that must be reliable delivered (like in this case), an EIGRP process will wait until the RTO (retransmission timeout)

  period has passed before beginning a recovery action. This period is calculated from the SRTT (smooth round-trip time). After R1 sends out updates it will wait for this period to expire. Then it makes a list of all the neighbors from which it did

  not receive an Acknowledgement (ACK). Next it sends out a packet telling these routers stop listening to multicast until they are been notified that it is safe again. Finally the router will begin sending unicast packets with the information to the

  routers that didn't answer, continuing until they are caught up. In our example the process will be like this:

  1.

  R1 sends out updates to 224.0.0.10

  2.

  R2 responds but R3 does not

  3.

  R1 waits for the RTO period to expire

  4.

  R1 then sends out an unreliable-multicast packet, called a sequence TLV (Type-Length- Value) packet, which tells R3 not to listen to multicast packets any more

  5.

  R1 continues sending any other muticast traffic it has and delivering all traffic, using unicast to R3, until it acknowledges all the packets

  6.

  Once R3 has caught up, R1 will send another sequence TLV, telling R3 to begin listening to multicast again. The sequence TLV packet contains a list of the nodes that should not listen to multicast packets while the recovery takes place.

  But notice that the TLV packet in step 6 does not contain any nodes in the list.

  Note. In the case R3 still does not reply in step 4, R1 will attempt to retransmit the unicast 16 times or continue to retransmit until the hold time for the neighbor in question expires. After this time, R1 will declare a retransmission limit exceeded

  error and will reset the neighbor.

  (Reference: EIGRP for IP: Basic Operation and Configuration)

• Question 562:

  DRAG DROP

  Drag and drop the events on the left to dispaly the correct sequence on the right when CoPP is enabled.

  Select and Place:

  

  

• Question 563:

  DRAG DROP

  Drag and drop the StackWise stack master election rule on the left into the correct priority order on the right.

  Select and Place:

  

  

• Question 564:

  Which feature can protect against broadcast DoS attacks?

  A. DAI
  B. Storm control.
  C. DHCP snooping
  D. IP Source Guard
  B. Storm control.

• Question 565:

  Which three condition types can be monitored by crypto conditional debug? (Choose three.)

  A. Peer hostname
  B. SSL
  C. ISAKMP
  D. Flow ID
  E. IPsec
  F. Connection ID
  A. Peer hostname
  D. Flow ID
  F. Connection ID

  ---

  Supported Condition Types

  The new crypto conditional debug CLIs--debug crypto condition, debug crypto condition unmatched, and show crypto debug-condition--allow you to specify conditions (filter values) in which to generate and display debug messages related

  only to the specified conditions. The table below lists the supported condition types.

  Table 1 Supported Condition Types for Crypto Debug CLI

  Condition Type (Keyword)

  Description

  connid 1

  An integer between 1-32766. Relevant debug messages will be shown if the current IPSec operation uses this value as the connection ID to interface with the crypto engine.

  flowid 1

  An integer between 1-32766. Relevant debug messages will be shown if the current IPSec operation uses this value as the flow-ID to interface with the crypto engine.

  FVRF

  The name string of a virtual private network (VPN) routing and forwarding (VRF) instance. Relevant debug messages will be shown if the current IPSec operation uses this VRF instance as its front-door VRF (FVRF).

  IVRF

  The name string of a VRF instance. Relevant debug messages will be shown if the current IPSec operation uses this VRF instance as its inside VRF (IVRF).

  peer group

  A Unity group-name string. Relevant debug messages will be shown if the peer is using this group name as its identity.

  peer hostname

  A fully qualified domain name (FQDN) string. Relevant debug messages will be shown if the peer is using this string as its identity; for example, if the peer is enabling IKE Xauth with this FQDN string.

  peeripaddress

  A single IP address. Relevant debug messages will be shown if the current IPSec operation is related to the IP address of this peer.

  peer subnet

  A subnet and a subnet mask that specify a range of peer IP addresses. Relevant debug messages will be shown if the IP address of the current IPSec peer falls into the specified subnet range.

  peer username

  A username string. Relevant debug messages will be shown if the peer is using this username as its identity; for example, if the peer is enabling IKE Extended Authentication (Xauth) with this username.

  SPI 1

  A 32-bit unsigned integer. Relevant debug messages will be shown if the current IPSec operation uses this value as the SPI.

  Reference: http://www.cisco.com/c/en/us/td/docs/ios- xml/ios/sec_conn_vpnips/configuration/xe-3s/sec-sec-for-vpns-w-ipsec-xe-3s-book/sec- crypto-debug- sup.html

• Question 566:

  Which two statements best describes the difference between active mode monitoring and passive mode monitoring? (Choose two.)

  A. Active mode monitoring is the act of Cisco PfR gathering information on user packets assembled into flows by NetFlow.
  B. Active mode monitoring uses IP SLA probes for obtaining performance characteristics of the current exit WAN link.
  C. Passive mode monitoring uses IP SLA to generate probes for the purpose of obtaining information regarding the characteristics of the WAN links.
  D. Passive mode monitoring uses NetFlow for obtaining performance characteristics of the exit WAN links.
  B. Active mode monitoring uses IP SLA probes for obtaining performance characteristics of the current exit WAN link.
  D. Passive mode monitoring uses NetFlow for obtaining performance characteristics of the exit WAN links.

• Question 567:

  Which three statements about IS-IS are true? (Choose three.)

  A. IS-IS is not encapsulated in IP.
  B. IS-IS is directly encapsulated in the data link layer.
  C. 0XFEFE is used in the Layer 2 header to identify the Layer 3 protocol.
  D. IS-IS uses protocol ID 93.
  E. IS-IS can be used to route the IPX protocol.
  F. IS-IS is an IETF standard.
  A. IS-IS is not encapsulated in IP.
  B. IS-IS is directly encapsulated in the data link layer.
  C. 0XFEFE is used in the Layer 2 header to identify the Layer 3 protocol.

  ---

  IS-IS is an Interior Gateway Protocol (IGP) for routing OSI. IS-IS packets are not encapsulated in CLNS or IP but are encapsulated directly in the data-link layer. The IS-IS protocol family is OSI, and values such as 0xFE and 0xFEFE are used by the data-link protocol to identify the Layer 3 protocol as OSI.

  Reference: http://www.cisco.com/en/US/products/ps6599/products_white_paper09186a00800a3e6f.sh tml

• Question 568:

  Which three conditions can cause excessive unicast flooding? (Choose three.)

  A. Asymmetric routing
  B. Repeated TCNs
  C. The use of HSRP
  D. Frames sent to FFFF.FFFF.FFFF
  E. MAC forwarding table overflow
  F. The use of Unicast Reverse Path Forwarding
  A. Asymmetric routing
  B. Repeated TCNs
  E. MAC forwarding table overflow

  ---

  Causes of Flooding The very cause of flooding is that destination MAC address of the packet is not in the L2 forwarding table of the switch. In this case the packet will be flooded out of all forwarding ports in its VLAN (except the port it was received on). Below case studies display most common reasons for destination MAC address not being known to the switch. Cause 1: Asymmetric Routing Large amounts of flooded traffic might saturate low-bandwidth links causing network performance issues or complete connectivity outage to devices connected across such low-bandwidth links. Cause 2: Spanning-Tree Protocol Topology Changes Another common issue caused by flooding is Spanning-Tree Protocol (STP) Topology Change Notification (TCN). TCN is designed to correct forwarding tables after the forwarding topology has changed. This is necessary to avoid a connectivity outage, as after a topology change some destinations previously accessible via particular ports might become accessible via different ports. TCN operates by shortening the forwarding table aging time, such that if the address is not relearned, it will age out and flooding will occur. TCNs are triggered by a port that is transitioning to or from the forwarding state. After the TCN, even if the particular destination MAC address has aged out, flooding should not happen for long in most cases since the address will be relearned. The issue might arise when TCNs are occurring repeatedly with short intervals. The switches will constantly be fast-aging their forwarding tables so flooding will be nearly constant. Normally, a TCN is rare in a well-configured network. When the port on a switch goes up or down, there is eventually a TCN once the STP state of the port is changing to or from forwarding. When the port is flapping, repetitive TCNs and flooding occurs. Cause 3: Forwarding Table Overflow Another possible cause of flooding can be overflow of the switch forwarding table. In this case, new addresses cannot be learned and packets destined to such addresses are flooded until some space becomes available in the forwarding table. New addresses will then be learned. This is possible but rare, since most modern switches have large enough forwarding tables to accommodate MAC addresses for most designs. Forwarding table exhaustion can also be caused by an attack on the network where one host starts generating frames each sourced with different MAC address. This will tie up all the forwarding table resources. Once the forwarding tables become saturated, other traffic will be flooded because new learning cannot occur. This kind of attack can be detected by examining the switch forwarding table. Most of the MAC addresses will point to the same port or group of ports. Such attacks can be prevented by limiting the number of MAC addresses learned on untrusted ports by using the port security feature.

  Reference: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6000-series- switches/23563-143.html#causes

• Question 569:

  What is the most efficient way to confirm whether microbursts of traffic are occurring?

  A. Monitor the output traffic rate using the show interface command.
  B. Monitor the output traffic rate using the show controllers command.
  C. Check the CPU utilization of the router.
  D. Sniff the traffic and plot the packet rate over time.
  D. Sniff the traffic and plot the packet rate over time.

  ---

  Micro-bursting is a phenomenon where rapid bursts of data packets are sent in quick succession, leading to periods of full line-rate transmission that can overflow packet buffers of the network stack, both in network endpoints and routers and switches inside the network. In order to troubleshoot microbursts, you need a packet sniffer that can capture traffic over a long period of time and allow you to analyze it in the form of a graph which displays the saturation points (packet rate during microbursts versus total available bandwidth). You can eventually trace it to the source causing the bursts (e.g. stock trading applications).

  Reference: Adam, Paul (2014-07-12). All-in-One CCIE V5 Written Exam Guide (Kindle Locations 989-994). Kindle Edition.

• Question 570:

  Which two statements about static NAT are true? (Choose two.)

  A. An outside local address maps to the same outside global IP address.
  B. An inside local address maps to a different inside global IP address.
  C. An outside local address maps to a different outside global IP address.
  D. An inside local address maps to the same inside global IP address.
  A. An outside local address maps to the same outside global IP address.
  D. An inside local address maps to the same inside global IP address.

  ---

  Example found at the reference link below:

  Reference: http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation- nat/4606-8.html