Cisco 351-001 Online Practice Questions and Exam Preparation

Cisco 351-001 Online Questions & Answers

• Question 701:

  When you configure the ip pmtu command under an L2TPv3 pseudowire class, which two things can happen when a packet exceeds the L2TP path MTU? (Choose two.)

  A. The router drops the packet.
  B. The router always fragments the packet after L2TP/IP encapsulation.
  C. The router drops the packet and sends an ICMP unreachable message back to the sender only if the DF bit is set to 1.
  D. The router always fragments the packet before L2TP/IP encapsulation.
  E. The router fragments the packet after L2TP/IP encapsulation only if the DF bit is set to 0.
  F. The router fragments the packet before L2TP/IP encapsulation only if the DF bit is set to 0.
  C. The router drops the packet and sends an ICMP unreachable message back to the sender only if the DF bit is set to 1.
  F. The router fragments the packet before L2TP/IP encapsulation only if the DF bit is set to 0.

  ---

  If you enable the ip pmtu command in the pseudowire class, the L2TPv3 control channel participates in the path MTU discovery. When you enable this feature, the following processing is performed:

  ?

  ICMP unreachable messages sent back to the L2TPv3 router are deciphered and the tunnel MTU is updated accordingly. In order to receive ICMP unreachable messages for fragmentation errors, the DF bit in the tunnel header is set according to the DF bit value received from the CE, or statically if the ip dfbit set option is enabled. The tunnel MTU is

  ?

  ICMP unreachable messages are sent back to the clients on the CE side. ICMP unreachable messages are sent to the CE whenever IP packets arrive on the CE- PE interface and have a packet size greater than the tunnel MTU. A Layer 2 header calculation is performed before the ICMP unreachable message is sent to the CE.

  Reference: http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/l2tpv325.html

• Question 702:

  Which two statements about private VLAN communications are true? (Choose two)

  A. Primary VLAN traffic is passed across trunk interfaces.
  B. Isolated ports communicate with other isolated ports.
  C. Promiscuous ports communicate with all other ports.
  D. Promiscuous ports connect only to routers.
  A. Primary VLAN traffic is passed across trunk interfaces.
  C. Promiscuous ports communicate with all other ports.

• Question 703:

  Which two statements about SNMP traps are true? (Choose two.)

  A. They are sent by an agent after a specified event.
  B. They are sent when solicited after a specified event.
  C. They are equivalent to a community string.
  D. They provide solicited data to the manager.
  E. They are sent by a management station to an agent.
  F. Vendor-specific traps can be configured.
  A. They are sent by an agent after a specified event.
  F. Vendor-specific traps can be configured.

  ---

  The SNMP agent contains MIB variables whose values the SNMP manager can request or change. A manager can get a value from an agent or store a value into the agent. The agent gathers data from the MIB, the repository for information

  about device parameters and network data. The agent can also respond to a manager's requests to get or set data. An agent can send unsolicited traps to the manager. Traps are messages alerting the SNMP manager to a condition on the

  network. Traps can mean improper user authentication, restarts, link status (up or down), MAC address tracking, closing of a TCP connection, loss of connection to a neighbor, or other significant events.

  Reference:

  http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12- 2_55_se/configuration/guide/scg_2960/swsnmp.html

• Question 704:

  In GETVPN, which key is used to secure the control plane?

  A. Traffic Encryption Key (TEK)
  B. content encryption key (CEK)
  C. message encryption key (MEK)
  D. Key Encryption Key (KEK).
  D. Key Encryption Key (KEK).

  ---

  GDOI introduces two different encryption keys. One key secures the GET VPN control plane; the other key secures the data traffic. The key used to secure the control plane is commonly called the Key Encryption Key (KEK), and the key used to encrypt data traffic is known as Traffic Encryption Key (TEK).

  Reference: Group Encrypted Transport VPN (Get VPN) Design and Implementation Guide PDF

• Question 705:

  What is a key advantage of Cisco GET VPN over DMVPN?

  A. Cisco GET VPN provides zero-touch deployment of IPSEC VPNs.
  B. Cisco GET VPN supports certificate authentication for tunnel establishment.
  C. Cisco GET VPN has a better anti-replay mechanism.
  D. Cisco GET VPN does not require a secondary overlay routing infrastructure.
  D. Cisco GET VPN does not require a secondary overlay routing infrastructure.

  ---

  DMVPN requires overlaying a secondary routing infrastructure through the tunnels, which results in suboptimal routing while the dynamic tunnels are built. The overlay routing topology also reduces the inherent scalability of the underlying IP VPN network topology. Traditional point-to-point IPsec tunneling solutions suffer from multicast replication issues because multicast replication must be performed before tunnel encapsulation and encryption at the IPsec CE (customer edge) router closest to the multicast source. Multicast replication cannot be performed in the provider network because encapsulated multicasts appear to the core network as unicast data. Cisco's Group Encrypted Transport VPN (GET VPN) introduces the concept of a trusted group to eliminate point-to-point tunnels and their associated overlay routing. All group members (GMs) share a common security association (SA), also known as a group SA. This enables GMs to decrypt traffic that was encrypted by any other GM. (Note that IPsec CE acts as a GM.) In GET VPN networks, there is no need to negotiate point-to- point IPsec tunnels between the members of a group, because GET VPN is "tunnel-less."

  Reference: Group Encrypted Transport VPN (Get VPN) Design and Implementation Guide PDF

• Question 706:

  DRAG DROP

  Drag and drop each BGP attribute on the left to the matching description on the right.

  Select and Place:

  

  

• Question 707:

  On a broadcast interface, which two OSPF states support BFD sessions? (Choose two.)

  A. DR
  B. BDR
  C. DROTHER
  D. 2WAY
  E. FULL
  F. ACTIVE
  A. DR
  B. BDR

• Question 708:

  In the DiffServ model, which class represents the lowest priority with the lowest drop probability?

  A. AF11
  B. AF13
  C. AF41
  D. AF43
  A. AF11

  ---

  Assured Forwarding (AF) Behavior Group

  Class 1

  Class 2

  Class 3

  Class 4

  Low Drop

  AF11 (DSCP 10)

  AF21 (DSCP 18)

  AF31 (DSCP 26)

  AF41 (DSCP 34)

  Med Drop

  AF12 (DSCP 12)

  AF22 (DSCP 20)

  AF32 (DSCP 28)

  AF42 (DSCP 36)

  High Drop

  AF13 (DSCP 14)

  AF23 (DSCP 22)

  AF33 (DSCP 30)

  AF43 (DSCP 38)

  Reference: http://en.wikipedia.org/wiki/Differentiated_services

• Question 709:

  Which three statements about IPsec VTIs are true? (Choose three.)

  A. IPsec sessions require static mapping to a physical interface.
  B. They can send and receive multicast traffic.
  C. They can send and receive traffic over multiple paths.
  D. They support IP routing and ACLs.
  E. They can send and receive unicast traffic.
  F. They support stateful failover.
  B. They can send and receive multicast traffic.
  D. They support IP routing and ACLs.
  E. They can send and receive unicast traffic.

• Question 710:

  Which two options are the two main phases of PPPoE? (Choose two.)

  A. Active Discovery Phase
  B. IKE Phase
  C. Main Mode Phase
  D. PPP Session Phase
  E. Aggressive Mode Phase
  F. Negotiation Phase
  A. Active Discovery Phase
  D. PPP Session Phase

  ---

  PPPoE is composed of two main phases:

  Active Discovery Phase -- In this phase, the PPPoE client locates a PPPoE server, called an access concentrator. During this phase, a Session ID is assigned and the PPPoE layer is established.

  PPP Session Phase -- In this phase, PPP options are negotiated and authentication is performed. Once the link setup is completed, PPPoE functions as a Layer 2 encapsulation method, allowing data to be transferred over the PPP link within

  PPPoE headers.

  Reference: http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/vpn/asa- vpn-cli/vpn-pppoe.html