Cisco 642-997 Online Practice Questions and Exam Preparation

Cisco 642-997 Online Questions & Answers

• Question 11:

  By default it will take 10 seconds for authentication to fail due to an unresponsive RADIUS server before a Cisco Nexus series switch reverts to another RADIUS server or local authentication. What is one efficient way to improve the reaction time to a RADIUS server failure?

  A. Decrease the global RADIUS retransmission count to 1.
  B. Decrease the global RADIUS timeout interval to 5 seconds.
  C. Configure the RADIUS retransmission count and timeout interval per server, versus globally.
  D. Configure per server a test idle timer, along with a username and password.
  D. Configure per server a test idle timer, along with a username and password.

  ---

  You can monitor the availability of RADIUS servers. These parameters include the username and password to use for the server and an idle timer. The idle timer specifies the interval during which a RADIUS server receives no requests

  before the Nexus 5000 Series switch sends out a test packet. You can configure this option to test servers periodically. The test idle timer specifies the interval during which a RADIUS server receives no requests before the Nexus 5000

  Series switch sends out a test packet. The default idle timer value is 0 minutes. When the idle time interval is 0 minutes, the Nexus 5000 Series switch does not perform periodic RADIUS server monitoring.

  Reference:

  http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guid e/cli_rel_4_0_1a/CLIConfigurationGuide/sec_radius.html

• Question 12:

  Which two security features are only supported on the Cisco Nexus 7000 Series Switches? (Choose two.)

  A. IP source guard
  B. traffic storm control
  C. CoPP
  D. DHCP snooping
  E. Dynamic ARP Inspection
  F. NAC
  B. traffic storm control
  F. NAC

  ---

  A traffic storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. You can use the traffic storm control feature to prevent disruptions on Layer 2 ports by a broadcast, multicast, or unicast traffic storm on physical interfaces. Traffic storm control (also called traffic suppression) allows you to monitor the levels of the incoming broadcast, multicast, and unicast traffic over a 10-millisecond interval. During this interval, the traffic level, which is a percentage of the total available bandwidth of the port, is compared with the traffic storm control level that you configured. When the ingress traffic reaches the traffic storm control level that is configured on the port, traffic storm control drops the traffic until the interval ends.

  Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/dcnm/security/configurati on/guide/b_Cisco_DCNM_Security_Configuration_Guide__Release_5- x/Cisco_DCNM_Security_Configuration_Guide__Release_5x_chapter17.html

  And http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/dcnm/security/configurati on/guide/b_Cisco_DCNM_Security_Configuration_Guide__Release_5- x/Cisco_DCNM_Security_Configuration_Guide__Release_5-x_chapter1.html

• Question 13:

  How is a dynamic vNIC allocated?

  A. Dynamic vNICs are assigned to VMs in vCenter.
  B. Dynamic vNICs can only be bound to the service profile through an updating template.
  C. Dynamic vNICs are bound directly to a service profile.
  D. Dynamic vNICs are assigned by binding a port profile to the service profile.
  C. Dynamic vNICs are bound directly to a service profile.

  ---

  The dynamic vNIC connection policy determines how the connectivity between VMs and dynamic vNICs is configured. This policy is required for Cisco UCS domains that include servers with VIC adapters on which you have installed VMs and

  configured dynamic vNICs. Each dynamic vNIC connection policy includes an Ethernet adapter policy and designates the number of vNICs that can be configured for any server associated with a service profile that includes the policy.

  For VM-FEX that has all ports on a blade in standard mode, you need to use the VMware adapter policy.

  For VM-FEX that has at least one port on a blade in high-performance mode, use the VMwarePassThrough adapter policy or create a custom policy. If you need to create a custom policy, the resources provisioned need to equal the resource

  requirements of the guest OS that needs the most resources and for which you will be using high-performance mode.

  Reference:

  http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/sw/vm_fex/vmware/gui/config _guide/b_GUI_VMware_VM-FEX_UCSM_Configuration_Guide/b_GUI_VMware_VM- FEX_UCSM_Configuration_Guide_chapter_010.html

• Question 14:

  Which situation must you consider when you add a remote RADIUS server to a Cisco Nexus device?

  A. If RADIUS authentication fails, the device falls back to local authentication automatically.
  B. If RADIUS authentication fails, the user is denied access with no further authentication checks.
  C. If the RADIUS server is unreachable, users are unable to log in.
  D. If the RADIUS server is unreachable, all users are given access with the default role.
  B. If RADIUS authentication fails, the user is denied access with no further authentication checks.

• Question 15:

  Which two advantages does FabricPath have over Spanning Tree in implementing a loop- free network topology design? (Choose two.)

  A. Blocked links can be brought in to service if active links fail.
  B. Convergence times are faster.
  C. Multipath forwarding is supported for unicast and multicast Layer 2 and Layer 3 traffic.
  D. Unknown unicast addresses are flooded in through the originating port.
  B. Convergence times are faster.
  C. Multipath forwarding is supported for unicast and multicast Layer 2 and Layer 3 traffic.

• Question 16:

  How does an FCoE end node acquire its FCoE MAC address?

  A. server-provided MAC address
  B. Fibre Channel name server
  C. fabric-provided MAC address
  D. FIP proxy
  C. fabric-provided MAC address

  ---

  The VN_Port is assigned a fabric-provided Mac address (FPMA) that is built by concatenating a 24-bit FCoE MAC address prefix (FC-MAP), ranging from 0x0E-FC-00 to 0x0E-FC-FF, to the 24-bit FCID. Being able to build a unique MAC address for the VN_Port directly from its FCID saves the switch from having to maintain a table that associates FCID and MAC addresses.

  Reference: http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Data_Center/UF_FCoE_final.ht ml

• Question 17:

  Which command specifies a load-balancing method based on the MAC address of a host where the same forwarder is always used for a particular host while the number of GLBP group members remains unchanged?

  A. load-balancing host-dependent
  B. load-balancing mac-pinning
  C. load-balancing round-robin
  D. load-balancing weighted
  A. load-balancing host-dependent

• Question 18:

  Which two issues explain why a packet is not being routed as desired in a policy-based routing configuration? (Choose two.)

  A. The route map is not applied to the egress interface.
  B. The route map is not applied to the ingress interface.
  C. The next hop that is configured in the route map is not in the global routing table.
  D. The next hop that is configured in the route map has a higher metric than the default next hop.
  C. The next hop that is configured in the route map is not in the global routing table.
  D. The next hop that is configured in the route map has a higher metric than the default next hop.

  ---

  The next hop that is configured in the route map is not in the global routing table then the packet will not be forwarded as desired. The next hop that is configured in the route map has a higher metric than the default next hop.

• Question 19:

  Which item represents the process that allows FCoE multihop using T11 standard FC-BB- 5?

  A. distributed FCF
  B. FIP proxy
  C. N Port proxy
  D. FIP snooping
  D. FIP snooping

  ---

  FIP snooping is used in multi-hop FCoE environments. FIP snooping is a frame inspection method that can be used by FIP snooping capable DCB devices to monitor FIP frames and apply policies based on the information in those frames.

  This allows for:

  Enhanced FCoE security (Prevents FCoE MAC spoofing.) Creates FC point-to-point links within the Ethernet LAN Allows auto-configuration of ACLs based on name server information read in the FIP frames

  Reference: http://www.definethecloud.net/fcoe-initialization-protocol-fip-deep-dive/

• Question 20:

  Which Cisco NX-OS feature allows transparent Layer 2 extension between sites?

  A. FabricPath
  B. ETV
  C. OTV
  D. vPC
  E. LISP
  F. TrustSec
  C. OTV