Cisco CCNP Enterprise 300-410 Questions & Answers

• Question 581:

  An associate configured a serial connection on Router1 to use PPP with authentication. You execute the debug ppp negotiation command on the router and receive the following output:

  

  Which of the following statements are true? (Choose all that apply.)

  A. the credentials are being sent in clear text

  B. the connection failed

  C. the peer's name is Router2

  D. the authentication failed

  Correct Answer: AC

  The peer router's name is Router2 and the authentication method is PAP, which transmits the credentials in clear text. The peer name can be seen in the following line of output:

  *Mar 3 00:06:17.536: Se1/1 PAP: Authenticating peer ROUTER2

  The authentication protocol used is seen in the following line of output:

  *Mar 3 00:06:16.868: Se1/1 LCP: AuthProto PAP (0x0304C023)

  The connection process and authentication process are two separate processes and in this case both succeeded. First the connection completed as indicated by the following line of output:

  *Mar 3 00:06:17.260: Se1/1 LCP: State is Open

  Then later the authentication succeeded, as indicated by this line at the end of the output:

  *Mar 3 00:06:17.584: Se1/1 PPP: Phase is UP

  Objective:

  Layer 2 Technologies

  Sub-Objective:

  Configure and verify PPP

  References:

  Point-to-Point Protocol (PPP) Introduction > Troubleshoot and Alerts > Troubleshooting TechNotes > Configuring and Troubleshooting PPP Password Authentication Protocol (PAP)

• Question 582:

  You have a Frame Relay topology that is currently a hub and spoke using a single physical serial interface on the hub router with the default network type. OSPF is also running on the interface.

  You execute the following command:

  ip ospf network point-to-point

  What would be the effect of executing this command on the serial interface of the hub router?

  A. The hello interval for OSPF will change to 30 seconds

  B. The dead interval for OSPF will change to 40 seconds

  C. There will now be a DR election

  D. The hub router must now be configured with a router ID

  Correct Answer: B

  The dead interval for OSPF will change to 40 seconds. By default, a Frame Relay connection that uses a physical interface is designated a non-broadcast network for purposes of determining the OSPF hello and dead intervals. There are four possible network types for Frame Relay, and they use different values for the OSPF hello and dead intervals. The values are shown below:

  

  When the ip ospf network point-to-point command is executed, it will change the network type from the default of non-broadcast to point-to-point. This alteration will change the hello and dead intervals to 10 and 40 seconds, respectively.

  The hello interval for OSPF will not change to 30 seconds. That is the value for non-broadcast and point-to- multipoint networks.

  There will not be a designated router (DR) election. DRs are not elected on a point-to-point network. The hub router does not need to be configured with a router ID. In OSPF for IPv4, the router can create its own by using one of the IP

  addresses of its interfaces.

  Objective:

  Layer 2 Technologies

  Sub-Objective:

  Explain Frame Relay

  References:

  Home > Support > Technology support > Initial Configurations for OSPF over Frame Relay Subinterfaces

• Question 583:

  In the Active Discovery phase of PPPoE, which of the following is NOT verified by the Broadband Network gateway (BNG) to prevent spoofing?

  A. source MAC address

  B. arriving access interface

  C. PPPoE session ID

  D. destination MAC address

  Correct Answer: D

  The destination MAC address is the address of the BNG, so there is no need for it to be verified. If the traffic arrived on the BNG interface, it is correct.

  PPPoE is composed of two main phases, the Active Discovery Phase and the PPP Session Phase. The Active Discovery phase consists of the following communications between the PPPoE client and the BNG:

  1.

  The client sends a PPPoE Active Discovery Initiation (PADI) broadcast signal to the remote device (BNG).

  2.

  The remote device sends back a PPPoE Active Discovery Offer (PADO) that contains the MAC address of the BNG and destination MAC address of the subscriber (client).

  3.

  The subscriber (client) send a PPPoE Active Discovery Request (PADR) continuing the destination MAC address of the BNG to which it wishes to establish a session.

  4.

  The BNG responds with a PPPoE Active Discovery Session-Confirmation (PADS) containing the PPPoE session ID.

  Once this process is complete, the session moves on to the PPP Session Phase in which Link Control Protocol (LCP) parameters such as maximum transmission unit (MTU) are agreed to, authentication is performed, and Network Control

  Protocols (NCP) for any Layer 3 protocol that will traverse the link are started.

  Objective:

  Layer 2 Technologies

  Sub-Objective:

  Configure and verify PPP

  References:

  Cisco Support Community > ASR9000 BNG debugging PPPoE sessions Cisco > Cisco Security Appliance Command Line Configuration Guide, Version 8.0 > Configuring the PPPoE Client > PPPoE Client Overview

• Question 584:

  An associate of yours configured a PPPoE connection. You have been alerted by a vulnerability tester that by using a sniffer, he was able to learn the connection credentials.

  What type of authentication must your associate have configured on the connection?

  A. PAP

  B. 802.1x

  C. CHAP

  D. IPsec

  Correct Answer: A

  The method used must have been Password Authentication Protocol (PAP). This method transmits the credentials in clear text, which makes it a poor choice.

  There are only two methods available to authenticate a PPP connection, PAP and Challenge-Handshake Authentication Protocol (CHAP). CHAP never sends the password across the link. Rather, the authenticating end of the connection

  sends random text and other information to the requester. The requester encrypts this data with its password and sends it back. The authenticating end of the connection reverses the encryption using the same password and compares the

  result with what was originally sent. If it matches, the authenticating end of the connection is assured that the requesting end knows the password.

  The connection could not have used either 802.1x or IPsec, as neither method would transmit the credentials in clear text.

  The connection could not have used CHAP. If it had, the credentials could not have been captured with a sniffer.

  Objective:

  Layer 2 Technologies

  Sub-Objective:

  Configure and verify PPP

  References:

  Cisco > Authentication, Authorization, and Accounting Configuration Guide, Cisco IOS Release 15MandT > Configuring Authentication > Non-AAA Authentication Methods > Enabling CHAP or PAP Authentication Cisco > Authentication,

  Authorization, and Accounting Configuration Guide, Cisco IOS Release 15MandT (PDF)

• Question 585:

  Examine the output of the show frame-relay map command:

  

  Which of the following statements is true of the configuration of R1?

  A. Neither PVC is up

  B. A frame-relay map statement was used to manually map the IP address to the DLCI on both PVCs

  C. The DLCIs for both PVCs were learned using inverse ARP

  D. Broadcast traffic is not allowed on either PVCs

  Correct Answer: C

  The output shows that the Data Link Connection identifiers (DLCI) for both PVCs were learned using inverse ARP. In a Frame Relay topology, Layer 2 addresses are called DLCSI. Each end of a Frame Relay circuit can learn the DLCI of the

  other end through manual configuration, using the frame-relay map command, or it can be learned dynamically, using a process called inverse ARP. When the addresses are learned using inverse ARP, the output of the show frame-relay

  map command will indicate that by designating the circuit as dynamic. Both PVCs are up, as indicated by the word active in the output for both PVCs.

  A frame-relay map statement not was used to manually map the IP addresses to the DLCI on both PVCs. Were that the case, the output would indicate static in the place where it says dynamic.

  Broadcast and multicast traffic are both allowed across both PVCs, as indicated by the word broadcast after each entry.

  Objective:

  Layer 2 Technologies

  Sub-Objective:

  Explain Frame Relay

  References:

  Home > Support > Technology Support > Wan > Frame relay > Troubleshoot and alerts > Troubleshooting TechNotes > Comprehensive Guide to Configuring and Troubleshooting Frame Relay

• Question 586:

  You are configuring a 6to4 tunnel. You want to translate the IPv4 address 192.168.50.4 to the IPv6 address for the tunnel.

  What would be the correct translation?

  A. 2002:c0a8:3204::/16

  B. 2002:c0a8:9901::/48

  C. 2002:c0a8:3204::/48

  D. c0a8:3204:2002::/16

  Correct Answer: C

  When implementing an automatic 6to4 tunnel, each IPv6 site receives a /48-bit prefix. The hexadecimal equivalent of the IPv4 address of the edge router is appended to 0x2002 and followed with the prefix to identify each end of the tunnel. In this case, if the edge router's IPv4 address were 192.168.50.4, the hexadecimal equivalent of the address (c0a8:3204) would be inserted between 0X2002 and the /48 prefix, resulting in 2002:c0a8:3204::/48 to arrive at the tunnel endpoint address.

  The correct address would not be 2002:c0a8:3204::/16. The prefix is 48, not 16.

  The correct address would not be 2002:c0a8:9901::/48. The hexadecimal equivalent of the address 192.168.50.4 is c0a8:3204, not c0a8:9901.

  The correct address would not be c0a8:3204:2002::/16. It has an incorrect prefix (/16) and the values in the other sections are out of order.

  Objective: Network Principles Sub-Objective:

  Recognize proposed changes to the network

  References:

  Cisco IPv6 Implementation Guide, Release 15.2MandT > Implementing Tunneling for IPv6 > Implementing Tunneling for IPv6 > Configuration Examples for Implementing Tunneling for IPv6

• Question 587:

  Which of the following statements is TRUE concerning a 6to4 tunnel?

  A. The IPv6 packet is encapsulated in an IPv4 packet using an IPv4 protocol type of 41.

  B. The 6to4 tunnel method includes a 20-byte IPv6 header with no options and an IPv4 payload.

  C. The maximum transmission unit is increased by 20 octets with the 6to4 tunnel method.

  D. The IPv6 packet has its header removed and replaced with an IPv4 header with the 6to4 tunnel method.

  Correct Answer: A

  When an IPv6 packet is tunneled across a portion of the network that does not support IPv6, the IPv6 packet is encapsulated in an IPv4 packet using an IPv4 protocol type of 41. When it reaches the other end of the tunnel, the IPv4 portion is

  stripped off and the packet is routed the rest of the way by using the remaining IPv6 header.

  This method does not include a 20-byte IPv6 header with no options and an IPv4 payload. On the contrary, it includes a 20-byte IPv4 header with no options and an IPv6 payload.

  The maximum transmission unit is not increased by 20 octets with this method. Rather, it is decreased by 20 bytes due to the extra overhead.

  The IPv6 packet does not have its header removed and replaced with an IPv4 header. It encapsulates the entire IPv6 packet within an IPv4 header.

  Objective:

  Network Principles

  Sub-Objective:

  Recognize proposed changes to the network

  References:

  Cisco > Home > Support > Technology Support > IP > IP Version 6 > Configure > Configuration Examples and Technotes > Tunneling IPv6 through an IPv4 Network

• Question 588:

  You just discovered that a ping packet sent from one of the devices to another took a different path in the return than it did on its way to the destination.

  What behavior caused this?

  A. Windowing

  B. Global synchronization

  C. MSS

  D. Asymmetric routing

  Correct Answer: D

  This behavior is caused by asymmetric routing. This is quite common in a routed network and usually is not a problem. It can, however, become an issue when firewalls reside in a routed path. Firewalls can cause problems when they

  maintain state information about connections. State information is used to determine if return connection is allowed. If the return path is routed through a different firewall, it will not have the correct state information for the connection, and the

  return will be disallowed.

  It is not caused by windowing. This is a technique used to adjust the number of packets that can be acknowledged at once by a receiving computer in a transmission. In times of congestion, the window or number of packets that can be

  acknowledged at a time will be small. Later, when congestion goes down, the window size can be increased.

  The behavior is not caused by the maximum segment size (MSS). This value specifies the largest amount of data, in octets, that a computer or communications device can receive in a single TCP segment. This will not cause a packet to take

  a different path in the return than it did on its way to the destination.

  The behavior is not caused by global synchronization. This occurs when congestion on the network causes all devices to reduce their transmission rates at the same time. The result is the network cycling between sharp increases and sharp

  decreases in traffic.

  Objective:

  Network Principles

  Sub-Objective:

  Explain TCP operations

  References:

  Home > Services > Technical services newsletter > Tech insights > Chalk talk > Asymmetric Routing and Firewalls

• Question 589:

  Which of the following are valid IPv4 to IPv6 migration strategies? (Choose two.)

  A. DHCP

  B. Tunnels

  C. Dual-stack

  D. Encapsulating IPv4 into IPv6

  Correct Answer: BC

  Tunnels and dual-stack are valid IPv4 to IPv6 migration strategies.

  Tunneling mechanisms can transport IPv6 across an IPv4 infrastructure. Cisco supports the following types of tunneling for this purpose: Manual tunnels Generic Routing Encapsulation (GRE) tunnels IPv4 compatible tunnels 6-to-4 tunnels Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) tunnels

  For all tunneling types, IPv6 packets are encapsulated in IPv4 packets for delivery across the IPv4 infrastructure. These tunnels require two endpoints, either two routers, or a router and a host. Both endpoints must support IPV4 and IPv6.

  When implementing an automatic 6-to-4 tunnel each IPv6 site receives a /48-bit prefix. The hexadecimal equivalent of the IPv4 address of the edge router is appended to 0x2002 and followed with the prefix to identify each end of the tunnel. Each end of the tunnel must be a dual stack router, that is, one that can route both IPv4 and IPv6. For example if the edge router's IPv4 address were 192.168.99.1, the hexadecimal equivalent of the address (c0a8:6301) would be inserted between 0X2002 and the /48 prefix, resulting in 2002:c0a8:6301:: /48 to arrive at the tunnel endpoint address.

  The following example shows a partial output of the show run command executed on a router hosting one end of a 6-to-4 tunnel:

  

  The least significant 32 bits in the address referenced by the ipv6 route 2002::/16 Tunnel0 command correspond to the IPv4 address (64.101.64.1) assigned to the tunnel source. The hex equivalent is 4065:4001, yielding 2002:4065:4001::/48.

  Another example of how IPv4 addresses can be used in the creation of the tunnel endpoint IPv6 identifier is shown in the partial output of the show run command executed on a router that is hosting one end of an automatic IPv4 compatible tunnel:

  

  In the neighbor statement under the BGP configuration section, the neighbor address is derived from the IPv4 address of the other router (192.168.4.1). This could be implemented in one of three ways: ::192.168.4.1

  0:0:0:0:0:0:192.168.4.1 ::c0a8:0401

  The IPv6 addresses ::192.168.4.1 and 0:0:0:0:0:0:192.168.4.1 are implemented by inserting the IP address at either the end of :: or 0:0:0:0:0:0. (:: is a IPv6 shortcut for 0:0:0:0:0:0). The IPv6 address::c0a8:0401 is implemented by inserting

  the hex equivalent of 192.168.4.1 (c0a8:0401) in the same location.

  Another potential migration strategy is to run dual stacks. The TCP/IP stack, or stack, is the TCP/IP software that is included in most operating systems. It is possible to run dual TCP/IP stacks on a computer. For example, servers and other

  infrastructure equipment often run both an IPv4 and IPv6 IP stack for application compatibility. This dual-stack configuration allows applications that require IPv6 to use the IPv6 stack and applications that require IPv4 to use the IPv4 stack.

  The following partial output of the show run command shows the configuration of a dual stack router:

  ipv6 unicast routing

  interface fastethernet0/0

  ip address 192.168.5.1 255.255.255.0

  ipv6 address 3ffe:b00:c19:2::3/127

  This configuration allows applications on the same segment to communicate via IPv4 or IPv6.

  Dynamic Host Configuration Protocol (DHCP) provides no benefits in migrating from IPv4 to IPv6.

  IPv4 is not encapsulated in IPv6 in any of the migration strategies. IPv6 is encapsulated into IPv4.

  Objective:

  Network Principles

  Sub-Objective:

  Recognize proposed changes to the network

  References:

  Cisco > Cisco IOS IPv6 Implementation Guide, Release 12.4 > Implementing Tunneling for IPv6

• Question 590:

  Refer to the following set of commands:

  

  Which of the following statements is TRUE about the given set of commands?

  A. IPv4 and IPv6 are running simultaneously on rtrA

  B. The IPv4 address is translated to an IPv6 address

  C. The IPv6 address is an IPv4-compatible address

  D. A tunnel is created for the interoperability of the IPv4 and IPv6 addresses

  Correct Answer: A

  The correct answer is that IPv4 and IPv6 are running simultaneously on rtrA. The set of commands enables IPv6 on the rtrA router and assigns an IPv4 address and an IPv6 address to the Fa0/0 interface. This indicates that the router is a

  dual-stack router on which both IPv4 and IPv6 are running simultaneously.

  The IPv4 address is not translated to the IPv6 address by the given set of commands because NAT-PT is not enabled on the router. To enable NAT-PT on a router, you need to use the ipv6 nat command. In addition, the ipv6 nat prefix

  command should be used to specify an IPv6 prefix.

  The IPv6 address is not an IPv4-compatible address. IPv4-compatible IPv6 addresses are used in automatic IPv4-compatible IPv6 tunnels. These addresses refer to those IPv6 unicast addresses that have zeros in the first 96 bits and an

  IPv4 address in the last 32 bits. For example, 0:0:0:0:0:0:192.156.10.67 is an IPv4- compatible IPv6 address where 192.156.10.67 is an IPv4 address. The IPv6 address (2001:0:1:1:D52::F3C/64), in this case, is not an IPv4-compatible IPv6

  address.

  A tunnel is not created for the interoperability of the IPv4 and IPv6 addresses because the given set of commands configures the router as a dual-stack router. There are no commands for configuring a tunnel on the router.

  Objective:

  Network Principles

  Sub-Objective:

  Recognize proposed changes to the network

  References:

  Cisco IOS IPv6 Configuration Guide, Release 12.4 > Implementing IPv6 Addressing and Basic Connectivity > Configuration Examples for Implementing IPv6 Addressing and Basic Connectivity > Example: Dual Protocol Stacks Configuration