Cisco CCNP Enterprise 300-410 Questions & Answers

• Question 651:

  Which of the following statements is TRUE about the communication occurring between rtrA and rtrB in the given exhibit?

  

  A. The only loopback interface used in the communication is the loopback 0 interface of rtrA.

  B. The only loopback interface used in the communication is the loopback 1 interface of rtrB.

  C. Both loopback 0 and loopback 1 interfaces are used for the communication between rtrA and rtrB.

  D. Neither loopback 0 nor loopback 1 interface is used for the communication between rtrA and rtrB.

  Correct Answer: A

  The only loopback interface used in the communication is the loopback 0 interface of rtrA. The configuration on the rtrA router indicates that BGP is enabled on rtrA in the autonomous system number (ASN) 450. The neighbor 131.78.45.2 remote-as 450 command establishes a connection with the rtrB interface having the 131.78.45.2 address. The Gi0/1 interface of rtrB has the address 131.78.45.2, which is directly connected to the Gi0/0 interface (132.78.45.1) of rtrA. The next line, neighbor 131.78.45.2 update-source loopback 0, specifies that the 131.78.45.2 interface (Gi0/1) of rtrB communicates with the loopback 0 interface on rtrA.

  In the configuration of rtrB, the neighbor 10.144.1.1 remote-as 450 command establishes a neighboring relationship with the interface having the address10.144.1.1. The loopback 0 interface of rtrA has the address 10.144.1.1. The loopback 1 interface on rtrB is assigned an IP address but not used in establishing BGP connections between rtrA and rtrB

  Loopback 1 interface of rtrB only would only be used in the communication between rtrA and rtrB if you configured rtrA and rtrB as follows:

  rtrA(config)#router bgp 450 rtrA(config-router)# neighbor 131.78.1.1 remote-as 450

  rtrB(config)#router bgp 450 rtrB(config-router)# neighbor 131.78.45.1 remote-as 450 rtrB(config-router)# neighbor 131.78.45.1 update-source loopback 1

  Both loopback 0 and loopback 1 interfaces are NOT used for communication between rtrA and rtrB. Only the loopback 0 interface of rtrA is used. Both of the loopback interfaces would be used in the communication between rtrA and rtrB only if you changed the configuration of rtrA and rtrB, as given below:

  rtrA(config)# router bgp 450 rtrA(config-router)# neighbor 131.78.1.1 remote-as 450 rtrA(config-router)# neighbor 131.78.1.1 update-source loopback 0

  rtrB(config)#router bgp 450 rtrB(config-router)# neighbor 10.144.1.1 remote-as 450 rtrB(config-router)# neighbor 10.144.1.1 update-source loopback 1

  Because the loopback 0 interface of rtrA is used in communication, is incorrect to state that neither loopback 0 nor loopback 1 interface is used. To ensure that neither of the loopback interfaces are be used for communication, you would configure rtrA and rtrB as follows: rtrA(config)# router bgp 450 rtrA(config-router)# neighbor 131.78.45.2 remote-as 450

  rtrB(config)# router bgp 450

  rtrB(config-router)# neighbor 131.78.45.1 remote-as 450

  Objective:

  Layer 3 Technologies

  Sub-Objective:

  Configure and verify eBGP (IPv4 and IPv6 address families)

  References:

  Cisco > Home > Support > Technology Support > IP > IP Routing > Design > Design Technotes > BGP Case Studies > eBGP Multihop

  Cisco > Cisco IOS IP Routing: Protocol-Independent Command Reference > neighbor update-source Cisco > Cisco IOS IP Routing: Protocol-Independent Command Reference > neighbor remote-as

• Question 652:

  Which command can you use to specify that network 208.15.208.0 belongs to OSPF area 0?

  A. router(config)# network 208.15.208.0 area 0

  B. router(config-if)# ip ospf area 0

  C. router(config)# network 208.15.208.0 255.255.255.0 area 0

  D. router(config-router)# network 208.15.208.0 0.0.0.255 area 0

  Correct Answer: D

  You identify the area to which a network belongs with the network area command issued from router configuration mode:

  router(config-router)# network address wildcard-mask area area-id

  To enter router configuration mode, enter the command router ospf process ID in global configuration mode. For this command to be accepted and acted upon by the router, at least one interface on the router must have an IP address

  assigned and be up.

  The command router(config)# network 208.15.208.0 area 0 is incorrect because it is executed in global configuration mode, as evidenced by the prompt router(config)#.

  The command router(config-if)# ip ospf area 0 is incorrect. This command would be used to configure the router for OSPF and its area. It would also enter configuration mode for that particular process of OSPF so the user can enter additional

  commands that affect that process. However, this command is missing the process ID.

  The command router(config)# network 208.15.208.0 255.255.255.0 area 0 is incorrect because it is executed in the wrong mode. It is entered in global configuration mode instead of OSPF configuration mode. It also has an incorrect mask.

  You must use a wildcard mask instead of a regular mask in the network statements for OSPF. In this case, the mask should be 0.0.0.255 instead of 255.255.255.0.

  Objective:

  Layer 3 Technologies

  Sub-Objective:

  Configure and verify OSPF operations

  References:

  Cisco : OSPF Commands > network area

• Question 653:

  Which commands will display the other routers with which the local router has established an adjacency with, including hold time and uptime parameters?

  A. show ip eigrp neighbors

  B. show ip route

  C. show adjacencies

  D. show eigrp neighbors

  Correct Answer: A

  The show ip eigrp neighbors command will display the neighboring EIGRP routers with which the local router has established an adjacency. It will also display hold time and uptime statistics. In this case, the uptime statistic refers to how long the adjacency has been established. A sample output of the show ip eigrp neighbors command is below.

  Router2# show ip eigrp neigh IP-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num

  1 10.20.0.1 Se1 11 22:37:26 28 200 0 2

  0 10.10.0.1 Se0 13 22:38:09 19 200 0 4

  The show ip route command simply displays the routing table and does not provide neighbor information.

  The other commands are not valid IOS commands.

  Objective:

  Layer 3 Technologies

  Sub-Objective:

  Configure and verify EIGRP neighbor relationship and authentication

  References:

  Cisco IOS IP Routing: EIGRP Command Reference > show ip eigrp neighbors

• Question 654:

  Which statements about BGP policy-based routing are true? (Choose two.)

  A. BGP policy-based routing is performed on a router's inbound interface.

  B. A BGP administrator can use policy-based routing to alter the final destination of the packet.

  C. BGP policy-based routing will select the next-hop of the packet based on its source address.

  D. BGP policy-based routing can be used to alter the path selection for a packet in a downstream AS.

  Correct Answer: AC

  BGP policy-based routing is performed on a router's inbound interface. BGP policy-based routing will select the next-hop of the packet based on its source address. It does this through the use of route maps.

  Below is a partial output of the show run command executed on a router that has a BGP configuration that uses a route map to alter the local preference of a route (172.16.0.0/16) to 90 if it is advertised from the BGP neighbor at 10.5.5.1:

  

  The above output indicates that the local preference for the route to 172.16.0.0/16 is 90 ONLY if it comes from 10.5.5.1, but not if the same route is advertised from 10.5.5.35.

  Route maps can be used to influence a part of the routing table without affecting the rest of the table. Consider an example where a router had two routes to every network in the table, and it prefers Neighbor A as the next hop for all routes. If

  you desired to change the next hop for one of the routes to Neighbor B without affecting the others, you could use route maps to take two different approaches, altering different attributes, which would arrive at the same result. The

  approaches would be:

  Apply a route map to Neighbor B incoming that would set the local preference to 200 (default is 100) for the route. Local preference values determine the path used to exit the AS. A higher value is preferred. Apply a route map to Neighbor A

  such that it advertises the route with a MED of 200. Med values determine the preferred path into the AS. A lower value is preferred. The default is 0.

  Either of these approaches would result in the next hop for the network hanging to Neighbor B without affecting the others,

  Policy-based routing does not alter the destination address of the packet. It can only alter the path to that final destination.

  The BGP routing policy in one AS cannot determine the BGP routing policy in another AS.

  Objective:

  Layer 3 Technologies

  Sub-Objective:

  Identify suboptimal routing

  References:

  Cisco > Home > Support > Technology Support > IP Routing > Design > Design Technotes > Route-Maps for IP Routing Protocol Redistribution Configuration

• Question 655:

  Which command can be used to view the number of times the SPF algorithm has been executed?

  A. show ip ospf

  B. show ip ospf interface

  C. show ip ospf database

  D. show ip ospf neighbor

  Correct Answer: A

  The show ip ospf command can be used to view the number of times the SPF algorithm has been executed, as shown in the last line of the following output:

  

  The show ip ospf interface command can be used to view neighbor adjacencies. A partial output of the command is shown below. It will not show the number of times the SPF algorithm has been executed.

  

  The show ip ospf neighbor command can also be used to view neighbor adjacencies, although its output is slightly different from the show ip ospf interface command. A partial output of the show ip ospf neighbor command is shown below. It also does not show the number of times the SPF algorithm was executed.

  

  The show ip ospf database command does not show the number of times the SPF algorithm has executed. It shows the contents of OSPF database. Partial output is shown below:

  

  You can make the command output more specific by using parameters with the show ip ospf database command. For example, to view only Type 5 LSAs in the database, you would execute the show ip ospf database external command.

  Since all Type 5 LSAs are from external networks, this keyword will trim the output to only those types of LSAs. When Type 5 (or external) routes are placed in the database, the next hop address will be 0.0.0.0, which makes it appear as if it is

  a default route. What this really means is that any traffic that needs to go to that external network will be sent to the router that originated the advertisement (the ASBR).

  Objective:

  Layer 3 Technologies

  Sub-Objective:

  Configure and verify OSPF operations

  References:

  Cisco IOS IP Routing: OSPF Command Reference > OSPF Commands: show ip ospf through T > show ip ospf

• Question 656:

  Which command can you use to display the topological database maintained by an OSPF router?

  A. show ip ospf topology

  B. show ip ospf database

  C. show ip ospf [process-id]

  D. show ip ospf border-routers

  Correct Answer: B

  The correct answer is show ip ospf database. Partial output is shown below:

  

  Issuing the show ip ospf database command will show you a summary of the database; however, to obtain details you must use a keyword with the command, such as router, network, summary, or external.

  The following commands are available to verify OSPF configurations:

  show ip route - displays known routes and from which protocol the routes were discovered for all routing protocols.

  show ip ospf - displays the number of times the SPF algorithm has run and the default Link State Update (LSU) interval.

  show ip ospf database - displays the router ID, the OSPF process ID, and the contents of the topological database.

  There is no show ip ospf topology command.

  The show ip ospf [process-id] command can be used to view the number of times the SPF algorithm has been executed, but not to view the database.

  The show ip ospf border-routers command display the ABRs and the routes to them, but not the contents of the database.

  Objective:

  Layer 3 Technologies

  Sub-Objective:

  Configure and verify OSPF path preference

  References:

  Cisco IOS Master Command List, Release 12.4T > sa ipsec through show ip route dhcp > show ip ospf database

• Question 657:

  Consider the partial output of the show ip route eigrp command:

  

  Which of the following destination subnets have equally load-balanced routes? (Choose all that apply.)

  A. 172.161.4.47/30

  B. 172.161.11.0/27

  C. 15.200.16.0/24

  D. 15.11.78.0/24

  E. 0.0.0.0/0

  Correct Answer: BCE

  The 172.161.11.0/27 and 15.200.16.0/24 networks have equally load-balanced routes. A default route, 0.0.0.0/0, has been configured for load balancing as well. These three subnets are each load balanced on multiple routes. The output

  entry for the 172.161.11.0/27 subnet is as follows:

  D 172.161.11.0/27 [90/1723695] via 10.10.19.45, 00:56:17, S0/1 [90/1723695] via 10.10.19.40, 00:50:58, S0/1

  This subnet can be reached by rtrA through two routes: 10.10.19.45 and 10.10.19.40 next-hop addresses. Both these routes have the same metric (1723695), and so are equally load balanced.

  In the output, the 15.200.16.0/24 subnet has three equal-metric routes: 10.10.78.23, 10.10.19.40, and 10.10.70.41. These three routes are equally used to balance the load from rtrA to the 15.200.16.0/24 subnet.

  The default route 0.0.0.0/0 is load balanced through two interfaces, as shown in the output:

  D*EX 0.0.0.0/0 [170/2645987] via 10.10.70.41, 00:05:12, Ethernet0/0 [170/2645987] via 10.10.70.23, 00:05:12, Ethernet0/0

  This load balancing of the default route could be tested by using traceroute to any IP address not represented in the routing table and verifying the path taken.

  Subnets 172.161.4.47/30 and 15.11.78.0/24 are not participating in load balancing. In the given output, there is a single route (line) for both of these subnets. The rtrA router uses the route through the next-hop 10.10.78.23 to reach the

  172.161.4.47/30 destination subnet. Similarly, rtrA uses the next-hop 10.10.70.41 to transmit packets to the 15.11.78.0/24 subnet.

  Objective:

  Layer 3 Technologies

  Sub-Objective:

  Configure and verify EIGRP load balancing

  References: Cisco IOS IP Routing: Protocol-Independent Command Reference > show ip route Cisco > Support > Technology Support > IP > IP Routing > Technology Information > Technology Whitepaper > Enhanced Interior Gateway Routing Protocol > Document ID: 16406 > Load Balancing

• Question 658:

  Refer to the exhibit. The branch router is configured with a default route toward the Internet and has no routes configured for the HQ site that is connected through interface G2/0. The HQ router is fully configured and does not require changes.

  

  Which configuration on the branch router makes the intranet website (TCP port 80) available to the branch office users?

  A. access-list 101 permit tcp any any eq 80 access-list 102 permit tcp any host intranet-webserver-ip ! route-map pbr permit 10 match ip address 101 set ip next-hop 192.168.2.2 route-map pbr permit 20 match ip address 102 set ip next-hop 192.168.2.2 ! interface G2/0 ip policy route-map pbr

  B. access-list 100 permit tcp host intranet-webserver-ip eq 80 any ! route-map pbr permit 10 match ip address 100 set ip next-hop 192.168.2.2 ! interface G1/0 ip policy route-map pbr

  C. access-list 100 permit tcp any host intranet-webserver-ip eq 80 ! route-map pbr permit 10 match ip address 100 set ip next-hop 192.168.2.2 ! interface G2/0 ip policy route-map pbr

  D. access-list 101 permit tcp any any eq 80 access-list 102 permit tcp any host intranet-webserver-ip ! route-map pbr permit 10 match ip address 101 102 set ip next-hop 192.168.2.2 ! interface G1/0 ip policy route-map pbr

  Correct Answer: D

  The ACL 101 matches all HTTP pakects while the ACL 102 matches TCP packets destined to Intranet webserver. These packets will be sent to HQ router. If amatchcommand refers to several objects in one command, either of them should match (the logical OR algorithm is applied). Forexample, in thematch ip address 101 102 command, a route is permitted if it is permitted by access list 101 or access list 102.

• Question 659:

  DRAG DROP

  Drag and drop the IPv6 first hop security device roles from the left onto the corresponding descriptions on the right.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NXOS_Security_Configuration_Guide_7x_chapter_011011.pdf

• Question 660:

  DRAG DROP

  Drag and drop the ICMPv6 neighbor discovery messages from the left onto the correct packet types on the right.

  Select and Place:

  

  Correct Answer: