Cisco CCNP Enterprise 300-410 Questions & Answers

• Question 731:

  Refer to the exhibit.

  

  A user has set up an IP SLA probe to test if a non SLA host web server on IP address 10.1.1.1 accepts HTTP sessions prior to deployment. The probe is failing. Which action should the network administrator recommend for the probe to succeed?

  A. Re-issue the ip sla schedule command.

  B. Add the control disable option to the tcp connect.

  C. Modify the ip sla schedule frequency to forever.

  D. Add icmp-echo command for the host.

  Correct Answer: B

  You should disable control packets whenever the other side is not a responder, so if you were running TCP connect to a real web server you would have to disable it because it would not be running as a responder.

• Question 732:

  Refer to the exhibit.

  

  The network administrator must mutually redistribute routes at the Chicago router to the LA and NewYork routers. The configuration of the Chicago router is this:

  

  After the configuration, the LA router receives all the NewYork routes, but NewYork router does not receive any LA routes. Which set of configurations fixes the problem on the Chicago router?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

  "LA router receives all the NewYork routes but it does not receive any LA routes" because when redistrubuting into EIGRP, we must configure the default metric.

• Question 733:

  Refer to the exhibit.

  

  Which two actions restrict access to router R1 by SSH? (Choose two.)

  A. Remove class-map ANY from service-policy CoPP.

  B. Configure transport output ssh on line vty and remove sequence 20 from access list 100.

  C. Configure transport input ssh on line vty and remove sequence 30 from access list 100.

  D. Remove sequence 10 from access list 100 and add sequence 20 deny tcp any any eq telnet to access list 199.

  E. Configure transport output ssh on line vty and remove sequence 10 from access list 199.

  Correct Answer: BC

  To only allow SSH to R1, we have to: + Deny Telnet in ACL 100 because the action of class-map: PERMIT is "permit" + Permit Telnet in ACL 199 because the action of class-map: ANY is "drop" But:

  +

  In ACL 100 there is a permit statement for Telnet traffic "20 permit tcp any any eq telnet (5 matches)" which is not correct so we must remove this statement. + In ACL 199 there is an ACL statement "10 deny tcp any eq telnet any (50 matches)". This statement is aimed for Telnet traffic leaving R1 which is not correct so we must remove this statement. Note:

  +

  The command "transport output telnet ssh" allows telnet and SSH from this device (to other devices).

  +

  Telnet is TCP port 23. + When using Telnet on source port, it affects Telnet traffic leaving from R1.

• Question 734:

  Refer to the exhibit. The R1 and R2 configurations are:

  

  The neighbor relationship is not coming up.

  Which two sets of configurations bring the neighbors up? (Choose two.)

  A. R2 ip route 10.1.1.2 255.255.255.255 192.168.1.2 router bgp 100 neighbor 10.1.1.2 ttl-security hops 1 neighbor 10.1.1.2 update-source loopback 0

  B. R1 ip route 10.1.1.2 255.255.255.255 192.168.1.2 router bgp 100 neighbor 10.1.1.2 disable-connected-check neighbor 10.1.1.2 update-source loopback0

  C. R2 ip route 10.1.1.1 255.255.255.255 192.168.1.1 router bgp 200 neighbor 10.1.1.1 disable-connected-check neighbor 10.1.1.1 update-source loopback0

  D. R2 ip route 10.1.1.1 255.255.255.255 192.168.1.1 router bgp 200 neighbor 10.1.1.1 ttl-security hops 1 neighbor 10.1.1.1 update-source loopback 0

  Correct Answer: BC

  The neighbor disable-connected-check command is used to disable the connection verification process for eBGP peering sessions that are reachable by a single hop but are configured on a loopback interface or otherwise configured with a non-directly connected IP address.

• Question 735:

  What are two functions of IPv6 Source Guard? (Choose two.)

  A. It works independent from IPv6 neighbor discovery.

  B. It denies traffic from unknown sources or unallocated addresses.

  C. It uses the populated binding table for allowing legitimate traffic.

  D. It denies traffic by inspecting neighbor discovery packets for specific patterns.

  E. It blocks certain traffic by inspecting DHCP packets for specific sources.

  Correct Answer: BC

  IPv6 source guard is an interface feature between the populated binding table and data traffic filtering. IPv6 source guard can deny traffic from unknown sources or unallocated addresses.

• Question 736:

  Refer to the exhibit.

  

  A network administrator is troubleshooting OSPF adjacency issue by going through the console logs in the router, but due to an overwhelming log messages stream, it is impossible to capture the problem.

  Which two commands reduce console log messages to relevant OSPF neighbor problem details so that the issue can be resolved? (Choose two.)

  A. debug condition ospf neighbor

  B. debug condition interface

  C. debug condition session-id ADJCHG

  D. debug condition all

  E. debug condition ip

  Correct Answer: BC

  sw#debug condition os % Unrecognized command sw#debug condition session-id <1-4294967295> Session Number for debug filtering

• Question 737:

  What is the output of the following command: show ip vrf

  A. Show's default RD values

  B. Displays IP routing table information associated with a VRF

  C. Show's routing protocol information associated with a VRF.

  D. Displays the ARP table (static and dynamic entries) in the specified VRF

  Correct Answer: A

• Question 738:

  Which command is used to check IP SLA when an interface is suspected to receive lots of traffic with options?

  A. show track

  B. show threshold

  C. show timer

  D. show delay

  Correct Answer: A

• Question 739:

  Refer to the exhibit.

  Jun 24 08:54:51.530: IF-EvO(GigabitEthemet0/0): IP Routing reports state transition from DOWN to DOWN Jun 24 08:54:52.525: %1INEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthemet0/0, changed state to down Jun 24 08:54:52.528: IF-EvD(GigabitEthernet0/0): IP Routing reports state transition from DOWN to DOWN Jun 24 08:54:53 215: IF-EvD(GigabitEthernet0/0): IP Routing reports state transition from DOWN to DOWN Jun 24 08:54:54.998: %LINK-3-UPDOWN: Interface GigabitEthemet0/0, changed state to up Jun 24 08:54:55.006: IF-EvO(GigabitEthernet0/0): IP Routing reports state transition from DOWN to UP Jun 24 08:54:55.998: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up

  R1 is connected with R2 via GigabitEthernet0/0, and R2 cannot ping R1. What action will fix the issue?

  A. Fix route dampening configured on the router

  B. Replace the SFP module because it is not supported.

  C. Fix IP Event Dampening configured on the interface.

  D. Correct the IP SLA probe that failed.

  Correct Answer: C

  The IP Event Dampening feature introduces a configurable exponential decay mechanism to suppress the effects of excessive interface flapping events on routing protocols and routing tables in the network. This feature allows the network operator to configure a router to automatically identify and selectively dampen a local interface that is flapping.

• Question 740:

  Which protocol does VRF-Lite support?

  A. S-IS

  B. ODR

  C. EIGRP

  D. IGRP

  Correct Answer: C