Cisco CCNP Enterprise 300-410 Questions & Answers

• Question 801:

  A network engineer is investigating a flapping (up/down) interface issue on a core switch that is synchronized to an NTP server. Log output currently does not show the time of the flap. Which command allows the logging on the switch to show the time of the flap according to the clock on the device?

  A. service timestamps log uptime

  B. clock summer-time mst recurring 2 Sunday mar 2:00 1 Sunday nov 2:00

  C. service timestamps log datetime localtime show-timezone

  D. clock calendar-valid

  Correct Answer: C

  By default, Catalyst switches add a simple uptime timestamp to logging messages. This is a cumulative counter that shows the hours, minutes, and seconds since the switch has been booted up

• Question 802:

  When provisioning a device in Cisco DNA Center, the engineer sees the error message "Cannot select the device. Not compatible with template". What is the reason for the error?

  A. The template has an incorrect configuration.

  B. The software version of the template is different from the software version of the device.

  C. The changes to the template were not committed.

  D. The tag that was used to filter the templates does not match the device tag.

  Correct Answer: D

  If you use tags to filter the templates, you must apply the same tags to the device to which you want to apply the templates. Otherwise, you get the following error during provisioning: Cannot select the device. Not

  Reference: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-2-10/user_guide/b_cisco_dna_center_ug_1_2_10/b_dnac_ug_1_2_10_chapter_0111.html

• Question 803:

  Refer to the exhibit.

  

  An engineer is trying to connect to a device with SSH but cannot connect. The engineer connects by using the console and finds the displayed output when troubleshooting. Which command must be used in configuration mode to enable SSH on the device?

  A. no ip ssh disable

  B. ip ssh enable

  C. ip ssh version 2

  D. crypto key generate rsa

  Correct Answer: D

• Question 804:

  Which statement about IPv6 ND inspection is true?

  A. It learns and secures bindings for stateless autoconfiguration addresses in Layer 3 neighbor tables.

  B. It learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables.

  C. It learns and secures bindings for stateful autoconfiguration addresses in Layer 3 neighbor tables.

  D. It learns and secures bindings for stateful autoconfiguration addresses in Layer 2 neighbor tables.

  Correct Answer: B

  IPv6 ND inspection learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables. IPv6 ND inspection analyzes neighbor discovery messages in order to build a trusted binding table database, and IPv6 neighbor discovery messages that do not have valid bindings are dropped. A neighbor discovery message is considered trustworthy if its IPv6-to-MAC mapping is verifiable. This feature mitigates some of the inherent vulnerabilities for the neighbor discovery mechanism, such as attacks on duplicate address detection (DAD), address resolution, device discovery, and the neighbor cache.

  Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/15-s/ip6f-15-s-book/ip6-snooping.pdf

• Question 805:

  While troubleshooting connectivity issues to a router, these details are noticed:

  1.

  Standard pings to all router interfaces, including loopbacks, are successful.

  2.

  Data traffic is unaffected.

  3.

  SNMP connectivity is intermittent.

  4.

  SSH is either slow or disconnects frequently.

  Which command must be configured first to troubleshoot this issue?

  A. show policy-map control-plane

  B. show policy-map

  C. show interface | inc drop

  D. show ip route

  Correct Answer: A

• Question 806:

  Refer to the exhibit.

  

  Why is user authentication being rejected?

  A. The TACACS+ server expects "user", but the NT client sends "domain/user".

  B. The TACACS+ server refuses the user because the user is set up for CHAP.

  C. The TACACS+ server is down, and the user is in the local database.

  D. The TACACS+ server is down, and the user is not in the local database.

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/13864-tacacs-pppdebug.html

• Question 807:

  Refer to the exhibit.

  

  Which control plane policy limits BGP traffic that is destined to the CPU to 1 Mbps and ignores BGP traffic that is sent at higher rate?

  A. policy-map SHAPE_BGP

  B. policy-map LIMIT_BGP

  C. policy-map POLICE_BGP

  D. policy-map COPP

  Correct Answer: D

• Question 808:

  Which statement about IPv6 RA Guard is true?

  A. It does not offer protection in environments where IPv6 traffic is tunneled.

  B. It cannot be configured on a switch port interface in the ingress direction.

  C. Packets that are dropped by IPv6 RA Guard cannot be spanned.

  D. It is not supported in hardware when TCAM is programmed.

  Correct Answer: A

  Restrictions for IPv6 RA Guard

  The IPv6 RA Guard feature does not offer protection in environments where IPv6 traffic is tunneled.

  This feature is supported only in hardware when the ternary content addressable memory (TCAM) is programmed.

  This feature can be configured on a switch port interface in the ingress direction.

  This feature supports host mode and router mode.

  This feature is supported only in the ingress direction; it is not supported in the egress direction.

  This feature is not supported on EtherChannel and EtherChannel port members.

  This feature is not supported on trunk ports with merge mode.

  This feature is supported on auxiliary VLANs and private VLANs (PVLANs). In the case of PVLANs,primary VLAN features are inherited and merged with port features.

  Packets dropped by the IPv6 RA Guard feature can be spanned.

  Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16/ip6f-xe-16-book/ip6-ra-guard.pdf https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-3s/ip6f-xe-3s-book/ip6-ra-guard.pdf

• Question 809:

  Refer to the exhibit. What does the imp-null tag represent in the MPLS VPN cloud?

  

  A. Pop the label

  B. Impose the label

  C. Include the EXP bit

  D. Exclude the EXP bit

  Correct Answer: A

  The imp-null (implicit null) tag instructs the upstream router to pop the tag entry off the tag stack before forwarding the packet. Note: pop means remove the top MPLS label

• Question 810:

  Which transport layer protocol is used to form LDP sessions?

  A. UDP

  B. SCTP

  C. TCP

  D. RDP

  Correct Answer: C

  LDP multicasts hello messages to a well-known UDP port (646) in order to discover neighbors. Once the discovery is accomplished, a TCP connection (port 646) is established and the LDP session begins. LDP keepalives ensure the health of the session. Thanks to the LDP session, LDP messages create the label mappings required for a FEC. Withdraw messages are used when FECs need to be torn down.