Cisco CCNP Enterprise 300-415 Questions & Answers

• Question 411:

  Which two mechanisms are used to guarantee the integrity of data packets in the Cisco SD-WAN architecture data plane? (Choose two.)

  A. certificates

  B. transport locations

  C. authentication headers

  D. encapsulation security payload

  E. TPM chip

  Correct Answer: CD

  A number of components contribute to the integrity of data packets in the Viptela data plane:

  1.

  ESP, which is the standard IPsec encryption protocol, protects (via encryption and authentication) the inner header, data packet payload, and ESP trailer in all data packets.

  2.

  AH, which is the standard IPsec authentication protocol, protects (via authentication) the entire data packet, including the inner and outer headers, data packet payload, and ESP trailer

• Question 412:

  Which software security feature is supported by the Cisco ISR 4451 router?

  A. IPsec/GRE cloud proxy

  B. reverse proxy

  C. Enterprise Firewall with Application Awareness

  D. Cloud Express service

  Correct Answer: C

• Question 413:

  Which configuration changes the packet loss priority from low to high?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: D

  You can use the remark action to set the packet loss priority (PLP) to high. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/qos/vEdge-20-x/qos-book/forwarding-qos.html

• Question 414:

  Refer to the exhibit. Which QoS treatment results from this configuration after the access list acl-guest is applied inbound on the vpn1 interface?

  

  A. A TCP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 is dropped

  B. A UDP packet sourcing from 172.16.20.1 and destined to 172.16.10.1 is accepted

  C. A UDP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 is dropped

  D. A TCP packet sourcing from 172.16.20.1 and destined to 172.16.10.1 is accepted

  Correct Answer: C

  Protocol 6 is used for TCP.

• Question 415:

  What is a benefit of the application-aware firewall?

  A. It blocks traffic by MTU of the packet

  B. It blocks encrypted traffic

  C. It blocks traffic by application

  D. It blocks traffic by MAC address

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_zbf/configuration/xe-16-9/sec-data-zbf-xe-16-9-book/sec-data-zbf-xe-16-9-book_chapter_0100100.html

• Question 416:

  At which layer does the application-aware firewall block applications on a WAN Edge?

  A. 3

  B. 5

  C. 2

  D. 7

  Correct Answer: D

  Application Firewall

  The Application Firewall blocks traffic based on applications or application-family. This application-aware firewall feature provides the following benefits:

  1.

  Application visibility and granular control

  2.

  Classification of 1400+ layer 7 applications

  3.

  Blocks traffic by application or application-family

• Question 417:

  Which scheduling method is configured by default for the eight queues in the cloud vEdge router?

  A. weighted round robin

  B. priority queue

  C. low latency queue

  D. weighted random early detection

  Correct Answer: A

  Reference: https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/Release_18.1/06Policy_Basics/05Localized_Data_Policy/ Configuring_Localized_Data_Policy_for_IPv4

• Question 418:

  When VPNs are grouped to create destination zone in Zone-Based Firewall, how many zones can a single VPN be part of?

  A. two

  B. four

  C. one

  D. three

  Correct Answer: C

  Reference: https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/Release_18.4/Security/Enterprise_Firewall_with_Application_Awareness

• Question 419:

  When the VPN membership policy is being controlled at the vSmart controller, which policy disallows VPN 1 at sites 20 and 30?

  

  

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: C

  Reference:

  https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/Release_17.2/04Segmentation/03Segm entation_(VPN)_Configuration_Examples

• Question 420:

  A voice packet requires a latency of 50 msec. Which policy is configured to ensure that a voice packet is always sent on the link with less than a 50 msec delay?

  A. localized data policy

  B. centralized control policy

  C. localized control policy

  D. centralized data policy

  Correct Answer: D

  Centralized data policies allow you to define rules and conditions for application-aware routing, QoS (Quality of Service), and traffic optimization. In this case, you would set up the policy to prioritize voice traffic and select the link with a delay of less than 50 milliseconds as the preferred path for voice packets. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/application-aware-routing.html