Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 101:

  In a Cisco VXLAN based network, which of the following best describes the main function of a VXLAN Tunnel Endpoint (VTEP)?

  A. A device that performs VXLAN encapsulation and decapsulation.

  B. It is a 24 bit segment ID that defines the broadcast domain.

  C. It is the Logical interface where the encapsulation and de-encapsulation occurs.

  D. It is a device that performs tunneling using GRE.

  Correct Answer: A

  VTEP (Virtual Tunnel Endpoint) - This is the device that does the encapsulation and de-encapsulation.

  reference:https://www.cisco.com/c/en/us/support/docs/switches/nexus-9000-series-switches/118978-config-vxlan-00.html

• Question 102:

  In a Cisco Software Defined Networking (SDN) architecture, what is used to describe the API communication between the SDN controller and the network elements (routers and switches) that it manages?

  A. Southbound API

  B. Northbound API

  C. Westbound API

  D. Eastbound API.

  Correct Answer: A

• Question 103:

  Ansible is being used in a network for configuration and management automation. Which of the following are true statements regarding Ansible? (Choose two.)

  A. Requires an agent on the end device.

  B. Utilizes the concept of playbooks to execute the configuration.

  C. Uses a pull model, where the end devices pull configuration files from the Ansible server.

  D. Utilizes SSH.

  Correct Answer: BD

  Playbooks https://docs.ansible.com/ansible-core/devel/getting_started/basic_concepts.html

  SSH https://docs.ansible.com/ansible-core/devel/getting_started/index.html

• Question 104:

  JSON web tokens (JWT) are used to secure JSON based communications. Which of the following fields make up a JWT? (Choose three.)

  A. Header

  B. Trailer

  C. Payload

  D. Sequence number

  E. Signature

  Correct Answer: ACE

  reference: https://jwt.io/introduction

• Question 105:

  Which of the following are features typically only found in a Next Generation (NextGen) firewall? (Choose two.)

  A. Network Address Translation (NAT)

  B. Secure remote access VPN (RA VPN)

  C. Deep packet inspection

  D. reputation based malware detection

  E. IPSec site-to-site VPN

  Correct Answer: CD

• Question 106:

  In a Cisco SD-Access network architecture, what is the role of the Fabric Edge Node?

  A. It manages endpoint to device relationships

  B. It connects external layer 3 networks to the SDA fabric

  C. It connects wired endpoints to the SDA fabric

  D. It connects wireless endpoints to the SDA fabric

  Correct Answer: C

• Question 107:

  You want to create a policy that allows all TCP traffic in the port range of 20 to 110, except for telnet traffic, which should be dropped. Which of the following access control lists will accomplish this?

  A. deny tcp any any eq 22 permit tcp any any gt 20 lt 110

  B. permit tcp any any range 22 443 deny tcp any any eq 23

  C. deny tcp any any eq 23 permit tcp any any

  D. deny tcp any any eq 23 permit tcp any any range 20 110

  Correct Answer: D

  for the policy map to MATCH an entry we should use 'permit' otherwise use 'deny'.

• Question 108:

  A new multicast server is being added to an existing PIM Sparse mode network. Which device in this network must the new server register with before its multicast traffic can be dispersed throughout the network?

  A. IGMP Querier

  B. Local PIM router

  C. Local IGMP switch

  D. Rendezvous Point (RP)

  Correct Answer: D

  reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/16-9/configuration_guide/sys_mgmt/b_169_ip_mcast_rtng_3850_cg/ ip_multicast_optimization__optimizing_pim_sparse_mode_in_a_large_ip_multicast_deployment.html

• Question 109:

  What are the four stages of obtaining an IP address lease from a DHCP server?

  A. Discover, Offer, Release, Renew

  B. Discover, Obtain, Request, Renew

  C. Determine, Obtain, Release, Acknowledge

  D. Discover, Offer, Request, Acknowledge

  Correct Answer: D

  DORA is the correct answer

• Question 110:

  Which Cisco EIGRP K-values are set to zero by default? (Choose three.)

  A. Bandwidth

  B. Load

  C. Total Delay

  D. Reliability

  E. MTU

  Correct Answer: BDE

  reference: https://ipwithease.com/eigrp-k-values/ https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_eigrp/configuration/15-s/ire-15-s-book/ire-wid-met.html