Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 131:

  Which statement about a fabric access point is true?

  A. It is in local mode and must be connected directly to the fabric edge switch.

  B. It is in local mode and must be connected directly to the fabric border node.

  C. It is in FlexConnect mode and must be connected directly to the fabric border node.

  D. It is in FlexConnect mode and must be connected directly to the fabric edge switch.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/sda-sdg-2019oct.html

• Question 132:

  In a Cisco SD-Access solution, what is the role of a fabric edge node?

  A. to connect external Layer 3 networks to the SD-Access fabric

  B. to connect wired endpoints to the SD-Access fabric

  C. to advertise fabric IP address space to external networks

  D. to connect the fusion router to the SD-Access fabric

  Correct Answer: B

  Refer to https://www.google.com/url?sa=tandrct=jandq=andesrc=sandsource=webandcd=andcad=rjaanduact=8andved=2ahUKEwjF37T9udPtAhXwo4sKHfwzDKoQFjAAegQIAxACandurl=https%3A%2F%2Fwww.cisco.com%2Fc%2Fdam%2Fm%2Fhr_hr% 2Ftraining-events%2F2019%2Fcisco-connect%2Fpdf%2FVH-Cisco-SD-Access-Connecting.pdfandusg=AOvVaw26SeDD9KzfyOqR-hk_vF3q

• Question 133:

  A customer reports that traffic is not passing on an EIGRP enabled multipoint interface on a router configured as below:

  interface Serial0/0/0 no ip address interface Serial0/0/0.9 multipoint ip address 10.1.1.1 255.255.255.248 ip split-horizon eigrp 1

  Which action resolves the issue?

  A. Enable split horizon.

  B. Disable poison reverse.

  C. Disable split horizon.

  D. Enable poison reverse.

  Correct Answer: C

  In this question sub-interface is used so we have to turn off split-horizon for EIGRP.

• Question 134:

  Refer to the exhibit. A network engineer applied a filter for LSA traffic on OSPFv3 interarea routes on the area 5 ABR to protect advertising the internal routes of area 5 to the business partner network. All other areas should receive the area 5 internal routes. After the respective route filtering configuration is applied on the ABR, area 5 routes are not visible on any of the areas. How must the filter list be applied on the ABR to resolve this issue?

  

  R2#sh ipv6 route ospf

  O 2002:ABCD::/64 [110/1] via FastEthernet0/1, directly connected O 2004:BBAB::/64 [110/1] via FastEthernet0/0, directly connected O 2004:BBAC::/64 [110/1] via FastEthernet1/0, directly connected O 3010:2:4:0:15::/128 [110/1] via FE80::C804:1DFF:FB20:8, FastEthernet0/0

  A. in the "out" direction for area 20 on router R2

  B. in the "in" direction for area 5 on router R1

  C. in the "out" direction for area 5 on router R1

  D. in the "in" direction for area 20 on router R2

  Correct Answer: A

• Question 135:

  Refer to the exhibit. An administrator wanted to make R1 always elected as DR, R2 as BDR, and R3 as DROTHER but could not achieve the desired results. Which two configurations resolve the issue? (Choose two) A. On the R2 F0/0 interface, configure OSPF priority to 200

  

  B. On the R1 F0/0 interface, configure OSPF priority to 202

  C. On the R2 F0/0 interface, configure OSPF priority to 201

  D. On the R1 F0/0 interface, configure OSPF priority to 255

  E. On the R3 F0/0 interface, configure OSPF priority to 201

  Correct Answer: CD

• Question 136:

  Refer to the exhibit. Which configuration enables OSPF for area 0 interfaces to establish adjacency with a neighboring router with the same VRF? ip vrf CCNP rd 1:1 interface Ethernet1 ip vrf forwarding CCNP ip address 10.1.1.1 255.255.255.252 ! interface Ethernet2 ip vrf forwarding CCNP ip address 10.2.2.2 255.2555.255.252

  A. router ospf 1 vrf CCNP network 10.1.1.1 0.0.0.0 area 0 network 10.2.2.2 0.0.0.0 area 0

  B. router ospf 1 interface Ethernet1 ip ospf 1 area 0.0.0.0 interface Ethernet2 ip ospf 1 area 0.0.0.0

  C. router ospf 1 vrf CCNP interface Ethernet1 ip ospf 1 area 0.0.0.0 interface Ethernet2 ip ospf 1 area 0.0.0.0

  D. router ospf 1 vrf CCNP network 10.0.0.0 0.0.255.255 area 0

  Correct Answer: A

• Question 137:

  Refer to the exhibit. An engineer must advertise routes into IPv6 MP-BGP and failed. Which configuration resolves the issue on R1?

  

  A. router bgp 65000 no bgp default ipv4-unicast address-family ipv6 multicast network 2001:DB8::/64

  B. router bgp 65000 no bgp default ipv4-unicast address-family ipv6 unicast network 2001:DB8::/64

  C. router bgp 64900 no bgp default ipv4-unicast address-family ipv6 multicast neighbor 2001:DB8:7000::2 translate-update ipv6 multicast

  D. router bgp 64900 no bgp default ipv4-unicast address-family ipv6 unicast redistribute ospf network 2001:DB9::/64

  Correct Answer: A

• Question 138:

  Refer to the exhibit.

  

  R1#show ip route 1.0.0.0/32 is subnetted, 1 subnets C 1.1.1.1/32 is directly connected, Loopback0 2.0.0.0/32 is subnetted, 1 subnets O 2.2.2.2/32 [110/2] via 10.10.10.2, 00:09:30, GigabitEthernet0/0/0 10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks C 10.10.10.0/30 is directly connected, GigabitEthernet0/0/0 L 10.10.10.1/32 is directly connected, GigabitEthernet0/0/0 C 10.10.20.0/30 is directly connected, GigabitEthernet0/0/1 L 10.10.20.1/32 is directly connected, GigabitEthernet0/0/1 D 10.20.10.0/30 [90/3072] via 10.10.10.2, 00:09:30, GigabitEthernet0/0/0 O 10.30.10.0/30 [90/3328] via 10.10.10.2, 00:05:48, GigabitEthernet0/0/0 S 10.40.10.0/30 [1/0] via 10.10.20.2

  Routers R1, R2, R3, and R4 use EIGRP. However, traffic always prefers R1 to R5 backup links in non failure scenarios. Which configuration resolves the issue?

  A. R1(config)#no ip route 10.40.10.0 255.255.255.252 10.10.20.2 R1(config)#ip route 10.40.10.0 255.255.255.252 10.10.20.2 115

  B. R1(config)#int gigabitEthernet 0/0/0 R1 (config-if)#bandwidth 10000000

  C. R1(config-if)#int gigabitEthernet 0/0/0 R1(config-if)#bandwidth 10000

  D. R1(config)#no ip route 10.40.10.0 255.255.255.252 10.10.20.2 R1(config)#ip route 0.0.0.0 0.0.0.0 10.10.10.2

  Correct Answer: A

• Question 139:

  Refer to the exhibit. An engineer is trying to add an encrypted user password that should not be visible in the router configuration. Which two configuration commands resolve the issue? (Choose two)

  

  A. service password-encryption

  B. username Admin password 5 Cisco@123

  C. no service password-encryption

  D. username Admin password Cisco@123

  E. password encryption aes

  F. username Admin secret Cisco@123

  Correct Answer: AF

  We can use the "service password-encryption" to encrypt all current and future passwords. Or we can use the "secret" keyword to encrypt the password with MD5 (although MD5 is not secured nowadays).

  Note: The command "service password-encryption" enables the AES password encryption feature (type 6) but we have to converts existing plain or weakly encrypted passwords to type-6 encrypted passwords with the "encryption re-encrypt

  obfuscated" command.

  You can enable the AES password encryption feature without a primary key, but encryption starts only when a primary key is present in the system with the command key config-key password-encrypt super-secret-password.

  Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3400s/sw/93x/security/configuration/guide/Cisco-n3400-nx-ossecurity-configuration-guide-93x/m-configuring-password-encryption-922.pdf

• Question 140:

  Refer to the exhibit.

  

  An engineer must configure and validate a CoPP policy that allows the network management server to monitor router R1 via SNMP while protecting the control plane. Which two commands or command sets must be used? (Choose two.)

  A. access-list 150 permit udp 10.0.1.4 0.0.0.0 host 10.0.1.2 eq snmp access-list 150 permit udp 10.0.1.4 0.0.0.0 eq snmp host 10.0.1.2 class-map match-all CoPP-management

  match access-group 150

  policy-map CoPP-policy

  class CoPP-management

  police 8000 conform-action transmit exceed-action transmit

  violate-action drop

  control-plane

  Service-policy input CoPP-policy

  B. show ip interface brief

  C. show quality-of-service-profile

  D. access-list 150 permit udp 10.0.1.4 0.0.0.0 host 10.0.1.2 eq snmp class-map match-all CoPP-management match access-group 150 policy-map CoPP-policy class CoPP-management police 8000 conform-action transmit exceed-action transmit violate-action transmit control-plane Service-policy input CoPP-policy

  E. show policy-map control-plane

  Correct Answer: DE

  A option has this ACL 150: access-list 150 permit udp 10.0.1.4 0.0.0.0 host 10.0.1.2 eq snmp access-list 150 permit udp 10.0.1.4 0.0.0.0 eq snmp host 10.0.1.2 But D option only: access-list 150 permit udp 10.0.1.4 0.0.0.0 host 10.0.1.2 eq snmp A option has a violation-action drop, but D option has a violation-action transmit the SNMP traffic will be never dropped