Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 171:

  What is a characteristic of MACsec?

  A. 802.1AE is built between the host and switch using the MKA protocol, which negotiates encryption keys based on the primary session key from a successful 802.1X session.

  B. 802.1AE is negotiated using Cisco AnyConnect NAM and the SAP protocol.

  C. 802.1AE is built between the host and switch using the MKA protocol using keys generated via the Diffie-Hellman algorithm (anonymous encryption mode).

  D. 802.1AE provides encryption and authentication services.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/deploy_guide_c17-663760.html

• Question 172:

  A network engineer attempts to connect to the Router1 console port.

  Which configuration is needed to allow Telnet connections?

  A. Router1(config)# line vty 0 15 Router1(config-line)# transport output telnet

  B. Router1(config)# telnet client

  C. Router1(config)# line console 0 Router1(config-line)# transport output telnet

  D. Router1(config)# access-list 100 permit tcp any any eq telnet Router1(config)# line console 0 Router1(config-line)# access-class 100 out

  Correct Answer: C

  Router# Router#conf t Enter configuration commands, one per line. End with CNTL/Z. Router(config)#line con 0 Router(config-line)#transport output none Router(config-line)#end *Apr 19 17:33:16.198: %SYS-5-CONFIG_I: Configured from console by console Router#disable Router>telnet 10.0.0.2 % telnet connections not permitted from this terminal Router>en Router#conf t Enter configuration commands, one per line. End with CNTL/Z. Router(config)#line console 0 Router(config-line)#transport output telnet Router(config-line)#exit Router(config)#end Router# *Apr 19 17:34:06.111: %SYS-5-CONFIG_I: Configured from console by console Router#disable Router>telnet 10.0.0.2 Trying 10.0.0.2 ... % Connection refused by remote host

  Router>

  Reference: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/command/iosxe/qualified-cli-command-reference-guide/m-line-commands.pdf

• Question 173:

  What is one difference between saltstack and ansible?

  A. SaltStack uses an API proxy agent to program Cisco boxes in agent mode, whereas Ansible uses a Telnet connection.

  B. SaltStack uses the Ansible agent on the box, whereas Ansible uses a Telnet server on the box

  C. SaltStack is agent based, whereas Ansible is agentless.

  D. SaltStack uses SSH to interact with Cisco devices, whereas Ansible uses an event bus

  Correct Answer: C

• Question 174:

  Refer to the exhibit.

  A network engineer must simplify the IPsec configuration by enabling IPsec over GRE using IPsec profiles. Which two configuration changes accomplish this? (Choose two).

  

  A. Create an IPsec profile, associate the transform-set ACL, and apply the profile to the tunnel interface.

  B. Apply the crypto map to the tunnel interface and change the tunnel mode to tunnel mode ipsec ipv4.

  C. Remove all configuration related to crypto map from R1 and R2 and eliminate the ACL.

  D. Create an IPsec profile, associate the transform-set, and apply the profile to the tunnel interface.

  E. Remove the crypto map and modify the ACL to allow traffic between 10.10.0.0/24 to 10.20.0.0/24.

  Correct Answer: CD

  A is wrong, you don't use a "transform-set ACL"

  B is wrong. question states use IPsec profiles. Crypto maps was the old way of doing ipsec tunnels before profiles.

  C is correct, need to remove crypto map config or it will cause some confusion if the tunnel profile is applied. Didn't lab it up, but book references this. D is correct, all you need to do is create a profile and associate the transform-set to this

  profile, then apply it to the tunnel. If no transform set was created you would have to create one. E is wrong, i believe removing crypto map would cause the traffic to flow unencrypted over the tunnel. acl in this case is to match the interesting

  traffic to be encrypted. it's denying it.

• Question 175:

  How does a router behave when configured with the default DNS lookup settings, and a URL is entered on the CLI?

  A. prompts the user to specify the desired IP address.

  B. initiates a pinfsfg request to the URL.

  C. continuously attxempts tos resolve the URL until the command is cancelled.

  D. attempts to query a DNS server on the network

  Correct Answer: D

• Question 176:

  What does a router do when configured with the default DNS lookup settings, and a URL is entered on the CLI?

  A. initiates a ping request to the URL

  B. prompts the user to specify the desired IP address

  C. continuously attempts to resolve the URL until the command is cancelled

  D. sends a broadcast message in an attempt to resolve the URL

  Correct Answer: D

• Question 177:

  What are two benefits of YANG? (choose two)

  A. it collects statistical constraint analysis information

  B. In enforces the use of specific encoding format for NETCONF

  C. in enforces configuration semantics

  D. it enables multiple leaf statements to exist within a leaf list

  E. it enforces configuration constraints

  Correct Answer: BE

• Question 178:

  Refer to the exhibit.

  

  An engineer has configured Cisco ISE to assign VLANs to clients based on their method of authentication, but this is not working as expected. Which action will resolve this issue?

  A. require a DHCP address assignment

  B. utilize RADIUS profiling

  C. set a NAC state

  D. enable AAA override

  Correct Answer: D

  The AAA Override option of a WLAN enables you to configure the WLAN for identity networking. It enables you to apply VLAN tagging, Quality of Service (QoS), and Access Control Lists (ACLs) to individual clients based on the returned RADIUS attributes from the AAA server. https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_010110111.html

• Question 179:

  Refer to the exhibit.

  

  Which command is required to validate that an IP SLA configuration matches the traffic between the branch office and the central site?

  A. R1# show ip sla group schedule

  B. R1# show ip route

  C. R1# show ip sla configuration

  D. R1# show ip sla statistics

  Correct Answer: D

• Question 180:

  Refer to the exhibit.

  

  Two switches are interconnected using interface GigabitEthernet0/0 on both sides. While configuring one of the switches, a network engineer receives the logging message. Which action resolves this issue?

  A. Block VLAN1 on the trunk interface GigabitEthernet0/0.

  B. Configure interface GigabitEthernet0/0 as an access port.

  C. Configure interface GigabitEthernet0/0 as a trunk port.

  D. Shutdown interface GigabitEthemet0/0 and bring it back up.

  Correct Answer: C