Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 371:

  The East-WLC-2504A controller has a problem. When configuration changes are made to the Employees- East-Wing AP Group that covers the East-Wing, none of the APs receive the updates. Refer to the exhibits to determine where the problems are.

  

  Note, not all menu items, text boxes, or radio buttons are active.

  

  Which four changes must be made in the configuration of the East-WLC-2504A controller to restore functionality to the Employees-East-Wing AP Group? (Choose four.)

  A. Change the AP in the Employees-East-Wing AP Group.

  B. Change the IP Address in the east-wing interface.

  C. Change the VLAN Identifier in the east-wing interface.

  D. Enable Dynamic AP Management in the east-wing interface.

  E. Change the Port Number to 2 in the east-wing interface.

  F. Add the Primary Controller and IP address to the 3700-East-Wing AP.

  G. Change the SSID in the Employees-East-Wing AP Group.

  H. Enable the Employees SSID

  Correct Answer: DFGH

  References: http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/69639-wlc- failover.html

• Question 372:

  Refer to the exhibit.

  

  Tunnel-Private-Group-Id(81): 15 Tunnel-Medium-Type(65): IEEE-802(6) Tunnel-Type(64): VLAN(13)

  A wireless client is connecting to FlexAP1 which is currently working standalone mode. The AAA authentication process is returning the following AVPs:

  Which three behaviors will the client experience? (Choose three.)

  A. While the AP is in standalone mode, the client will be placed in VLAN 15.

  B. While the AP is in standalone mode, the client will be placed in VLAN 10.

  C. When the AP transitions to connected mode, the client will be de-authenticated.

  D. While the AP is in standalone mode, the client will be placed in VLAN 13.

  E. When the AP is in connected mode, the client will be placed in VLAN 13.

  F. When the AP transitions to connected mode, the client will remain associated.

  G. When the AP is in connected mode, the client will be placed in VLAN 15.

  H. When the AP is in connected mode, the client will be placed in VLAN 10.

  Correct Answer: BCG

  Traffic flow on WLANs configured for Local Switching when Flex APs are in Connected Mode:

  1.

  If the VLAN is returned as one of the AAA attributes and that VLAN is not present in the Flex AP database, traffic will switch centrally and the client will be assigned this VLAN/Interface returned from the AAA server provided that the VLAN exists on the WLC.

  2.

  If the VLAN is returned as one of the AAA attributes and that VLAN is not present in the Flex AP database, traffic will switch centrally. If that VLAN is also not present on the WLC, the client will be assigned a VLAN/Interface mapped to a WLAN on the WLC.

  3.

  If the VLAN is returned as one of the AAA attributes and that VLAN is present in the FlexConnect AP database, traffic will switch locally.

  4.

  If the VLAN is not returned from the AAA server, the client will be assigned a WLAN mapped VLAN on that FlexConnect AP and traffic will switch locally.

  Traffic flow on WLANs configured for Local Switching when Flex APs are in Standalone Mode:

  1.

  If the VLAN returned by an AAA server is not present in the Flex AP database, the client will be put to default VLAN (that is, a WLAN mapped VLAN on Flex AP). When the AP connects back, this client will be de-authenticated and will switch traffic centrally.

  2.

  If the VLAN returned by an AAA server is present in the Flex AP database, the client will be put into a returned VLAN and traffic will switch locally.

  3.

  If the VLAN is not returned from an AAA server, the client will be assigned a WLAN mapped VLAN on that FlexConnect AP and traffic will switch locally.

• Question 373:

  Refer to the exhibit.

  

  During deployment, a network engineer notices that voice traffic is not being tagged correctly as it traverses the network. Which COS to DSCP map must be modified to ensure that voice traffic is treated properly?

  A. COS of 5 to DSCP 46

  B. COS of 7 to DSCP 48

  C. COS of 6 to DSCP 46

  D. COS of 3 to DSCP of 26

  Correct Answer: A

• Question 374:

  Refer to the exhibit.

  

  A network engineer must configure a WLAN on a Cisco IOS-XE controller to support corporate devices (using VLAN 30) and BYOD (using VLAN 40) on the same secure SSID. The security team has built an ISE deployment to be used for VLAN assignment and to restrict access based on policy and posture compliance.

  Given the existing WLAN configuration, which configuration change must be made?

  A. remove ip dhcp required

  B. Add aaa-override

  C. Remove nac

  D. Add mac-filtering default

  Correct Answer: B

• Question 375:

  Refer to the exhibit. To which setting is the client limitation for WLAN LAP1 configured?

  

  A. 60

  B. 1800

  C. Client exclusion is not enabled

  D. 25

  Correct Answer: D

• Question 376:

  What does this EEM applet event accomplish?

  "event snmp oid 1.3.6.1.3.7.1.5.1.2.4.2.9 get-type next entry-op g entry-val 75 poll-interval 5"

  A. It issues email when the value is greater than 75% for five polling cycles.

  B. It reads an SNMP variable, and when the value exceeds 75%, it triggers an action

  C. It presents a SNMP variable that can be interrogated.

  D. Upon the value reaching 75%, a SNMP event is generated and sent to the trap server.

  Correct Answer: B

  EEM offers the ability to monitor events and take informational or corrective action when the monitored events occur or reach a threshold. An EEM policy is an entity that defines an event and the actions to be taken when that event occurs.

  There are two types of EEM policies: an applet or a script. An applet is a simple form of policy that is defined within the CLI configuration. To specify the event criteria for an Embedded Event Manager (EEM) applet that is run by sampling

  Simple Network Management Protocol (SNMP) object identifier values, use the event snmp command in applet configuration mode. event snmp oid oid-value get-type {exact | next} entry-op operator entry-val entryvalue [exit-comb {or | and}]

  [exit-op operator] [exit-val exit-value] [exit-time exit-timevalue] poll-interval poll-int-value + oid: Specifies the SNMP object identifier (object ID) + get-type: Specifies the type of SNMP get operation to be applied to the object ID specified by the

  oid-value argument.

  -- next ?Retrieves the object ID that is the alphanumeric successor to the object ID specified by the oid-value argument.

  + entry-op: Compares the contents of the current object ID with the entry value using the specified operator. If there is a match, an event is triggered and event monitoring is disabled until the exit criteria are met. + entry-val: Specifies the value with which the contents of the current object ID are compared to decide if an SNMP event should be raised. + exit-op: Compares the contents of the current object ID with the exit value using the specified operator. If there is a match, an event is triggered and event monitoring is reenabled. + poll-interval: Specifies the time interval between consecutive polls (in seconds)

  Reference: https://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtioseem.html

• Question 377:

  Which method does the enable secret password option use to encrypt device passwords?

  A. AES

  B. CHAP

  C. PAP

  D. MD5

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/107614-64.html

• Question 378:

  A client with IP address 209.165.201.25 must access a web server on port 80 at 209.165.200.225. To allow this traffic, an engineer must add a statement to an access control list that is applied in the inbound direction on the port connecting to the web servers. Which statement allows this traffic?

  A. permit tcp host 209 165 200 225 eq 80 host 209.165.201.25

  B. permit tcp host 209 165.201 25 host 209.165.200.225 eq 80

  C. permit tcp host 209.165.200 225 It 80 host 209.165.201.25

  D. permit tcp host 209.165.200.225 host 209.165.201.25 eq 80

  Correct Answer: A

• Question 379:

  Refer to the exhibit.

  

  You are configuring a controller that runs Cisco IOS XE by using the CLI. Which three configuration options are used for 802.11w Protected Management Frames? (Choose three.)

  A. mandatory

  B. association-comeback

  C. SA teardown protection

  D. saquery-retry-time

  E. enable

  F. comeback-time

  Correct Answer: ABD

  Reference: https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/5700/software/release/ ios_xe_33/11rkw_DeploymentGuide/b_802point11rkw_deployment_guide_cisco_ios_xe_release33/ b_802point11rkw_deployment_guide_cisco_ios_xe_release33_chapter_0100.pdf

• Question 380:

  Refer to the exhibit.

  

  Which level message does the WLC send to the syslog server?

  A. syslog level errors and less severity messages

  B. syslog level errors messages

  C. all syslog levels messages

  D. syslog level errors and greater severity messages

  Correct Answer: A

  If you set a syslog level, only those messages whose severity is equal to or less than that level are sent to the syslog servers. For example, if you set the syslog level to Notifications (severity level 5), only those messages whose severity is betwen 0 and 5 are sent to the syslog servers. https://www.cisco.com/c/en/us/support/docs/wireless/4100-series-wireless-lan-controllers/107252-WLC-Syslog-Server.html