Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 411:

  Refer to the exhibit.

  

  Which statement about the OPSF debug output is true?

  A. The output displays all OSPF messages which router R1 has sent to received on interface Fa0/1.

  B. The output displays all OSPF messages which router R1 has sent or received on all interfaces.

  C. The output displays OSPF hello messages which router R1 has sent received on interface Fa0/1.

  D. The output displays OSPF hello and LSACK messages which router R1 has sent or received.

  Correct Answer: C

  This combination of commands is known as "Conditional debug" and will filter the debug output based on your conditions. Each condition added, will behave like an `And' operator in Boolean logic. Some examples of the "debug ip ospf hello" are shown below:

  

• Question 412:

  Which requirement for an Ansible-managed node is true?

  A. It must be a Linux server or a Cisco device.

  B. It must have an SSH server running.

  C. It must support ad hoc commands.

  D. It must have an Ansible Tower installed.

  Correct Answer: B

• Question 413:

  What is the difference between the enable password and the enable secret password when password encryption is enable on an IOS device?

  A. The enable password is encrypted with a stronger encryption method.

  B. There is no difference and both passwords are encrypted identically.

  C. The enable password cannot be decrypted.

  D. The enable secret password is protected via stronger cryptography mechanisms.

  Correct Answer: D

  The "enable secret" password is always encrypted (independent of the "service passwordencryption" command) using MD5 hash algorithm. The "enable password" does not encrypt the password and can be view in clear text in the runningconfig. In order to encrypt the "enable password", use the "service password-encryption" command. This command will encrypt the passwords by using the Vigenere encryption algorithm. Unfortunately, the Vigenere encryption method is cryptographically weak and trivial to reverse. The MD5 hash is a stronger algorithm than Vigenere so answer 'The enable secret password is protected via stronger cryptography mechanisms' is correct.

• Question 414:

  Refer to the exhibit.

  

  A port channel is configured between SW2 and SW3. SW2 is not running a Cisco operating system. When all physical connections are made, the port channel does not establish. Based on the configuration except of SW3, what is the cause of the problem?

  A. The port channel on SW2 is using an incompatible protocol.

  B. The port-channel trunk is not allowing the native VLAN.

  C. The port-channel should be set to auto.

  D. The port-channel interface lead balance should be set to src-mac

  Correct Answer: A

  The Cisco switch was configured with PAgP, which is a Cisco proprietary protocol so non-Cisco switch could not communicate.

• Question 415:

  A client device fails to see the enterprise SSID, but other devices are connected to it. What is the cause of this issue?

  A. The hidden SSID was not manually configured on the client.

  B. The broadcast SSID was not manually configured on the client.

  C. The client has incorrect credentials stored for the configured hidden SSID.

  D. The client has incorrect credentials stored for the configured broadcast SSID.

  Correct Answer: A

• Question 416:

  Which description of an SD-Access wireless network infrastructure deployment is true?

  A. The access point is part of the fabric underlay.

  B. The WLC is part of the fabric underaly.

  C. The access point is part the fabirc overlay.

  D. The wireless client is part of the fabirc overlay.

  Correct Answer: C

  Access Points

  + AP is directly connected to FE (or to an extended node switch) + AP is part of Fabric overlay Reference: https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2018/pdf/BRKEWN-2020.pdf

• Question 417:

  Which statement about Cisco EAP-FAST is true?

  A. It does not require a RADIUS server certificate

  B. It requires a client certificate

  C. It is an IETF standard.

  D. It operates in transparent mode

  Correct Answer: A

  The Cisco switch was configured with PAgP, which is a Cisco proprietary protocol so non-Cisco switch could not communicate.

  If your environment is relatively small or you do not have a RADIUS server in production, you can use an authentication server that is built in to the WLC. This is called Local EAP, and it supports LEAP, EAP-FAST, PEAP, and EAP-TLS.

  Reference: https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/99791-eapfast-wlc-rad-config.html

• Question 418:

  What are two common sources of interface for WI-FI networks? (Choose two.)

  A. radar

  B. LED lights

  C. rogue AP

  D. conventional oven

  E. fire alarm

  Correct Answer: AC

  It includes many different types of radio communication, such as low-frequency radio, AM radio, shortwave radio, television, FM radio, microwave, and radar. The microwave category also contains the two main frequency ranges that are used for wireless LAN communication: 2.4 and 5 GHz.

• Question 419:

  In OSPF, which LAS type is responsible for pointing to the ASBR router?

  A. type 1

  B. type 2

  C. type 3

  D. type 4

  Correct Answer: D

• Question 420:

  Which two descriptions of FlexConnect mode for Cisco APs are true? (Choose two.)

  A. APs that operate in FlexConnect mode cannot detect rogue APs.

  B. When connected to the controller, FlexConnect APs can tunnel traffic back to the controller.

  C. FlexConnect mode is used when the APs are set up in a mesh environment and used to bridge between each other.

  D. FlexConnect mode is a feature that is designed to allow specified CAPWAP-enabled APs to exclude themselves from managing data traffic between dents and infrastructure.

  E. FlexConnect mode is a wireless solution for branch office and remote office deployments.

  Correct Answer: BE

  A FlexConnect AP can, on a per-WLAN basis, either tunnel client data in CAPWAP to the controller (called Central Switching), or have client data egress at the AP's LAN port (called Local Switching). With Locally Switched WLANs, the AP can tag client traffic in separate VLANs, to segregate the traffic from its management interface.

  Reference: https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-2/configuration/guide/cg/cg_flexconnect.html https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/flexconnect.html#flexconnect-overview