Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 531:

  Refer to the exhibit.

  

  Which configuration enables fallback to local authentication and authorization when no TACACS+ server is available?

  A. Router(config)# aaa authentication login default local Router(config)# aaa authorization exec default local

  B. Router(config)# aaa authentication login default group tacacs+ local Router(config)# aaa authorization exec default group tacacs+ local

  C. Router(config)# aaa fallback local

  D. Router(config)# aaa authentication login FALLBACK local Router(config)# aaa authorization exec FALLBACK local

  Correct Answer: B

• Question 532:

  An engineer must configure an EXEC authorization list that first checks a AAA server then a local username. If both methods fail, the user is denied. Which configuration should be applied?

  A. aaa authorization exec default local group tacacs+

  B. aaa authorization exec default local group radius none

  C. aaa authorization exec default group radius local none

  D. aaa authorization exec default group radius local

  Correct Answer: D

• Question 533:

  Refer to the exhibit.

  

  These commands have been added to the configuration of a switch. Which command flags an error if it is added to this configuration?

  A. monitor session 1 source interface port-channel 6

  B. monitor session 1 source vlan 10

  C. monitor session 1 source interface FastEthernet0/1 rx

  D. monitor session 1 source interface port-channel 7, port-channel 8

  Correct Answer: B

  RSPAN consists of at least one RSPAN source session, an RSPAN VLAN, and at least one RSPAN destination session. You separately configure RSPAN source sessions and RSPAN destination sessions on different network devices. To configure an RSPAN source session on a device, you associate a set of source ports or source VLANs with an RSPAN VLAN.

  Traffic monitoring in a SPAN session has these restrictions: + Sources can be ports or VLANs, but you cannot mix source ports and source VLANs in the same session.

  Reference:

  https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

  Therefore in this question, we cannot configure a source VLAN because we configured source ports for RSPAN session 1 already.

• Question 534:

  What are two benefits of implementing a traditional WAN instead of an SD-WAN solution? (Choose two.)

  A. comprehensive configuration standardization

  B. lower control plane abstraction

  C. simplify troubleshooting

  D. faster fault detection

  E. lower data plane overhead

  Correct Answer: BE

  The provided answers are for the benefits of SD-WAN compared to traditional WAN

• Question 535:

  Which two results occur if Cisco DNA Center loses connectivity to devices in the SD-Access fabric? (Choose two )

  A. All devices reload after detecting loss of connection to Cisco DNA Center

  B. Already connected users are unaffected, but new users cannot connect

  C. User connectivity is unaffected.

  D. Cisco DNA Center is unable to collect monitoring data in Assurance.

  E. Users lose connectivity

  Correct Answer: CD

  If you have Cisco SD-Access implemented and DNA Centre becomes unreachable then the wired and wireless network will continue to forward packets as usual. There will be no impact to network performance or behavior. Yes you will be able to SSH / telnet / console into switches and wireless network infra as usual. For the period DNA Centre is unreachable, Assurance data will be lost, and you will not be able to make configuration changes to the Cisco SD-Access network.

  https://community.cisco.com/t5/cisco-digital-network-architecture-dna/dna-failure-mode/td-p/3841715

• Question 536:

  Which activity requires access to Cisco DNA Center CLI?

  A. provisioning a wireless LAN controller

  B. creating a configuration template

  C. upgrading the Cisco DNA Center software

  D. graceful shutdown of Cisco DNA Center

  Correct Answer: D

• Question 537:

  A switch is attached to router R1 on its gig 0/0 interface. Fort security reasons, you want to prevent R1 from sending OSPF hellos to the switch. Which command should be enabled to accomplish this?

  A. R1(config-router)#ip ospf hello disable

  B. R1(config-router)#ip ospf hello-interval 0

  C. R1(config)#passive-interface Gig 0/0

  D. R1(config-router)#passive-interface Gig 0/0

  Correct Answer: D

• Question 538:

  An engineer must implement a configuration to allow a network administrator to connect to the console port of a router and authenticate over the network. Which command set should the engineer use?

  A. aaa new-model aaa authentication login default enable

  B. aaa new-model aaa authentication login console local

  C. aaa new-model aaa authentication login console group radius

  D. aaa new-model aaa authentication enable default

  Correct Answer: C

  network means Radius, TACACS+ So correct answer should be:

  aaa new-model aaa authentication login default group radius

  or

  aaa new-model aaa authentication login console group radius line con 0 aaa authentication login console

• Question 539:

  Which cisco DNA center application is responsible for group-based access control permissions?

  A. Design

  B. Provision

  C. Assurance

  D. Policy

  Correct Answer: D

  Reference:

  https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-3-1-0/user_guide/ b_cisco_dna_center_ug_1_3_1_0/b_cisco_dna_center_ug_1_3_1_0_chapter_01011.html

• Question 540:

  Refer to the exhibit

  

  Which command must be applied to complete the configuration and enable RESTCONF?

  A. ip http secure-server

  B. ip http server

  C. ip http secure-port 443

  D. ip http client username restconf

  Correct Answer: A