Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 541:

  What is the function of the fabric control plane node In a Cisco SD-Access deployment?

  A. It is responsible for policy application and network segmentation in the fabric.

  B. It performs traffic encapsulation and security profiles enforcement in the fabric.

  C. It holds a comprehensive database that tracks endpoints and networks in the fabric.

  D. It provides Integration with legacy nonfabric-enabled environments.

  Correct Answer: C

  Fabric control plane node (C): One or more network elements that implement the LISP Map-Server (MS) and Map-Resolver (MR) functionality. The control plane node`s host tracking database keep track of all endpoints in a fabric site and associates the endpoints to fabric nodes in what is known as an EID-to- RLOC binding in LISP.

  Reference: https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-macro-segmentation-deploy-guide.html

• Question 542:

  An engineer must configure router R1 to validate user logins via RADIUS and fall back to the local user database if the RADIUS server is not available. Which configuration must be applied?

  A. aaa authorization exec default radius local

  B. aaa authorization exec default radius

  C. aaa authentication exec default radius local

  D. aaa authentication exec default radius

  Correct Answer: A

• Question 543:

  Which mechanism can be used to enforce network access authentication against an AAA server if the endpoint does not support the 802.1X supplicant functionality?

  A. WebAuth

  B. MACsec

  C. private VLANs

  D. port security

  Correct Answer: A

• Question 544:

  Refer to the exhibit.

  

  Which two commands ensure that DSW1 becomes the root bridge for VLAN 10 and 20? (Choose two.)

  A. spanning-tree mst 1 priority 1

  B. spanning-tree mst 1 root primary

  C. spanning-tree mstp vlan 10,20 root primary

  D. spanning-tree mst vlan 10,20 priority root

  E. spanning-tree mst 1 priority 4096

  Correct Answer: BE

  Priority values are 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440. All other values are rejected.

• Question 545:

  A network engineer must configure a switch to allow remote access for all feasible protocols. Only a password must be requested for device authentication and all idle sessions must be terminated in 30 minutes. Which configuration must be applied?

  A. line vty 0 15 password cisco transport input telnet ssh exec-timeout 30 0

  B. line vty 0 15 password cisco

  transport input all

  exec-timeout 0 30

  C. username cisco privilege 15 cisco line vty 0 15 transport input telnet ssh login local exec-timeout 0 30

  D. line console 0 password cisco exec-timeout 30 0

  Correct Answer: A

  exec-timeout minutes [seconds]

• Question 546:

  Which security measure mitigates a man-in-the-middle attack of a REST API?

  A. SSL certificates

  B. biometric authentication

  C. password hash

  D. non repudiotion feature

  Correct Answer: A

• Question 547:

  Refer to the exhibit.

  

  An engineer is reaching network 172.16.10.0/24 via the R1-R2-R4 path. Which configuration forces the traffic to fake a path of R1-R3-R4?

  A. R1(config)#route-map RM_LOCAL_PREF permit 10 R1(config-route-map)#set local-preference 101 R1(config-route-map)#exit R1(config)#router bgp 100 R1(config-router)#neighbor 13.13.13.3 route-map RM_LOCAL_PREF in R1(config-router)#end R1#clear ip bgp 13.13.13.3 soft in

  B. R1(config)#route-map RM_AS_PATH_PREPEND R1(config-route-map)#set as-path prepend 200 200 R1(config-route-map)#exit R1(config)#router bgp 100 R1(config-router)#neighbor 12.12.12.2 route-map RM_AS_PATH_PREPEND in R1(config-router)#end R1#clear ip bgp 12.12.12.2 soft in

  C. R1(config)#router bgp 100 R1(config-router)#neighbor 13.13.13.3 weight 1 R1(config-router)#end

  D. R2(config)#route-map RM_MED permit 10 R2(config-route-map)#set metric 1 R2(config-route-map)#exit R2(config)#router bgp 200 R2(config-router)#neighbor 12.12.12.1 route-map RM_MED out R2(config-router)#end R2#clear ip bgp 12.12.12.1 soft out

  Correct Answer: A

• Question 548:

  Which IP SLA operation requires the IP SLA responder to be configured on the remote end?

  A. ICMP echo

  B. UDP jitter

  C. CMP jitter

  D. TCP connect

  Correct Answer: B

  Cisco IOS IP SLA Responder is a Cisco IOS Software component whose functionality is to respond to Cisco IOS IP SLA request packets. The IP SLA source sends control packets before the operation starts to establish a connection to the responder. Once the control packet is acknowledged, test packets are sent to the responder. The responder inserts a time-stamp when it receives a packet and factors out the destination processing time and adds time-stamps to the sent packets. This feature allows the calculation of unidirectional packet loss, latency, and jitter measurements with the kind of accuracy that is not possible with ping or other dedicated probe testing.

  The IP SLAs responder is a component embedded in the destination Cisco device that allows the system to anticipate and respond to IP SLAs request packets. The responder provides accurate measurements without the need for dedicated probes.

  UDP Jitter measures the delay, delay variation(jitter), corruption, misorderingand packet lossby generating periodic UDP traffic. This operation always requires IP SLA responder.

  Reference: https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2017/pdf/BRKNMS-3043.pdf https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/46sg/configuration/guide/Wrapper-46SG/swipsla.pdf

• Question 549:

  An engineer must protect the password for the VTY lines against over-the-shoulder attacks. Which configuration should be applied?

  A. service password-encryption

  B. username netadmin secret 9 $9$vFpMf8elb4RVV8$seZ/bDA

  C. username netadmin secret 7$1$42J36k33008Pyh4QzwXyZ4

  D. line vty 0 15 p3ssword XD822j

  Correct Answer: A

  cisco(config)#username test privilege 15 password test777 cisco(config)#do s running-config | include user username test privilege 15 password 0 test777

  cisco(config)#service password-encryption

  cisco(config)#do s running-config | include user username test privilege 15 password 7 044F0E151B761B19 cisco(config)#

  cisco(config)#do wr

  Building configuration...

  [OK] cisco(config)#

• Question 550:

  Which JSON script is properly formatted?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: D