Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 551:

  What is a benefit of Cisco TrustSec in a multilayered LAN network design?

  A. Policy or ACLS are nor required.

  B. There is no requirements to run IEEE 802.1X when TrustSec is enabled on a switch port.

  C. Applications flows between hosts on the LAN to remote destinations can be encrypted.

  D. Policy can be applied on a hop-by-hop basis.

  Correct Answer: C

• Question 552:

  Refer to the exhibit.

  

  Which command filters the ERSPAN session packets only to interface GigabitEthernet1?

  A. source ip 10.10.10.1

  B. source interface gigabitethernet1 ip 10.10.10.1

  C. filter access-group 10

  D. destination ip 10.10.10.1

  Correct Answer: C

• Question 553:

  Refer to the exhibit.

  

  Only administrators from the subnet 10.10.10.0/24 are permitted to have access to the router. A secure protocol must be used for the remote access and management of the router instead of clear- text protocols. Which configuration achieves this goal?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: A

• Question 554:

  Refer to the exhibit.

  

  Traffic is not passing between SW1 and SW2. Which action fixes the issue?

  A. Configure LACP mode on S1 to passive.

  B. Configure switch port mode to ISL on S2.

  C. Configure PAgP mode on S1 to desirable.

  D. Configure LACP mode on S1 to active.

  Correct Answer: C

• Question 555:

  Which Python code snippet must be added to the script to store the changed interface configuration to a local JSON-formatted file?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

  1 - 'response' type is (class Response).

  2 - 'UpdateConfig' converted 'response' to a String, so it's a String.

  3 - When using write() the passed argument must be a String.

  NOT C, json.dump(ARG1, ARG2) method takes a python dictionary NOT a String, and convert it as a JSON file.

• Question 556:

  Which DNS lookup does an access point perform when attempting CAPWAP discovery?

  A. CISCO-DNA-CONTROlLLER.local

  B. CAPWAP-CONTROLLER.local

  C. CISCO-CONTROLLER.local

  D. CISCO-CAPWAP-CONTROLLER.local

  Correct Answer: D

  Reference: http://www.revolutionwifi.net/revolutionwifi/2010/11/capwap-controller-discovery-process_23.html

• Question 557:

  What is the role of the vsmart controller in a Cisco SD-WAN environment?

  A. IT performs authentication and authorization

  B. It manages the control plane.

  C. It is the centralized network management system.

  D. It manages the data plane.

  Correct Answer: B

  + Control plane (vSmart) builds and maintains the network topology and make decisions on the traffic flows. The vSmart controller disseminates control plane information between WAN Edge devices, implements control plane policies and distributes data plane policies to network devices for enforcement.

• Question 558:

  What is a characteristic of para-virtualization?

  A. Para-virtualization guest servers are unaware of one another

  B. Para-virtualization allows direct access between the guest OS and the hypervisor

  C. Para-virtualization allows the host hardware to be directly accessed

  D. Para-virtualization lacks support for containers

  Correct Answer: B

  Paravirtualization is virtualization in which the guest operating system (the one being virtualized) is aware that it is a guest and accordingly has drivers that, instead of issuing hardware commands, simply issues commands directly to the host operating system. This will include things such as memory management as well.

• Question 559:

  A wireless administrator must create a new web authentication corporate SSID that will be using ISE as the external RADIUS server. The guest VLAN must be specified after the authentication completes. Which action must be performed to allow the ISE server to specify the guest VLAN?

  A. Enable AAA Override.

  B. Enable Network Access Control State.

  C. Set AAA Policy name.

  D. Set RADIUS Profiling.

  Correct Answer: A

• Question 560:

  Refer to the exhibit.

  

  An engineer must protect the CPU of the router from high rates of NTP, SNMP, and SSH traffic. Which two configurations must be applied to drop these types of traffic when it continuously exceeds 320 kbps? (Choose two)

  A. R1(config-pmap)#class CLASS-CoPP-Management R1(config-pmap-c)#police 32 conform-action transmit exceed-action drop violate-action transmit

  B. R1(config)#policy-map POLICY-CoPP R1(config-pmap)#class CLASS-CoPP-Management R1(config-pmap-c)#police 320000 conform-action transmit exceed-action drop violate-action drop

  C. R1(config)#policy-map POLICY-CoPP R1(config-pmap)#class CLASS-CoPP-Management R1(config-pmap-c)#police 320000 conform-action transmit exceed-action transmit violate-action drop

  D. R1(config)#control-plane R1(config-cp)# service-policy output POLICY-CoPP

  E. R1(config)#control-plane R1(config-cp)# service-policy input POLICY-CoPP

  Correct Answer: CE

  "continuously" would imply that occasionally exceeding 320kbps is ok. "exceed drop" will not allow it to ever go above it.