[Dec-2021] 350-401 Pre-Exam Practice Tests | Exam Questions and Answers for CCNP Enterprise Study Guide
Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) Certification Sample Questions
Automation: The students will be evaluated based on their ability to perform specific automation tasks. They include the following:
- Interpreting REST API response codes;
- Explain high-level principles and advantages of data modeling languages, including YANG;
- Interpreting fundamental Python elements and scripts;
- Constructing an authentic JSON encoded file;
- Explaining APIs for vManage and Cisco DNA Center;
- Constructing EEM applet for the automation of configuration, data collection, or troubleshooting.
Infrastructure: This domain focuses on infrastructure and its associated concepts. The areas of its focus include the following:
- Layer 2 concepts, which requires troubleshooting dynamic and static 802.1q trunking protocols as well as static and dynamic EtherChannels. It also covers skills in configuring and verifying common Spanning Tree Protocols (MST and RSTP);
- Layer 3 concepts, which covers comparing routing concepts of OSPF and EIGRP; configuring and authenticating OSPF environments, and eBGP between closely connected neighbors;
- IP Services, covering NTP, NAT/PAT, first-hop redundancy protocols, and multicast protocols.
- Wireless concepts, covering knowledge of Layer 1 concepts, AP modes, and antenna categories, as well as access point discovery, principles, use case for Layer 2 and 3 roaming, WLAN configuration, and wireless client connectivity concerns;
NEW QUESTION 17
Which statement about Cisco Express Forwarding is true?
- A. It makes forwarding decisions by a process that is scheduled through the IOS scheduler.
- B. It uses a fast cache that is maintained in a router data plane.
- C. maintains two tables in the data plane the FIB and adjacency table.
- D. The CPU of a router becomes directly involved with packet-switching decisions.
Answer: C
NEW QUESTION 18
Which AP mode allows an engineer to scan configured channels for rogue access points?
- A. sniffer
- B. monitor
- C. local
- D. bridge
Answer: B
NEW QUESTION 19
Which tunneling technique is used when designing a Cisco SD-Access fabric data plane?
- A. VXLAN
- B. VRF
- C. VRF Lite
- D. LISP
Answer: A
Explanation:
Explanation
The tunneling technology used for the fabric data plane is based on Virtual Extensible LAN (VXLAN).
VXLAN encapsulation is UDP based, meaning that it can be forwarded by any IP-based network (legacy or third party) and creates the overlay network for the SD-Access fabric. Although LISP is the control plane for the SD-Access fabric, it does not use LISP data encapsulation for the data plane; instead, it uses VXLAN encapsulation because it is capable of encapsulating the original Ethernet header to perform MAC-in-IP encapsulation, while LISP does not. Using VXLAN allows the SD-Access fabric to support Layer 2 and Layer
3 virtual topologies (overlays) and the ability to operate over any IP-based network with built-in network segmentation (VRF instance/VN) and built-in group-based policy.
Reference: CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide
NEW QUESTION 20
An engineer has deployed a single Cisco 5520 WLC with a management IP address of 172.16.50.5/24. The engineer must register 50 new Cisco AIR-CAP2802I-E-K9 access points to the WLC using DHCP option 43.
The access points are connected to a switch in VLAN 100 that uses the 172.16.100.0/24 subnet. The engineer has configured the DHCP scope on the switch as follows:
The access points are failing to join the wireless LAN controller. Which action resolves the issue?
- A. configure dns-server 172.16.50.5
- B. configure option 43 Hex F104.AC10.3205
- C. configure option 43 Hex F104.CA10.3205
- D. configure dns-server 172.16.100.1
Answer: B
Explanation:
Explanation
172.16.50.5 in hex is
We will have the answer from this paragraph:
"TLV values for the Option 43 suboption: Type + Length + Value. Type is always the suboption code 0xf1.
Length is the number of controller management IP addresses times 4 in hex. Value is the IP address of the controller listed sequentially in hex. For example, suppose there are two controllers with management interface IP addresses, 192.168.10.5 and 192.168.10.20. The type is 0xf1. The length is 2 * 4 = 8 = 0x08. The IP addresses translates to c0a80a05 (192.168.10.5) and c0a80a14 (192.168.10.20). When the string is assembled, it yields f108c0a80a05c0a80a14. The Cisco IOS command that is added to the DHCP scope is option 43 hex f108c0a80a05c0a80a14." Reference:
https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/97066-dhcp-option-43-00.htm Therefore in this question the option 43 in hex should be "F104.AC10.3205 (the management IP address of
172.16.50.5 in hex is AC.10.32.05).
NEW QUESTION 21
How does SSO work with HSRP to minimize network disruptions?
- A. It enables HSRP to failover to the standby RP on the same device.
- B. It ensures fast failover in the case of link failure.
- C. It enables HSRP to elect another switch in the group as the active HSRP switch.
- D. It enables data forwarding along known routes following a switchover, white the routing protocol reconverges.
Answer: C
Explanation:
NEW QUESTION 22
Which component of the Cisco Cyber Threat Defense solution provides user and flow context analysis?
- A. Cisco Firepower and FireSIGHT
- B. Advanced Malware Protection
- C. Cisco Stealth watch system
- D. Cisco Web Security Appliance
Answer: C
Explanation:
The goal of the Cyber Threat Defense solution is to introduce a design and architecture that can help facilitate the discovery, containment, and remediation of threats once they have penetrated into the network interior.
Cisco Cyber Threat Defense version 2.0 makes use of several solutions to accomplish its objectives:
* NetFlow and the Lancope StealthWatch System
- Broad visibility
- User and flow context analysis
- Network behavior and anomaly detection
- Incident response and network forensics
* Cisco FirePOWER and FireSIGHT
- Real-time threat management
- Deeper contextual visibility for threats bypassing the perimeters
- URL control
* Advanced Malware Protection (AMP)
- Endpoint control with AMP for Endpoints
- Malware control with AMP for networks and content
* Content Security Appliances and Services
- Cisco Web Security Appliance (WSA) and Cloud Web Security (CWS)
- Dynamic threat control for web traffic
- Outbound URL analysis and data transfer controls
- Detection of suspicious web activity
- Cisco Email Security Appliance (ESA)
- Dynamic threat control for email traffic
- Detection of suspicious email activity
* Cisco Identity Services Engine (ISE)
- User and device identity integration with Lancope StealthWatch
- Remediation policy actions using pxGrid
Reference:
/ctd/ctd2-0/design_guides/ctd_2-0_cvd_guide_jul15.pdf
NEW QUESTION 23
Drag and Drop Question
Drag and drop the description from the left onto the correct QoS components on the right.
Answer:
Explanation:
Explanation:
The following diagram illustrates the key difference between traffic policing and traffic shaping.
Traffic policing propagates bursts. When the traffic rate reaches the configured maximum rate (or committed information rate), excess traffic is dropped (or remarked). The result is an output rate that appears as a saw-tooth with crests and troughs. In contrast to policing, traffic shaping retains excess packets in a queue and then schedules the excess for later transmission over increments of time. The result of traffic shaping is a smoothed packet output rate.
Note: Committed information rate (CIR): The minimum guaranteed data transfer rate agreed to by the routing device.
NEW QUESTION 24
Witch two actions provide controlled Layer 2 network connectivity between virtual machines running on the same hypervisor? (Choose two.)
- A. Use a single trunk link to an external Layer2 switch.
- B. Use a virtual switch provided by the hypervisor.
- C. Use a virtual switch running as a separate virtual machine.
- D. Use VXLAN fabric after installing VXLAN tunneling drivers on the virtual machines.
- E. Use a single routed link to an external router on stick.
Answer: B,E
NEW QUESTION 25
Refer to the exhibit. An engineer must modify the access control list EGRESS to allow all IP traffic from subnet 10.1.10.0/24 to 10.1.2.0/24. The access control list is applied in the outbound direction on router interface GigabitEthemet 0/1.
Which configuration commands can the engineer use to allow this traffic without disrupting existing traffic flows?
- A. config t
ip access-list extended EGRESS
permit ip 10.1.10.0 255.255.255.0 10.1.2.0 255.255.255.0 - B. config t
ip access-list extended EGRESS
5 permit ip 10.1.10.0 0.0.0.255 10.1.2.0 0.0.0.255 - C. config t
ip access-list extended EGRESS
permit ip 10.1.10.0 0.0.0.255 10.1.2.0 0.0.0.255 - D. config t
ip access-list extended EGRESS2
permit ip 10.1.10.0 0.0.0.295 10.1.2.0 0.0.0.299
permit ip 10.1.100.0 0.0.0.299 10.1.2.0 0.0.0.299
deny ip any any
!
interface g0/1
no ip access-group EGRESS out
ip access-group EGRESS2 out
Answer: B
NEW QUESTION 26
An engineer must configure the strongest password authentication to locally authenticate on a router. Which configuration must be used?
- A. Option C
- B. Option A
- C. Option B
- D. Option D
Answer: B
NEW QUESTION 27
Which statement describes the IP and MAC allocation requirements for virtual machines on types 1 hypervisors?
- A. Each virtual machine requires a unique IP and MAC addresses to be able to reach to other nodes.
- B. Each virtual machine requires a unique IP address but shares the MAC address with the physical server
- C. Each virtual machine requires a unique MAC address but shares the IP address with the physical server.
- D. Each virtual machines requires a unique IP address but shares the MAC address with the address of the physical server.
Answer: A
Explanation:
Explanation
A virtual machine (VM) is a software emulation of a physical server with an operating system.
From an application's point of view, the VM provides the look
and feel of a real physical server, including all its components, such as CPU, memory, and network interface cards (NICs).
The virtualization software that creates VMs and performs the hardware abstraction that allows multiple VMs to run concurrently is known as a hypervisor.
There are two types of hypervisors: type 1 and type 2 hypervisor.
In type 1 hypervisor (or native hypervisor), the hypervisor is installed directly on the physical server. Then instances of an operating system (OS) are installed on the hypervisor. Type 1 hypervisor has direct access to the hardware resources. Therefore they are more efficient than hosted architectures. Some examples of type 1 hypervisor are VMware vSphere/ESXi, Oracle VM Server, KVM and Microsoft Hyper-V.
In contrast to type 1 hypervisor, a type 2 hypervisor (or hosted hypervisor) runs on top of an operating system and not the physical hardware directly. answer 'Each virtual machine requires a unique IP and MAC addresses to be able to reach to other nodes' big advantage of Type 2 hypervisors is that management console software is not required. Examples of type 2 hypervisor are VMware Workstation (which can run on Windows, Mac and Linux) or Microsoft Virtual PC (only runs on Windows).
NEW QUESTION 28
Refer to the exhibit.
What are two effects of this configuration? (Choose two.)
- A. R1 becomes the standby router.
- B. R1 becomes the active router.
- C. If R2 goes down, R1 becomes active but reverts to standby when R2 comes back online.
- D. If R1 goes down. R2 becomes active and remains the active device when R1 comes back online.
- E. If R1 goes down, R2 becomes active but reverts to standby when R1 comes back online.
Answer: B,D
NEW QUESTION 29
Refer to the exhibit.
An engineer must modify the access control list EGRESS to allow all IP traffic from subnet 10.1.10.0/24 to
10.1.2.0/24. The access control list is applied in the outbound direction on router interface GigabitEthemet 0/1.
Which configuration commands can the engineer use to allow this traffic without disrupting existing traffic flows?
A)
B)
C)
D)
- A. Option B
- B. Option A
- C. Option C
- D. Option D
Answer: A
NEW QUESTION 30
Drag and drop the LISP components from the left onto the function they perform on the right. Not all options are used.
Answer:
Explanation:
check the answer below.
Explanation
Components as on functions
NEW QUESTION 31 
Refer to the exhibit. Both controllers are in the same mobility group. Which result occurs when client 1 roams between APs that are registered to different controllers in the same WLAN?
- A. The client database entry moves from controller A to controller B.
- B. CAPWAP tunnel is created between controller A and controller B.
- C. Client 1 users an EoIP tunnel to contact controller A.
- D. Client 1 contact controller B by using an EoIP tunnel.
Answer: A
Explanation:
Explanation
This is called Inter Controller-L2 Roaming. Inter-Controller (normally layer 2) roaming occurs when a client roam between two APs registered to two different controllers, where each controller has an interface in the client subnet. In this instance, controllers exchange mobility control messages (over UDP port 16666) and the client database entry is moved from the original controller to the new controller.
NEW QUESTION 32
Refer to the exhibit.
Which statement about the OPSF debug output is true?
- A. The output displays all OSPF messages which router R1 has sent or received on all interfaces.
- B. The output displays all OSPF messages which router R1 has sent to received on interface Fa0/1.
- C. The output displays OSPF hello and LSACK messages which router R1 has sent or received.
- D. The output displays OSPF hello messages which router R1 has sent received on interface Fa0/1.
Answer: D
Explanation:
Explanation
This combination of commands is known as "Conditional debug" and will filter the debug output based on your conditions. Each condition added, will behave like an 'And' operator in Boolean logic. Some examples of the "debug ip ospf hello" are shown below:
NEW QUESTION 33
Which protocol is responsible for data plane forwarding in a Cisco SD-Access deployment?
- A. OSPF
- B. VXLAN
- C. LISP
- D. IS-IS
Answer: B
Explanation:
Explanation
In SD-Access the control plane is based on LISP (Locator/ID Separation Protocol), the data plane is based on VXLAN (Virtual Extensible LAN), the policy TrustSec, and the management plane is enabled and powered by
https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html#:~:text=In%20SD%
NEW QUESTION 34
In an SD-Access solution what is the role of a fabric edge node?
- A. to connect wired endpoint to the SD-Access fabric
- B. to connect external Layer 3- network to the SD-Access fabric
- C. to advertise fabric IP address space to external network
- D. to connect the fusion router to the SD-Access fabric
Answer: A
Explanation:
Explanation
+ Fabric edge node: This fabric device (for example, access or distribution layer device) connects wired endpoints to the SDA fabric.
NEW QUESTION 35
What is the structure of a JSON web token?
- A. three parts separated by dots: header, payload, and signature
- B. header and payload
- C. three parts separated by dots: version, header, and signature
- D. payload and signature
Answer: A
Explanation:
Explanation/Reference: https://auth0.com/docs/tokens/references/jwt-structure
NEW QUESTION 36
What is a benefit of data modeling languages like YANG?
- A. They enable programmers to change or write their own application within the device operating system.
- B. They make the CLI simpler and more efficient.
- C. They provide a standardized data structure, which results in configuration scalability and consistency.
- D. They create more secure and efficient SNMP OIDs.
Answer: C
Explanation:
Yet Another Next Generation (YANG) is a language which is only used to describe data models
(structure). It is not XML or JSON.
NEW QUESTION 37
Refer to the exhibit.
You have just created a new VRF on PE3. You have enabled debug
ip bgp vpnv4 unicast updates on PE1, and you can see the route in the debug, but not in the BGP VPNv4 table. Which two statements are true? (Choose two)
- A. address-family ipv4 vrf is not configured on PE3
- B. PE1 will reject the route due to automatic route filtering
- C. After you configure route-target import 999:999 for a VRF on PE3, the route will be accepted
- D. After you configure route-target import 999:999 for a VRF on PE1, the route will be accepted
- E. VPNv4 is not configured between PE1 and PE3
Answer: B,D
Explanation:
Explanation
Because some PE routers might receive routing information they do not require, a basic requirement is to be able to filter the MP-iBGP updates at the ingress to the PE router so that the router does not need to keep this information in memory.
The Automatic Route Filtering feature fulfills this filtering requirement. This feature is available by default on all PE routers, and no additional configuration is necessary to enable it. Its function is to filter automatically VPN-IPv4 routes that contain a route target extended community that does not match any of the PE's configured VRFs. This effectively discards any unwanted VPN-IPv4 routes silently, thus reducing the amount of information that the PE has to store in memory -> Answer 'PE1 will reject the route due to automatic route filtering' is correct.
Reference: MPLS and VPN Architectures Book, Volume 1
The reason that PE1 dropped the route is there is no "route-target import 999:999" command on PE1 (so we see the "DENIED due to: extended community not supported" in the debug) so we need to type this command to accept this route -> Answer 'After you configure route-target import 999:999 for a VRF on PE1, the route will be accepted' is correct.
NEW QUESTION 38
Which benefit is offered by a cloud infrastructure deployment but is lacking in an on-premises deployment?
- A. supported systems
- B. efficient scalability
- C. virtualization
- D. storage capacity
Answer: B
NEW QUESTION 39
Drag and drop the threat defense solutions from the left onto their descriptions on the right.
Answer:
Explanation:
NEW QUESTION 40
What is provided by the Stealthwatch component of the Cisco Cyber threat defense solution?
- A. malware control
- B. real-time threat management to stop DDoS attacks to the core and access networks
- C. real-time awareness of users, devices and traffic on the network
- D. dynamic threat control for web traffic
Answer: B
Explanation:
Explanation
Cisco Stealthwatch is a comprehensive, network telemetry-based, security monitoring and analytics solution that streamlines incident response through behavioral analysis; detecting denial of service attacks, anomalous behaviour, malicious activity and insider threats. Based on a scalable enterprise architecture, Stealthwatch provides near real-time situational awareness of all users and devices on the network.
NEW QUESTION 41
Which statement about a Cisco APIC controller versus a more traditional SDN controller is true?
- A. APIC uses a policy agent to translate policies into instructions
- B. APIC supports OpFlex as a Northbound protocol
- C. APIC uses an imperative model
- D. APIC does support a Southbound REST API
Answer: A
Explanation:
Explanation
The southbound protocol used by APIC is OpFlex that is pushed by Cisco as the protocol for policy enablement across physical and virtual switches.
Southbound interfaces are implemented with some called Service Abstraction Layer (SAL), which talks to the network elements via SNMP and CLI.
Note: Cisco OpFlex is a southbound protocol in a software-defined network (SDN).
NEW QUESTION 42
......
Cisco Exam Practice Test To Gain Brilliante Result: https://www.verifieddumps.com/350-401-valid-exam-braindumps.html
Tested Material Used To 350-401: https://drive.google.com/open?id=1vXGKQRLZjj9dC_qGqelFSm9F3dgfKzth
