350-501 practice questions 211–220

1. Question 211 · 377 in bank

   How does Cisco DNA Center enhance network automation?

   • AIt allows network administrators to quickly deploy Cisco Layer 2 devices without requiring STP and broadcast transport.
   • BIt allows network administrators to reduce inconsistencies when they deploy and validate network configurations.
   • CIt allows network administrators to reduce the number of VRFs in a multi customer environment by automatically implementing a single VLAN per customer.
   • DIt allows network administrators to combine voice and data networks into a single topology without manual configuration.

   Show answer

   Answer: B

   Next question

2. Question 212 · 377 in bank

   

   Refer to the exhibit. Which type of DDoS attack will be mitigated by this configuration?

   • Ateardrop attack
   • Bsmurf attack
   • CSYN flood
   • DSIP INVITE flood attacks

   Show answer

   Answer: D

   References

   • cisco.com documentation

   Next question

3. Question 213 · 377 in bank

   

   Refer to the exhibit. A network engineer is implementing multicast services on CPE-1 and CPE-2. CPE-1 must be configured as the preferred IGMP querier for the LAN segment. PIM-SM must be implemented on the LAN interfaces with an IGMP version that supports (*, G) joins only. Which configurations must the engineer implement on CPE-1 and CPE-2?

   • AOn CPE-1: interface GigabitEthernet0/1 ip address 10.0.12.129 255.255.255.128 ip pim sparse-mode ip igmp version 2 On CPE-2: interface GigabitEthernet0/1 ip address 10.0.12.130 255.255.255.128 ip pim sparse-mode ip igmp version 2
   • BOn CPE-1: interface GigabitEthernet0/1 ip address 10.0.12.130 255.255.255.128 ip pim sparse-mode ip igmp version 3 On CPE-2: interface GigabitEthernet0/1 ip address 10.0.12.129 255.255.255. 128 ip pim sparse-mode ip igmp version 3
   • COn CPE-1: interface GigabitEthernet0/1 ip address 10.0.12.130 255.255.255.128 ip pim sparse-mode ip igmp version 2 On CPE-2: interface GigabitEthernet0/1 ip address 10.0.12.129 255.255.255.128 ip pim sparse-mode ip igmp version 2
   • DOn CPE-1: interface GigabitEthernet0/1 ip address 10.0.12.129 255.255.255.128 ip pim sparse-mode ip igmp version 3 On CPE-2: interface GigabitEthernet0/1 ip address 10.0.12.130 255.255.255.128 ip pim sparse-mode ip igmp version 3

   Show answer

   Answer: A

   Explanation

   When an IGMPv2 device receives a general query message, the device compares the source IP address in the message with its own interface address. The device with the lowest IP address on the subnet is elected the IGMP querier. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipmulti_igmp/configuration/xe-16-9/imc-igmp-xe-16-9-book/imc-customizing-igmp.html

   Source: Adapted from community discussion — Karoly

   References

   • Cisco documentation

   Next question

4. Question 214 · 377 in bank

   A new PE router is configured to run OSPF as an IGP with LDP on all interfaces. The engineer is trying to prevent black holes after convergence when the PERSON device loses an LDP session with other PE routers. Which action must the engineer take to implement LDP session protection on a new PE router?

   • AConfigure the mpls ldp session protection and mpls label protocol ldp commands on the interfaces on the new PE router that connect to the CENTER routers.
   • BConfigure the mpls ldp discovery targeted-hello accept and mpls ldp session protection commands on the interfaces on the new PE router that connect to the CE routers.
   • CConfigure the new PE router with the mpls ldp session protection command and on neighboring routers that connect to this new PE router.
   • DConfigure the new PE router with the mpls ldp session protection command on interfaces with directly connected neighbors.

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

5. Question 215 · 377 in bank

   Which condition must be met for TI-LFA to protect LDP traffic?

   • AFor single-segment protection, the PQ node must be LDP and SR-capable.
   • BThe protected destination must have an associated LDP label and prefix-SID.
   • CThe point of local repair must be LDP-capable.
   • DFor double-segment protection, the P and Q nodes must be SR-capable.

   Show answer

   Answer: D

   Explanation

   Protecting LDP traffic with TI-LFA – Restrictions • Point of Local Repair (PLR) must be SR-capable • Protected destination must have an associated prefix-SID – Advertised by itself if SR-capable – Advertised by mapping server if not SR-capable • Single-segment protection: PQ node must be SR-capable – If not, use rLFA, which requires targeted LDP session • Double-segment protection: P and Q nodes must both be SR-capable Page 56 - https://www.cisco.com/c/dam/global/zh_cn/solutions/service-provider/segment-routing/pdf/topology_independent_lfa.pdf

   Source: Adapted from community discussion — ja73

   References

   • Cisco documentation

   Next question

6. Question 216 · 377 in bank

   The NOC team must update the BGP forwarding configuration on the network with these requirements: ✑ BGP peers must establish a neighborship with NSF capability and restart the session for the capability to be exchanged after 120 seconds. ✑ BGP peers must delete routes after 360 seconds of inactivity. Which action meets these requirements?

   • ASet the BGP restart-time to 120 seconds and the BGP ha-mode sso to 360 seconds.
   • BSet the stalepath-time to 120 seconds and the BGP restart-time to 360 seconds.
   • CSet the BGP ha-mode sso to 120 seconds and the BGP restart-time to 360 seconds.
   • DSet the BGP restart-time to 120 seconds and the stalepath-time to 360 seconds.

   Show answer

   Answer: D

   Next question

7. Question 217 · 377 in bank

   

   Refer to the exhibit. A network engineer is configuring router RB to secure BGP advertisements against route hijacking activity. RB must validate all prefixes that it receives from origin AS 200 before installing them in the BGP route table. Which configuration meets the requirement?

   • ARB(config)# router bgp 100 RB(config-router)# address-family ipv4 unicast RB(config-router-af)# bgp bestpath origin-as use validity
   • BRB(config-bgp)# router bgp 100 RB(config-bgp)# bgp origin-as validation signal ibgp RB(config-bgp)# bgp bestpath origin-as allow invalid
   • CRB(config-bgp)# router bgp 100 RB(config-bgp)# bgp origin-as validation time off
   • DRB(config)# router bgp 100 RB(config-router)# address-family ipv4 unicast PB(config-router-af)# bgp origin-as validation enable

   Show answer

   Answer: D

   Explanation

   https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/217020-bgp-rpki-with-xr7-cisco8000-whitepaper.html By default, the router fetches ROAs from the validator but does not begin using them until it is configured to do so. As a result, these prefixes are marked as ‘D’ or disabled... In order to enable the router for as-origin validity check, activate this command for the concerned address family. router bgp address-family ipv4 unicast bgp origin-as validation enable it causes the router to scan the prefixes present in its BGP table against the ROA information received from the validator and one of the three states is assigned to prefixes. In order to enable the router to use prefix validation state information while making the best path calculation, this command is needed. router bgp address-family ipv4 unicast bgp bestpath origin-as use validity I would go for D, since it just need to scan the prefix

   Source: Adapted from community discussion — kelso1603

   References

   • Cisco documentation

   Next question

8. Question 218 · 377 in bank

   After troubleshooting multiple outages on the network due to repeated configuration errors, the network architect asked an engineer to enable NETCONF to facilitate future configurations. The configuration must enable syslog messaging to record NETCONF notifications from each of the numerous devices on the network. Which configuration must the engineer apply?

   • Ausername cisco test taker privilege 15 password 0 cisco test aaa new-model aaa authorization exec default local snmp-server community cisco test RW netconf-yang cisco-ia snmp-community-string ciscotest logging history warnings
   • Busername cisco test taker privilege 15 password 0 ciscotest aaa new-model aaa authorization exec default local snmp-server community ciscotest RW netconf-yang cisco logging history critical
   • Cnetconf-yang username ciscotesttaker privilege 15 password 0 ciscotest aaa new-model aaa authorization exec default local snmp-server community ciscotest RW netconf-yang cisco-ia snmp-community-string ciscotest logging history debugging
   • Dnetconf-yang username ciscotesttaker privilege 15 password 0 ciscotest snmp-server community ciscotest RW netconf-yang cisco-ia snmp-community-string ciscotest logging history informational

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

9. Question 219 · 377 in bank

   

   Refer to the exhibit. In the service provider network, routers PE1, PE2, and PE4 have access to the internet and provide access to customer networks. Router PE3 is used for access to other customer systems. In accordance with a new SLA, an engineer is updating settings on this network so that router CE1 accesses the internet via PE1 instead of PE2. Which two tasks must the engineer perform to complete the process? (Choose two.)

   • AOn PE1, configure the internet VRF with import route target 102:102.
   • BOn PE1 and PE4, configure the internet VRF with import route targets 102:102 and 104:104.
   • COn PE2, configure the internet VRF with import route target 102:102.
   • DOn PE2 and PE3, configure the internet VRF with import route target 101:101.
   • EOn PE2, configure the CE1 VRF with import route target 101:101.

   Show answer

   Answer: E

   Explanation

   option E is correct but option A does not seems correct, instead it should be on PE1 in CE1 VRF remove import RT of 102:102

   Source: Adapted from community discussion — Zee81

   Next question

10. Question 220 · 377 in bank

    

    Refer to the exhibit. A NOC engineer is configuring label-based forwarding from CSR to the EPC gateway. Cell-site operation and maintenance for IPv4 traffic between 10.20.10.1 and 192.168.10.10 is already up. CR1 and CR2 are configured as route reflectors for AG1 and AG2. Which action completes the configuration?

    

    • ARemove address-family labeled-unicast from the BGP session-group infra on AG1 for neighbor-group core.
    • BApply the BGP_Egress_Filter route policy to the BGP neighbor-group packet core on AG1.
    • CConfigure AG1 to allocate a label to the BGP routes that are received in the BGP session group transport.
    • DConfigure AG1 to allow the 300:100 and 200:100 communities in the BGP_Egress_Filter route policy.

    Show answer

    Answer: B

    Explanation

    ommunity-set Allowed-Comm 300:100, 200:100, !!BGP Packet Core Community=300:100 !!BGP Agg Community=200:100 route-policy BGP_Egress_Filter if community matches-any Allowed-Comm then pass neighbor-group Packet-Core use session-group infra address-family ipv4 labeled-unicast route-reflector-client next-hop-self route-policy BGP_Egress_Filter both Answer: B

    Source: Adapted from community discussion — sushil_bhattacharjee

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-501 practice, question 211. 377 questions available.