350-401 practice questions 231–240

1. Question 231 · 1003 in bank

   

   Refer to the exhibit. Cisco DNA Center has obtained the username of the client and the multiple devices that the client is using on the network. How is Cisco DNA Center getting these context details?

   • AThose details are provided to Cisco DNA Center by the Identity Services Engine.
   • BThe administrator had to assign the username to the IP address manually in the user database tool on Cisco DNA Center.
   • CCisco DNA Center pulled those details directly from the edge node where the user connected.
   • DUser entered those details in the Assurance app available on iOS and Android devices.

   Show answer

   Answer: A

   Explanation

   Identity Services Engine Cisco Identity Services Engine (ISE) is a secure network access platform enabling increased management awareness, control, and consistency for users and devices accessing an organization's network. ISE is an integral and mandatory component of SD-Access for implementing network access control policy. ISE performs policy implementation, enabling dynamic mapping of users and devices to scalable groups, and simplifying end-to-end security policy enforcement. Within ISE, users and devices are shown in a simple and flexible interface. ISE integrates with Cisco DNA Center by using Cisco Platform Exchange Grid (pxGrid) and REST APIs (Representational State Transfer Application Programming Interfaces) for endpoint event notifications and automation of policy configurations on ISE.

   Source: Adapted from community discussion — SandyIndia

   References

   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 232 · 1003 in bank

   Which command set configures RSPAN to capture outgoing traffic from VLAN 3 on interface GigabitEthernet 0/3 while ignoring other VLAN traffic on the same interface?

   • Amonitor session 2 source interface gigabitethernet0/3 rx monitor session 2 filter vlan 3
   • Bmonitor session 2 source interface gigabitethernet0/3 rx monitor session 2 filter vlan 1 - 2, 4 - 4094
   • Cmonitor session 2 source interface gigabitethernet0/3 tx monitor session 2 filter vlan 3
   • Dmonitor session 2 source interface gigabitethernet0/3 tx monitor session 2 filter vlan 1- 2, 4 - 4094

   Show answer

   Answer: C

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

3. Question 233 · 1003 in bank

   

   Refer to the exhibit. What is required to configure a second export destination for IP address 192.168.10.1?

   • ASpecify a different UDP port.
   • BSpecify a different TCP port.
   • CConfigure a version 5 flow-export to the same destination.
   • DSpecify a different flow ID.
   • ESpecify a VRF.

   Show answer

   Answer: A

   Explanation

   yes, it works but with warnings: cisco_R3(config)#do s runn | sec flow ip flow-export version 9 ip flow-export destination 1.1.1.2 9999 cisco_R3(config)#ip flow-export destination 1.1.1.2 9999 %Cannot configure Identical Destination address and port 1.1.1.2 9999 cisco_R3(config)#ip flow-export destination 1.1.1.2 9991 %Warning: Second destination address is the same as previous address 1.1.1.2 cisco_R3(config)# cisco_R3(config)#do s runn | sec flow ip flow-export version 9 ip flow-export destination 1.1.1.2 9999 ip flow-export destination 1.1.1.2 9991 cisco_R3(config)#

   Source: Adapted from community discussion — nushadu

   Next question

4. Question 234 · 1003 in bank

   

   Refer to the exhibit. After implementing the configuration, 172.20.20.2 stops replying to ICMP echos, but the default route fails to be removed. What is the reason for this behavior?

   • AThe threshold value is wrong.
   • BThe source-interface is configured incorrectly.
   • CThe destination must be 172.30.30.2 for icmp-echo.
   • DThe default route is missing the track feature.

   Show answer

   Answer: D

   Explanation

   cisco_R3#show track Track 1 IP SLA 1 state State is Down 1 change, last change 00:04:01 Latest operation return code: No connection Tracked by: Static IP Routing 0 cisco_R3#show ip route track-table ip route 0.0.0.0 0.0.0.0 2.2.2.2 track 1 state is [down] cisco_R3# cisco_R3#sh runn | s ip rou ip route 0.0.0.0 0.0.0.0 2.2.2.2 track 1 ... cisco_R3# cisco_R3#show ip route static | b Gate Gateway of last resort is not set 172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks S 172.16.1.0/24 is directly connected, Ethernet0/0.30 S 192.168.1.0/24 is directly connected, Ethernet0/0.20 cisco_R3#

   Source: Adapted from community discussion — nushadu

   Next question

5. Question 235 · 1003 in bank

   Refer to the exhibit.

   

   An engineer is troubleshooting a connectivity issue and executes a traceroute. What does the result confirm?

   • AThe destination port is unreachable.
   • BThe probe timed out.
   • CThe destination server reported it is too busy.
   • DThe protocol is unreachable.

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

6. Question 236 · 1003 in bank

   Which Cisco DNA Center application is responsible for group-based access control permissions?

   • AProvision
   • BDesign
   • CAssurance
   • DPolicy

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

7. Question 237 · 1003 in bank

   An engineer is concerned with the deployment of a new application that is sensitive to inter-packet delay variance. Which command configures the router to be the destination of jitter measurements?

   • ARouter(config)# ip sla responder udp-connect 172.29.139.134 5000
   • BRouter(config)# ip sla responder tcp-connect 172.29.139.134 5000
   • CRouter(config)# ip sla responder udp-echo 172.29.139.134 5000
   • DRouter(config)# ip sla responder tcp-echo 172.29.139.134 5000

   Show answer

   Answer: C

   Explanation

   Tcp-connect involves establishing a full connection whereas udp-echo echo is used to measure response times and test end-to-end connectivity therefore C is the correct answer

   Source: Adapted from community discussion — Marving

   Next question

8. Question 238 · 1003 in bank

   Which NGFW mode blocks flows crossing the firewall?

   • Atap
   • Binline
   • Cpassive
   • Dinline tap

   Show answer

   Answer: B

   Explanation

   From the option provided, only option 'B' can block traffic. When Inline Pair Mode is in use, packets can be blocked since they are processed inline. When Tap Mode is enabled, a copy of the packet is inspected and dropped internally while the actual traffic goes through FTD unmodified. Inline pair mode is an active mode, Tap mode is a passive mode. https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200924-configuring-firepower-threat-defense-int.html#toc-hId-1297094981:~:text=Yes-,Inline%20Pair,No,-Configure%20Inline%20Pair

   Source: Adapted from community discussion — AbdullahMohammad251

   References

   • Cisco documentation

   Next question

9. Question 239 · 1003 in bank

   How does Cisco TrustSec enable more flexible access controls for dynamic networking environments and data centers?

   • Auses flexible NetFlow
   • Bassigns a VLAN to the endpoint
   • Cclassifies traffic based on advanced application recognition
   • Dclassifies traffic based on the contextual identity of the endpoint rather than its IP address

   Show answer

   Answer: D

   Explanation

   Answer is D Introduction Cisco TrustSec classification and policy enforcement functions are embedded in Cisco® switching, routing, wireless LAN, and firewall products. By classifying traffic based on the contextual identity of the endpoint versus its IP address, Cisco TrustSec enables more flexible access controls for dynamic networking environments and data centers. https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/at_a_glance_c45-726831.pdf

   Source: Adapted from community discussion — XalaGyan

   References

   • Cisco documentation

   Next question

10. Question 240 · 1003 in bank

    DRAG DROP - Drag and drop the QoS mechanisms from the left onto their descriptions on the right. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Mod, pls fix the answer. Correct answer imo, DSCP == portion of the IP header used to classify the packets policy map == mechanism to create a scheduler for packets prior to forwarding service policy == mechanism to apply a QoS policy to an interface

    Source: Adapted from community discussion — mungeri

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 231. 1003 questions available.