350-401 practice questions 251–260

1. Question 251 · 1003 in bank

   Which control plane protocol is used between Cisco SD-WAN routers and vSmart controllers?

   • ATCP
   • BOMP
   • CUDP
   • DBGP

   Show answer

   Answer: B

   Explanation

   B The Viptela Overlay Management Protocol (OMP) establishes and maintains the Viptela control plane. OMP is enabled by default on all vEdge routers, vManage NMSs, and vSmart controllers, so there is no need to explicitly configure or enable OMP. OMP must be operational for the Viptela overlay network to function. If you disable it, you disable the overlay network. Reference: https://sdwan-docs.cisco.com/Product_Documentation/vManage_Help/Release_18.3/Configuration/Templates/OMP#:~:text=The%20Viptela%20Overlay,the%20overlay%20network.

   Source: Adapted from community discussion — Asymptote

   References

   • cisco.com documentation

   Next question

2. Question 252 · 1003 in bank

   An engineer must protect their company against ransomware attacks. Which solution allows the engineer to block the execution stage and prevent file encryption?

   • AUse Cisco Firepower and block traffic to TOR networks.
   • BUse Cisco AMP deployment with the Malicious Activity Protection engine enabled.
   • CUse Cisco Firepower with Intrusion Policy and snort rules blocking SMB exploitation.
   • DUse Cisco AMP deployment with the Exploit Prevention engine enabled.

   Show answer

   Answer: B

   Explanation

   B is correct: https://www.cisco.com/c/dam/en/us/products/collateral/security/amp-for-endpoints/white-paper-c11-740980.pdf Malicious Activity Protection provides run-time detection and blocking of abnormal behavior of a running program on the endpoint (for example,behaviors associated with ransomware).

   Source: Adapted from community discussion — Kakat

   References

   • Cisco documentation

   Next question

3. Question 253 · 1003 in bank

   Refer to the exhibit.

   

   An engineer must deny Telnet traffic from the loopback interface of router R3 to the loopback interface of router R2 during the weekend hours. All other traffic between the loopback interfaces of routers R3 and R2 must be allowed at all times. Which command set accomplishes this task?

   • AR3(config)#time-range WEEKEND R3(config-time-range)#periodic Saturday Sunday 00:00 to 23:59 R3(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKEND R3(config)#access-list 150 permit ip any any time-range WEEKEND R3(config)#interface G0/1 R3(config-if)#ip access-group 150 out
   • BR1(config)#time-range WEEKEND R1(config-time-range)#periodic weekend 00:00 to 23:59 R1(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKEND R1(config)#access-list 150 permit ip any any R1(config)#interface G0/1 R1(config-if)#ip access-group 150 in
   • CR3(config)#time-range WEEKEND R3(config-time-range)#periodic weekend 00:00 to 23:59 R3(config)#access-list 150 permit tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKEND R3(config)#access-list 150 permit ip any any time-range WEEKEND R3(config)#interface G0/1 R3(config-if)#ip access-group 150 out
   • DR1(config)#time-range WEEKEND R1(config-time-range)#periodic Friday Sunday 00:00 to 00:00 R1(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKEND R1(config)#access-list 150 permit ip any any R1(config)#interface G0/1 R1(config-if)#ip access-group 150 in

   Show answer

   Answer: B

   Explanation

   cisco_R3(config)#time-range q_277 cisco_R3(config-time-range)#periodic ? Friday Friday Monday Monday Saturday Saturday Sunday Sunday Thursday Thursday Tuesday Tuesday Wednesday Wednesday daily Every day of the week weekdays Monday thru Friday weekend Saturday and Sunday cisco_R3(config-time-range)#periodic weekend ? hh:mm Starting time cisco_R3(config-time-range)#periodic weekend 00:00 ? to ending day and time cisco_R3(config-time-range)#periodic weekend 00:00 to ? hh:mm Ending time - stays valid until beginning of next minute cisco_R3(config-time-range)#periodic weekend 00:00 to 23:59

   Source: Adapted from community discussion — nushadu

   Next question

4. Question 254 · 1003 in bank

   

   Refer to the exhibit. PC-1 must access the web server on port 8080. To allow this traffic, which statement must be added to an access control list that is applied on SW2 port G0/0 in the inbound direction?

   • Apermit tcp host 172.16.0.2 host 192.168.0.5 eq 8080
   • Bpermit tcp host 192.168.0.5 host 172.16.0.2 eq 8080
   • Cpermit tcp host 192.168.0.5 eq 8080 host 172.16.0.2
   • Dpermit tcp host 192.168.0.5 lt 8080 host 172.16.0.2

   Show answer

   Answer: C

   Explanation

   Answer is C, as the ACL is applied INBOUND on the Web server's switch port (G0/0). Therefore the traffic needing to be blocked will have a source IP and port of the server (192.168.0.5:8080) and a destination address of PC-1 (172.16.0.2) on any port.

   Source: Adapted from community discussion — Mac13

   Next question

5. Question 255 · 1003 in bank

   What is the result of applying this access control list? ip access-list extended STATEFUL 10 permit tcp any any established 20 deny ip any any

   • ATCP traffic with the URG bit set is allowed.
   • BTCP traffic with the SYN bit set is allowed.
   • CTCP traffic with the ACK bit set is allowed.
   • DTCP traffic with the DF bit set is allowed.

   Show answer

   Answer: C

   Explanation

   The established keyword indicates that packets belong to an existing connection if the Transmission Control Protocol (TCP) datagram has the Acknowledgment (ACK) or Reset (RST) bit set. https://community.cisco.com/t5/networking-documents/how-to-configure-acls-to-permit-only-established-connections-and/ta-p/3127503

   Source: Adapted from community discussion — P1Z7C

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

6. Question 256 · 1003 in bank

   Which outbound access list, applied to the WAN interface of a router, permits all traffic except for http traffic sourced from the workstation with IP address 10.10.10.1?

   • Aip access-list extended 200 deny tcp host 10.10.10.1 eq 80 any permit ip any any
   • Bip access-list extended 10 deny tcp host 10.10.10.1 any eq 80 permit ip any any
   • Cip access-list extended NO_HTTP deny tcp host 10.10.10.1 any eq 80
   • Dip access-list extended 100 deny tcp host 10.10.10.1 any eq 80 permit ip any any

   Show answer

   Answer: D

   Explanation

   Defo D as its an extended ACL the range is betwee 100-199 Router(config)#ip access-list extended ? Extended IP access-list number Extended IP access-list number (expanded range) WORD Access-list name

   Source: Adapted from community discussion — Sajj_gabi

   References

   • Cisco documentation

   Next question

7. Question 257 · 1003 in bank

   

   Refer to the exhibit. An engineer must create a configuration that executes the show run command and then terminates the session when user CCNP logs in. Which configuration change is required?

   • AAdd the access-class keyword to the username command.
   • BAdd the autocommand keyword to the aaa authentication command.
   • CAdd the access-class keyword to the aaa authentication command.
   • DAdd the autocommand keyword to the username command.

   Show answer

   Answer: D

   Explanation

   I've been a CCNP for 11 years, and doing Cisco networking for almost 25. Today, right now, is the first time I have ever heard of this capability.

   Source: Adapted from community discussion — hex2

   References

   • Cisco documentation

   Next question

8. Question 258 · 1003 in bank

   

   Refer to the exhibit. An engineer configures CoPP and enters the show command to verify the implementation. What is the result of the configuration?

   • AAll traffic will be policed based on access-list 120.
   • BIf traffic exceeds the specified rate, it will be transmitted and remarked.
   • CClass-default traffic will be dropped.
   • DICMP will be denied based on this configuration.

   Show answer

   Answer: A

   Next question

9. Question 259 · 1003 in bank

   DRAG DROP - Drag and drop the threat defense solutions from the left onto their descriptions on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   From the Official Cert Guide. P. 1426 (AMP – Advanced Malware Protection) P. 1430 (Umbrella – Formerly known as OpenDNS) P. 1436 (ESA – Email Security Appliance) P. 1444 (FTD – Firepower Threat Defense) P. 1446 (Cisco Stealthwatch – is a collector and aggregator of network telemetry data that performs network security analysis and monitoring to automatically detect threats that manage to infiltrate a network as well as the ones that originate form within a network.) given answer is correct.

   Source: Adapted from community discussion — AlbertoStu

   

   Next question

10. Question 260 · 1003 in bank

    Refer to the exhibit.

    

    What is the effect of this configuration?

    • AThe device will allow users at 192.168.0.202 to connect to vty lines 0 through 4 using the password ciscotestkey.
    • BThe device will authenticate all users connecting to vty lines 0 through 4 against TACACS+.
    • CThe device will allow only users at 192.168.0.202 to connect to vty lines 0 through 4.
    • DWhen users attempt to connect to vty lines 0 through 4, the device will authenticate them against TACACS+ if local authentication fails.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 251. 1003 questions available.