350-401 practice questions 591–600

1. Question 591 · 1003 in bank

   

   Refer to the exhibit. An administrator troubleshoots intermittent connectivity from internal hosts to an external public server. Some internal hosts can connect to the server while others receive an ICMP Host Unreachable message, and these hosts change over time. What is the cause of this issue?

   • AThe NAT ACL and NAT pool share the same name.
   • BThe translation does not use address overloading.
   • CThe NAT ACL does not match all internal hosts.
   • DThe NAT pool netmask is excessively wide.

   Show answer

   Answer: B

   Explanation

   My answer is B because it's not a solution, it's just a scenario that can be causing the problem. I'm not sure if you can tell from the logs what the NAT ACL is (please correct me if I'm wrong), but you CAN tell that the pool only allows for 2 NAT IP addresses: 198.51.100.5 and 198.51.100.6. Additionally, from the logs you can tell that the NAT Pool is exhausted and it's dropping ICMP polls from hosts that don't have a NAT mapping. Therefore, if you need more than 2 hosts to have access to the outside, you'd need more than the 2-IP NAT pool. "The NAT pool is too small" would be a fine answer if it was a choice, but the next best thing is to say the translation doesn't allow overloading, which would allow more hosts to be translated after the first 2 IPs in the pool are used up.

   Source: Adapted from community discussion — a197cbf

   Next question

2. Question 592 · 1003 in bank

   What is the function of the LISP map resolver?

   • Ato connect a site to the LISP-capable part of a core network publish the EID-to-RLOC mappings for the site, and respond to map-request messages
   • Bto advertise routable non-LISP traffic from one address family to LISP sites in a different address family
   • Cto send traffic to non-LISP sites when connected to a service provider that does not accept nonroutable EIDs as packet sources
   • Dto decapsulate map-request messages from ITRs and forward the messages to the MS

   Show answer

   Answer: D

   Explanation

   Like an MS, a LISP MR connects to the ALT. The function of the LISP MR is to accept encapsulated Map-Request messages from ingress tunnel routers (ITRs), decapsulate those messages, and then forward the messages to the MS responsible for the egress tunnel routers (ETRs) that are authoritative for the requested EIDs. When an MR is implemented concurrently with an MS in a private mapping system deployment, the concurrent MS forwards the encapsulated Map-Request messages to the authoritative ETRs. When a LISP ALT is present in the deployment, the MR forwards the Map-Request messages directly over the ALT to the MS responsible for the ETRs that are authoritative for the requested EIDs. An MR also sends Negative Map-Replies to ITRs in response to queries for non-LISP addresses. source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_lisp/configuration/xe-3s/irl-xe-3s-book/irl-overview.html#GUID-89BB8D34-63BF-43DE-8743-5572D357CDB3

   Source: Adapted from community discussion — Tacolicious

   References

   • Cisco documentation

   Next question

3. Question 593 · 1003 in bank

   

   Refer to the exhibit. An attacker can advertise OSPF fake routes from 172.16.20.0 network to the OSPF domain and black hole traffic. Which action must be taken to avoid this attack and still be able to advertise this subnet into OSPF?

   • AConfigure 172.16.20.0 as a stub network.
   • BConfigure graceful restart on the 172.16.20.0 interface.
   • CConfigure a passive interface on R2 toward 172.16.20.0.
   • DApply a policy to filter OSPF packets on R2.

   Show answer

   Answer: C

   Explanation

   C. Passive interface means R2 won't form neighbor relationships out that interface, and therefore can't learn routes via that subnet

   Source: Adapted from community discussion — civan

   Next question

4. Question 594 · 1003 in bank

   

   Refer to the exhibit. What is the result when a switch that is running PVST+ is added to this network?

   • ABoth switches operate in the PVST+ mode.
   • BSpanning tree is disabled automatically on the network.
   • CBoth switches operate in the Rapid PVST+ mode.
   • DDSW2 operates in Rapid PVST + and the new switch operates in PVST+.

   Show answer

   Answer: D

   Explanation

   This seems to be a frequent topic in cisco forums. DSW2 is not going to switch to PVST+ mode, only the affected interfaces are going to adjust their behavior to the old style PVST+ device. The output shows that DSW2 runs "protocol rstp" i.e. cisco rapid-pvst+, whereas the new switch (connected to DSW2) runs PVST+. Hence we see "P2p Peer(STP)" under "Type". Source: https://ccie2012.wordpress.com/2011/12/27/what-p2p-peerstp-means-in-the-show-spanning-tree-output/ "The RPVST+ switch should detect that the other switch is running PVST+ by the incoming BPDUs. It would then revert to sending 802.1D BPDUs on that interface and rely on timers instead of synchronization." Source: https://community.cisco.com/t5/switching/rstp-rapid-pvst-compatibility/td-p/2400863 "An RSTP bridge that receives an STP BPDU know that it's connected to a legacy device and start sending STP BPDUs itself. This mechanism will happen on a per-vlan basis with Cisco PVST/Rapid-PVST." Source: https://community.cisco.com/t5/switching/mix-pvst-and-rstp/td-p/1345045

   Source: Adapted from community discussion — HungarianDish_111

   References

   • cisco.com documentation
   • cisco.com documentation
   • Cisco documentation

   Next question

5. Question 595 · 1003 in bank

   Which protocol is responsible for data plane forwarding in a Cisco SD-Access deployment?

   • AIS-IS
   • BOSPF
   • CVXLAN
   • DLISP

   Show answer

   Answer: C

   Explanation

   The control plane is based on Locator/ID Separation Protocol (LISP), the data plane is based on Virtual Extensible LAN (VXLAN), the policy plane is based on Cisco TrustSec and the management plane is enabled and powered by Cisco DNA Center.

   Source: Adapted from community discussion — GeorgeFortiGate

   Next question

6. Question 596 · 1003 in bank

   DRAG DROP - Drag and drop the characteristics from the left onto the appropriate infrastructure deployment types on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   On Premisses customizable hardware more suitable for companies resources can be over or Cloud easy to scale and upgrade requires a strong and stable internet connection build-in, automated data backups and recovery

   Source: Adapted from community discussion — Pudu_vlad

   

   Next question

7. Question 597 · 1003 in bank

   Which action is performed by Link Management Protocol in a Cisco StackWise Virtual domain?

   • AIt determines which switch becomes active or standby.
   • BIt determines if the hardware is compatible to form the StackWise Virtual domain.
   • CIt rejects any unidirectional link traffic forwarding.
   • DIt discovers the StackWise domain and brings up SVL interfaces.

   Show answer

   Answer: C

   Explanation

   C seems like the best fit: The Link Management Protocol (LMP) is activated on each link of the StackWise Virtual link as soon as it is brought up online. The LMP performs the following functions: • Verifies link integrity by establishing bidirectional traffic forwarding, and rejects any unidirectional links • Exchanges periodic hellos to monitor and maintain the health of the links • Negotiates the version of StackWise Virtual header between the switches A = StackWise Discovery Protocol (SDP) Page 7 - https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9000/nb-06-cat-9k-stack-wp-cte-en.pdf

   Source: Adapted from community discussion — Mac13

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 598 · 1003 in bank

   

   Refer to the exhibit. Which Python code parses the response and prints "18:32:21.474 UTC Sun Mar 10 2019"?

   • Aprint(response['result'][0]('simple_time'])
   • Bprint(response['result']['body']( 'simple_time'])
   • Cprint(response['body']['simple_time'])
   • Dprint(response['jsonrpc']['body'][ 'simple_time'])

   Show answer

   Answer: B

   Explanation

   B is almost 100% correct, should be response['result']['body']['simple_time'] { "jsonrpc": "2.0", "result": { "body": { "simple_time": "17:53:49.435 UTC Tue Nov 22 2022\n", "time_source": "NTP" } }, "id": 1 }

   Source: Adapted from community discussion — Zizu007

   Next question

9. Question 599 · 1003 in bank

   

   Refer to the exhibit. An engineer configures the trunk and proceeds to configure an ESPAN session to monitor VLANs 10, 20, and 30. Which command must be added to complete this configuration?

   • ADevice(config-mon-erspan-src-dst)# no vrf 1
   • BDevice(config-mon-erspan-src)# no filter vlan 30
   • CDevice(config-mon-erspan-src-dst)# mtu 1460
   • DDevice(config-mon-erspan-src-dst}# erspan-id 6

   Show answer

   Answer: B

   Explanation

   B is best since you can't mix "source VLAN" and "filter VLAN", but it also requires "source vlan 30" after you remove "filter". SMH Cisco.

   Source: Adapted from community discussion — rogue_user

   References

   • Cisco documentation
   • Cisco documentation

   Next question

10. Question 600 · 1003 in bank

    An administrator is configuring NETCONF using the following XML string. What must the administrator end the request with? <?xml version="1.0" encoding="UTF-8" ?> <rpc message-id="9.0">

    • A</rpc>]]>]]>
    • B<rpc message-id="9.0"><notification-off/>
    • C</rpc-reply>
    • D</rpc>

    Show answer

    Answer: A

    Explanation

    Thanks @Darude for the link. "All NETCONF requests must end with ]]>]]> which denotes an end to the request. Until the ]]>]]> sequence is sent, the device will not process the request."

    Source: Adapted from community discussion — HarwinderSekhon

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 591. 1003 questions available.