350-401 practice questions 721–730

1. Question 721 · 1003 in bank

   Select 2

   Which two prerequisites must be met before Cisco DNA Center can provision device? (Choose two.)

   • ACisco DNA Center must have the software image for he provisioned device in its image repository.
   • BThe provisioned device must be put into bootloader mode.
   • CThe provisioned device must be configured with CLI and SNMP credentials that are known to Cisco DNA Center.
   • DCisco DNA Center must have IP connectivity to the provisioned device.
   • EThe provisioned device must recognize Cisco DNA Center as its LLDP neighbor.

   Show answer

   Answer: CD

   Explanation

   Out of all of the answers the only 100% sure answer is C and then the common sense one is D Feel free to check out more information on the following link: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/2-2-2/user_guide/b_cisco_dna_center_ug_2_2_2/b_cisco_dna_center_ug_2_2_2_chapter_01101.html

   Source: Adapted from community discussion — Clauster

   References

   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 722 · 1003 in bank

   In Cisco DNA Center, what is used to publish events and notifications to a third-party product such as IPAM?

   • Aintent API
   • Bsouthbound SDK
   • Cintegration API
   • DRESTful API

   Show answer

   Answer: C

   Explanation

   https://blogs.cisco.com/networking/with-apis-cisco-dna-center-can-improve-your-competitive-advantage Westbound—Integration APIs Cisco DNA Center platform can power end-to-end IT processes across the value chain by integrating various domains such as ITSM, IPAM, and reporting. By leveraging the REST-based Integration Adapter APIs, bi-directional interfaces can be built to allow the exchange of contextual information between Cisco DNA Center and the external, third-party IT systems. The westbound APIs provide the capability to publish the network data, events and notifications to the external systems and consume information in Cisco DNA Center from the connected systems.

   Source: Adapted from community discussion — MJane

   References

   • cisco.com documentation
   • cisco.com documentation
   • cisco.com documentation

   Next question

3. Question 723 · 1003 in bank

   Router R1 must be configured as a UDP responder on port 6336. Which configuration accomplishes this task?

   • A(config)#ip sla responder udp-echo ipaddress 10.10.10.1 port 6336
   • B(config)#ip sla responder udp-echo ipv4 10.10.10.1 port 6336
   • C(config)#ip sla responder ipaddress 10.10.10.1 port 6336
   • D(config-if)#ip sla responder udp-port ipaddress 10.10.10.1 port 6336

   Show answer

   Answer: A

   Explanation

   100 percent A. Straight from CML lab; showing all options for full knowledge: R01(config)#ip sla responder ? auto-register Setup auto-register to hub tcp-connect Setup tcp-connect responder twamp Setup TWAMP responder udp-echo Setup udp-echo responder R01(config)#ip sla responder udp-echo ? ipaddress Permanent address port Permanent port R01(config)#ip sla responder udp-echo 10.0.0.1 ? R01(config)#ip sla responder udp-echo ip R01(config)#ip sla responder udp-echo ipaddress 10.0.0.1 ? port Permanent port R01(config)#ip sla responder udp-echo ipaddress 10.0.0.1 po R01(config)#ip sla responder udp-echo ipaddress 10.0.0.1 port 6336 <--------- //end R01#sh run b | s version version 15.9 hth

   Source: Adapted from community discussion — NetworkJanitor

   References

   • Cisco documentation

   Next question

4. Question 724 · 1003 in bank

   

   Refer to the exhibit. An engineer must configure an ERSPAN tunnel that mirrors traffic from Linux1 on Switch1 to Linux2 on Switch2. Which command must be added to the destination configuration to enable the ERSPAN tunnel?

   • A(config-mon-erspan-src-dst)# no shut
   • B(config-mon-erspan-src-dst)# traffic bidirectional
   • C(config-mon-erspan-src-dst)# monitor session 1 activate
   • D(config-mon-erspan-src-dst)# ip address 10.10.10.10

   Show answer

   Answer: D

   Explanation

   There are 2 versions of this question. Version 1, missing item: Switch2(config-mon-erspan-dst-src)# erspan-id 110 Version 2, missing item: Switch1(config-mon-src-dst) ip address 10.10.10.10 - You must specify the destination IP address for the ERSPAN traffic in the source session config - ERSPAN flow ID must match in source and destination sessions.

   Source: Adapted from community discussion — AbdullahMohammad251

   References

   • Cisco documentation

   Next question

5. Question 725 · 1003 in bank

   Select 2

   Which two namespaces does the LISP network architecture and protocol use? (Choose two.)

   • ATLOC
   • BRLOC
   • CDNS
   • DVTEP
   • EEID

   Show answer

   Answer: BE

   Explanation

   Ref: IP Routing: LISP Configuration Guide, Cisco IOS XE Release 3S “C H A P T E R 1 Locator ID Separation Protocol (LISP) Overview Locator ID Separation Protocol (LISP) is a network architecture and protocol that implements the use of two namespaces instead of a single IP address: • Endpoint identifiers (EIDs)—assigned to end hosts. • Routing locators (RLOCs)—assigned to devices (primarily routers) that make up the global routing system. …” A. TLOC Wrong answer. B. RLOC Correct answer. C. DNS Wrong answer. D. VTEP Wrong answer. E. EID Correct answer.

   Source: Adapted from community discussion — [Removed]

   Next question

6. Question 726 · 1003 in bank

   Refer to the exhibit.

   

   Which configuration enables fallback to local authentication and authorization when no TACACS+ server is available?

   • ARouter(config)# aaa fallback local
   • BRouter(config)# aaa authentication login FALLBACK local Router(config)# aaa authorization exec FALLBACK local
   • CRouter(config)# aaa authentication login default local Router(config)# aaa authorization exec default local
   • DRouter(config)# aaa authentication login default group tacacs+ local Router(config)# aaa authorization exec default group tacacs+ local

   Show answer

   Answer: D

   Next question

7. Question 727 · 1003 in bank

   Which configuration protects the password for the VTY lines against over-the-shoulder attacks?

   • Aline vty 0 15 password $2$FpM7f82!
   • Busername admin secret 7 6j809J23kpp438337113N7%e$
   • Cline vty 0 4 password $2$FpM7f82!
   • Dservice password-encryption

   Show answer

   Answer: D

   Next question

8. Question 728 · 1003 in bank

   Refer to the exhibit.

   

   Remote users cannot access the Internet but can upload files to the storage server. Which configuration must be applied to allow Internet access?

   • Aciscoasa(config)# access-list MAIL_AUTH extended permit udp any any eq http ciscoasa(config)# aaa authentication listener http outside redirect
   • Bciscoasa(config)# access-list MAIL_AUTH extended permit tcp any any eq www ciscoasa(config)# aaa authentication listener http inside redirect
   • Cciscoasa(config)# access-list MAIL_AUTH extended permit tcp any any eq http ciscoasa(config)# aaa authentication listener http inside port 43
   • Dciscoasa(config)# access-list HTTP_AUTH extended permit udp any any eq http ciscoasa(config)# aaa authentication listener http outside port 43

   Show answer

   Answer: B

   Explanation

   A. ciscoasa(config)# access-list MAIL_AUTH extended permit udp any any eq http ciscoasa(config)# aaa authentication listener http outside redirect B. ciscoasa(config)# access-list MAIL_AUTH extended permit tcp any any eq www ciscoasa(config)# aaa authentication listener http inside redirect C. ciscoasa(config)# access-list MAIL_AUTH extended permit tcp any any eq http ciscoasa(config)# aaa authentication listener http inside port 43 D. ciscoasa(config)# access-list HTTP_AUTH extended permit udp any any eq http ciscoasa(config)# aaa authentication listener http outside port 43

   Source: Adapted from community discussion — dragonwise

   References

   • Cisco documentation

   Next question

9. Question 729 · 1003 in bank

   Refer to the exhibit.

   

   Extended access-list 100 is configured on interface GigabitEthernet 0/0 in an inbound direction, but it does not have the expected behavior of allowing only packets to or from 192.168.0.0/16. Which command set properly configures the access list?

   • AR1(config)#no access-list 100 deny ip any any
   • BR1(config)#no access-list 100 seq 10 R1(config)#access-list 100 seq 40 deny ip any any
   • CR1(config)#ip access-list extended 100 R1(config-ext-nacl)#5 permit ip any any
   • DR1(config)#ip access-list extended 100 R1(config-ext-nacl)#no 10

   Show answer

   Answer: D

   Explanation

   D makes sense because the 10 statement won't allow ip packets from the 192.168.0.0 subnet or any other subnet pass through

   Source: Adapted from community discussion — Pilgrim5

   Next question

10. Question 730 · 1003 in bank

    Which security measure mitigates a man-in-the-middle attack of a REST API?

    • Apassword hash
    • BSSL certificates
    • Cnonrepudiation feature
    • Dbiometric authentication

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 721. 1003 questions available.