350-401 practice questions 871–880

1. Question 871 · 1003 in bank

   Select 2

   

   Refer to the exhibit. An engineer must assign an IP address of 192.168.1.1/24 to the GigabitEthernet1 interface. Which two commands must be added to the existing configuration to accomplish this task? (Choose two.)

   • ARouter(config-if)#ip address 192.168.1.1 255.255.255.0
   • BRouter(config-vrf)#address-family ipv4
   • CRouter(config-vrf)#ip address 192.168.1.1 255.255.255.0
   • DRouter(config-if)#address-family ipv4
   • ERouter(config-vrf)#address-family ipv6

   Show answer

   Answer: AB

   Explanation

   Agreed 100%. Tested in GNS3. Router#show run vrf STAFF Building configuration... Current configuration : 237 bytes vrf definition STAFF ! address-family ipv4 exit-address-family ! ! interface GigabitEthernet0/1 vrf forwarding STAFF ip address 192.168.1.1 255.255.255.0 standby version 2 shutdown duplex auto speed auto media-type rj45 ! end

   Source: Adapted from community discussion — ciscogear

   Next question

2. Question 872 · 1003 in bank

   Which action is a LISP ITR responsible for?

   • Aresponding to map-request messages
   • Bforwarding user data traffic
   • Cfinding EID-to-RLOC mappings
   • Daccepting registration requests from ETRs

   Show answer

   Answer: C

   Explanation

   Given answer is correct. LISP Ingress Tunnel Router (ITR) An ITR is responsible for finding EID-to-RLOC mappings for all traffic destined for LISP-capable sites. When the ITR receives a packet destined for an EID, it first looks for the EID in its mapping cache. If the ITR finds a match, it encapsulates the packet inside a LISP header with one of its RLOCs as the IP source address https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_lisp/configuration/15-mt/irl-15-mt-book/irl-overview.pdf

   Source: Adapted from community discussion — Storcaks

   References

   • Cisco documentation

   Next question

3. Question 873 · 1003 in bank

   Select 2

   An engineer modifies the existing ISE guest portal URL to use a static FQDN. Users immediately report that they receive certificate errors when they are redirected to the new page. Which two additional configuration steps are needed to implement the change? (Choose two.)

   • AAdd a new DNS record to resolve the FQDN to the PSN IP address
   • BCreate and sign a new CSR that contains the static FQDN entry
   • CManually configure the hosts file on each user device.
   • DDisable HTTPS on the WLC under the Management menu
   • EAdd the FQDN entry under the WLC virtual interface

   Show answer

   Answer: AB

   Explanation

   The two correct additional configuration steps needed to implement the change are: A. Add a new DNS record to resolve the FQDN to the PSN IP address This is required so that when users try to access the FQDN, it correctly resolves to the IP address of the Policy Service Node (PSN), ensuring proper redirection. B. Create and sign a new CSR that contains the static FQDN entry A new certificate must be generated with the static FQDN in the subject or subject alternative name (SAN) field. This is necessary to avoid certificate errors, as the certificate must match the new FQDN for secure HTTPS connections. Explanations for incorrect options: C: Manually configuring the hosts file on each user device is not a scalable or practical solution for large networks. D: Disabling HTTPS on the Wireless LAN Controller (WLC) under the Management menu would not resolve certificate issues, and it would reduce security. E: While adding the FQDN to the WLC virtual interface could help with redirection, it does not address the certificate error issue directly.

   Source: Adapted from community discussion — cjoyce1980

   References

   • cisco.com documentation

   Next question

4. Question 874 · 1003 in bank

   What is contained in the VXLAN header?

   • AVXLAN network identifier
   • Bsource and destination RLOC ID
   • Cendpoint ID
   • Doriginal Layer 2 VLAN ID

   Show answer

   Answer: A

   Explanation

   The VXLAN (Virtual Extensible LAN) header contains the VXLAN network identifier, also known as the VNI (VXLAN Network Identifier). The VNI is a 24-bit identifier that uniquely identifies the VXLAN segment or virtual network. VXLAN encapsulates Layer 2 Ethernet frames in Layer 3 UDP (User Datagram Protocol) packets, and the VNI in the VXLAN header helps route these packets to the appropriate VXLAN segment or network.

   Source: Adapted from community discussion — slacker_at_work

   Next question

5. Question 875 · 1003 in bank

   

   Refer to the exhibit. Clients are reporting an issue with the voice traffic from the branch site to the central site. What is the cause of this issue?

   • AThere is a routing loop on the network
   • BThere is a high delay on the WAN links
   • CTraffic is load-balancing over both links, causing packets to arrive out of order
   • DThe voice traffic is using the link with less available bandwidth

   Show answer

   Answer: C

   Explanation

   With routing loop I would expect no traffic to reach the destination. Traceroute shows several repeated hops but the destination is eventually reached. It also shows a delay of several ms which can be detrimental to voice traffic not so much to the other traffic. Clients are complaining about voice traffic only, therefore I go with C.

   Source: Adapted from community discussion — Horsefeathers

   References

   • cisco.com documentation

   Next question

6. Question 876 · 1003 in bank

   Which virtualization component creates VMs and performs hardware abstraction that allows multiple VMs to run at the same time?

   • Acontainer
   • BDocker
   • Chypervisor
   • Drkt

   Show answer

   Answer: C

   Explanation

   Not A: Containers are a form of lightweight virtualization that package applications and their dependencies into isolated environments called containers. Not B: Similar to containers, Docker does not create VMs or perform hardware abstraction. It orchestrates the deployment and management of containerized applications. Not D: Like Docker, rkt focuses on managing containers rather than creating VMs or performing hardware abstraction. It does not serve the role of a hypervisor.

   Source: Adapted from community discussion — slacker_at_work

   Next question

7. Question 877 · 1003 in bank

   

   Refer to the exhibit. An SSID is configured and both clients can reach their gateways on the Layer 3 switch, but they cannot communicate with each other. Which action resolves this issue?

   • ASet the WMM Policy to Allowed
   • BSet the P2P Blocking Action to Disabled
   • CSet the WMM Policy to Required
   • DSet the P2P Blocking Action to Forward-UpStream

   Show answer

   Answer: B

   Explanation

   P2P Blocking is a security feature on some wireless controllers that can be used to prevent peer-to-peer communication between wireless clients. This feature is typically used to prevent unauthorized file sharing or other unwanted network traffic. In this case, it is likely that P2P Blocking is enabled and is preventing the two clients from communicating with each other. Disabling P2P Blocking will allow the clients to communicate with each other on the Layer 2 network. This will allow them to ping each other and access any shared resources that are available on the network.

   Source: Adapted from community discussion — shefo1

   Next question

8. Question 878 · 1003 in bank

   Which network devices secure API platforms?

   • Acontent switches
   • Bweb application firewalls
   • Cnext-generation intrusion detection systems
   • DLayer 3 transit network devices

   Show answer

   Answer: B

   Explanation

   Answer is B. Cisco® Secure Web Application Firewall (WAF) and bot protection defends your online presence and ensures that website, mobile applications, and APIs are secure, protected, and “always on.” https://www.cisco.com/c/en/us/products/collateral/security/advanced-waf-bot-aag.pdf>

   Source: Adapted from community discussion — yasmiine

   References

   • Cisco documentation

   Next question

9. Question 879 · 1003 in bank

   What does Call Admission Control require the client to send in order to reserve the bandwidth?

   • ASIP flow information
   • BWi-Fi multimedia
   • CVoIP media session awareness
   • Dtraffic specification

   Show answer

   Answer: D

   Explanation

   If your phone supports CAC (this is the case with a 7925), before any call (as you punch the numbers and press the green button), the phone is going to send to the AP and Add Traffic Tream (ADDTS) request. The request contains a Traffic Classification (TCLAS) field, that basically says that this is voice 2 ways. It also contains a field called traffic specification (TSPEC) that provides all the details you need for the call: average size of packets, volume of traffic on the way up (per second), on the way down, minimum data rate needed, etc. This is what allows the AP to determine if this call can be adminteed

   Source: Adapted from community discussion — Annielover007

   Next question

10. Question 880 · 1003 in bank

    The following system log message is presented after a network administrator configures a GRE tunnel: %TUN-RECURDOWN Interface Tunnel 0 temporarily disabled due to recursive routing Why is Tunnel 0 disabled?

    • ABecause dynamic routing is not enabled.
    • BBecause the tunnel cannot reach its tunnel destination.
    • CBecause the best path to the tunnel destination is through the tunnel itself.
    • DBecause the router cannot recursively identify its egress forwarding interface.

    Show answer

    Answer: C

    Explanation

    and here the explanation to complete it https://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/22327-gre-flap.html The %TUN-5-RECURDOWN: Tunnel0 temporarily disabled due to recursive routing error message means that the generic routing encapsulation (GRE) tunnel router has discovered a recursive routing problem. This condition is usually due to one of these causes: A misconfiguration that causes the router to try to route to the tunnel destination address using the tunnel interface itself (recursive routing) A temporary instability caused by route flapping elsewhere in the network

    Source: Adapted from community discussion — XalaGyan

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 871. 1003 questions available.