Cisco Certification Exam Answers
Verified answers and clear explanations for every Cisco certification exam. Browse by exam below, or practice the full set on ExamRoll.io.
CISCO Adv. Routing Services (ENARSI) 300-410 Certification All exam questions
- 10.10.20.0/24 must be divided using VLSM to provide subnets for 120 hosts, 30 hosts, and 6 hosts. Which prefix length should be assigned to the subnet that needs to support 120 hosts?
- A branch router is configured as an EIGRP stub. What is an expected effect of configuring a router as stub?
- A branch router shows 'encap pkts' increasing in 'show crypto ipsec sa' but 'decap pkts' remains zero on the peer. Which single troubleshooting conclusion is most plausible?
- A campus deploys SSM for application distribution using groups in 232.0.0.0/8. Which two conditions must be met for native SSM operation without an RP? Choose two.
- A Cisco router is configured on an access interface with ipv6 dhcp relay destination 2001:db8::53. How does the router handle DHCPv6 Solicit messages from clients on that interface?
- A CoPP policy applied on the WAN interface for SSH causes SSH responses to stall under high utilization because SSH traffic does not match the ACL. What action resolves this?
- A CoPP policy polices inbound Telnet to 100 kbps but must not apply to traffic from 10.1.1.1 and 172.16.1.1. Which configuration set resolves the issue?
- A customer CE device advertises its routes to the service provider. Which of the following responsibilities belongs to the PE, not the CE?
- A DMVPN deployment shows spokes registered on the hub (NHRP registrations present), but spokes still forward traffic via the hub instead of forming direct spoke-to-spoke tunnels. Which two configurations are required to enable direct spoke-to-spoke routing? Choose two.
- A FlexVPN (IKEv2) site-to-site connection repeatedly fails during IKE phase 1 when the peers are configured to use certificates. The local router's crypto logs show identity verification failures. What single configuration issue is most likely causing the failure?
- A GLBP group should ensure the same client host always receives the same active virtual gateway (AVG) for session persistence. Which GLBP load-balancing mode provides that behavior?
- A host needs to join a specific source S for group G in an SSM deployment. Which IGMP message type will the host send to indicate this source-specific join?
- A host performing Duplicate Address Detection (DAD) sends a Neighbor Solicitation for a tentative IPv6 address. Which reception indicates DAD has failed and the address is duplicate?
- A network engineer configures an interface-level manual EIGRP summary on a PE router's outbound interface. What behavior will the PE router exhibit toward neighbors on that interface?
- A network receives two eBGP-learned paths to a destination. Path X has an AS path length of 3 after prepending by the remote, Path Y has AS path length 1. All other attributes equal. Which path will BGP prefer?
- A network suffers frequent SPF recalculations causing CPU spikes. Which OSPF tuning action will reduce the frequency of SPF runs by batching calculations?
- A network team must carry IPv6 traffic securely across an IPv4-only WAN. Which single design is the recommended approach to both tunnel and encrypt IPv6 traffic end-to-end on IOS/IOS XE routers?
- A pair of routers are in EIGRP named mode. One router is running 'router eigrp CORP' and has not entered address-family ipv4 unicast configuration, the other has. Both are otherwise correctly reachable. What is the most likely reason IPv4 EIGRP adjacencies do not form between them?
- A PE router receives an LDP label mapping for 10.10.10.0/24 but its FIB has no route to that prefix. What is the observed behavior on the router?
- A policy-based routing route-map contains multiple sequential clauses that could match a packet. How does the router apply those clauses?
- A policy-based routing route-map is applied inbound on an interface and matches source 10.1.1.0/24 to set the next-hop to 192.0.2.2. Which traffic is affected by this PBR?
- A provider configures a conditional advertisement so a backup prefix is advertised to a peer only when the primary prefix is withdrawn from the local routing table. Which behavior will you observe after configuring 'neighbor X advertise-map backup exist' correctly?
- A provider PE router carries multiple customer VPNs over a single physical uplink. The provider must enforce a 10 Mbps per-customer aggregate and still apply per-flow policing inside each customer. Which is the appropriate QoS architecture on the uplink interface?
- A receiver on VLAN100 joins multicast group 239.10.10.10 on a PIM sparse-mode network where an RP is configured. What PIM message does the first-hop multicast-capable router send toward the RP to build the rendezvous-point tree?
- A remote branch must enforce a 10 Mbps outbound limit but avoid dropping bursty interactive traffic. Which statement correctly describes shaping behavior that meets this requirement?
- A remote office router uses a GRE tunnel over an MPLS link. TCP sessions across the tunnel show frequent path MTU issues and fragmentation. Which single action will most directly resolve the problem without changing the physical MTU on the WAN interface?
- A route reflector (RR) reflects an iBGP-learned prefix from client A to client B, but client B cannot reach the route's next-hop. Which configuration on the RR will ensure client B receives a reachable next-hop for reflected routes?
- A route-map references access-list NON-CISCO to influence forwarding. Which two describe the resulting behavior?
- A router fails to initiate SSH sessions to other devices. Which two actions resolve the problem? (Choose two.)
- A router has a successor metric of 1000. Two feasible successors have metrics 2500 and 3200. The router is configured with variance 3. Which routes will be installed as additional successors?
- A router has two candidate BGP paths for a prefix that are identical in weight, local-pref, origin, AS path, MED, and next-hop reachability. Which tie-breaker will BGP use to choose the best path?
- A router is logging ACL denies to the console for Telnet. Which change stops console log messages but keeps the Telnet deny effective?
- A router learns 10.10.10.0/24 from both OSPF and EIGRP internal. Which route will be installed in the RIB?
- A router learns 172.16.0.0/16 via OSPF and an administrator then configures ip route 172.16.0.0 255.255.0.0 Null0 250. Which route will the router prefer for forwarding?
- A router learns 192.0.2.0/24 via an 'network' statement locally and also receives the same prefix from an eBGP neighbor. Which route will be preferred on a Cisco IOS router by default?
- A router learns a prefix from iBGP (AD 200) and from EIGRP external (AD 170). Which route will the router place in the RIB?
- A router receives an EIGRP route advertisement with an advertised distance of 1200 for a prefix whose current feasible distance is 1500. According to the feasibility condition, what is true about this route?
- A router receives multicast packets for (S,G) but its unicast routing table has no route toward S, causing an RPF check failure. By default how does the router handle those multicast packets?
- A service provider receives customer-marked DSCP values and wants to prevent customers from affecting provider QoS. What is the recommended action at the provider edge?
- A single PE router must share routes between two VRFs so hosts in VRF‑A can reach VRF‑B. Choose two.
- A site redistributes OSPF routes into EIGRP and tags them with 100. To prevent those tagged EIGRP routes from being redistributed back into OSPF, which configuration is appropriate?
- A TFTP download from the CPE's flash over Gi0/0 fails while an inbound ACL is applied. Which action resolves the transfer failure?
- A three-node Cisco DNA Center cluster was created but all services are running on a single host. What action fixes this?
- A user cannot print from their PC to the local printer id:123456789. Which Cisco DNA Center Assurance tool should be used to diagnose the problem?
- A virtual link between two ABRs remains down after configuration. One ABR has the transit area configured as an NSSA. Which statement best explains the failure?
- A VRF route learned on PE1 is not installed into the VRF on PE2 even though PE2 received a VPNv4 update. Which BGP attribute determines whether PE2 imports that route into the local VRF?
- A VRRP IPv4 group is configured with virtual router ID 10. What is the standard VRRP virtual MAC address for that group?
- AAA is configured with 'aaa authentication login default group tacacs+ local'. During a TACACS+ server outage, user logins successfully authenticate locally. What is required on the router for this fallback to work?
- After a Compact Flash upgrade on a Catalyst 6509 the SNMP interface indexes changed. Which global configuration preserves interface index values?
- After applying route-map OUT on R2 outbound to the eBGP neighbor 1.1.1.1, what is the effect on the locally originated prefix 192.168.130.0/24?
- After configuring inter-area summaries, inter-area reachability broke. Which command resolves this in a multi-area OSPF AS?
- After configuring ip summary-address eigrp 100 10.0.0.0 255.255.248.0 on R1's interface toward the branch routers, what is the immediate effect on EIGRP advertisements sent out that interface?
- After configuring VPNv4, a remote PE shows the vpnv4 route but traffic fails; 'show bgp vpnv4 unicast' shows next‑hop is PE1's loopback that is not in the core routing table. What configuration step would fix reachability from other PEs?
- After the P router removes the RD, which routing protocol does the PE use to advertise routes to the CE without redistribution or static routes?
- An ABR injects a default route into a standard stub area so routers in the area have a default to reach external destinations. What LSA type does the ABR use to advertise that default into the stub area?
- An ABR is configured with 'area 1 range 10.0.0.0 255.255.0.0' but routers in area 1 still install the component /24 routes instead of the summarized /16. What explains why the summary is not selected in routing tables?
- An access switch has ipv6 nd raguard enabled on its access ports. A workstation on an access port sends a rogue Router Advertisement advertising itself as the default gateway. What will the switch do with that RA?
- An administrator wants to prevent specific multicast groups defined in ACL BLOCK-MCAST from crossing from the DMZ into the internal network. Which IOS interface command applied to the internal-facing interface accomplishes this?
- An ASBR located inside an NSSA redistributes external routes into that area. Which OSPF LSA type will that ASBR originate within the NSSA?
- An edge router R1 learns 10.10.10.0/24 from an ISP via eBGP and advertises it to an internal iBGP neighbor R2. R2 installs the route but cannot reach the route's next-hop address. What explains the problem?
- An edge router sends Router Advertisements with the M flag set to 0 and the O flag set to 1. What behavior should hosts on that LAN exhibit?
- An egress link carries mixed TCP and UDP traffic. WRED is enabled for TCP-sensitive DSCP classes, while UDP-based streaming classes are unshaped. What outcome is expected during congestion?
- An engineer configured a GRE tunnel to carry native IPv6 between two sites but IPv6 traffic is not forwarded through the tunnel. The tunnel was created with the default command 'tunnel mode gre ip'. What single change fixes the problem?
- An engineer configured a site-to-site crypto map based policy VPN. After adding a new internal subnet behind the local router, traffic from that subnet is not traversing the VPN. Which single root cause explains this behavior for a policy-based VPN?
- An engineer configures ipv6 route 2001:db8:dead::/48 fe80::1 on a router and the static route does not get installed. Why does this static route fail to install?
- An engineer enabled MPLS with 'mpls label protocol ldp' globally on all routers but no LDP neighbors appear. Which omission is the most likely cause?
- An enterprise has high-bandwidth multicast sources and occasional receivers. To minimize PIM Register traffic across the network when sources start sending, where is the best place to locate the RP?
- An enterprise needs sub-millisecond forwarding for voice while ensuring voice cannot use more than 1 Mbps of a WAN link. Which configuration provides strict low-latency treatment and limits voice bandwidth?
- An enterprise needs to support many remote networks behind a single tunnel endpoint and wants to add or change remote subnets without reconfiguring crypto ACLs. Which VPN design best satisfies this requirement?
- An enterprise uses a BGP confederation composed of sub-AS 65010 and 65011. When routes from inside the confederation are advertised to an external eBGP neighbor, what will that external neighbor see in the AS path?
- An IPv6 network is under attack from a source not in the binding table and not learned via neighbor discovery. Which feature helps prevent this attack?
- An operator configures a LAN-facing interface as passive for EIGRP. Which immediate effect will this configuration have on that interface?
- An operator inspects the LFIB and sees an entry with action 'pop' for incoming label 16 on interface Gi0/1. What does this indicate the router will do for matching labeled packets?
- An operator plans to mitigate excessive SNMP and ICMP traffic to the router CPU. Which statement about Control Plane Policing (CoPP) is correct?
- Area 2 is attached only to area 1, and area 1 connects to backbone area 0. Will area 0 have full reachability to area 2 networks?
- AS111 wants AS200 preferred for 172.20.5.0/24 and AS100 as backup. AS100 became unused for all routes after applying the route-map. Which configuration fixes the issue?
- At which OSI boundary is an MPLS label inserted?
- BGP is being rate-limited on the control plane and causing frequent route recalculations. Which control-plane policing configuration resolves the issue?
- Choose three benefits of deploying an MPLS network.
- Choose two: Which statements correctly describe NSSA behavior?
- Choose two. An engineer must apply QoS to application flows that traverse an IPsec tunnel. Which two approaches are valid to ensure correct classification and treatment?
- Choose two. An ISP asks that certain routes not be advertised to any of your eBGP peers. Which well-known BGP communities on a received prefix will cause your router to refrain from advertising that prefix to its eBGP neighbors?
- Choose two. On an enterprise access switch, which two features are appropriate to enable to mitigate IPv6 Router Advertisement (RA) spoofing attacks?
- Choose two. Which two configuration mismatches will prevent two routers from forming an EIGRP adjacency?
- Cisco DNA Center cannot pull a device's software image directly from the device. Why is the image not uploading?
- Control Plane Policing should limit inbound SSH to 500 kbps for 10.10.10.0/24 and 192.168.10.0/24. ACL 100 currently permits ip 10.10.10.0/24 any and tcp 192.168.10.0/24 eq 23; class-map matches ACL 100; policy applied on interfaces E0/0 and E0/1. CoPP is not enforcing SSH. Which configuration fixes the problem?
- CoPP currently limits SNMP CPU traffic from 192.168.1.11 to 1000 kbps and is dropping needed SNMP. Which configuration set fixes the issue by matching the host and raising the police rate?
- CoPP failed to limit HTTP/HTTPS from 172.16.1.99 to the router CPU. Which configuration change resolves the issue? (Choose two.)
- CoPP limits routing protocol traffic to 1 Mbps and Telnet/SSH to 500 kbps. The policy-map PM-COPP uses class-maps that reference access-group 100 but no traffic is being policed and CPU is high. Which configuration resolves the issue?
- Describe the forwarding action performed by an MPLS L3 VPN egress PE for labeled packets.
- DHCP is configured so Cisco IP phones should download their configuration from a TFTP server, but phones fail to load the config. What DHCP configuration is required?
- During redistribution into OSPF you want to control the external LSA metric assigned to redistributed routes. Which route-map set clause achieves that?
- EIGRP over a multipoint interface is not forwarding traffic. Which action resolves the problem?
- EIGRP summary with leak-map was configured but the specific Loopback0 (10.1.1.1/30) is not advertised along with the summary. Which two changes fix this? (Choose two.)
- For an end device running DHCPv6 guard, what behavior applies when the device is configured as a client?
- Given AAA and a TACACS+ server-group configured on R1, which change fixes vty authentication to use the server group?
- Given output from show crypto isakmp sa during DMVPN setup, which debug command will help identify the issue?
- Given successful pings to all interfaces (including loopbacks), normal data traffic, intermittent SNMP, and slow/disconnecting SSH, which command should you run first to troubleshoot?
- Given two VRFs (Red and Blue) and a next-hop 10.1.1.1 reachable in both VRFs, which static route configuration ensures connectivity for both VRFs?
- How are routes learned from different CEs isolated on a PE router?
- How do devices operate in an MPLS L3VPN topology?
- How do you ensure a router's static default route is advertised into OSPF?
- How does an MPLS Layer 3 VPN distinguish overlapping customer IP address spaces?
- How does an MPLS Layer 3 VPN interconnect customer sites?
- How does LDP select its router ID in an MPLS network?
- How does the IPv6 DHCP Guard feature treat DHCP messages from clients and other device roles?
- How is VPN routing information controlled/distributed in an MPLS VPN?
- How many NetFlow export destinations can you configure for flow data export?
- Identify two prerequisites for establishing a DMVPN mGRE/IPsec tunnel.
- IKEv2 establishes a successful IKE SA on both routers, but 'show crypto ipsec sa' shows no child SAs and no encrypted traffic. Which single condition is the most likely cause?
- In a DMVPN single-hub using IPsec+mGRE with OSPF, what configuration on the hub ensures it becomes the OSPF designated router?
- In an Auto-RP deployment, which device role collects candidate-RP advertisements and advertises the group-to-RP mappings to all routers?
- In an enterprise using EIGRP named mode, which statement is correct about named mode behavior compared with classic mode?
- In an MPLS L3VPN hub-and-spoke IP/VPN design, what must be configured to bypass BGP AS_PATH loop prevention?
- In an MPLS VPN, how are customer routes controlled and distributed?
- In an MPLS VPN, which router type imposes and removes VPN labels at the edge?
- Interface GigabitEthernet2 is currently in VRF RED with an IP. The plan is to move it to existing VRF BLUE and retain the IP. Which configuration completes the change?
- ISE RADIUS is configured for VTY authentication with local fallback. If ISE is down, Telnet should use local admin/cisco123. Which two config changes fix the failure? (Choose two.)
- Monitoring shows interface index inconsistencies after router reloads. What fixes persistent ifIndex changes across reboots?
- Notifications are being sent reliably but are not encrypted. Which change ensures notifications are both reliable and encrypted?
- On a Catalyst 3560 where TACACS+ SSH authentication falls back to local accounts, which command fixes the TACACS source-interface?
- On a Cisco Catalyst switch with an 802.1Q trunk configured mls qos trust dscp, how will ingress frames be classified for QoS treatment?
- On a congested egress interface WRED is enabled for AF classes with three drop precedences. Which behavior is accurate for WRED operation in this scenario?
- On a DMVPN network using multipoint GRE (mGRE), spokes must encrypt traffic destined for other spokes. Which single configuration is required on spokes to apply IPsec to mGRE-based spokes-to-spokes tunnels?
- On a DMVPN spoke configured with ip mtu 1400, which command enables fragmentation and the maximum negotiated TCP MTU over GRE/IPsec?
- On a multiaccess VLAN three routers participate in OSPF: R1 priority 100, R2 priority 1, R3 priority 0. After adjacency formation which statement is correct?
- On a PIM Dense Mode domain, a branch was previously pruned and a new receiver appears that needs traffic immediately. Which PIM message causes the upstream neighbor to resume forwarding multicast down that branch without waiting for the next periodic refresh?
- On an egress interface configured with 'shape average 5000000 15000', what does the 15000 value represent?
- On DMVPN spokes migrating to IPv6 while still carrying IPv4, which tunnel mode enables both IPv4 and IPv6 DMVPN over the spoke?
- OSPF adjacency is stuck in EXSTART/EXCHANGE. Which parameter mismatch should be corrected to resolve this?
- Policy-based routing on a router sets ip next-hop 203.0.113.1 for matched traffic, but there is no route to 203.0.113.1 in the routing table. What happens to the matched packets?
- R1 and R2 have an LDP session but are not directly connected. What LDP session type is this?
- R1 must authenticate Telnet via Cisco ISE at 192.168.1.5 with shared secret Cisco123. R1 currently has radius server ISE1 and an AAA group defined as tacacs+ RAD-SERV, and aaa authentication login default group RAD-SERV. Which configuration change fixes Telnet authentication against ISE?
- R1 must block incoming BGP prefixes that are subnets of 172.16.0.0/16 with mask lengths less than or equal to /23. Which configuration on R1 accomplishes this?
- Redistribution between multiple OSPF domains caused a routing loop. Which action prevents the loop?
- Regarding DMVPN and FlexVPN, which statement is correct?
- Router A (priority 110) and Router B (priority 100) run HSRP with preempt enabled on both. Router A has 'standby 1 track GigabitEthernet0/1 decrement 20'. GigabitEthernet0/1 on Router A fails. Which router becomes active for the HSRP group?
- Router A has an EIGRP route with successor via R2 and an advertised feasible successor via R3. The link to R2 fails. Which outcome best describes DUAL behavior on Router A?
- Router R learns two external routes to the same prefix from two different neighboring ASes. Route A has MED 50 (from AS65001), Route B has MED 100 (from AS65002). Assuming default Cisco BGP behavior and no special configuration, which statement is true?
- Router_A's ip summary-address eigrp 1 172.16.80.0 255.255.240.0 isn't being advertised to Router_B. Which Router_A loopback address ensures the summary is advertised?
- Routers are receiving too many external routes and CPU spikes on low-memory devices. Which action mitigates the issue when redistributing routes?
- Select four valid fields present in an MPLS label stack entry.
- Select the Cisco First-Hop Security features supported (choose three).
- Select the two primary components required for an MPLS L3 VPN deployment.
- Select three actions to secure a router.
- Select two characteristics of MPLS labels.
- Select two correct properties of a VRF instance.
- Select two functions of MPLS Layer 3 VPNs.
- Select two purposes of configuring the IPv4 and VPNv4 address-families in an MPLS Layer 3 VPN.
- Send packets to a specific outgoing interface for any destination not present in the routing table. Which command implements this behavior?
- SNMP notifications sent with authentication and DES privacy return the error "UNKNOWNUSERNAME, WRONGDIGEST." What action resolves this?
- The console is flooded with debug output and typed commands are not visible. What command lets you see entered console commands while still viewing debug messages?
- The MPLS LDP autoconfiguration enables LDP on interfaces associated with an IGP instance. Which two IGPs support this feature?
- The network policy requires both message authentication and encryption for SNMP. Which SNMP configuration meets this requirement?
- The operations team plans to migrate the core to Segment Routing (SR‑MPLS) for LSP steering. Which legacy control‑plane protocol can be safely removed in an SR‑MPLS core for label distribution?
- To allow only devices with registered IPv6 addresses and connecting from assigned locations, which IPv6 security feature is required?
- To enable IPv6 over DMVPN using mGRE, which configuration command is required to build an IPv6 mGRE tunnel neighborship?
- To have OSPF immediately tear down an adjacency when the BFD session fails, which actions are required? Choose two.
- To prefer the non‑high‑delay ISP link (when both ISP links are up) in BGP with default attributes, which attribute should be changed?
- Troubleshooting an MPLS L3VPN shows traceroutes between CEs one hop shorter than expected; the penultimate LSR advertises implicit-null. Why does the traceroute omit the penultimate hop?
- Two customers use identical IPv4 subnets. The service provider must keep them distinct when carrying them over the MPLS core. What is the primary function of the route distinguisher in this scenario?
- Two iBGP peers advertise the same prefix into an AS. Route A has local-preference 200, Route B has local-preference 100; all other attributes equal. Which route will the local router select?
- Two OSPF neighbors exchange Hellos but never form adjacency. Router A is configured for MD5 authentication on the interface; Router B is configured with no authentication. What behavior will you observe?
- Two routers are configured as Anycast RPs sharing the same loopback address for redundancy. To ensure sources learned by one RP are advertised to the other RP so receivers can form SPTs, which additional protocol should be used between the RPs?
- Two routers on an Ethernet link repeatedly stall in ExStart/Exchange during adjacency formation after one side had its MTU changed. What is the most likely underlying cause?
- Two routers on the same Ethernet VLAN show OSPF neighbor state stuck at 2-way. Router A's interface uses the default broadcast network type; Router B's interface is configured with 'ip ospf network point-to-point'. What is the most likely cause?
- VRF-Lite: which OSPF commands create neighbors on 10.10.10.0/28 for vrf blue and 192.168.0.0/30 for vrf red?
- VRF‑lite OSPF LSAs 3,4,5,7 are not present at Site A CE connected to a PE. Which change resolves the missing LSAs?
- What advantage does enabling BFD between R1 and R2 provide?
- What are the four DHCP transaction stages represented by the acronym DORA?
- What are two benefits of using BFD?
- What are two characteristics of IPv6 Source Guard? (Choose two.)
- What are two disadvantages of mutual route redistribution between OSPF and EIGRP? (Choose two.)
- What are two functions of IPv6 Source Guard? (Choose two.)
- What data structure does IPv6 Source Guard consult to validate and forward IPv6 source addresses?
- What DMVPN NHRP configuration ensures spokes form direct spoke-to-spoke tunnels when needed and otherwise use the hub?
- What does 'downstream unsolicited' label distribution mean in MPLS?
- What does penultimate hop popping (PHP) perform?
- What function does BFD provide?
- What is an advantage of using BFD?
- What is an MPLS LDP targeted session?
- What is penultimate hop popping (PHP) in MPLS?
- What is required for deploying MPLS Layer 3 VPN services between PEs?
- What is the approximate failure-detection time provided by BFD?
- What is the function of DHCPv6 Guard?
- What is the primary advantage of deploying BFD?
- What is the primary advantage of migrating from SNMPv2 to SNMPv3?
- What is the primary role of a Provider (P) router in an MPLS network?
- What is the purpose of an OSPF sham-link in an MPLS VPN when OSPF is the PE‑CE protocol?
- What is the purpose of IPv6 snooping?
- What is the purpose of LDP on an LSR?
- What is the role of LDP in an MPLS network?
- What is the total length of an MPLS label stack entry (MPLS header)?
- What is the typical first global command to enable AAA on a Cisco router?
- What must you configure so router log message timestamps match the NTP-synchronized/local time?
- What occurs when an MPLS packet is forwarded with no outgoing label (label pop/untagged)?
- What primary function does BFD provide?
- What role does LDP perform in an MPLS network?
- What term describes loss of MPLS labels and inner VPN information when a packet traverses an untagged interface, breaking VPN connectivity?
- What two requirements must be in place to deploy L3VPN over an MPLS network?
- When Control Plane Policing causes routing protocol flaps, which action prevents flapping while still validating policy and rates?
- When designing a single-customer full‑mesh MPLS L3 VPN, what requirement applies to route targets (RTs) within that VPN?
- When initiating an LDP session to a non-directly connected MPLS router, which LDP message type does the target send back over UDP?
- When PBR uses the set ip default next-hop command and the specified next hop is not present in the routing table, how are packets handled?
- When provisioning a device in Cisco DNA Center, why does the error 'Cannot select the device. Not compatible with template' appear?
- When two LDP neighbors negotiate a session and establish the TCP connection, which neighbor becomes the active TCP opener?
- When using the BSR mechanism for RP distribution, which router component aggregates candidate-RP advertisements and distributes the RP-set to all PIM routers?
- Where is an MPLS label imposed in the OSI model?
- Which ACL and route-map configuration forces HTTP traffic from 10.1.1.0/24 to destination 10.100.100.100 to use next hop 10.2.2.2 (recursive, two hops away)?
- Which advantage does BFD provide?
- Which are valid uRPF operation modes? (Choose two.)
- Which best describes an LDP label binding?
- Which BFD parameter configures the minimum transmit interval the local system must wait before sending a control packet?
- Which BFD parameter specifies the minimum required receive spacing for control packets after a control packet arrives?
- Which BGP attribute can be used to influence the path that incoming traffic takes into your AS from other autonomous systems?
- Which BGP attribute(s) can influence the path that outgoing traffic takes from your AS to other autonomous systems? (Choose two.)
- Which characteristic applies to Layer 3 MPLS VPNs?
- Which characteristic fits a hub-and-spoke PE deployment in a Layer 3 MPLS VPN?
- Which characteristic of BFD provides rapid link-failure detection with minimal resource use?
- Which Cisco DNA Center feature allows running diagnostic CLI commands on managed devices?
- Which Cisco DNA Center feature provides system-guided and self-guided troubleshooting?
- Which Cisco DNA Center setting allows running diagnostic CLI commands on managed devices?
- Which CLI config sets the preshared key 'Test' for all remote peers in a GRE over IPsec DMVPN?
- Which command configures an EIGRP stub that advertises only connected and summary routes?
- Which command displays the IP routing table for a specific VRF?
- Which command enables load sharing for routes in an MPLS Layer 3 VPN configuration?
- Which command increases R1's local log buffer size and captures more messages at an informational level?
- Which command makes the switch include the device clock time (with timezone) in log messages so you can see the flap time?
- Which command must be configured on both spokes so two spokes can send traffic directly to each other (bypass the hub)?
- Which command prevents the router from attempting to load a startup config from TFTP during boot (fixes the tftp://255.255.255.255/... socket error)?
- Which command sequence assigns interface FastEthernet0/0 to the VRF named Inet?
- Which command sequence on R1 sets external EIGRP administrative distance to 130 while keeping internal EIGRP at its default?
- Which command shows the best path for 10.1.1.0/24 inside VRF Blue?
- Which configuration forces Telnet traffic from 10.10.1.0/24 to host 10.10.10.10 (port 23) to use next-hop 10.4.4.4?
- Which configuration limits TCP segment size on a DMVPN IPsec tunnel to avoid MTU issues and improve application performance?
- Which configuration should be used to block rogue IPv6 router advertisements instead of using IPv6 RA Guard?
- Which control-plane process allows MPLS forwarding state recovery when a secondary RP takes over from a failed primary RP?
- Which debug command should you use to verify that policy-based routing matches the intended traffic and path?
- Which describes a function of IPv6 Source Guard?
- Which device applies the VPN label to packets received from a CE before sending them into the provider core?
- Which device converts customer routes into VPNv4 routes and advertises them via MP‑BGP?
- Which DHCP options can a DHCP server provide to clients? (Choose two.)
- Which disjointness attribute excludes LFAs that share a common fiber (SRLG) with the protected path?
- Which failure-detection mechanism does BFD use?
- Which feature drops packets when the source address is not present in the snooping table?
- Which feature filters IPv6 traffic on untrusted Layer 2 ports?
- Which fields are carried in the MP-BGP OPEN message?
- Which IGPs are supported by LDP autoconfiguration?
- Which interface-level command adds an IPv4 interface into OSPFv3 process 1 under the IPv4 address family?
- Which ip nhrp registration command allows a spoke with a dynamic IP to send traffic over the DMVPN tunnel?
- Which ip verify unicast source reachable-via interface configuration prevents RPF from dropping packets when a route lookup fails even though the prefix exists in the routing table?
- Which IPv6 feature blocks traffic when the source address is not present in the device binding table?
- Which IPv6 feature helps minimize IPv6 DoS attacks on a network?
- Which IPv6 first-hop security feature helps minimize denial-of-service attacks?
- Which IPv6 switch feature blocks all host traffic on initial port connection except traffic needed to obtain an IPv6 address and perform neighbor discovery?
- Which is an advantage of deploying MPLS Layer 3 VPNs?
- Which L2 IPv6 snooping features validate the source of IPv6 traffic? (Choose two.)
- Which label operations does a label edge router perform?
- Which Layer 3 VPN attribute allows different customers to use the same MPLS core with overlapping IP ranges?
- Which Layer 3 VPN attribute causes customer routes to be installed into a VRF?
- Which list correctly defines the fields of an MPLS label?
- Which mechanism changes a router’s forwarding decision without modifying the routing table or altering the IP data plane?
- Which mechanism makes identical customer-private routes unique when advertised in VRF-based VPNs?
- Which mechanism provides faster OSPF reconvergence without the CPU cost of reducing hello and dead timers?
- Which mechanism provides traffic segmentation within a DMVPN deployment?
- Which mechanism removes the outermost MPLS label before forwarding a packet to an adjacent LER?
- Which method and multicast group does LDP use to discover neighbors on an IPv4 network?
- Which MPLS control protocol should be protected with MD5 authentication to prevent rogue LSRs from being introduced into the cloud?
- Which MPLS value is combined with an IP prefix to form a VPNv4 prefix?
- Which MPLS VPN component extends an IP address so the VPN membership can be identified?
- Which of the following are required for two OSPF routers to become neighbors? (Choose two.)
- Which of the following must be true for two EIGRP routers to become neighbors?
- Which of these are valid IPv6 RA Guard modes? (Choose two.)
- Which of these are valid TFTP error codes? (Choose two.)
- Which OSPF LSA types were introduced for IPv6 (OSPFv3) and do not apply to IPv4 OSPF? (Choose two.)
- Which OSPF neighbor state applies only to manually configured neighbors on a NBMA network?
- Which PBR configuration matches traffic to 10.10.10.0/24, forwards it to 10.1.1.1 with IP precedence 5, and sends all other traffic to 10.1.1.2 with precedence 0?
- Which ports are commonly used for RADIUS authentication and accounting? (Choose two.)
- Which prerequisite is required on BFD endpoints for BFD operation?
- Which protocol carries labeled paths between PE routers in an MPLS network?
- Which protocol resolves the NBMA (underlay) address of the remote endpoint for mGRE tunnels?
- Which protocol should be secured with MD5 authentication across the MPLS cloud to prevent insertion of bogus routers?
- Which restrictions apply when configuring Control Plane Policing (CoPP) on Cisco devices? (Choose two.)
- Which signaling protocol does MPLS use to support traffic engineering?
- Which solution best fits: simplify deployment for 100+ branches, enable branch-to-branch connectivity, be cost-effective, and provide strong encryption?
- Which statement about Bidirectional Forwarding Detection (BFD) is correct?
- Which statement about IPv6 Neighbor Discovery (ND) inspection is true?
- Which statement about IPv6 RA Guard is true?
- Which statement about route distinguishers in an MPLS network is true?
- Which statement about the IPv6 RA Guard feature is true?
- Which statement about the MPLS LDP router ID selection is correct?
- Which statement accurately describes Cisco EIGRP wide metrics?
- Which statement correctly describes BFD packet behavior?
- Which statement correctly describes IPv6 RA Guard behavior?
- Which statement describes an MPLS LSP tunnel?
- Which statements about Cisco DNA Center Path Trace are true?
- Which statements about IPsec pre-fragmentation (look-ahead fragmentation) are true? (Choose two.)
- Which statements about split horizon in IP routing are correct? (Choose two.)
- Which table maps packets in an MPLS LSP that exit the same interface, use the same next hop, and share queuing policies?
- Which tag does the PE use to forward a packet to the correct customer?
- Which TCP port does LDP use for its reliable transport connections?
- Which time keyword options are valid with the time-range command? (Choose two.)
- Which transport-layer protocol carries LDP sessions?
- Which Tunnel1 configuration on R2 establishes the GRE tunnel to R1 (use loopbacks and avoid MTU issues)?
- Which two actions are required to copy an IOS image between routers using TFTP? (Choose two.)
- Which two are control-plane protocols used inside a service-provider MPLS network?
- Which two components are required to configure an MPLS Layer 3 VPN? (Choose two.)
- Which two conditions can cause an LSP to break between two PE routers? (Choose two.)
- Which two control-plane protocols operate on P routers in the MPLS core? (Choose two.)
- Which two feature-and-router combinations are required to enable MPLS forwarding?
- Which two features describe BFD?
- Which two functions describe how the IPv6 First-Hop Security Binding Table operates? (Choose two.)
- Which two goals describe micro-BFD behavior for a link-aggregation group (LAG)?
- Which two label-distribution methods are used by MPLS routers?
- Which two measures mitigate frequent label-binding exchanges caused by a flapping link between MPLS routers? (Choose two.)
- Which two mechanisms remove the iBGP full-mesh requirement for scaling?
- Which two methods can you use to prevent redistribution loops between two routing protocols? Choose two.
- Which two NLRI attributes are carried in MP-BGP when exchanging VPNv4 routes in an MPLS Layer-3 VPN? (Choose two.)
- Which two protocols can a P router use to carry VPN traffic between PE routers in an MPLS network?
- Which two statements describe functions of LDP? (Choose two.)
- Which two technologies provide MPLS fast protection / bandwidth-preserving backup for slow-response failures? (Choose two.)
- Why are RD and VPNv4 addresses used in an MPLS L3 VPN? (Choose two.)
- With Binding Table Recovery enabled, which two devices perform recovery of missing binding table entries? (Choose two.)
- Within an MPLS VPN, what does the PE convert an IPv4 prefix into?
- Wrong default gateway was configured for the Cisco DNA Center enterprise interface during install. Which command corrects the configuration?
- You configure 'logging trap informational' on a router. Which numeric syslog severity corresponds to 'informational' and will be sent to the logging host?
- You configure 'redistribute connected route-map RM' and RM contains a clause that denies certain connected subnets. What happens to those denied connected routes?
- You configured a Flexible NetFlow flow monitor and exporter but no flow records are appearing on the collector. What additional step is required on the router to start collecting flows?
- You configured an IP SLA UDP-jitter operation targeting a remote non-Cisco server that does not run any IP SLA responder. What is the most likely outcome?
- You must redistribute only /24 prefixes inside 10.0.0.0/8 into BGP. Which configuration accomplishes this?
- You want an Embedded Event Manager applet to trigger when a specific syslog message appears. Which EEM event type should you use to match a syslog pattern?
- You want traffic to fail over to ISP-B automatically if ISP-A becomes unreachable, using IP SLA. Which configuration pattern is required?
Cisco CCNP Enterprise (ENCOR) 350-401 Certification All exam questions
- A Cisco 5520 HA cluster (SSO) and a single Catalyst 9800 have a working mobility tunnel. After the primary 5520 fails, WLAN services remain but clients cannot roam between 5520 and 9800 without dropping. Which feature must be configured to fix roaming between controllers?
- A Cisco 5520 WLC has management IP 172.16.50.5. CAP2802I APs on VLAN 100 (172.16.100.0/24) fail to join when DHCP option 43 is set as ASCII 172.16.50.5. Which action resolves the issue?
- A client cannot see the enterprise SSID while other clients remain connected. What is the cause?
- A client measures signal -67 dBm and noise floor -85 dBm. What is the SNR?
- A client roams between APs on different floors joined to the same WLC in local mode; APs are in different AP groups with different IPs but the client VLAN is unchanged. What type of roam is this?
- A client roams between mobility-peer WLCs where both controllers have dynamic interfaces on the same client VLAN. What type of roam is this?
- A corporate web-auth SSID uses ISE RADIUS and the guest VLAN must be assigned after authentication. What must be enabled so ISE can specify the guest VLAN?
- A customer moves wired infrastructure into SD-Access but does not want wireless integrated with the fabric. Which wireless deployment allows them to coexist without integration?
- A GRE tunnel shows '%TUN-RECURDOWN Interface Tunnel0 temporarily disabled due to recursive routing' — why is the tunnel disabled?
- A Linux server hosts virtual machines and provides DNS and DHCP for a small business. Which virtualization type does this describe?
- A single on-prem WLC must not be exposed to the Internet. How can RSSI updates be securely sent to Cisco DNA Spaces?
- A wireless client roams between APs on different switches in SD-Access with a single WLC involved. Which roaming method is used?
- After a redundant route processor fails, which feature allows a neighbor to forward packets using the device's most recent forwarding tables?
- After adding a new member to a StackWise stack and the previous active switch is re-elected, what action does the active switch take?
- After authenticating to the Cisco DNA Center API, what is returned to identify the authenticated session for subsequent API requests?
- After changing the ISE guest portal URL to a static FQDN, users see certificate errors. Which two steps are required to implement the FQDN correctly? (Choose two.)
- After creating ip prefix-list OFFICE seq 5 deny 172.16.0.0/16, which two additional commands are required so OSPF will not install that route? (Choose two.)
- After increasing web-access security on a WLAN controller, an engineer has IP connectivity but cannot open the controller's web management session from a browser. Which action resolves the issue?
- Allow console login to drop directly into privileged EXEC without using AAA. Which action achieves this?
- Among firewall capabilities, which feature is found only in Cisco next-generation firewalls?
- An autonomous AP configured as a Workgroup Bridge is properly set up but fails to associate to a CAPWAP AP. Which advanced WLAN setting fixes this?
- An EEM applet uses: event snmp oid 1.3.6.1.4.3.8.0.5.8.7.1.3 get-type next entry-op gt entry-val 80 poll-interval 8 — what is the effect?
- An engineer must configure HSRP for VLAN 1200 on SW1. The peer uses the last usable IP in the subnet as the virtual IP. Which command set on SW1 accomplishes this?
- An HTTP/1.1 204 No Content response is returned after curl -i -X DELETE. What occurred?
- An inbound ACL on the server-facing port must allow client 209.165.201.25 to reach web server 209.165.200.225 TCP/80. Which statement allows this?
- Apply an exec authorization method that checks a AAA server first, then local users, and denies access if both fail. Which configuration does this?
- Apply the minimal, strongest SNMPv3 configuration to allow only NMS 10.15.2.19 encrypted, password-protected read access — which configuration is correct?
- Besides over-the-air metrics, what else does the Cisco WLC Radio Resource Management (RRM) detect?
- BGP between R1 and R2 uses peer‑group CORP with MD5 authentication. R1 logs an invalid MD5 digest from 10.10.10.1 to 10.120.10.1. Which two neighbor configurations will establish the BGP session? (Choose two.)
- By default, what virtual MAC address does HSRP group 15 use?
- By default, what virtual MAC address does HSRP group 22 use?
- By default, which virtual MAC address does HSRP group 12 use?
- By default, which virtual MAC address does HSRP group 25 use?
- By default, which virtual MAC address does HSRP group 30 use?
- CAPWAP APs cannot reach the WLC even though IP connectivity is OK. What action fixes this?
- Client loses connectivity while roaming between two different wireless controllers. Which configuration error causes this?
- Compared to BasicAuth, which mechanism does OAuth introduce to strengthen REST API security?
- Compared to on-premises deployments, how do cloud deployments differ regarding user experience across regions?
- Compared to on-premises deployments, which statement is generally true about cloud deployments?
- Compared with cloud infrastructure, which advantage does on-premises infrastructure provide?
- Configure R1 to act as an IP SLA UDP responder on port 6336 for address 10.10.10.1. Which command accomplishes this?
- Contractors get a certificate error accessing the ISE guest/employee portal while employees do not. What change allows both contractors and employees to access the portal without errors?
- EIRP (Effective Isotropic Radiated Power) is based on which three components? (Choose three.)
- For a new SSID on 6 GHz radios that requires EAP-TLS authentication, which wireless Layer 2 security is required?
- For a WPA2+WPA3 Personal SSID, which encryption cipher should be configured?
- For an enterprise Wi‑Fi 6 employee SSID requiring enhanced speeds and trusted access, which two Layer 2 security policies should be used? (Choose two.)
- For devices that do not support an agent, which configuration method should you use?
- For EAP-MSCHAPv2 client authentication via RADIUS, which EAP outer method should ISE be configured to use?
- For remote branches requiring no local controller and VLAN-based local internet breakout, which deployment mode should be used?
- For VMs on a Type 1 hypervisor, which statement about IP and MAC addressing is correct?
- Given interface GigabitEthernet0/1 configured for VRRP group 115, which command set ensures this router becomes primary when it has the highest priority?
- Given requirements of FHRP redundancy, multivendor routers, and IPv4 and IPv6 hosts, which protocol fits the design?
- Given RSSI readings A: -72 dBm, B: -75 dBm, C: -65 dBm, D: -80 dBm — which two statements are correct?
- Given RSSI-based triangulation, 5 Mbps sustained per client, up to 30 clients per classroom, and primary 5 GHz coverage, which AP placement is appropriate?
- Given the ACL 'ip access-list extended STATEFUL
- Given the API response shown, what is the most likely problem?
- Given the applied EEM applet, what does the applet accomplish?
- Given the configuration 'aaa new-model' and 'aaa authentication login default local group tacacs+', what is the order of authentication checks for a login attempt?
- Given the interface configuration, what is the expected OSPF adjacency state?
- Given the log entry '%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up', what is the severity level?
- Given the log entry '%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up', what is the severity level?
- Given the loop condition 'while loop != 999:', which value will terminate the loop?
- Given the router's JSON API response, which Python snippet prints the hostname value?
- Given two images representing QoS behaviors, which statements are true? (Choose two.)
- How are API keys used for REST API authentication?
- How are EIGRP and OSPF similar?
- How can an access point discover a wireless LAN controller? (Choose two.)
- How can an engineer mitigate simple replay attacks against a REST API used for brute-force attempts?
- How do IGMP versions interoperate?
- How do TCAM entries differ architecturally from MAC address table entries?
- How do the MAC address table and TCAM differ in purpose and storage?
- How do the RIB and FIB differ in function?
- How do the RIB and FIB differ in origin and function?
- How do the RIB and FIB differ?
- How does a Type 2 hypervisor operate?
- How does a wireless LAN controller provide stateful failover for access points and client sessions?
- How does CEF differ from process switching?
- How does Cisco DNA Center enable southbound management of non-Cisco devices?
- How does Cisco Express Forwarding (CEF) switching differ from process switching on Cisco devices?
- How does Cisco TrustSec classify traffic?
- How does Cisco TrustSec provide more flexible access controls for dynamic networks and data centers?
- How does EIGRP differ from OSPF?
- How does NETCONF/YANG represent configuration and state data?
- How does Protocol Independent Multicast perform multicast forwarding?
- How does SSO integrate with HSRP to minimize network disruption?
- How does TCAM differ from CAM for forwarding lookups?
- How does the Cisco SD-Access control plane simplify routing compared with traditional designs?
- How does the EIGRP metric calculation differ from OSPF’s metric?
- How does the OAuth framework function in REST API access?
- How does the RIB differ from the FIB?
- How does traffic shaping mitigate network congestion?
- How is a JWT characterized in the context of REST API security?
- How is CAPWAP data traffic encapsulated for an Over-the-Top WLAN in Cisco SD-Access?
- How is MSDP used to connect multiple PIM-SM domains?
- How is the data-plane tunnel health monitored in a Cisco SD-WAN deployment?
- Identify two common sources of Wi‑Fi RF interference.
- If a FlexConnect branch loses controller connectivity, which state denies new client authentication but keeps already connected clients active?
- If a wireless controller uses LAG to the switch, which EtherChannel mode must the switch use for the WLC to connect?
- If an EBGP neighbor is in the Active state, which statement about the local router is true?
- If an endpoint lacks an 802.1X supplicant, which mechanism can enforce AAA-based network access authentication?
- If Cisco DNA Center loses connectivity to devices in an SD-Access fabric, which two outcomes occur?
- If global TPC maximum transmit power for 802.11a/n/ac is set to 10 dBm, which configured power level approximately doubles the transmit power?
- If multiple WLCs resolve CISCO-CAPWAP-CONTROLLER.localdomain, what does the LAP send during CAPWAP discovery?
- If the noise floor is -90 dBm and the client receives -75 dBm, what is the SNR (dB)?
- If the VRRP master fails, which router becomes the new master?
- In a Cisco SD-Access fabric, what function does a fabric access point perform?
- In a Cisco SD-Access wireless fabric, which device hosts the anycast gateway?
- In a Cisco SDN architecture, which API describes controller-to-network-element communication?
- In a dual-stack network with two dual-stack NetFlow collectors, how many flow exporters are required per device in a Flexible NetFlow configuration?
- In a fabric-enabled SSID, how is 802.11 user traffic handled?
- In a GLBP group whose member routers have differing throughput/capacity, which GLBP load-balancing method accommodates unequal member weights?
- In a LISP architecture, which device receives map-requests and determines the appropriate ETR for the requested mapping?
- In a Mobility Express deployment, how are control/authentication traffic and data forwarding handled?
- In a Mobility Express deployment, where is the wireless LAN controller located?
- In a PIM Sparse Mode network, which device must a new multicast server register with before its traffic is propagated?
- In a StackWise Virtual pair, which planes are combined into the common logical switch?
- In a three-tier campus design, which action is a core-layer best practice?
- In a VXLAN deployment, what is the primary function of a VXLAN Tunnel Endpoint (VTEP)?
- In an EID-to-RLOC mapping, what does the weight attribute specify?
- In an NSF with SSO design, what happens when the active route processor fails?
- In an SD-Access deployment, what primary role does Cisco DNA Center perform?
- In an SDN architecture, what function does a northbound API provide?
- In Cisco DNA Center Plug and Play, what does an 'unclaimed' device indicate?
- In Cisco DNA Center, what is the integration API (westbound)?
- In Cisco DNA Center, where is API documentation organized by functional area?
- In Cisco DNA Center, which feature creates reusable configuration templates applicable to devices with similar settings?
- In Cisco DNA Center, which interface is used to publish events and notifications to third-party tools such as IPAM?
- In Cisco SD-Access wireless, when a client roams between APs on different access switches managed by a single WLC, which roaming method is used?
- In Cisco SD-Access wireless, where is radio resource management (RRM) executed?
- In Cisco SD-Access wireless, which device serves as the fabric entry and exit point?
- In Cisco SD-Access, VXLAN provides which function?
- In Cisco SD-Access, what is the primary role of a border node?
- In Cisco SD-Access, what is the primary role of a Fabric Edge node?
- In Cisco SD-Access, what role does the Identity Services Engine perform?
- In Cisco SD-Access, which protocol does an extended node use to connect to a single edge node?
- In Cisco SD-Access, which protocol provides the data-plane encapsulation between fabric nodes?
- In Cisco SD-WAN, what does a data policy define?
- In Cisco SD-WAN, what does a VPN represent?
- In Cisco SD-WAN, what is the centralized control policy?
- In Cisco SD-WAN, which two functions does OMP perform? (Choose two.)
- In LISP, which component decapsulates messages and forwards them to the map server that handles egress tunnel routers?
- In LISP, which device receives and decapsulates LISP-encapsulated packets for endpoints inside a LISP site?
- In policy-based routing, how is traffic that matches a route-map 'deny' clause handled?
- In SD-Access with fabric-enabled wireless, how are control plane and data plane traffic forwarded?
- In SD-Access, what is the role of a fabric edge node?
- In the Cisco DNA Center GUI, which section manages software image operations?
- In the Cisco DNA Center Image Repository, what is a "golden image"?
- In VXLAN, what does the destination MAC in the outer Ethernet header identify?
- Increasing an AP's transmit power from 25 mW to 100 mW produces what change in dBm?
- Interpret this EEM event: 'event snmp oid 1.3.6.1.3.7.6.5.3.9.3.8.7 get-type next entry-op gt entry-val 75 poll-interval 5' — what does it do?
- Interpreting the Cisco DNA REST response, what does it indicate about device access?
- Log shows active router virtual IP 10.1.1.1 differs from locally configured 10.1.1.25. What configuration change is required?
- On a Catalyst chassis with two supervisor modules, which feature lets you remove the active supervisor without disrupting forwarding?
- On a Cisco 5520 WLC with one web-auth SSID, which command sets the virtual interface to the nonroutable IP 192.0.2.1?
- On a Cisco 9800 wireless LAN controller, an engineer must create a new SSID and configure authentication using a pre-shared key. Which controller profile should be edited?
- On interface GigabitEthernet0/0 (ip 172.16.13.2/24), configure VRRP group 10 so this router becomes master when it has the highest priority. Which command set should be added?
- On interface GigabitEthernet1/0/0 (ip 172.16.13.2/24), configure VRRP group 5 so this router becomes master when it has the highest priority. Which commands should be added?
- One AP will cover a square office from a central location. Which antenna type provides even 360° coverage for this placement?
- Recommended minimum SNR (dB) for wireless data applications?
- Regarding Ansible for network automation, which statements are true? (Choose two.)
- Regarding RESTCONF writes to devices, which statement about TLS is correct?
- Select prerequisites for deploying LISP. (Choose two.)
- Select two accurate descriptions of vManage APIs.
- Select two benefits of choosing a cloud deployment over on-premises:
- Select two benefits of implementing a traditional WAN instead of an SD-WAN solution.
- Select two differences between OSPF and EIGRP.
- Select two properties of a directional antenna.
- Site adjacent to a large airport experiences frequent 5 GHz channel changes due to radar. Which two actions address radar-triggered channel switching?
- Syslog reports host 0054.3962.7651 in VLAN 14 flapping between Gi1/0/1 and Gi1/0/2. What is causing the problem?
- To block ransomware at the execution stage and prevent file encryption, which solution should be used?
- To configure NetFlow when you already have source IP, destination IP, source port, and destination port, which additional fields are required? (Choose three.)
- To locate and track malicious devices by threat signatures in a multi-tenant wireless deployment monitored by Cisco DNA Center, which feature is required?
- To make this router the active HSRP for group 300 when the peer uses the default priority, which command set is required?
- To support an SSID that uses 802.11r and requires a passphrase, what must be configured?
- Two routers are directly connected via Gig0/0 over a 1 Gbps link. Which 'ip ospf network' setting on both interfaces forms an adjacency without DR/BDR election?
- Two WLCs are mobility peers. A client roams from AP1 on WLC1 to AP2 on WLC2 and the controllers use different VLANs. How is the client's entry handled for inter-subnet roaming?
- Two WLCs manage separate APs and advertise the same SSID on different interfaces; users lose connectivity and change IPs when roaming. What fixes this?
- Under which condition does a Cisco StackWise primary switch lose its primary role?
- Users experience brief wireless disconnects; AP logs show repeated "AP is down. Reason: Radio channel set." The client re-associates automatically. What reduces user impact?
- Using TLS for syslog, which logging host command sends syslog securely to the TLS default port?
- VLAN 10 must be allowed only on SW1 and SW2, but VLAN 10 appeared on SW3. Which configuration fixes this?
- What access control behavior does MAC Authentication Bypass (MAB) provide?
- What advantage do data models provide in a multivendor network environment?
- What advantage do YANG modules provide?
- What are key differences between HSRPv1 and HSRPv2? (Choose two.)
- What are the core components of Cisco TrustSec?
- What are the four DHCP lease transaction stages?
- What are two benefits of implementing Cisco SD-WAN? (Choose two.)
- What are two considerations when using SSO for supervisor redundancy? (Choose two.)
- What are two correct distinctions between the RIB and the FIB? (Choose two.)
- What benefit does Stateful Switchover (SSO) provide?
- What capability does Cisco DNA Center Assurance provide?
- What capability does WLC Layer 3 roaming provide for wireless clients?
- What command shows the best path for 10.2.1.0/24 in VRF Green?
- What components are required to run a virtual machine?
- What defines a Type 1 hypervisor?
- What distinguishes Chef from Ansible in automation architecture?
- What do Cisco DNA southbound APIs provide?
- What does a TLOC represent in a Cisco SD-WAN deployment?
- What does a YANG model define?
- What does an asterisk (*) next to the date in device log entries indicate?
- What does Received Signal Strength Indicator (RSSI) represent?
- What does the Cisco DNA Center Authentication API return?
- What does the numeric NTP stratum level indicate?
- What does the Stealthwatch component of Cisco Cyber Threat Defense provide?
- What does vManage use to communicate with Cisco SD-WAN devices in the fabric?
- What function does a fusion router provide in an SD-Access solution?
- What function does the control-plane node provide in a Cisco SD-Access fabric?
- What is a characteristic of a Type 2 hypervisor?
- What is a characteristic of Cisco DNA Center and vManage northbound APIs?
- What is a key benefit of adopting a data modeling language?
- What is a primary benefit of YANG-style data modeling languages?
- What is a primary function of the RP in PIM?
- What is an OVF?
- What is modularity in network design?
- What is one benefit of adopting a data modeling language for network management?
- What is one difference between SaltStack and Ansible?
- What is one function of a VXLAN VTEP?
- What is required on a managed node for Ansible to connect and manage it?
- What is stateful switchover?
- What is the BGP path-attribute preference order from most preferred to least preferred used by the best-path algorithm?
- What is the default HSRP virtual MAC address for HSRP group 16?
- What is the default virtual MAC address used by HSRP group 32?
- What is the outcome of this Python snippet: client.connect(ip, port=22, username=usr, password=pswd); stdin, stdout, stderr = client.exec_command('show ip bgp 192.168.101.0 bestpath\n'); print(stdout)?
- What is the output of print(format(0.8, '.0%'))?
- What is the primary purpose of a data modeling language?
- What is the primary role of the vSmart controller in Cisco SD-WAN?
- What is the process that moves a virtual machine between hosts with no downtime?
- What is the purpose of a data modeling language?
- What is the purpose of data modeling languages?
- What is the purpose of LISP's routing and addressing architecture?
- What is the purpose of YANG?
- What is the recommended minimum SNR for voice over wireless?
- What is the role of a fabric border node in Cisco SD-Access?
- What is the role of a fabric wireless LAN controller in an SD-Access deployment?
- What is the role of a secondary wireless LAN controller?
- What is the role of a VTEP in VXLAN?
- What is the role of the fabric control-plane node in Cisco SD-Access?
- What is the RP's role in PIM Sparse Mode?
- What is the structure of a JSON Web Token?
- What is vBond’s role in a Cisco SD-WAN deployment?
- What is YANG's primary purpose in network management?
- What maintains Layer 2 isolation between segments in a VXLAN environment?
- What mechanism on an egress interface can prioritize database traffic from an ingress interface without altering the CoS value?
- What MTU size is recommended for a Cisco SD-Access fabric?
- What must a client send for Call Admission Control to reserve bandwidth?
- What NTP metric indicates how close a server is to the authoritative time source?
- What occurs when HSRP is changed from version 1 to version 2?
- What role does a Cisco SD-Access extended node serve?
- What role does vSmart perform in a Cisco SD-WAN deployment?
- What role does vSmart perform in Cisco SD‑WAN?
- What task does the vSmart controller perform in a Cisco SD-WAN deployment?
- What type of roaming occurs when a client moves between different mobility groups?
- When a FlexConnect AP switches to standalone mode, which behavior occurs?
- When a POST to /dna/intent/api/v1/template-programmer/project returns HTTP 404, what does that status mean?
- When a switch with dual route processors using stateful switchover (SSO) loses the primary RP, which two conditions occur?
- When calculating EIRP, which parameter is subtracted from the transmitter power?
- When Cisco DNA Center deploys an IP-based access control policy, which devices are configured?
- When configuring Local WebAuth on a Cisco WLC per RFC 5737, which virtual IP must be used?
- When designing with BFD, which consideration is true?
- When is an outbound QoS policy applied on a router WAN interface most beneficial?
- When is GLBP preferred over HSRP?
- When is the Design workflow used in Cisco DNA Center?
- When should MAC authentication bypass be used on a switch port?
- When should you deploy an external AP antenna indoors?
- When terminal logging output interrupts command entry, which two actions minimize the chance of typing commands incorrectly?
- When two Cisco switches are stacked with StackWise and operate as one logical switch, which two planes are combined? (Choose two.)
- When using Cisco DNA Center Design workflow to create a network, how is the physical device hierarchy organized?
- When using VXLAN encapsulation in SD-Access, what is the minimum MTU devices should be configured with?
- When Web Policy 'Authentication' is chosen under Layer 3 Security for a WLAN, which device serves the web authentication portal to clients?
- When will Cisco DNA Center apply changes to a network device?
- When you configure a random 1-out-of-100 sampler on an interface for Flexible NetFlow, which two results occur compared to traditional NetFlow?
- Where in an HTTP message is the Content-Type specified?
- Which A-record name should ONS provide so APs resolve the wireless LAN controller IP?
- Which aaa command configures R1 to use RADIUS for logins and fall back to the local user database if RADIUS is unavailable?
- Which AAA command validates users against the local router database to authorize execution of configuration (exec) commands?
- Which AAA commands configure console login to authenticate over the network via RADIUS?
- Which AAA configuration allows console access to be authenticated by a network server and supports command authorization?
- Which access point mode forwards client data out the AP's local switch port?
- Which ACL entry permits TCP packets that include the ACK flag?
- Which ACL implements: allow TCP ports 20–110 but drop telnet (port 23)?
- Which ACL sequence permits only TCP destination ports 22–443 while excluding port 80?
- Which action is required to prevent API injection attacks?
- Which action is the vSmart controller responsible for in an SD-WAN deployment?
- Which action occurs during a Layer 3 roam?
- Which additional security component must be configured for WPA2-Enterprise on a WLAN?
- Which advantage does a Type 2 hypervisor provide compared with a Type 1 hypervisor?
- Which advantage does cloud infrastructure provide that on-premises typically lacks?
- Which advantage is associated with on-premises infrastructure compared to cloud deployment?
- Which algorithm does the IOS 'enable secret' option use to protect the device password?
- Which algorithms are used to harden password handling against brute-force attacks for REST APIs?
- Which antenna type is appropriate for a site-to-site wireless connection?
- Which antenna type provides a 360-degree radiation pattern?
- Which AP mode allows APs to register to a WLC so the controller centrally switches traffic?
- Which AP mode enables scanning configured channels for rogue access points?
- Which AP mode lets the AP act like a WLAN client to associate and help diagnose client connectivity issues?
- Which are advantages of deploying an on-premises (premise-based) data center versus a cloud-based deployment? (Choose two.)
- Which are benefits of implementing Cisco DNA Center? (Choose all that apply.)
- Which are benefits of implementing VXLAN in a network? (Choose two.)
- Which authorization framework provides limited third-party access to HTTP services?
- Which behavior describes a WLC running in master controller mode?
- Which behavior describes traffic shaping?
- Which benefit does a virtual machine provide compared with a physical server?
- Which benefit does MACsec provide in a multilayer LAN design?
- Which benefit does TrustSec segmentation provide?
- Which calculation measures the radiated power after the radio, antenna cable, and antenna?
- Which campus design supports migrating from a traditional campus to a programmable fabric?
- Which capability do EIGRP and OSPF share?
- Which capability does a distributed virtual switch provide?
- Which capability does Cisco Advanced Malware Protection (AMP) for Endpoints provide?
- Which capability does the Cisco Mobility Services Engine provide in a Wireless Unified Network?
- Which capability is provided by a distributed virtual switch?
- Which capability is provided by the Cisco DNA Center southbound API?
- Which capability is supported by EIGRP but not by OSPF?
- Which CAPWAP deployment model provides local controller management suitable for small branches?
- Which change to the script's first line fixes the import error?
- Which character encoding is required for DHCP Option 43 for current AP models?
- Which characteristic applies to a traditional WAN but not to a Cisco SD-WAN solution?
- Which characteristic applies to the endpoint security component of Cisco Threat Defense?
- Which characteristic describes a Type 2 hypervisor?
- Which characteristic describes Cisco DNA Center northbound APIs?
- Which characteristic describes Cisco SD-WAN?
- Which characteristic describes Cisco StackWise technology?
- Which characteristic describes traditional WAN deployments but not Cisco SD-WAN?
- Which characteristic describes vManage?
- Which characteristic describes VXLAN?
- Which characteristic is shared by Ansible and Chef?
- Which Cisco Cyber Threat Defense component provides user and flow context analysis?
- Which Cisco DNA Center API retrieves image information?
- Which Cisco DNA Center application enforces group-based access control policies?
- Which Cisco DNA Center Assurance feature verifies host reachability?
- Which Cisco DNA Center capability enables application delivery across the network and produces analytics?
- Which Cisco DNA Center template type groups multiple templates to run in sequence?
- Which Cisco FlexConnect state lets wireless clients continue operating when the controller connection is lost?
- Which Cisco NGFW deployment option provides scalability?
- Which Cisco SD-WAN component authenticates the routers and the vSmart controllers?
- Which Cisco SD-WAN component performs the orchestration function?
- Which Cisco SD-WAN component provides centralized management, monitoring, and configuration (single pane of glass)?
- Which Cisco SD-WAN controller can act as a STUN server during Edge device onboarding?
- Which Cisco SD-WAN controller provides the single plane of management?
- Which Cisco WLC feature lets a client perform a Layer 3 roam between controllers without changing the client IP address?
- Which client-access method requires user authentication and can operate without link-layer encryption?
- Which command prevents R1 from sending OSPF hello packets on interface GigabitEthernet0/0?
- Which command sequence creates Loopback0 with address 172.22.2.1/24 and advertises it in OSPF?
- Which command-line tool is used to consume REST APIs?
- Which commands on the core switch generate a certificate signing request (CSR) to obtain a corporate CA–signed certificate for HTTPS access?
- Which component determines whether a wired client is allowed access when connecting to an SD-Access edge switch?
- Which component does Cisco Threat Defense use to measure bandwidth, application performance, and utilization?
- Which component forwards traffic between guest VMs on the same host?
- Which component is specific to a Type 2 hypervisor?
- Which configuration enables Telnet access to RouterX using the router username/password database for authentication?
- Which configuration helps prevent over-the-shoulder disclosure of VTY passwords?
- Which configuration makes SW4 the root bridge for VLAN 1 and forces SW2 interface G0/2 into a blocking state?
- Which configuration protects VTY line passwords from over-the-shoulder exposure?
- Which consideration applies when designing the Cisco SD-Access underlay network?
- Which control most effectively mitigates a man-in-the-middle attack against a REST API?
- Which control-plane protocol do Cisco SD-WAN routers use to communicate with vSmart controllers?
- Which control-plane protocol does an SD-Access fabric use for endpoint mapping and resolution?
- Which credential mechanism does OAuth 2.0 use for REST API authentication?
- Which definition matches a Type 2 hypervisor?
- Which describes Cisco DNA southbound APIs?
- Which device finds EID-to-RLOC mappings when sending traffic to a LISP-enabled site?
- Which device in an SD-Access wireless fabric maintains endpoint-ID to edge-node bindings?
- Which device makes the roaming decision for a wireless client?
- Which device roles are valid in a Cisco SD-Access fabric architecture? (Choose three.)
- Which devices from the list can be part of a Cisco SD‑WAN solution? (Choose two.)
- Which DHCP option helps lightweight APs discover the IP address of a WLC?
- Which DHCP option must be used so Cisco Aironet 2800 APs can register to a WLC with an IPv6 management address?
- Which DHCP option supplies CAPWAP APs with the wireless controller address?
- Which DHCP option, dependent on the AP VCI, returns at least one WLAN management IP during discovery?
- Which DNS A-record hostname must point to a new AireOS WLC so CAPWAP APs can discover it?
- Which DNS hostname does an access point query for CAPWAP controller discovery?
- Which DNS record type is required to allow APs to discover a WLC using DNS over IPv4?
- Which EEM action sends a syslog message for the applet below? event manager applet LogMessage event routing network 172.30.197.0/24 type all
- Which EEM applet action writes text directly to the active console synchronously?
- Which EEM applet enables OSPF debugging when an OSPF neighborship goes down?
- Which EEM applet syntax registers an applet that can be executed on demand (manual invocation)?
- Which EIGRP feature is not supported by OSPF?
- Which EIGRP K-values are set to zero by default? (Choose three.)
- Which emulated system has dedicated CPU, memory, storage, and a full operating system installed?
- Which encoding is used for HTTP Basic (username:password) authentication in RESTful APIs?
- Which enhancement was introduced with Wi‑Fi 6?
- Which feature enables Layer 2 client roaming across wireless controllers?
- Which feature must be configured to allow packet capture over a Layer 3 infrastructure?
- Which features are typically found only in Next-Generation firewalls? (Choose two.)
- Which features does Cisco EDR use for threat detection and response?
- Which field is carried in the VXLAN header?
- Which fields make up a JSON Web Token (JWT)? (Choose three.)
- Which First Hop Redundancy Protocol best meets multi-vendor, dual-stack (IPv4/IPv6) deployment requirements?
- Which First Hop Redundancy Protocol maximizes uplink utilization while minimizing configuration?
- Which First Hop Redundancy Protocol optimizes default-gateway bandwidth usage across multiple devices?
- Which Flexible NetFlow configuration exports a flow when it is idle for 20 seconds to avoid overloading the flow collector?
- Which FQDN must be resolvable for APs to use DNS to locate and register to their WLC?
- Which free tool can make REST calls to Cisco DNA Center?
- Which function does a LISP Ingress Tunnel Router (ITR) perform?
- Which function does a virtual switch perform?
- Which function does an SD-Access fabric edge node perform?
- Which function does Link Management Protocol (LMP) perform in a StackWise Virtual domain?
- Which function does vSmart perform in the Cisco SD-WAN architecture?
- Which function is performed by vManage in a Cisco SD‑WAN fabric?
- Which hashing algorithm does NTP use for authentication?
- Which HTTP status code indicates authentication failure (incorrect password) for a REST API request?
- Which hypervisor type runs on a host OS and cannot access hardware directly?
- Which IEEE standard permits or denies network connectivity based on user or device identity?
- Which IOS queuing method uses four fixed/static queues for congestion handling?
- Which IP SLA configuration sets up a multicast UDP jitter operation?
- Which IP SLA operation requires an IP SLA responder on the remote endpoint?
- Which ip sla responder command configures the router as the destination for jitter measurements?
- Which IPv4 header field carries the IP QoS classification marking?
- Which is a characteristic of a next-generation firewall?
- Which is a core REST security design principle?
- Which is a primary REST security design principle?
- Which is a valid method to secure a REST API?
- Which JSON object sent in HTTP requests authenticates a client?
- Which JSON syntax below is valid?
- Which language defines the data modeling structure used by NETCONF and RESTCONF?
- Which Layer 2 security mode must be configured with Cisco ISE to allow a single SSID to authenticate IoT devices using distinct passwords?
- Which Layer 2 WLAN mode on a Cisco WLC allows passphrase entry and provides forward secrecy?
- Which layer sequence correctly represents a Type‑1 (bare‑metal) hypervisor deployment?
- Which layer/interface in Cisco DNA Center exposes REST controls?
- Which LISP component accepts traffic from non-LISP sites destined for LISP sites to provide connectivity?
- Which LISP component enables a LISP site to communicate with a non-LISP site?
- Which LISP device publishes EID-to-RLOC mappings for a site?
- Which LISP device receives packets from remote-site-facing devices and either decapsulates LISP packets or routes them natively?
- Which listed product is a Type 1 hypervisor?
- Which local configuration provides the strongest password authentication on a router?
- Which logging configuration filters out DOT1X messages like '%DOT1X-5-FAIL:Authentication failed for client ...' from being sent to syslog host 10.15.20.33?
- Which logging host command meets these requirements: syslog server 10.10.10.1, use a reliable protocol, and avoid well-known TCP/UDP ports?
- Which mechanism enforces AAA network access when an endpoint lacks an 802.1X supplicant?
- Which mechanism provides stateless authentication and authorization for REST API calls?
- Which mechanisms can be used to secure NTP? (Choose two.)
- Which method ensures confidentiality of data exchanged over a REST API in transit?
- Which metric is calculated from transmitter power level, cable loss, and antenna gain?
- Which mismatch can cause an OSPF neighbor to remain in EXSTART/EXCHANGE?
- Which monitor session command captures only outbound (tx) VLAN 3 traffic on GigabitEthernet0/3 while ignoring other VLANs?
- Which multicast mode sends a prune to the source when there are no local members or downstream neighbors?
- Which ncclient manager call prevents others from modifying the device while a script runs?
- Which NetFlow version/type does Cisco Threat Defense use for network visibility?
- Which network device is used to protect API platforms?
- Which next-generation firewall mode actively blocks flows traversing the firewall?
- Which NTP concept indicates the distance from a device to its authoritative time source?
- Which NTP mode must be enabled when a Cisco router is used as an authoritative NTP server?
- Which NTP Stratum is a server directly connected to an authoritative time source?
- Which of the following are examples of Type-2 hypervisors? (Choose three.)
- Which of the following are valid Cisco Express Forwarding (CEF) operation modes? (Choose two.)
- Which of these are valid PAgP channel negotiation modes? (Choose two.)
- Which OSPF LSA type points to the ASBR?
- Which outbound ACL applied to the WAN interface permits all traffic except HTTP sourced from 10.10.10.1?
- Which packet field is used for QoS classification?
- Which PAgP mode combination will prevent an EtherChannel from forming?
- Which pair of OSPF network types are compatible and will allow adjacency between two peers?
- Which policy feature is used with TrustSec to provide endpoint entitlement?
- Which post‑survey measurement best represents an AP's cell edge?
- Which protocol encrypts control-plane traffic between SD-WAN controllers and SD-WAN endpoints?
- Which protocol forms the Cisco SD-Access fabric data plane?
- Which protocol is used in Cisco SD-WAN to measure link quality?
- Which protocol is used to secure control-plane adjacencies between Cisco SD-WAN nodes?
- Which protocol protects Cisco SD‑WAN control-plane communication?
- Which protocol secures the REST API communication channel?
- Which protocol's use implies a YANG data model is employed?
- Which purpose describes an integration API in Cisco DNA Center?
- Which Python code prints the value of the "upTime" key from the JSON response?
- Which Python json call serializes the Devices object to a JSON-formatted string?
- Which Python library is used to work with YANG data models via NETCONF?
- Which QoS function modifies packet headers to influence how traffic is treated?
- Which QoS function uses the IP Precedence bits in the IP ToS field to separate traffic into priority levels?
- Which QoS mechanism enables creating multiple hierarchical levels of policy for finer-grained traffic management?
- Which QoS mechanism identifies traffic flows and uses DSCP, IP precedence, and MPLS EXP to assign priority levels?
- Which QoS mechanism lets an administrator enforce a maximum traffic rate on an interface?
- Which QoS queuing method transmits packets strictly in the order they arrive?
- Which queuing feature enforces strict-priority servicing for voice/video traffic?
- Which resource can be shared by multiple virtual machines on the same physical host?
- Which resource must a hypervisor allocate to its virtual machines?
- Which resource must a hypervisor expose to its virtual machines?
- Which resource must a hypervisor provide to virtual machines?
- Which REST security principle requires validating access to every resource and not relying on cached permissions?
- Which RESTCONF HTTP method corresponds to NETCONF `<edit-config>` operation="create"?
- Which return statement produces the JSON object {"cat_9k": "FXS1932Q2SE"}?
- Which router becomes the IGMP Querier when multiple routers share a LAN segment?
- Which SD-Access feature forwards ARP, broadcast, and link-local frames across the fabric so silent hosts can receive traffic and begin communicating?
- Which security design principle enforces that access is denied by default unless explicitly permitted?
- Which security measure prevents credential capture in basic API authentication?
- Which signal strength and noise pair meets the minimum SNR for voice networks?
- Which solution simplifies management of secure access to network resources?
- Which standard ACE permits traffic from odd-numbered hosts in 10.0.0.0/24?
- Which statement about a fabric access point is correct?
- Which statement about Cisco EAP-FAST is correct?
- Which statement about Cisco Express Forwarding (CEF) is correct?
- Which statement about configuring an RSPAN session is true?
- Which statement about multicast Rendezvous Points (RPs) is correct?
- Which statement about route targets when using VRF-Lite is true?
- Which statement about SD-Access wireless deployments is true?
- Which statement about the northbound APIs of Cisco DNA Center and vManage is correct?
- Which statement about VXLAN is correct?
- Which statement about Wi‑Fi channels is correct?
- Which statement accurately contrasts agent-based and agentless configuration management tools?
- Which statement best describes a type 2 hypervisor?
- Which statement correctly contrasts EIGRP and OSPF?
- Which statement correctly describes a virtual machine?
- Which statement correctly describes a YANG characteristic?
- Which statement correctly describes how PIM forwards multicast traffic?
- Which statement correctly describes Layer 3 roaming?
- Which statement correctly describes MACsec?
- Which statement correctly describes the role of a LISP map resolver?
- Which statement correctly describes traffic shaping?
- Which statement correctly describes VXLAN?
- Which statement correctly differentiates OSPF and EIGRP?
- Which statement correctly distinguishes TCAM from the MAC address table?
- Which statement describes a characteristic of the Cisco SD-Access control plane?
- Which statement describes a difference between SaltStack and Ansible?
- Which statement describes a key operational difference between Ansible and Chef?
- Which statement describes a Type 1 hypervisor?
- Which statement describes a virtual machine's characteristic?
- Which statement describes an AP operating in FlexConnect mode?
- Which statement describes paravirtualization?
- Which statement describes the Cisco DNA Center Template Editor?
- Which statement describes the overlay network in the Cisco SD-Access architecture?
- Which statements about the Link Management Protocol (LMP) used with StackWise Virtual are true? (Choose two.)
- Which statements about using Bidirectional Forwarding Detection (BFD) in Cisco SD‑WAN are true?
- Which statements about VRRP are correct? (Choose two.)
- Which statements are used for error handling in Python?
- Which statements are valid regarding Nonstop Forwarding (NSF) with Stateful Switchover (SSO)? (Choose two.)
- Which stratum level is directly connected to an authoritative time source?
- Which switch configuration enforces password-only authentication for all remote protocols and disconnects idle sessions after 30 minutes?
- Which task requires using the Cisco DNA Center CLI?
- Which TCP parameter is adjusted to reduce fragmentation risk over a GRE/IP tunnel?
- Which TCP-related term defines the maximum packet size a host interface can accept on ingress?
- Which technique isolates and analyzes unknown files by executing them in a controlled environment to protect endpoints and data?
- Which technology allows a standby supervisor to assume control when the primary supervisor fails?
- Which technology creates an overlay to connect remote sites over commodity links while improving performance, security, and reducing cost?
- Which technology do IaaS providers use to stretch a Layer 2 segment across a Layer 3 network?
- Which technology provides a secure channel for all Layer 2 traffic on a link?
- Which technology provides logical Layer 2 and Layer 3 networks in Cisco SD-Access?
- Which technology reduces reliance on STP and transports both unicast and multicast traffic in modern data-center overlays?
- Which technology underpins the Cisco SD-Access data plane?
- Which technology uses network traffic telemetry, contextual information, and file reputation to provide insight into cyber threats?
- Which three factors determine Wi‑Fi air time efficiency?
- Which three layers make up the traditional three-tier enterprise network design?
- Which three methods can Cisco DNA Center use to discover devices?
- Which three resources must a hypervisor present to guest virtual machines? (Choose three.)
- Which three route types does OMP advertise between vSmart and SD-WAN edge devices?
- Which time synchronization protocol includes security extensions and uses site-local IPv6 multicast addresses?
- Which TLV value must be included in DHCP Option 43 to ensure APs join the WLC?
- Which trait is shared by both Chef and Ansible?
- Which transport/port must be permitted so APs can join a WLC when directed broadcasts are used on a Cisco IOS switch?
- Which TrustSec feature supplies scalable, secure communication by assigning tags?
- Which tunnel type allows seamless Layer 3 client roam between a Cisco AireOS WLC and a Cisco IOS XE WLC?
- Which tunnel type between two WLCs is required to support inter-controller roaming?
- Which tunnel type enables seamless Layer 3 client roaming between a Cisco AireOS WLC and a Cisco IOS XE WLC?
- Which two actions reduce an AP's coverage area?
- Which two advanced security capabilities do next-generation firewalls provide that standard firewalls did not?
- Which two AP operational modes can scan channels for rogue APs while still serving client traffic? (Choose two.)
- Which two are benefits of virtual switching versus hardware switching? (Choose two.)
- Which two are benefits provided by YANG? (Choose two.)
- Which two are best practices when designing a campus Layer 3 infrastructure? (Choose two.)
- Which two attributes describe Cisco DNA Center's Intent API? (Choose two.)
- Which two benefits does BFD provide for failure detection? (Choose two.)
- Which two benefits does Cisco TrustSec provide?
- Which two benefits result from server virtualization using VMs in a data center?
- Which two campus network problems indicate a need for QoS? (Choose two.)
- Which two capabilities does Cisco SD-Access add to a traditional campus network? (Choose two.)
- Which two Cisco SD-WAN components exchange OMP routes and services?
- Which two commands are required on a Cisco 9800 WLC to configure AAA for central web authentication?
- Which two commands or command sets configure and verify a CoPP policy that permits SNMP from the management server to router R1 while protecting the control plane? (Choose two.)
- Which two constructs appear in YANG data models?
- Which two device roles exist in a Cisco SD-Access fabric?
- Which two elements define the two-tier leaf-spine data center architecture?
- Which two factors cause broadcast amplification in virtualized (VM) environments?
- Which two features are available only in next-generation firewalls?
- Which two functions is an edge node responsible for? (Choose two.)
- Which two GRE-related settings are configured to prevent packet fragmentation?
- Which two items are examples of QoS traffic descriptors? (Choose two.)
- Which two items are Type 1 (bare-metal) hypervisors?
- Which two LAN actions facilitate Layer 3 CAPWAP discovery for lightweight APs? (Choose two.)
- Which two LISP components are supported?
- Which two measurements are required to compute signal‑to‑noise ratio (SNR)?
- Which two mechanisms augment OAuth 2.0 for enhanced validation?
- Which two mechanisms can be used to secure NTP?
- Which two mechanisms does Cisco Threat Defense use to gain visibility into high-risk cyber threats?
- Which two methods assign Security Group Tags (SGTs) to users in a Cisco TrustSec deployment? (Choose two.)
- Which two methods can back up a Cisco DNA Center Assurance database?
- Which two methods interconnect two SD-Access fabric sites?
- Which two methods provide controlled Layer 2 connectivity between virtual machines on the same hypervisor?
- Which two namespaces does the LISP architecture use?
- Which two new security capabilities does a next-generation firewall add at the Internet edge? (Choose two.)
- Which two operations are valid for RESTCONF?
- Which two prerequisites must be met before Cisco DNA Center can provision a device? (Choose two.)
- Which two protocols commonly transport YANG data models? (Choose two.)
- Which two security features are available when implementing NTP? (Choose two.)
- Which two security practices are recommended to protect REST APIs?
- Which two statements about FlexConnect mode for Cisco APs are true? (Choose two.)
- Which two statements about traffic policing are true?
- Which two statements about VXLAN are correct? (Choose two.)
- Which two statements correctly distinguish CAM from TCAM? (Choose two.)
- Which two statements describe Cisco SD-Access fabric elements?
- Which two tasks are required to complete a full Cisco DNA Center upgrade? (Choose two.)
- Which two threats can AMP4E block? (Choose two.)
- Which unit is used to measure RF signal-to-noise ratio (SNR)?
- Which virtualization component creates virtual machines and abstracts hardware so multiple VMs can run concurrently?
- Which vManage API collection contains resources to obtain a list of fabric nodes?
- Which VPN ID is reserved as the transport VPN carrying control traffic in Cisco SD-WAN?
- Which VPN ID is reserved for out-of-band network management in Cisco SD-WAN?
- Which VTY configuration allows only secure remote access, requires only a password, and times out idle EXEC sessions after 60 minutes?
- Which VTY configuration permits all remote protocols, requires only a password for authentication, and disconnects idle EXEC sessions after 60 minutes?
- Which vty configuration restricts remote device administration to secure, encrypted access only?
- Which VXLAN component encapsulates and decapsulates Ethernet frames?
- Which VXLAN construct provides segmentation for Layer 2 and Layer 3 traffic?
- Which wireless architecture supports centrally managed branch offices with local Internet plus WAN connectivity to headquarters?
- Which wireless deployment mode uses Flex architecture and permits Layer 2 client roaming between APs without a physical wireless controller?
- Which wireless design keeps APs fully functional if the wireless controller fails?
- Which wireless feature must be disabled to maintain voice call quality over a WLAN?
- While configuring a new SSID to present a browser-based splash page for user authentication, which WLAN Layer 3 setting is required?
- While connected to a Cisco router over Telnet, which command enables immediate display of log messages for the current session?
- Why are stateless REST API calls advantageous in cloud applications?
- Why did SNMP polling for the router fail after adding an interface and rebooting?
- Why is a Type 1 hypervisor considered more efficient than a Type 2 hypervisor?
- Why must the vBond orchestrator have a public IP in Cisco SD-WAN?
- Why would a small or mid-size business choose a cloud solution over on-premises?
- Why would an AP join a different WLC than the one provided via DHCP option 43?
- With a central WLC managing one AP per store, which technique provides per-store user analytics (presence counts)?
- With a pair of Cisco 5520 WLCs in SSO managing APs and guest traffic anchored to a 3504 in a DMZ, what ensures the EoIP tunnel stays UP after SSO failover?
- With service password-encryption enabled on IOS, how does the enable secret differ from the enable password?
- With two distribution multilayer switches as default gateways, which two technologies enable every VLAN host to use both gateways?
- WLAN has fast transition enabled and legacy clients fail to connect. Which feature lets legacy clients connect while allowing FT for clients selected by OUI?
CISCO Network Associate (CCNA) 200-301 Certification All exam questions
- 192.168.32.0/24 must be divided into 8 subnets, each supporting 30 hosts. VLAN 10 must use the last usable IP of the first subnet on a Layer 3 interface. Which interface command is correct?
- A Cisco IP phone receives untagged data frames from an attached PC. What does the phone do with that traffic?
- A company security team sent an email with a link that reported the site safe even though the link may contain malicious code. What type of security program is this?
- A device detects two stations transmitting simultaneously after the first 64 bytes of the frame have been received. Which interface counter increments?
- A DHCP server is at 172.16.32.15. For clients on 192.168.52.0/24 to reach the server, what command is required on the client subnet router?
- A frame arrives at a switch and fails FCS. Which two interface counters increase? (Choose two.)
- A packet is destined for 10.10.1.22. Which static route provides the best match?
- A probe response follows a client's probe request. Which 802.11 frame type is this?
- A router has route entries for 172.31.0.0/16, 172.31.0.0/24, and 172.31.0.0/25. A packet to 172.31.0.1 arrives—which route is chosen?
- A router learned 10.0.0.0/8, 10.0.0.0/16, and 10.0.0.0/24. Which show ip route output correctly displays all three prefixes?
- A router learns the same route via OSPF and via EIGRP. What administrative distance will the installed route have?
- A serial interface between R1 and R2 uses PPP and OSPF in a single area. By default, what OSPF network type is shown by show ip ospf interface?
- A server directly connected to the core switch shows high FCS error counts and unreliable transfers. What is the likely cause?
- A southbound API facilitates communication between which components?
- A wireless printer is assigned a static IP on the Wi‑Fi network. Which controller/feature must be enabled to avoid connectivity problems?
- A WLC reports a rogue AP that is actually a legitimate autonomous AP. How do you stop alarms for that AP's MAC?
- About the command ip route 172.16.3.0 255.255.255.0 192.168.2.4, which two statements are true? (Choose two.)
- After configuring domain name, username, and password on a router, which command generates the RSA key pair required for SSH?
- After configuring the authentication server and creating a dynamic interface for a new WLAN, what is the next step to complete the basic configuration?
- After creating VLANs 2, 3, and 4 and assigning ports, how should unused switch ports be handled?
- After deploying a new WLAN controller, which two follow-up tasks should you consider? (Choose two.)
- After enabling SIP call‑snooping ports for Call Admission Control in the WLC GUI, which two steps must you complete next?
- After updating LAG configuration on a Cisco WLC, which additional task must be performed when changes are complete?
- Allow SSH access from subnet 10.139.58.0/28 to the router (domain, crypto keys, and SSH configured). Which destination-router configuration permits the traffic?
- An application scales to 600 servers; each server needs a production subnet in 10.0.0.0/8. Which interface IP/mask on the router gives enough hosts while minimizing wasted addresses?
- An engineer configures remote access to a router from subnet 10.139.58.0/28. Domain name, crypto keys, and SSH are configured. Which destination-router configuration permits the traffic?
- An interface must be configured with IP 10.10.10.145 and the mask 11111111.11111111.11111111.11111000. Which CIDR prefix should be used?
- An IPv4 ACL applied to an interface appears to allow all incoming traffic. Which two misconfigurations could cause this behavior? (Choose two.)
- Before an NMS can process an SNMP trap from an agent, what must the NMS have available?
- Before generating RSA keys for SSH, which command must be configured on the device?
- By default, how does port security behave on a trunk port?
- By default, how long will a switch retain a workstation MAC address entry after the workstation stops sending traffic?
- By default, which path attributes does EIGRP use to compute a route metric?
- Clients are on 10.10.0.0/24 and the DHCP server is at 192.168.10.1 on a different subnet. Which command forwards DHCP requests between them?
- Clients need access to a less congested 5 GHz band for better voice quality. Which feature must be enabled on the WLAN?
- Compress the IPv6 address 2001:0EB8:00C1:2200:0001:0000:0000:0331/64. Which form must be configured?
- Configure a factory-default router with: console user EXEC password p4ssw0rd1, VTY (Telnet) user EXEC password s3cr3t2, and privileged EXEC password priv4t3p4ss. Which command sequence is correct?
- Configure OSPF on R1 so the Ethernet link to R2 does not perform a DR/BDR election. Which configuration is required on R1?
- Configure R1 as an NTP server with authentication, source NTP packets from Loopback0, set NTP stratum 2, and permit NTP only from client 209.165.200.225. Which configuration achieves this?
- Configure R1 so any traffic with no matching route is sent to 192.168.1.1. Which configuration achieves this?
- Configure R1 with a local user named engineer2 that uses the strongest available password option. Which command should be used?
- Contractors receive a certificate error accessing the Cisco ISE guest portal but employees do not. What change allows both groups to access the portal without errors?
- During controller discovery, which message does an AP send to the WLC AP-Manager interface?
- During frame flooding, what happens to the frames?
- During STP root port selection, which criterion is considered first?
- FastEthernet0/13 'show interface' shows high input errors, many CRC and frame counts. What is the root cause?
- For a centralized WLAN architecture, which switch interface mode should lightweight APs use to connect?
- For a corporate WPA3-Personal SSID using a PSK, which encryption cipher must be configured?
- For a locally switched FlexConnect AP where AP management and client VLANs differ, what must be configured on the switch port?
- For a mixed-vendor network, which redundancy protocol prevents traffic interruption if the default gateway fails?
- For a site-to-site VPN, which IPsec mode encapsulates and encrypts the entire original IP packet?
- For DHCP pool NOCC on 192.168.20.0/24, configure the DHCP default gateway as the next-to-last usable address. Which command is required?
- For which two purposes does Ethernet use physical (MAC) addresses?
- From the 10.70.128.0/19 block, you need two subnets: one supporting 24 hosts and another 472 hosts, both with the longest masks possible and using the first usable address for the router. Which two interface configurations meet these requirements?
- Given an 8-floor office with ~30–40 users per floor and only one subnet allowed, which SVI address and mask is the most efficient use of 192.168.0.0?
- Given devices where pins 1–2 are RX and pins 3–6 are TX and no auto MDI-X is available, which Ethernet cable type is required to connect a router and a switch?
- How are configuration changes applied to a lightweight access point?
- How are dynamically learned MAC addresses populated in a switch CAM table?
- How can a network supervisor reduce maintenance costs while maintaining network integrity in a traditionally managed network?
- How can an authenticator app protect the second factor if a user's smartphone is lost or stolen?
- How can VLAN-hopping attacks be mitigated?
- How do 1000BASE-LX/LH and 1000BASE-ZX differ in supported fiber link distance?
- How do AAA authentication and authorization differ?
- How do AAA functions relate to user identification, service tracking, and access control?
- How do authentication and authorization differ?
- How do controller-based networks differ from traditional networks regarding control-plane placement?
- How do IPv6 link-local and unique local addresses differ in scope?
- How do IPv6 unicast and anycast addresses differ?
- How do TCP and UDP differ in connection behavior?
- How do TCP and UDP differ in establishing connections between endpoints?
- How do TCP and UDP differ in how they provide delivery reliability?
- How do TCP and UDP differ in mechanisms that ensure delivery?
- How do TCP and UDP differ in reliability and connection behavior?
- How do traditional campus device management and Cisco DNA Center device management differ in deployment?
- How do UTP and STP cabling differ?
- How do virtual servers connect to the physical network on a hypervisor?
- How does a Cisco Unified Wireless Network handle overlapping Wi‑Fi channels?
- How does a hub treat a frame destined for a known MAC compared to a switch?
- How does a spine-and-leaf design scale when additional access ports are required?
- How does a switch handle a frame with an unknown destination MAC?
- How does a switch handle frames with unknown destination MAC addresses?
- How does a switch learn MAC addresses?
- How does an IPv6 multicast address differ from an IPv6 anycast address?
- How does CAPWAP allow a local-mode access point to communicate with its WLC?
- How does Chef configuration management enforce a required device configuration?
- How does Cisco DNA Center gather data from the network?
- How does encryption protect a wireless network?
- How does Ethernet frame switching operate on a bridge/switch?
- How does HSRP provide first-hop redundancy?
- How does IPsec secure communications within an organization?
- How does MAC address learning operate?
- How does MAC learning work on a switch?
- How does QoS improve voice traffic quality?
- How does Rapid PVST+ provide a fast, loop‑free topology?
- How does Spanning Tree Protocol (STP) prevent forwarding loops at OSI Layer 2?
- How does TFTP operate in terms of error handling and connections?
- How does WPA3 strengthen Wi-Fi security?
- How is Link Aggregation implemented on a Cisco Wireless LAN Controller regarding client traffic?
- How should an administrator securely manage an AP operating in lightweight mode?
- If a CDP-enabled interface on a neighbor has no IP address, what will CDP report for that neighbor?
- If a destination MAC has just aged out, how will the switch forward a received frame for that MAC?
- If a router has multiple static routes to the same destination with different next hops under the same OSPF process, how does it forward traffic?
- If a switch port receives a new frame while it is transmitting a previous frame, how are the frames handled?
- If a switch receives a frame whose destination MAC is not in its MAC address table, how does it handle the frame?
- If all OSPF routers in an area have the same priority and no loopback is configured, which address is used as the router ID?
- If an autonomous AP maps two WLANs to two VLANs, which port type should connect the AP to the wired network?
- If an autonomous AP provides a single SSID and carries client data plus management traffic, which wired port type is required?
- If clients are congesting 2.4 GHz and 5 GHz is underused, what should be configured to steer clients to 5 GHz APs?
- If loopback 10.54.73.1/32 is represented as IPv6 0:0:0:0:0:ffff:a36:4901, which IPv6 prefix length should be used?
- If multiple AP-Manager interfaces exist on a WLC, how does an AP choose which to use?
- If no loopback or explicit router ID is configured before starting OSPF, how is the router ID chosen?
- If the active HSRP router fails, which HSRP state router takes over and forwards packets?
- If the active VRRP router fails, which router assumes the role and forwards packets?
- If the neighbor switch is set to trunk or dynamic desirable, which command should you configure to form a trunk?
- If you advertise a GigabitEthernet interface into OSPF, which OSPF network type does it use by default?
- Implementing badge authentication to limit data center access is an example of which security program element?
- In 2.4 GHz 802.11 networks, which set of channels are nonoverlapping?
- In a collapsed core design, which two layers are combined?
- In a collapsed-core architecture, what is a function of the core/distribution layer?
- In a RADIUS access-request packet, which field is encrypted?
- In a site-to-site VPN, which protocol is responsible for transporting user data (the payload)?
- In a software-defined architecture, where does the control plane interface with the data plane?
- In a software-defined architecture, which plane handles packet forwarding on a Cisco router?
- In a spine-and-leaf design, how are leaf and spine switches interconnected?
- In an SDN architecture, which network-node function is centralized on the controller?
- In an SDN, what is the controller's function?
- In cloud computing, what is rapid elasticity?
- In default HSRP operation, which value is used to elect the active router?
- In EIGRP for IPv6, which show command displays the protocol error/event log?
- In HSRP, which address do routers share for hosts to use as the subnet default gateway?
- In local mode, which switch port type does a lightweight AP use to connect to the wired network?
- In NAT terminology, what is the public IP address assigned to an inside host called?
- In Rapid PVST+, what is the mode and role of a backup port on a shared LAN segment?
- In Rapid PVST+, which port state does not receive BPDUs or update the MAC address table?
- In Rapid PVST+, which port state processes BPDUs but does not forward frames or update the MAC address table?
- In RSTP (802.1w), besides discarding, which two port states does a port transition through? (Choose two.)
- In software-defined architectures, which plane is distributed and responsible for traffic forwarding?
- In STP, what is the root port?
- In syslog, what does the term facility refer to?
- In that JSON schema, the token "switch" represents which JSON element?
- In that JSON schema, what does "LB13" represent?
- In the Cisco WLC GUI when creating a WPA2-PSK WLAN, which two key formats can you select? (Choose two.)
- In the given JSON schema, what does line 2 represent?
- In the JSON example, what is 'ge3/36'?
- In the JSON schema, the token "fe5/42" represents which element type?
- In the JSON schema, what does "port" represent?
- In the JSON schema, what role does "IDS" serve?
- In the JSON snippet, what does "LB20" represent?
- In the JSON snippet, what does "R29" represent?
- In the JSON snippet, what does "VPN11" represent?
- In the JSON snippet, what does line 2 represent?
- In the JSON snippet, what does the term "firewall" represent?
- In this JSON schema, what does the term "port" represent?
- In this JSON schema, what does the token "R20" represent?
- In this JSON schema, what is represented on line 3?
- In Wi-Fi, how is 'noise' defined?
- Lines 1–5 of the JSON schema represent which JSON construct?
- Maximum number of concurrent Telnet sessions supported by a Cisco WLC?
- Neighbor discovery is disabled and the ISP uses third‑party devices. What must be enabled on the PE router interface Gi1/0 to complete neighbor discovery?
- New network 10.120.10.0/24 was added. Which OSPF command on R14 advertises that network into OSPF area 0?
- On a Cisco WLC, which interface is the default for in-band administration and controller–AP communication?
- On a WLC, which configuration prevents spoofed association requests and forces a 10 ms retry delay?
- On a WLC, which interface is the default for in-band wireless management?
- On a WLC, which selections are required when configuring a RADIUS server for wireless authentication?
- On interface FastEthernet0/1 carrying voice and data from an IP phone, which command preserves the data packet priority as received from the phone access port?
- On Microsoft Windows workstations, which protocol provides the default gateway address to the device?
- On R1, create an IPv6 static route to 2019:C15C:0CAF:E001::/64 with next hop 2019:C15C:0CAF:E002::1 reachable via GigabitEthernet0/0. Which command configures the route?
- On which device is a DHCP helper address configured to support DHCP?
- PC1 sends a frame to PC2 whose MAC is not in the switch MAC table, so the switch forwards the frame to all ports in the VLAN. What switching behavior is this?
- R1 and R2 cannot form an OSPF adjacency on their shared Ethernet link. Given their show ip ospf interface e0 output, what is the cause?
- R1 cannot form an OSPF neighbor relationship with R3. Which two conditions could cause this? (Choose two.)
- R1 learned 192.168.12.0/24 via IS-IS, OSPF, RIP, and internal EIGRP. Under normal conditions, which route is installed in the routing table?
- R1 learns the same network from multiple routing protocols. Which route will be installed in the routing table?
- Secure lobby switchport gi1/0/15 and limit allowed MAC addresses to two. Which configuration fulfills this requirement?
- Select three reasons large OSPF deployments use a hierarchical (area) design:
- Select two actions that occur in the data plane.
- Select two addressing methods that provide Internet access while conserving public IPv4 addresses. (Choose two.)
- Select two behaviors of a point-to-point WAN topology.
- Select two benefits of deploying private IP addressing. (Choose two.)
- Select two benefits of enabling PortFast on an access port.
- Select two benefits of FHRPs.
- Select two benefits of private IPv4 addressing. (Choose two.)
- Select two benefits of using private IPv4 addressing. (Choose two.)
- Select two characteristics of a public cloud implementation.
- Select two correct statements describing three-tier network topology.
- Select two differences between optical-fiber cabling and copper cabling.
- Select two differences between WPA2 and WPA3. (Choose two.)
- Select two disadvantages of a full-mesh topology.
- Select two functions a firewall can perform in an enterprise network.
- Select two primary drivers for network automation.
- Select two reasons to implement DHCP in a network.
- Select two reasons to use private IPv4 addressing.
- Select two recommendations to secure switch ports located in office areas outside the IT closet.
- Select two true statements about exterior routing protocols:
- Select two ways a password manager reduces the risk of a password being stolen.
- SW1 interface g0/1 is shown as down/down. Which two reasons could explain this state? (Choose two.)
- SW1 is set to Dynamic Auto and SW2 is set to Dynamic Desirable in DTP. What is the resulting link state?
- Switch forwards a frame out all ports except the ingress port. What is this process called?
- To aggregate four switch ports into one L2 logical link with both ends set to active, which protocol must be used?
- To allow a router to forward DHCPDISCOVER messages from a client to a remote DHCP server, what must be configured?
- To allow only hosts in 203.0.113.0/24 to manage a Catalyst switch while permitting transit traffic, which two router configurations are required? (Choose two.)
- To carry VLANs between a Cisco switch and a third‑party switch, which trunk encapsulation should be configured?
- To complete OSPF neighbor configuration between R1 and R3 (authentication set and interfaces in the same 192.168.1.0/30), what two steps are next? (Choose two.)
- To enable neighbor discovery between the company router and an ISP that uses a third-party router, what is the next configuration step on the company device?
- To ensure users connecting to the 'Office' SSID at different branches have identical access, what must be the same at each site?
- To harden management access on a Wireless LAN Controller, which two protocols should be disabled? (Choose two.)
- To manage an AP that has no IP address or dial-up number configured, which connection type is used?
- To minimize reassociation time as mobile devices roam among access points across many device types, which feature should be configured?
- To mitigate ARP spoofing on an access switch where Port-channel1 is the uplink, which two configurations should be applied on the access switch? (Choose two.)
- To obtain a public IP from an ISP dynamically on interface FastEthernet0/0, which command is required?
- To prevent backup server traffic from saturating the primary MPLS circuit, what inexpensive change should the engineer make?
- To replace Telnet with SSH and increase the RSA modulus to 2048 on new Catalyst switches, which two commands are required? (Choose two.)
- To restrict the WLAN to a maximum of 10 simultaneous clients, which two configuration actions are required? (Choose two.)
- To secure unused switch ports that are in the default VLAN, which two actions should you take? (Choose two.)
- Two EIGRP paths to 10.10.10.0 have feasible distances 3072 and 6144. What change enables EIGRP to load-balance across both paths?
- Two OSPF neighbors on a crossover Ethernet link are slow to reach FULL. Which interface command reduces adjacency formation time?
- Two PCs have addresses 192.168.25.128/25 and 192.168.25.100/25. Which subnet mask should both use so they are on the same local network?
- Two switches at default settings must use an industry-standard trunk allowing VLANs 1–10 and blocking others. How should the interconnecting ports be configured?
- Under which condition is TCP preferred over UDP?
- What action does a switch port with PoE power classification override take when a power condition is detected?
- What action does a switch take when PoE power classification override detects a monitored port exceeding the administrative maximum?
- What advantage do private IPv4 addresses provide for an internal network?
- What advantage does network automation provide an enterprise?
- What advantage does PoE auto mode provide versus static mode when an AP is connected to a PoE switch port?
- What are two benefits of network automation? (Choose two.)
- What are two fundamentals of virtualization? (Choose two.)
- What are two purposes of HSRP? (Choose two.)
- What are two reasons to configure a floating static route? (Choose two.)
- What are two requirements for an HSRP group? (Choose two.)
- What benefit does a Cisco Wireless LAN Controller provide?
- What benefit does Cisco DNA Center's network assurance provide over traditional campus management?
- What benefit does controller-based networking provide versus traditional networking?
- What benefit does store-and-forward switching provide?
- What capability does a Next-Generation IPS provide?
- What capability does FTP provide for network-related file transfers?
- What capability does WPA3 provide in wireless networks?
- What characterizes a collapsed-core network topology?
- What condition can place a switch port into the err-disabled state?
- What configuration is required so an HSRP router's local interface becomes active if all other group members fail?
- What consideration supports adopting network automation?
- What default behavior applies when an encrypted mobility tunnel is used between two Cisco WLCs?
- What defines the functionality of virtual machines?
- What describes MAC address learning?
- What differentiates Cisco DNA Center device management from traditional campus device management?
- What distinguishes Cisco DNA Center from traditional network management?
- What distinguishes TACACS+ from RADIUS?
- What do 10GBase-SR and 10GBase-LR interfaces have in common?
- What do the 1000BASE-LX and 1000BASE-T Ethernet standards share in common?
- What does a Layer 2 switch do when it receives a frame with an unknown destination MAC?
- What does a service-set identifier (SSID) identify?
- What does a switch do when it receives a frame whose destination MAC address is not in the MAC address table?
- What does a switch look up in the CAM table to forward a frame?
- What does disaggregation mean in controller-based networking?
- What does Opportunistic Wireless Encryption (OWE) provide?
- What does physical access control regulate?
- What does the HTTP PUT method do?
- What does the ip address dhcp command configure on an interface?
- What does traffic shaping do?
- What effect does the service password-encryption command have on a router's configuration?
- What failure does a first-hop redundancy protocol protect the network against?
- What function do wireless access points perform in an enterprise network?
- What function does a northbound API provide in SDN?
- What function does an SNMP agent perform?
- What function does the collapsed core perform in a two-tier network architecture?
- What functionality does the console port on a Cisco WLC provide?
- What functions does the OSPF Hello protocol perform? (Choose two.)
- What happens if PortFast is enabled on an interface connected to another switch?
- What information does a switch use to populate its MAC address table?
- What information is stored on a DHCP server?
- What interface condition does this output indicate?
- What is a benefit of private IPv4 addressing?
- What is a benefit of using private IPv4 address space?
- What is a characteristic of an SSID in a wireless network?
- What is a characteristic of an SSID on a wireless LAN?
- What is a consideration when deploying 802.11a radios?
- What is a difference between local AP mode and FlexConnect AP mode?
- What is a function of a Next-Generation IPS?
- What is a function of a northbound API?
- What is a function of a spine-and-leaf architecture?
- What is a reason to configure LAG (link aggregation) on a Cisco WLC?
- What is a reason to configure LAG on a Cisco WLC?
- What is a role of an endpoint?
- What is a similarity between OM3 and OM4 multimode fiber?
- What is an advantage of Cisco DNA Center versus traditional campus device management?
- What is an expected outcome of deploying network management automation?
- What is common to both copper and fiber SFP interfaces?
- What is one similarity between global and unique local IPv6 addresses?
- What is required for Wi‑Fi channels to be nonoverlapping?
- What is required to enable communication between different VLANs?
- What is SNMP's role in a network?
- What is the 8-bit binary prefix for IPv6 Unique Local Addresses (ULA)?
- What is the advantage of separating the control plane from the data plane in SDN?
- What is the authoritative source for an address lookup?
- What is the default character encoding for JSON text per RFC 4627?
- What is the default HSRP virtual MAC address for group 14?
- What is the destination MAC address of an Ethernet broadcast frame?
- What is the effect of deploying overlapping Wi‑Fi channels?
- What is the effect of the aaa new-model configuration command?
- What is the effect of the logging trap debug command on syslog messages?
- What is the function of a controller in controller-based (SDN) networking?
- What is the function of SNMP community strings?
- What is the link-local all-nodes IPv6 multicast address?
- What is the maximum bandwidth of a T1 point-to-point connection?
- What is the minimum configuration to allow only SSH version 2 remote management on router R1?
- What is the primary benefit of configuring PortFast on an interface?
- What is the primary difference between TCP and UDP regarding delivery and reliability?
- What is the primary effect of the spanning-tree portfast command?
- What is the primary function of a First Hop Redundancy Protocol (FHRP)?
- What is the primary function of a server?
- What is the primary function of Cisco DNA Center?
- What is the primary purpose of a Layer 3 device?
- What is the primary purpose of an SSID?
- What is the primary purpose of private IPv4 address space?
- What is the primary purpose of the console port on a Cisco WLC?
- What is the primary purpose of traffic shaping?
- What is the primary purpose of using nonoverlapping Wi-Fi channels?
- What is the primary role of a firewall in an enterprise network?
- What is the purpose of a southbound API in a controller-based architecture?
- What is the purpose of an ESSID?
- What is the purpose of an iterative DNS query during name resolution?
- What is the purpose of implementing VRRP?
- What is the purpose of the Cisco DNA Center controller?
- What is the purpose of traffic shaping?
- What is the recommended method to avoid co‑channel congestion when deploying 2.4 GHz access points?
- What is the role of the control plane in a network device?
- What is the role of the root port on a nonroot switch in STP?
- What is the traffic path between workstations on separate switches in a three-tier design?
- What is the typical use of RFC 1918 private IPv4 addresses in a network?
- What is the VRRP virtual MAC address for group 1?
- What JSON construct is represented on line 4?
- What must be considered before deploying virtual machines?
- What must be enabled so an interface derives a global unicast IPv6 address from its MAC address?
- What must be true for a floating static route to act as a backup when the primary route fails?
- What operation is performed by the data plane in a network device?
- What practice helps protect a network from VLAN-hopping attacks?
- What primary benefit does an FHRP provide?
- What primary function does a First Hop Redundancy Protocol provide on a subnet?
- What primary function does the data plane provide?
- What primary function does the SDN controller perform?
- What primary goal is achieved by using private IPv4 addressing on a network?
- What protocol or service is required for IP SLA to measure UDP jitter?
- What purpose does a northbound API serve in a controller-based networking architecture?
- What purpose does the private IPv4 address range serve?
- What role do commodity (off-the-shelf) switches play in a controller-based network?
- What role does a hypervisor provide for each virtual machine in server virtualization?
- What switchport mode is required when an AP is operating in FlexConnect mode?
- What TFTP function is used in network device maintenance?
- When a bridge port receives the best BPDU, what role does it assume?
- When a device is added to Cisco DNA Center, which two actions occur automatically? (Choose two.)
- When a DHCP client and DHCP server are on different IP networks, which device forwards DHCP messages between them?
- When a lightweight AP is in FlexConnect with local switching and VLAN tagging, which wired port type carries the traffic?
- When a router forwards a packet to the next hop, what happens to the MAC addresses?
- When a switch receives a frame destined for a MAC address already in its CAM table, how is the frame handled?
- When a switch receives a frame with an unknown source MAC, what action does it take?
- When an EUI-64 interface ID is generated from a MAC address, what occurs?
- When an IPv6 address is configured on an interface, which two multicast addresses are joined? (Choose two.)
- When configuring a WPA2-PSK WLAN on a Wireless LAN Controller, what is the minimum required ASCII passphrase length?
- When creating a WPA2-PSK WLAN in the Wireless LAN Controller GUI, which passphrase format is supported?
- When EAP-TLS session resumption is disabled, which step immediately follows receipt of the EAP Success message?
- When EIGRP learns the same route from two paths, which parameter selects the best path?
- When enabling, disabling, or changing LAG on a WLC, what requirement applies?
- When is a collapsed-core architecture appropriate?
- When is it appropriate to use private IPv4 addressing?
- When is private IPv4 addressing used?
- When is the HTTP PUT method used?
- When is using private IPv4 addressing appropriate for a new subnet?
- When LAG is enabled on a WLC, which interface is limited to a single instance?
- When multiple employees enter a building using one person's ID badge (tailgating), which security control is violated?
- When OSPF learns multiple paths to a destination, how does it choose the best route?
- When PortFast is enabled, which Rapid PVST+ state is skipped on that port?
- When QoS marking is enabled on a Cisco device, which IP header field is modified?
- When Rapid PVST+ is used, which STP state do ports always enter immediately after the switch boots?
- When reintroducing an old switch into a VTP domain, what action prevents it from overwriting the VLAN database?
- When two routes to the same destination are learned from different routing protocols, which attribute determines which route is installed?
- When using RADIUS for WLC management access, which service is not provided?
- When would you choose a global unicast IPv6 subnet instead of a unique local (ULA) subnet?
- Where does a switch store DHCP snooping entries?
- Where is MAC address learning enabled by default?
- Which 2.4 GHz channels are the nonoverlapping standard in the United States?
- Which 802.11 frame category carries an Association Response?
- Which 802.11 management frame is sent when a client roams to another access point on the same SSID?
- Which access point operating mode depends on a centralized controller for management, roaming, and SSID configuration?
- Which access-layer mitigation technique enforces identity-based access control?
- Which action must be taken when implementing password protection?
- Which action prevents VLAN hopping attacks?
- Which alternative to passwords is used for authenticating enterprise devices to the corporate network?
- Which AP mode allows access points to be managed by Cisco Wireless LAN Controllers?
- Which AP mode allows client traffic to break out locally at the branch and provides AP survivability during a WAN outage?
- Which AP mode captures wireless frames and forwards them to a PC running a packet analyzer?
- Which AP mode forwards all client traffic to a wireless controller?
- Which AP mode is required for CAPWAP communication with a Wireless LAN Controller?
- Which AP type meets these requirements: zero-touch WLC-managed deployment, only real-time MAC processed locally, and split-MAC architecture?
- Which API type does a controller use to interact with edge devices?
- Which attack floods a TCP port with SYN packets to exhaust the target's half-open connection resources?
- Which authentication method requires a user to present a physical characteristic?
- Which behavior describes an SSID on a WLAN?
- Which behavior describes frame switching?
- Which benefit does Cisco DNA Center provide compared to traditional campus management?
- Which benefit does VRRP provide?
- Which best describes JWT in REST API security?
- Which cable type should be used to connect two like devices when MDI-X auto-detection is unavailable (requires pins 1↔3 and 2↔6)?
- Which capability does TFTP provide?
- Which capability is provided by a spine-and-leaf architecture?
- Which channel-group mode must be configured when bundling multiple distribution interfaces connected to a WLC?
- Which characteristic applies to an SSID?
- Which characteristic applies to wireless encryption?
- Which characteristic benefits external users of public cloud resources?
- Which characteristic describes a Layer 2 switch?
- Which characteristic describes private IPv4 addresses?
- Which characteristic describes private IPv4 addressing?
- Which characteristic describes spine-and-leaf architecture?
- Which characteristic describes TFTP?
- Which characteristic distinguishes authentication from authorization and accounting?
- Which cipher is supported for wireless encryption only under the WPA2 standard?
- Which cipher provides the strongest encryption for WPA2-PSK?
- Which Cisco Wireless LAN Controller feature, when enabled, restricts management access from specified networks?
- Which Cisco-proprietary protocol provides immediate, transparent, automatic traffic recovery when edge devices or access circuits fail?
- Which CLI command enables HTTP access to a Cisco WLC?
- Which cloud service lets an organization install its own operating system on a virtual machine?
- Which cloud service model removes the need for employees to install, manage, or update infrequently used software?
- Which command configures a DHCP relay agent on an interface?
- Which command configures a floating static default route to backup router 10.200.0.2?
- Which command configures an interface to obtain its IPv4 address via DHCP?
- Which command configures an LLDP reinitialization/delay time of 5 seconds?
- Which command configures port-security with a manually assigned MAC address abcd.abcd.abcd on an access port connected to a VoIP handset?
- Which command configures this switch to always be the Spanning Tree root for VLAN 750?
- Which command creates a static NAT mapping from internal host 10.1.1.1 to public address 209.165.200.225?
- Which command creates an IPv6 address from a given prefix using an interface MAC via EUI-64?
- Which command displays a Windows host's IP address and DNS server settings at the command prompt?
- Which command displays the DHCP relay (helper) address configured on the router?
- Which command displays the HSRP priority for a router in the group?
- Which command displays the OSPF link-state database?
- Which command enables LLDP globally on a Cisco IOS ISR?
- Which command enables LLDP to send the port-description TLV on the switch?
- Which command ensures a router with higher HSRP priority becomes active after it reloads?
- Which command immediately places an access port into the forwarding state when a PC is connected?
- Which command indicates configuration of SNMPv3?
- Which command is required to configure a device as an NTP master?
- Which command must be issued before using the 'password complexity not manufacturer-name' command?
- Which command prevents the Cisco WLC CLI serial session from automatically logging out?
- Which command shows the addresses assigned by the DHCP server?
- Which command specifies the LLDP initialization delay (seconds) on interfaces?
- Which component allocates and manages physical resources for each virtual machine?
- Which component enables virtual machines on a host to communicate with physical hardware and each other?
- Which compressed IPv6 address should be configured on R1 GigabitEthernet1/1 for 2001:0db8:0000:0000:0500:000a:400F:583B?
- Which condition commonly places a switch port into the err-disabled state?
- Which condition is occurring on the interface shown?
- Which configuration makes switch SW1 act as an NTP master if upstream NTP servers become unreachable?
- Which configuration management tool uses TCP port 22 by default to communicate with managed nodes?
- Which configuration must be set before generating an RSA key pair for SSH on a router?
- Which consideration is correct when choosing autonomous APs versus cloud-managed APs?
- Which construct set does Puppet use for configuration code?
- Which CRUD operation maps to the HTTP GET method?
- Which CRUD operation modifies an existing table or view?
- Which definition best describes backdoor malware?
- Which describes FTP behavior?
- Which describes private IPv4 addressing?
- Which describes the function of a remote-access VPN?
- Which description best matches VRRP?
- Which description matches a DHCP client?
- Which design practice is a best practice when deploying an 802.11b wireless infrastructure?
- Which device centralizes authentication and roaming control in an enterprise wireless network?
- Which device enforces allow/deny rules to control network traffic?
- Which device performs stateful inspection of traffic?
- Which device protects an internal network from the Internet?
- Which device segments a network into zones with distinct security policies?
- Which device separates networks into security domains?
- Which DHCP message is used to detect unauthorized (rogue) DHCP servers?
- Which DHCP pool command causes the router to supply the default gateway to clients?
- Which DSCP per-hop behavior is split into subclasses based on drop probability?
- Which encryption algorithm is used by WPA2 in pre-shared key (PSK) mode?
- Which encryption algorithm is used by WPA3?
- Which encryption does WPA1 use for data protection?
- Which encryption mode is used when a site-to-site VPN leaves the packet's IP address fields unencrypted?
- Which enhancement is implemented in WPA3?
- Which enhancements were introduced in WPA3?
- Which EtherChannel mode enables LACP only when the peer initiates it (i.e., only if an LACP device is detected)?
- Which EtherChannel mode must be set for LAG on a Cisco WLC?
- Which Ethernet frame field notifies a host that incoming bits represent a frame?
- Which event corresponds to a router sending a notice-level syslog message?
- Which event generates a router syslog message at notice severity?
- Which EXEC-mode command sets the router date to Jan 1 2020 and time to 00:00?
- Which extended ACL configuration denies HTTP from 192.168.240.0/20 to 10.125.128.32/27 but allows 192.168.240.0/20 to reach the rest of 10.0.0.0/8?
- Which feature does WPA provide?
- Which fiber connector combination is required to connect a switch with 1000BASE-SX GBIC modules to one with 1000BASE-SX SFP modules?
- Which file lists the hosts and groups that Ansible targets?
- Which file transfer protocol requires authentication to upload a router backup configuration to a remote server?
- Which firmware-update consideration distinguishes autonomous and lightweight access points?
- Which function describes a southbound API?
- Which function does Cisco Advanced Malware Protection for NGIPS provide?
- Which function is performed by a Layer 3 switch?
- Which function is performed by the network control plane?
- Which function is provided by a web server?
- Which function is provided by a wireless LAN controller?
- Which function is provided by DHCP snooping on a switch?
- Which function normally performed by a traditional network device is moved to a software-defined controller?
- Which global command must be enabled on Cisco devices to allow network topology mapping via LLDP?
- Which global IOS command encrypts all passwords in the running configuration?
- Which GUI QoS profile should be selected for voice over WLAN?
- Which HTTP header indicates the media type the client accepts in a REST API request?
- Which HTTP method updates an object in the Cisco DNA Center Intent API?
- Which HTTP methods are standard for REST APIs?
- Which HTTP methods implement UPDATE in CRUD? (Choose two.)
- Which HTTP status code indicates a successful REST API request?
- Which hypervisor type runs directly on hardware without a host OS?
- Which IEEE standard is required when a Cisco WLC has multiple distribution-system ports but only one IP address configured?
- Which interface command makes the switch actively attempt to form a trunk with a neighbor using DTP?
- Which interface condition is indicated by this output?
- Which interface condition is occurring in this output?
- Which interface condition is shown by this output?
- Which interface connects controller software to agent code on a network device?
- Which interface forwards traffic to the destination network?
- Which interface forwards traffic toward the destination network?
- Which interface IP and mask is a usable address for a /30 subnet between two routers?
- Which interface is used to forward traffic to the destination network?
- Which interface is used to send traffic to the destination network?
- Which interface problem does this output indicate?
- Which interface type lets a client application send data to a server over IP?
- Which interface will be used to send traffic toward the destination network?
- Which interface will forward traffic to the destination network?
- Which IOS command causes locally configured passwords to be stored encrypted rather than as plain text in the device configuration?
- Which IOS command indicates GigabitEthernet0/0 obtained its address via DHCP?
- Which IPsec mode encrypts the entire original IP packet?
- Which IPsec mode is used when a packet's destination differs from the security termination point?
- Which IPv4 address type confines a server to internal network use and prevents direct Internet reachability?
- Which IPv4 address type conserves the pool of globally unique addresses?
- Which ipv6 address command configures 2001:0db8:0000:0000:0700:0003:400F:572B on serial0/0 using compressed notation?
- Which IPv6 address is appropriate for anycast-assigned distributed services?
- Which IPv6 address type allows communication between subnets but is not routable on the public Internet?
- Which IPv6 address type resembles a unicast address but is assigned to multiple devices on the same network simultaneously?
- Which IPv6 address type should be assigned so the device is reachable only from the internal network?
- Which IPv6 configuration on interface VLAN 2000 creates a locally unique, routable address that won’t be advertised to the Internet?
- Which IPv6 prefix range identifies multicast addresses rather than unicast?
- Which IPv6 prefix range is used to send packets to a group (multicast) address rather than an individual address?
- Which is a characteristic of a SOHO network?
- Which is a function of a Wireless LAN Controller?
- Which is a primary function of a firewall on an enterprise network?
- Which is an advantage of a point-to-point leased line?
- Which is true about a Layer 2 switch?
- Which item correctly describes what a virtual machine contains?
- Which JSON data type is an unordered set of attribute-value pairs?
- Which Layer 2 switch function encapsulates packets from different VLANs so they traverse the same port while keeping traffic separated?
- Which line command enables Telnet in addition to SSH?
- Which logging trap command configures syslog to record both warnings and errors?
- Which MAC address is the VRRP virtual address?
- Which MAC address is used as the VRRP virtual MAC?
- Which management security process is used when a user logs in with a username and password?
- Which measure implements physical access control in an organization's security program?
- Which mechanism between a wireless LAN controller and a Layer 2 switch provides redundancy, higher bandwidth, and load sharing?
- Which mechanism tests whether network QoS is sufficient to support IP services?
- Which mode must be used to configure an EtherChannel between two switches without using a negotiation protocol?
- Which monitoring technology provides the highest security for configuring network device monitoring?
- Which NAT configuration translates source subnet 10.10.0.0/24 to any of 192.168.3.1–192.168.3.3?
- Which NAT keyword allows multiple inside hosts to share a single outside IP address?
- Which NAT term identifies a group of addresses designated for NAT translation?
- Which network appliance inspects packet state to determine whether a packet is allowed?
- Which network is a private address range allowing hosts to communicate without Internet access?
- Which network plane is centralized and manages routing decisions?
- Which networking function is performed on the data plane?
- Which NTP command configures the router to synchronize its clock to 172.24.54.8?
- Which of these actions is performed in the device data plane?
- Which of these dynamic routing protocols are distance-vector based?
- Which option best describes an API?
- Which option is the JSON encoding of a dictionary/hash?
- Which organization type should choose a collapsed-core network design?
- Which OSPF neighbor state confirms the router has reached full adjacency (DR in proper mode)?
- Which pair of credentials satisfies a multifactor authentication requirement?
- Which per-hop behavior modifies a packet header field to set the packet's class of service?
- Which per-hop behavior modifies the IPv4 ToS field value?
- Which per-hop traffic-control action limits or drops traffic when a customer exceeds its committed bandwidth?
- Which physical component is distributed among multiple virtual machines running on the same hypervisor?
- Which plane is centralized by an SDN controller?
- Which plane is centralized in software-defined networking (SDN)?
- Which PoE mode detects powered devices and guarantees power when detected?
- Which port type accepts the spanning-tree portfast command without additional configuration?
- Which port type accepts the spanning-tree portfast command without extra configuration?
- Which port-security violation mode drops frames from unauthorized MACs while allowing frames from authorized MACs?
- Which port-security violation mode drops traffic from unknown MAC addresses and sends an SNMP trap?
- Which practice helps prevent VLAN hopping attacks?
- Which problem does private IPv4 addressing mitigate?
- Which protocol allows separate authentication and authorization for wireless AP management?
- Which protocol allows using the copy command to back up up to 20 router configurations globally?
- Which protocol causes a Wireless LAN Controller to generate a local SSL certificate for its web GUI?
- Which protocol do REST APIs use for communication?
- Which protocol does an access point use to obtain power information from a connected switch?
- Which protocol does an SDN controller use to relay forwarding changes to a southbound API?
- Which protocol does Ansible use to connect to managed nodes and deploy modules?
- Which protocol does Software Defined Access (SDA) use to provide a tunnel between edge nodes in different fabrics?
- Which protocol is used for secure remote CLI access to network devices?
- Which protocol lets you back up router configurations using the Cisco IOS MIB?
- Which protocol should be used to transfer large files if the firewall permits TCP ports 20 and 21?
- Which protocol uses an agent on devices to report metrics for network monitoring and troubleshooting?
- Which protocol uses SSL for security?
- Which QoS mechanism drops packets that exceed the committed rate?
- Which QoS mechanism is used to prioritize voice traffic on a network that is primarily for data?
- Which QoS mechanism prioritizes voice traffic on a network primarily used for data?
- Which QoS method drops or marks packets that exceed a configured bit rate?
- Which QoS prioritization method is appropriate for interactive voice and video traffic?
- Which QoS technique buffers excess packets and schedules them for later transmission when configured bandwidth is exceeded?
- Which Rapid PVST+ command ensures this switch is the root bridge for VLAN 200?
- Which Rapid PVST+ command sets the time a port remains in the Listening and Learning states?
- Which Rapid PVST+ feature should be enabled on a switch port to forward immediately when a connected server link becomes active?
- Which remote-access protocol provides unencrypted CLI access?
- Which role best describes a network endpoint?
- Which router R1 configuration sequence generates an RSA key pair for SSH management access?
- Which SDN plane forwards user-generated (data) traffic?
- Which security control best describes installing badge readers on data-center doors to allow entry based on job role?
- Which security method helps prevent man-in-the-middle attacks?
- Which security program reduces employee susceptibility to phishing?
- Which sequence of actions satisfies the requirements for multifactor authentication?
- Which service allows initiating a Telnet session by hostname?
- Which signal frequency equals 60 cycles per minute?
- Which SNMP message sent by an agent is reliably delivered and requires an acknowledgment from the manager?
- Which software-defined architecture plane provides Layer 2 reachability and Layer 3 routing information to assist forwarding decisions?
- Which solution protects an individual network endpoint from attack?
- Which statement about Cisco Discovery Protocol is true?
- Which statement about FTP is correct?
- Which statement about IPsec modes is correct when implementing an IPsec VPN?
- Which statement about JSON is true?
- Which statement about LLDP is true?
- Which statement about private IPv4 addressing is correct?
- Which statement about RSA is true?
- Which statement about SSIDs is correct?
- Which statement about syslog must be considered when deploying it on a network?
- Which statement about VLAN configuration is true?
- Which statement best describes a northbound REST API for SDN?
- Which statement best describes network endpoints?
- Which statement best describes southbound APIs?
- Which statement characterizes cloud-based network topology?
- Which statement compares traditional networks and controller-based networks?
- Which statement correctly describes encryption in wireless networks?
- Which statement correctly describes RSA?
- Which statement defines a zero-day exploit?
- Which statement describes a characteristic of private IPv4 addressing?
- Which statement describes a function or outcome of MAC learning on a switch?
- Which statement describes an SSID in wireless networks?
- Which statement describes an SSID?
- Which statement describes encryption in wireless networks?
- Which statement describes hypervisor virtualization capabilities?
- Which statement describes private IPv4 addressing?
- Which statement describes wireless encryption?
- Which statement distinguishes Cisco OfficeExtend AP mode from FlexConnect?
- Which statements describe OSPF? (Choose three.)
- Which STP feature bypasses listening and learning and places a port immediately into forwarding?
- Which switch command makes VLAN 10 untagged across a trunk link?
- Which switch feature immediately transitions a port to forwarding when the link comes up?
- Which switch function forwards frames only to ports with a matching destination MAC address?
- Which switch load‑balancing mode is recommended for Cisco WLCs?
- Which switching feature is used to create separate broadcast domains?
- Which switching feature removes unused MAC addresses from the MAC address table to make room for new entries?
- Which switching mechanism creates separate broadcast domains?
- Which switchport port-security violation mode increments the violation counter and sends an SNMP trap?
- Which syslog filtering criterion separates messages into files by importance?
- Which syslog severity level is the most severe, indicating the system is unusable?
- Which syslog severity level logs interface line-protocol up/down events?
- Which syslog severity level must be set to capture informational messages?
- Which syslog severity level records informational messages?
- Which technique can tunnel IPv6 traffic across an IPv4 infrastructure?
- Which technology allows multiple operating systems to run on a single physical host?
- Which technology can prevent a workstation from obtaining a DHCP address?
- Which technology enforces port access control so clients cannot connect without authentication remediation?
- Which technology improves web traffic performance by proxy caching?
- Which technology is used for communication between an SDN controller and network applications?
- Which technology uses HTTP messages to transfer data to applications on different hosts?
- Which three are typical VLAN characteristics?
- Which three nonoverlapping 2.4 GHz channels does DSSS use to minimize collisions?
- Which three statements about MAC addresses are correct?
- Which traffic type does IPsec (without GRE) carry?
- Which trait describes a Layer 2 switch?
- Which tunneling mechanism carries multicast between remote sites and supports encryption?
- Which two actions implement physical access control? (Choose two.)
- Which two actions influence EIGRP path selection? (Choose two.)
- Which two Ansible components are required to create a script that configures a VLAN on a switch? (Choose two.)
- Which two are advantages of a controller-based network architecture compared to traditional architectures? (Choose two.)
- Which two are benefits of controller-based networking versus traditional networking? (Choose two.)
- Which two are features of a DHCP relay agent?
- Which two are primary reasons to use IPv4 private address space? (Choose two.)
- Which two are social-engineering attacks?
- Which two are southbound APIs? (Choose two.)
- Which two behaviors are characteristic of HSRP? (Choose two.)
- Which two behaviors describe PortFast? (Choose two.)
- Which two behaviors does Weighted Random Early Detection (WRED) perform? (Choose two.)
- Which two benefits do private IPv4 addresses provide? (Choose two.)
- Which two benefits does UDP offer for application traffic? (Choose two.)
- Which two benefits does VTP provide in a switching environment?
- Which two cable types are required to connect an AP to a WLC to support 2.5-Gbps and 5-Gbps uplinks? (Choose two.)
- Which two capabilities does VRRP provide within a LAN? (Choose two.)
- Which two channel-group modes configure an EtherChannel to actively negotiate? (Choose two.)
- Which two choices are examples of multifactor authentication? (Choose two.)
- Which two Cisco DNA Center features increase extensibility compared to traditional campus device management? (Choose two.)
- Which two Cisco WLC port types provide out-of-band management?
- Which two commands configure a Layer 3 EtherChannel using the open-standard protocol (LACP)? (Choose two.)
- Which two conditions can prevent OSPF routers from forming an adjacency?
- Which two conditions cause late collisions to be counted on an Ethernet interface? (Choose two.)
- Which two conditions must be met before SSH will operate normally on a Cisco IOS switch? (Choose two.)
- Which two data items can Cisco Discovery Protocol advertise about a Cisco device? (Choose two.)
- Which two describe a typical small office/home office (SOHO) network environment? (Choose two.)
- Which two describe characteristics of a controller-based network? (Choose two.)
- Which two describe the access layer in a three-tier network?
- Which two effects result from traffic policing? (Choose two.)
- Which two encoding formats do REST APIs commonly support? (Choose two.)
- Which two functions are performed by a Layer 2 switch? (Choose two.)
- Which two functions are provided by DHCP? (Choose two.)
- Which two functions describe a server on a network? (Choose two.)
- Which two functions does a DHCP server provide? (Choose two.)
- Which two functions does a WLC perform in a lightweight AP architecture that an autonomous AP performs itself?
- Which two functions does DNS provide? (Choose two.)
- Which two functions does the core layer provide in a three-tier architecture? (Choose two.)
- Which two HTTP methods are appropriate for REST-based APIs? (Choose two.)
- Which two HTTP status-code classes indicate errors in REST APIs? (Choose two.)
- Which two IP addresses are private-address-space hosts usable inside an enterprise? (Choose two.)
- Which two IPv6 addresses can be used for connectivity between two routers on a shared link? (Choose two.)
- Which two items are components of a PKI? (Choose two.)
- Which two items can be determined from show ntp status output? (Choose two.)
- Which two northbound APIs are found in an SDN? (Choose two.)
- Which two parameters are minimally required on an active interface for OSPFv2 to operate? (Choose two.)
- Which two pieces of information can you learn from the routing table? (Choose two.)
- Which two practices support an acceptable network security posture? (Choose two.)
- Which two protocols are part of the IPsec suite? (Choose two.)
- Which two protocols are supported on service-port interfaces? (Choose two.)
- Which two protocols are used for administrator authentication and device configuration on access points? (Choose two.)
- Which two QoS mechanisms provide congestion management? (Choose two.)
- Which two reasons justify implementing private IPv4 addressing? (Choose two.)
- Which two reasons justify using CDP?
- Which two server types perform DNS name-to-IP resolution? (Choose two.)
- Which two SNMPv2 features allow retrieving large datasets in one request and acknowledging traps? (Choose two.)
- Which two statements about an SSID are true? (Choose two.)
- Which two statements about eBGP neighbor relationships are correct?
- Which two statements about NTP are true? (Choose two.)
- Which two statements about SSIDs are true?
- Which two statements about VTP are true?
- Which two statements accurately describe the purpose of the OSI model?
- Which two statements describe similarities between UTP Cat5e and Cat6a cabling? (Choose two.)
- Which two statements describe virtual machines (VMs)? (Choose two.)
- Which two statements differentiate authentication from accounting?
- Which two statements differentiate optical-fiber cabling from copper cabling?
- Which two steps are required on a device to configure it as an NTP client trusting a server? (Choose two.)
- Which two STP states does PortFast bypass on a port? (Choose two.)
- Which two transport protocols can carry syslog messages?
- Which two values must be entered when creating a new WLAN on a Cisco WLC GUI? (Choose two.)
- Which two VLAN IDs represent default or reserved VLANs? (Choose two.)
- Which two VPN technologies are recommended for multiple branch offices and large-scale deployments? (Choose two.)
- Which two WAN architecture choices improve scalability and reliability for a business network? (Choose two.)
- Which two wireless security standards use Counter Mode CBC-MAC Protocol (CCMP) for encryption and integrity? (Choose two.)
- Which two WLAN design practices are recommended when adding coverage cells? (Choose two.)
- Which type of API allows an SDN controller to dynamically change the network?
- Which type of attack is mitigated by Dynamic ARP Inspection (DAI)?
- Which type of IPv6 address is publicly routable like IPv4 public addresses?
- Which unified AP mode continues to serve wireless clients after losing connectivity to its Cisco WLC?
- Which value can be changed to make a specific interface the preferred forwarding port?
- Which value uniquely identifies the wireless network an access point advertises and uses to connect clients?
- Which virtualization component manages virtual services and connects them to external interfaces?
- Which WAN access technology is preferred for a small office/home office?
- Which WAN topology balances simplicity, performance, and availability?
- Which WAN topology provides the greatest reliability and redundancy?
- Which Windows command (alternative to "route print") displays the IP routing table?
- Which Wireless LAN Controller interface provides out-of-band management in Cisco's Unified Wireless architecture?
- Which wireless security implementation provides the strongest encryption suite?
- Which WLAN security protocol implements Perfect Forward Secrecy?
- Which WLC interface IP is used as the CAPWAP tunnel source for APs?
- Which WLC interface is used for out-of-band management?
- Which WLC management connection type is vulnerable to man-in-the-middle attacks?
- Which WLC port connects to a switch to carry normal access-point data traffic?
- Which WPA mode uses a pre-shared key (PSK) for authentication?
- Which WPA3 feature prevents eavesdroppers from viewing Wi-Fi traffic?
- Which WPA3 feature provides stronger security than prior WPA versions?
- Why assign different syslog levels per device?
- Why choose Cisco DNA Center over traditional management to speed device deployment in a campus?
- Why classify traffic in QoS?
- Why configure a trunk port on the switch port that connects to a WLC distribution port?
- Why deploy IPv4 private addressing?
- Why enable PortFast on a switch port connected to an end host? (Choose two.)
- Why implement a first-hop redundancy protocol?
- Why implement an automated network management solution?
- Why implement automation in a network environment?
- Why implement VRRP in a multivendor environment?
- Why is TCP preferred over UDP for applications requiring extensive error checking (for example, HTTPS)?
- Why is UDP better suited than TCP for low-latency applications like VoIP?
- Why is UDP preferred over TCP for low-latency applications like VoIP?
- Why use Cisco DNA Center for automated lifecycle management?
- Why was the RFC 1918 private IPv4 address space defined?
- Why will a switch flood a frame out all ports?
- Why would an administrator implement automated network management?
- With default DNS lookup enabled on a router, what occurs when a URL is entered at the CLI?
- With logging trap 3 configured, which three severity levels are sent to the syslog server? (Choose three.)
- With port security enabled on a switch interface for a printer, which action lets the switch learn and save the printer's MAC automatically?
- With PortFast enabled on an access port, which STP state does the port enter?
- With RADIUS down, which configuration secures the console port using a local user and local authentication?
- You set an OSPF router ID but the router still shows a physical-interface IP. What is the least disruptive action to make the configured router ID take effect?
Cisco SD-WAN Solutions (Ensdwi) 300-415 Certification All exam questions
- A vEdge router logs 'DCONFAIL (DTLS connection failure)'. What is the most likely cause?
- After uploading the WAN Edge inventory in vManage, what action marks devices valid for onboarding before they come online?
- Before adding a new queue to a QoS map and deploying it from vManage, which configuration must be completed first?
- Before initiating Cloud OnRamp for IaaS from vManage to expand into AWS, which two prerequisites must be met? (Choose two.)
- During a simultaneous rekey in the pairwise-keys process, what is the maximum number of IPsec SAs temporarily created before converging onto the new SAs?
- During zero‑touch provisioning when a WAN Edge contacts ztp.viptela.com, which onboarding action occurs?
- Enable QoS on the transport-side interface of a WAN Edge 5000 router. Which policy setting must be selected?
- For an on‑premises SD‑WAN deployment on ESXi, what responsibility falls to the IT team?
- For Google Cloud integration with Cisco SD-WAN, which TLOC color is used for site-to-site communication?
- For OMP↔BGP redistribution between two DCs with a direct interconnect, which action prevents WAN Edge routers at each DC from learning duplicate LAN routes?
- For plug‑and‑play (ZTP) on Cisco IOS XE SD‑WAN, which two requirements apply?
- For upgrading vManage, vSmart, vBond, and WAN Edge Cloud from 19.2 to 20.3, which image files are required?
- Given a policing target of 125 Bps and a burst of 8000 bits, which configuration choice completes this task?
- Given branches sharing location ID A042:B49C:D02E::72 that require direct internet access (DIA), which WAN Edge configuration satisfies the requirement?
- Given three WAN links (public Internet, business Internet, MPLS), which command configures the WAN Edge to use two paths simultaneously?
- Given two spokes behind one SD‑WAN hub, which two features are required to enable dynamic spoke‑to‑spoke tunnels?
- How are custom application ports configured for monitoring across Cisco SD‑WAN controllers?
- How are multicast service routes and joins handled in the SD-WAN overlay?
- How do WAN Edge devices behave when vSmart is unreachable?
- How do you revert a three-node vManage cluster to a single vManage?
- How do you scale vManage in a Cisco SD‑WAN deployment?
- How does the device at site S4300T6E43F36 report events to the management plane?
- How does vManage resolve reachability to vBond?
- How is a TLOC defined in SD-WAN?
- How many VM NICs are required when deploying a vSmart controller on VMware ESXi?
- How many vManage NMS nodes per domain are recommended for scalability and redundancy?
- How should IP addresses be assigned for all vManage cluster members located in the same data center?
- How should the network architect extend on‑premises SD‑WAN branch connectivity into AWS?
- If a WAN Edge image version is newer than the controller's version, what happens when attempting the upgrade?
- If OMP graceful restart is 24 hours, what IPsec rekey timer must be configured?
- If Smart Account Sync is not used, which component accepts the authorized serial-number file upload?
- If the intelligent proxy becomes unreachable, what occurs?
- If vManage loses connectivity to the fabric, which two effects occur? (Choose two.)
- If WAN Edge routers learn equal‑preference OMP routes, which route is selected?
- In a centralized control policy using multiple match/action entries, which ordering method ensures Prefix List is evaluated before TLOC, and TLOC before Origin?
- In a Cisco SD-WAN Multi-Region fabric with three or more regions, which topology type is supported in each noncore region?
- In a Cisco SD-WAN Multi-Region Fabric, which service provider type delivers secure private connectivity between data centers, access regions, and cloud providers?
- In a cloud-hosted SD-WAN controller deployment, where are policies created and where are they enforced?
- In a multitenant deployment with vManage hosting four tenants, how many vBond controllers are required?
- In an OMP feature template applied to WAN Edge routers, which setting prevents LAN-learned routes from being redistributed back into OMP?
- In SD-WAN, what is the primary role of the WAN Edge?
- In the WAN Edge Health pane, which device CPU or memory usage percentage is classified as normal?
- In UX 2.0, which component creates a feature profile using a structured approach to configuration?
- In which device state does a WAN Edge create control connections but not establish data tunnels?
- On vManage NMS, which severity level indicates events that require immediate action?
- On which OSI layer does the application‑aware firewall block applications on a WAN Edge?
- On which VPN is NAT configured on the outgoing interface for direct Internet access?
- Select two advantages of deploying cloud-based Cisco SD-WAN controllers:
- Select two benefits of deploying SD-WAN controllers in cloud-hosted services.
- Select two metrics a cloud Edge router should use to choose the optimal path to a SaaS application reachable via a gateway site.
- Select two reasons to choose IPsec tunnels over GRE.
- Select two WAN Edge platforms suitable for deployment in a cloud environment.
- To configure DIA based on matching QoS parameters on a WAN Edge, which two actions are required? (Choose two.)
- To implement a regional hub topology across multiple data centers in a retail SD‑WAN, which construct is used?
- To improve throughput for connection-oriented traffic by reducing RTT, which change should be made?
- To insert a firewall service at the hub, on which device do you configure the service-FW address?
- To prevent routing loops for routes advertised between data-center sites over the SD-WAN fabric, which attribute must be configured on the routers?
- To set the Controller Certificate Authorization mode to indicate a root certificate, which two actions are required?
- To use data prefixes when building centralized data policies in the vManage policy wizard, what is the first step?
- Two sites, each with one WAN Edge and two public TLOCs; TLOCs are fully reachable and no restrict is configured. How many data-plane tunnels does each WAN Edge form?
- Under Monitor > Network > Select Device, which view is used to verify service-insertion configuration?
- Under VPN 0, which vBond system configuration option allows a routable public IP even if DNS name, hostname, or IP are omitted?
- What advantage does deploying the SD-WAN controller on-premises provide?
- What are three JSON data types used in JavaScript?
- What BFD multiplier value does application-aware routing use?
- What color type is assigned to a TLOC when the TLOC endpoint is located behind NAT?
- What condition causes the Cisco Umbrella resolver to forward DNS requests to the intelligent proxy?
- What device identifiers must be provided to PNP/ZTP for zero-touch onboarding?
- What does packet duplication do in Cisco SD-WAN?
- What function does the STUN server provided by the vBond orchestrator perform?
- What is a benefit of the application-aware firewall in Cisco SD‑WAN?
- What is the default BFD 'Multiplier' value in vManage's basic BFD configuration?
- What is the default BFD poll-interval value (milliseconds) in the basic configuration?
- What is the default number of paths advertised per prefix in the OMP feature template?
- What is the default OMP graceful-restart timer on vSmart controllers and WAN Edge routers?
- What is the function of a TLOC extension interface?
- What is the function of the AppNav Controller in SD-WAN AppNav?
- What is the maximum number of concurrent vManage REST API sessions before the least-recently-used session is invalidated?
- What is the minimum Red Hat Enterprise Linux version required for Cisco SD‑WAN controller deployment via KVM?
- What is the primary purpose of an AppNav cluster in SD-WAN?
- What is the primary purpose of TLOC extensions on a WAN Edge router?
- What is the purpose of vpn 0 in a WAN Edge onboarding template?
- What is the recommended sequence to perform SD-WAN software upgrades?
- What is the role of colocation in Cloud OnRamp for SaaS?
- What is the size of the SGT field in the metadata header?
- What issue occurs when provisioning an ISR 4000 by PnP using only its UDI while the device has two serial identifiers (UDI and SUDI)?
- What key element is used in a vBond Orchestrator redundancy topology?
- What problem does Forward Error Correction (FEC) address in Cisco SD-WAN?
- What protocol must a WAN Edge use to reach vManage, vBond, and vSmart controllers in a data center?
- What requirement is needed to deploy on-premises vBond controllers using the Plug and Play Connect process?
- What requirement must be met before enabling data redundancy elimination (DRE) in SD-WAN?
- What scheduler is configured by default for the eight QoS queues on a cloud vEdge router?
- What two benefits do configuration groups provide in SD-WAN? (Choose two.)
- What UDP port offset range is valid when manually configuring nondefault offsets for IPsec tunnel creation on WAN Edge routers?
- What upgrade and reboot sequence should be used to upgrade all Cisco SD‑WAN controllers and WAN Edge devices?
- When a dual-DIA WAN Edge's DPI identifies a SaaS app, which behavior occurs?
- When a WAN Edge joins the SD-WAN fabric, which tunnels are established?
- When a WAN Edge learns routing information from the local site and local routing protocols, which route type represents those advertisements?
- When adding a tenant in vManage, what is the maximum number of alphanumeric characters allowed in the tenant name?
- When configuring an application-aware firewall on a WAN Edge via vManage, what inspection does the 'inspect' action perform?
- When configuring Cloud OnRamp for lease, what type of connection is created between the host VNet and the transit VNet?
- When configuring SNMPv3 via CLI on a Cisco WAN Edge router, how many characters does the 'snmp user' command support?
- When configuring VRRP to avoid a black hole after the primary transport fails, what should be tracked to achieve the fastest failover to the standby?
- When creating an IPv4 data policy for a single WAN Edge at a site with multiple edges, where in vManage is the policy added using the policy wizard?
- When enabling TLS Proxy in SD-WAN, what is the first step in establishing traffic flows through the proxy?
- When grouping VPNs into destination zones for Zone-Based Firewall, how many zones can a single VPN belong to?
- When placing a multicast replicator outside the local network with no local sources or receivers, which component is not required?
- When provisioning Cloud OnRamp for Multicloud on AWS in a multiregion deployment, how many cloud gateway instances can be created per region?
- When selecting an ISR1K with 4 GB RAM for branches, which two software features must it support?
- When two OMP routes are learned from the same SD-WAN device, which route is preferred?
- When upgrading vManage, which two image-upload options place images into the local vManage software repository? (Choose two.)
- When using Quick Connect, which VPNs must be created outside the workflow to complete the SD-WAN overlay setup?
- When vSmart is configured as a route reflector, which protocol carries routes between vSmart and WAN Edge routers?
- Where must application-aware enterprise firewall policies be applied on the same WAN Edge router?
- Which alarm severity monitors serious events that affect but do not shut down a network function?
- Which API endpoint returns a list of all devices from vManage?
- Which application list comes preconfigured?
- Which attribute does vManage use to associate and group all controllers within an SD‑WAN deployment?
- Which attributes uniquely identify and represent a TLOC route?
- Which authentication, encryption, and integrity combination is used for IPsec tunnels in Cisco SD-WAN?
- Which capability does Cisco SD-WAN Multi-Region Fabric provide?
- Which capability does the application‑aware firewall provide?
- Which certificate field is verified to confirm the identity of the physical WAN Edge device?
- Which certificate must be installed on vManage to allow users to access vManage via a web browser?
- Which Cisco SD-WAN component provides a single-pane-of-glass for network monitoring and configuration?
- Which Cisco SD‑WAN feature automatically provisions WAN Edge routers in AWS?
- Which Cisco SD‑WAN solution provides exploit protection, advanced signature‑based antivirus with sandboxing and threat intelligence to stop malicious attachments before execution?
- Which Cloud OnRamp component measures Quality of Experience (QoE)?
- Which Cloud onRamp solution deploys virtual SD-WAN routers in a transit AWS VPC that connects to an AWS Transit Gateway via site-to-site IPsec tunnels?
- Which combination of platforms is managed by vManage?
- Which command applies QoS to transport-side tunnel interfaces on a WAN Edge cloud router to enable scheduling and shaping?
- Which command disables writing syslog messages to the local disk?
- Which command must be configured on WAN Edge 5000 routers to apply a QoS scheduling policy for traffic received from transport-side tunnels?
- Which command on a vEdge verifies a policy that was pushed from vSmart?
- Which command on a WAN Edge activates it with vManage?
- Which command verifies a vEdge router's certificate validity?
- Which component coordinates a WAN Edge device's connection to a vSmart controller when joining the overlay?
- Which component optimizes the SD‑WAN multicast distribution tree?
- Which component performs stateful inspection of TCP, UDP, and ICMP flows in Cisco SD-WAN firewall policies?
- Which compression algorithm does DRE use in Cisco SD-WAN?
- Which condition prevents deleting a VNF image from the software repository?
- Which configuration component is used in a firewall security policy?
- Which configuration enables local redundancy at a site?
- Which control-plane component must reside in public IP space to assist NAT traversal?
- Which controller handles the orchestration plane in a cloud Cisco SD-WAN deployment?
- Which data-policy CLI path element specifies match criteria for capturing packets in a data policy?
- Which deployment scenario benefits most from deploying Cisco Umbrella SIG?
- Which device should be configured with the service‑chain IP to steer intersite traffic through a firewall?
- Which devices must run PIM and IGMP when enabling SD‑WAN multicast?
- Which disk image/storage format is used when vManage is deployed as a virtual machine on a KVM hypervisor?
- Which egress QoS queue on a WAN Edge should be used for voice traffic?
- Which elements does the controller verify to authenticate an edge device?
- Which encryption algorithm is used to encrypt SD-WAN data-plane traffic?
- Which external map service does vManage use to render the geography screen when accessed over the Internet?
- Which feature allows a device with an active DNS security policy to reach internally hosted (local) applications by bypassing DNS redirection?
- Which feature lets branch routers locally analyze and steer traffic to regional network functions to optimize cost and user experience?
- Which feature uses the cross-link between two redundant WAN Edges to provide transport redundancy?
- Which GUI selection changes certificate authorization mode from manual to automated?
- Which hardware component is used in the Cisco SD‑WAN authentication process on ISR platforms?
- Which identifier uniquely distinguishes a TLOC from a WAN Edge into the SD‑WAN transport network?
- Which IP must a WAN Edge reach for ZTP provisioning to succeed?
- Which IPS signature sets are available in vManage security policy configuration?
- Which items make up zone configuration in an application-aware firewall?
- Which keyword selects a specific tunnel type when traffic matches an SLA class?
- Which log type records when a device was upgraded?
- Which mechanism does Cisco SD‑WAN implement for data‑plane resiliency?
- Which mechanism forwards branch traffic from an SD‑WAN domain to the Cisco Umbrella SIG cloud?
- Which monitoring tab shows OMP tags on a route's next hop?
- Which of the following is an attribute of a TLOC?
- Which of these is a Cisco SD-WAN virtual platform?
- Which on‑box security feature is supported on the Cisco ISR 4451 SD‑WAN but not on vEdge?
- Which persistent connections does the vBond orchestrator establish?
- Which platform cannot provide IPS and URL filtering?
- Which policy permits TLOC communication between data-center hubs and spokes while blocking spoke-to-spoke communication?
- Which policy should be configured to redirect traffic from the private network to an ISP network?
- Which policy type blocks remote TLOCs while allowing data-center TLOCs to form hub-and-spoke peering?
- Which policy type is used to ensure voice packets are always sent on a link with under 50 ms delay?
- Which policy type must be applied on a WAN Edge to configure an ACL for traffic arriving from a service-side VPN with circuit ID 123456789?
- Which policy type must be applied on a WAN Edge application-aware firewall to control inter-VPN traffic?
- Which policy type should you apply to a site list to influence routing based on a group of prefixes?
- Which policy type tracks tunnel characteristics for SLA-based convergence and path selection?
- Which policy type under Configuration > Policies configures application-aware routing?
- Which prefix-list expression matches all IPv4 prefixes with lengths from /1 through /16?
- Which protocol advertises WAN Edge routes on the service side?
- Which protocol detects path up/down, measures loss/latency/jitter, and evaluates IPsec tunnel MTU quality?
- Which protocol does the SD-WAN REST API use to communicate with network devices?
- Which protocol does vManage use to connect to a cloud-hosted vSmart controller?
- Which protocol does vManage use to provision a WAN Edge during onboarding?
- Which protocol is enabled by default on tunnels to detect loss, latency, jitter, and path failures in Cisco SD-WAN?
- Which protocol is the default for control-plane connections?
- Which protocol is used for control connections between SD-WAN devices?
- Which protocol measures loss, latency, jitter, and liveliness between WAN Edge router peers?
- Which protocol propagates multicast join requests across the SD-WAN fabric?
- Which queue should be assigned for control-plane and BFD traffic to ensure convergence on a WAN Edge router?
- Which request command automates onboarding a WAN Edge cloud router with vManage?
- Which REST API endpoint checks the status of a device action?
- Which REST API resource is used for real‑time monitoring of application‑aware routing?
- Which restriction applies when configuring a tunnel interface?
- Which route type represents prefixes learned from a local site via an SD-WAN Edge router?
- Which routing protocol carries control-plane information between vSmart controllers and WAN Edge routers in Cisco SD-WAN?
- Which routing protocol has the highest default administrative distance?
- Which SD-WAN component centralizes policy configuration?
- Which SD-WAN component ensures only authenticated customer nodes join the overlay?
- Which SD-WAN component is configured to enforce a policy that redirects branch-to-branch traffic to a network service (firewall or IPS)?
- Which SD-WAN component manages the overlay control plane and WAN Edge connectivity?
- Which SD-WAN component runs routing protocols such as BGP and OSPF?
- Which SD-WAN controller delivers a centralized policy that influences route advertisement across the fabric?
- Which SD-WAN controller establishes secure control connections to WAN Edge routers and distributes routes and policies via OMP?
- Which SD-WAN feature carries packets with SGTs across the network?
- Which SD-WAN plane builds and maintains the network topology and makes traffic-flow decisions?
- Which SD-WAN plane handles automatic onboarding of routers into the overlay?
- Which SD-WAN security feature blocks malware, phishing, and other unacceptable DNS requests to improve user Internet access performance?
- Which SD‑WAN capability helps a bank improve application experience and meet critical application SLAs?
- Which SD‑WAN component collects path performance telemetry at site ID 123456 to report issues to the service provider?
- Which SD‑WAN component distributes route and policy information using OMP?
- Which SD‑WAN component facilitates the initial connectivity exchange so WAN Edge devices can join the fabric?
- Which SD‑WAN configuration construct provides day‑zero deployment and reusable configuration components?
- Which SD‑WAN control‑plane component stores certificates and device configurations?
- Which SD‑WAN controller handles device provisioning and configuration?
- Which secure connection should be used to access vManage REST APIs via the web server?
- Which service VPN must be reachable from all WAN Edge devices and the controllers?
- Which source can cause an SD‑WAN Edge router to originate a vRoute?
- Which statement about software management in Cisco SD-WAN is correct?
- Which statement correctly describes a requirement when integrating a Secure Internet Gateway (SIG) with an SD‑WAN Edge device?
- Which statement correctly describes vManage NMS?
- Which subnets must exist in an Azure VNet for a WAN Edge (CSR) cloud deployment?
- Which table on vSmart stores service routes learned from WAN Edge routers for hub and branch sites?
- Which TCP optimization prevents unnecessary retransmissions and improves throughput?
- Which third‑party Enterprise CA must be used for a cloud-based vSmart controller?
- Which timer controls how long a router retains routing information in cache after all OMP sessions are lost at location S4317T8E35F76?
- Which tunnel type is used to connect one WAN Edge router to other WAN Edge routers?
- Which two advanced security features are available on SD-WAN WAN Edge (vEdge)? (Choose two.)
- Which two algorithms authenticate a user for SNMPv3 on a WAN Edge router?
- Which two Cisco products provide SHA file hashing, disposition (good/unknown/malicious), real-time traffic analysis, and alerting? (Choose two.)
- Which two components are included in a vManage high-availability cluster architecture? (Choose two.)
- Which two criteria does the Cisco Umbrella cloud firewall support for filtering traffic? (Choose two.)
- Which two features are NOT supported when FIPS mode is enabled on an IOS XE SD-WAN device? (Choose two.)
- Which two features does the application firewall provide? (Choose two.)
- Which two functions describe the TCP optimization feature in Cisco SD-WAN?
- Which two functions does the vSmart controller perform?
- Which two functions does vSmart perform? (Choose two.)
- Which two functions/components are part of vSmart? (Choose two.)
- Which two hardware platforms support Cisco IOS XE SD-WAN images?
- Which two image formats are supported for controller code?
- Which two items are components of an application-aware firewall? (Choose two.)
- Which two items are components of vManage centralized policy deployment? (Choose two.)
- Which two mechanisms ensure data‑plane packet integrity in the Cisco SD‑WAN architecture? (Choose two.)
- Which two methods add a WAN Edge router's certificate serial number to vManage's Authorized Serial Number list? (Choose two.)
- Which two network services are required for zero-touch (PNP/ZTP) onboarding? (Choose two.)
- Which two performance metrics does vAnalytics provide? (Choose two.)
- Which two platforms are used to host Cisco WAN Edge virtual router appliances? (Choose two.)
- Which two prerequisites are required for Cloud OnRamp for SaaS to report accurate vQoE? (Choose two.)
- Which two protocols are supported for downloading software images from a remote server? (Choose two.)
- Which two requirements must be met for DNS inspection when integrating with Cisco Umbrella? (Choose two.)
- Which two resource data types does the REST API use to collect monitoring information in Cisco SD‑WAN? (Choose two.)
- Which two REST API functions are typically performed against Cisco devices in an SD-WAN overlay? (Choose two.)
- Which two routing protocols are redistributed into OMP?
- Which two SD‑WAN platforms can be deployed as a hypervisor VM on‑premises or in IaaS cloud? (Choose two.)
- Which two sets of identifiers does OMP advertise for TLOC routes between WAN Edge routers? (Choose two.)
- Which two SGT propagation methods does Cisco TrustSec support? (Choose two.)
- Which two steps let a specific department require firewall protection to reach the data center without including other departments? (Choose two.)
- Which two virtualization lifecycle-management platforms are supported by WAN Edge cloud routers?
- Which two vRoute attributes should vSmart policies match or set and be modified by data policies? (Choose two.)
- Which two WAN Edge certificate states are shown in vManage?
- Which types of OMP route advertisements can you verify?
- Which UDP destination port does a WAN Edge use to establish a DTLS connection to the vBond orchestrator?
- Which vEdge command displays BFD session summary information per TLOC?
- Which vManage CLI configuration enables automated certificate signing through Cisco?
- Which vManage policy type tracks path characteristics such as loss, latency, and jitter?
- Which vManage view contains details about a control node failure?
- Which vManage wizard sequence lets you create applications/groups and traffic rules (for loss-based path preference) and then apply the policy to sites and VPNs?
- Which VPN ID is used for the WAN Edge transport interface connecting to the underlay/WAN?
- Which VPN must exist on at least one interface to install vManage and integrate it with WAN Edge devices for an overlay site?
- Which vRoute attribute indicates its type?
- Which VRRP advertisement interval restores a vEdge to the default timer?
- Which vSmart component creates and maintains the DTLS/TLS control-plane connection?
- Which WAN Edge command shows the fabric colors learned from vSmart via OMP?
- Which WAN Edge platform supports LTE and Wi-Fi?
- Who advertises the rendezvous point and over which network in the SD-WAN replicator role?
- With controller certificates and no alternate port configured, which port does vBond use?
- With two WAN links and two TLOCs on a WAN Edge, which two TLOC attributes must be configured?
Pass your Cisco exam — faster
Every verified answer and explanation in one place. Practice the full exam and save hours of prep — free to start.
Pass your exam →Guides & tips
- Cisco 300-410: Advanced IPv4 and IPv6 Addressing — Study Guide
- Cisco 300-410: BGP Policy, Scalability and Path Selection — Study Guide
- Cisco 300-410: EIGRP Design, Metrics and Convergence — Study Guide
- Cisco 300-410: MPLS, VRFs and Layer 3 VPN Services — Study Guide
- Cisco 300-410: Multicast Routing and Distribution — Study Guide
- Cisco 300-410: Network Services, Resiliency and Operations — Study Guide