IT Exam Questions and Solutions Library

Drag and drop the code snippets from the bottom onto the blanks in the script to convert a Python object into a JSON string. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the deployment models on the right.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the deployment models on the right. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the architectures on the right.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the deployment models on the right.

Select and Place:


Correct Answer:

Drag and drop the snippets onto the blanks within the code to construct a script that brings up the failover Ethernet port if the primary port goes down and also shuts down the failover port when the primary returns to service. Not all options are used.

Select and Place:

Correct Answer:

Drag and drop the solutions that comprise Cisco Cyber Threat Defense from the left onto the objectives they accomplish on the right.

Select and Place:


Correct Answer:

Drag and drop the code snippets from the bottom onto the blanks in the code to construct a request that configures policy-based routing.

Select and Place:

Correct Answer:

Drag and drop the components of the Cisco SD-Access fabric architecture from the left onto the correct descriptions on the right. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the snippets onto the blanks within the code to construct a script that configures BGP according to the topology. Not all options are used, and some options may be used twice.

Select and Place:

Correct Answer:

Drag and drop the code snippets from the bottom onto the blanks in the PHP script to convert a PHP array into JSON format. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the code snippets from the bottom onto the blanks in the script to convert a Python object into a compact JSON object by removing space characters. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the automation characteristics from the left onto the corresponding tools on the right.

Select and Place:

Correct Answer:

Drag and drop the automation characteristics from the left onto the appropriate tools on the right. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the code snippets from the bottom onto blanks in the Python script so that the program changes the IP address and saves it as a new JSON file on the disk. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the characteristics of Cisco SD-WAN from the left onto the right. Not all options are used.

Select and Place:

Correct Answer:

Drag and drop the code snippets from the bottom onto the blanks in the Python script to print the device model to the screen and write JSON data to a file. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the QoS mechanisms from the left onto their descriptions on the right.

Select and Place:


Correct Answer:

Drag and drop the code snippets from the bottom onto the blanks in the script to convert a Python object into a JSON string. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the corresponding switching architectures on the right.

Select and Place:


Correct Answer:

Drag and drop the NTP elements from the left onto the correct descriptions on the right.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the routing protocols they describe on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the orchestration tools that they describe on the right.

Select and Place:

Correct Answer:

Drag and drop the LISP components on the left to the correct description on the right.

Select and Place:

Correct Answer:

Drag and drop the tools from the left onto the agent types on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the switching architectures on the right.

Select and Place:

Correct Answer:

Drag and drop the automation characteristics from the left onto the appropriate tools on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left to the table types on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the configuration models on the right.

Select and Place:

Correct Answer:

Drag and drop the Cisco SD-Access solution areas from the left onto the protocols they use on the right.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the routing protocols they describe on the right.

Select and Place:

Correct Answer:

An engineer is working with the Cisco DNA Center API. Drag and drop the methods from the left onto the actions that they are used for on the right.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the QoS components they describe on the right.

Select and Place:

Correct Answer:

Drag and drop the snippets onto the blanks within the code to create an EEM script that adds an entry to a locally stored text file with a timestamp when a configuration change is made. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the snippets onto the blanks within the code to construct a script that configures a loopback interface with an IP address. Not all options are used.

Select and Place:


Correct Answer:

Please drag and drop the options provided in the left to configure NTP in client mode.

Select and Place:


Correct Answer:

Drag and drop the definitions on the left to their respective technological names on the right.

Select and Place:

Correct Answer:

Drag and drop the definitions in the left to their respective Terminology in the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the routing protocols they describe on the right.

Select and Place:


Correct Answer:

Drag and drop the code snippets from the bottom onto the blanks in the code to construct a request that configures a deny rule on an access list.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the orchestration tool classifications on the right.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the orchestration tools that they describe on the right.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the orchestration tools they describe on the right.

Select and Place:


Correct Answer:

Drag and drop the snippets onto the blanks within the code to construct a script that changes the routing from gateway 1 to gateway 2 from 11:00

m. to 12:00 a.m. (2300 to 2400) only, daily. Not all options are used, and some options may be used twice.

Drag and drop the characteristics from the left onto the technology types on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the routing protocols they describe on the right.

Select and Place:

Correct Answer:

Drag and drop the snippets onto the blanks within the code to construct a script that shows all logging that occurred on the appliance from Sunday until 9:00 p.m.
Thursday. Not all options are used.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the infrastructure deployment models on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the orchestration tools that they describe on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the infrastructure deployment models they describe on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the routing protocols they describe on the right.

Select and Place:

Correct Answer:

Drag and drop the tools from the left onto the agent types on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the infrastructure deployment models on the right.

Select and Place:

Correct Answer:

Drag and drop the LISP components on the left to their descriptions on the right. Not all options are used.

Select and Place:

Correct Answer:

An engineer plans to use Python to convert text files that contain device information to JSON Drag and drop the code snippets from the bottom onto the blanks in the code to construct the request. Not all options are used.

Select and Place:

Correct Answer:

Refer to the exhibit. Drag and drop the snippets into the RESTCONF request to form the request that returns this response. Not all options are used.

Select and Place:

Correct Answer:

Drag and drop the snippets onto the blanks within the code to construct a script that adds a prefix list to a route map and sets the local preference. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the snippets onto the blanks within the code to construct a script that advertises the network prefix 192.168.5.0/24 into a BGP session. Not all options are used.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the switching mechanisms they describe on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the switching architectures on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the deployment types on the right.

Select and Place:

Correct Answer:

Drag and drop the descriptions from the left onto the correct QoS components on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the appropriate infrastructure deployment types on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the infrastructure types on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the correct infrastructure deployment type on the right.

Select and Place:


Correct Answer:

Drag and drop the QoS mechanisms from the left onto their descriptions on the right.

Select and Place:

Correct Answer:

Drag and drop the LISP components from the left onto the functions they perform on the right. Not all options are used.

Select and Place:


2%80%93%20Proxy%20ITR%20(PITR)%3A%20A,devices%20deployed%20at%20LISP%20sites.

Correct Answer: E

Drag and drop the descriptions of the VSS technology from the left to the right. Not all options are used.

Select and Place:


Correct Answer:

Drag and drop the virtual components from the left onto their descriptions on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the correct routing protocol types on the right.

Select and Place:

Correct Answer:

Drag and drop the descriptions from the left onto the routing protocol they describe on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics from the left onto the routing protocols they describe on the right.

Select and Place:

Correct Answer:

Drag and drop the descriptions from the left onto the routing protocol they describe on the right.

Select and Place:


Correct Answer:

Drag and drop the DHCP messages that are exchanged between a client and an AP into the order they are exchanged on the right.

Select and Place:


Correct Answer:

Drag and drop the characteristics from the left onto the protocols they apply to on the right.

Select and Place:

Correct Answer:

Drag and drop the characteristics of PIM Dense Mode from the left to the right. Not all options are used.

Select and Place:

Correct Answer:

Drag and drop the wireless elements on the left to their definitions on the right.

Select and Place:

Correct Answer:

Drag and drop the threat defense solutions from the left onto their descriptions on the right.

Select and Place:

Correct Answer:

Drag and drop the REST API authentication methods from the left onto their descriptions on the right.

Select and Place:


Correct Answer:

Drag and drop the solutions that compromise Cisco Cyber Threat Defense from the left onto the objectives they accomplish on the right.

Select and Place:


Correct Answer:

An engineer creates the configuration below. Drag and drop the authentication methods from the left into the order of priority on the right. Not all options are used.

Select and Place:
R1#sh run | i aaa -
aaa new-model
aaa authentication login default group ACE group AAA_RADIUS local-case aaa session-id common R1#

Correct Answer:

Refer to the exhibit. What can be determined from the output?

A. Flow record CC is configured with two separate exporters.

B. Flow record CC is configured with a single exporter.

C. Flow monitor FLOW-CC is configured with two separate flow records to a single exporter.

D. Flow monitor FLOW-CC is configured to two separate exporters.










Correct Answer: D

Refer to the exhibit. Which action results from executing the Python script?

A. display the output of a command that is entered on that device

B. display the output of a command that is entered on that device in a single line

C. SSH to the IP address that is manually entered on that device

D. display the unformatted output of a command that is entered on that device A
Correct Answer:

Which policy feature is used with TrustSec to provide endpoint entitlement in an enterprise network?

A. security group tags

B. access control lists

C. virtual local area network

D. virtual routing and forwarding










Correct Answer: A

Refer to the exhibit. After unsuccessfully configuring an EtherChannel link, an engineer enables debugging. Which action will resolve the issue?

A. configure the EtherChannel members in desirable mode.

B. Set the EtherChannel to mode on.

C. Set the EtherChannel to mode active.

D. configure the EtherChannel members in passive mode.










Correct Answer: C

Refer to the exhibit. What is achieved by this code?

A. It unshuts the loopback interface.

B. It displays the loopback interface.

C. It renames the loopback interface.

D. It deletes the loopback interface.










Correct Answer: A

Which collection contains the resources to obtain a list of fabric nodes through the vManage API?

A. device inventory

B. administration

C. device management

D. monitoring










Correct Answer: C

Which Cisco DNA Center Assurance feature verifies host reachability?

A. path trace

B. application experience

C. detail information

D. network time travel










Correct Answer: A

What is one characteristic of Cisco DNA Center and vManage northbound APIs?

A. They push configuration changes down to devices.

B. They exchange XML-formatted content.

C. They implement the RESTCONF protocol.

D. They implement the NETCONF protocol.










Correct Answer: B

Which feature is offered by the Cisco Advanced Malware Protection for Endpoints solution?

A. File Sandboxing

B. NetFlow

C. TrustSec

D. DNS Protection










Correct Answer: A

Which JSON script is properly formatted?





A. D
Correct Answer:

How are control traffic, client authentication and data traffic handled in a mobility express environment?

A. Control traffic and client authentication is handled centrally by the controller. Data traffic is switched centrally by the controller.

B. Control traffic and client authentication is handled centrally by the controller. Data traffic is switched locally by the access points.

C. Control traffic and client authentication is handled locally by each access point. Data traffic is switched locally by the access points.

D. Control traffic and client authentication is handled locally by each access point. Data traffic is switched centrally by the controller.










Correct Answer: B

Which feature allows clients to perform Layer 2 roaming between wireless controllers?

A. mobility groups

B. N+1 high availability

C. RF grouping

D. SSO










Correct Answer: A

What is a characteristic of Cisco DNA Northbound APIs?

A. They utilize multivendor support APIs.

B. They simplify the management of network infrastructure devices.

C. They utilize RESTCON

D. They enable automation of network infrastructure based on intent.










Correct Answer: D

Refer to the exhibit. R1 and R2 are on the same VLAN. VRRP is configured between the two routers. What is the cause of the VRRP error?

A. R1 is configured with VIP 10.18.0.2 on VRRP group 1 and R2 is configured with VIP 10.18.0.1 on VRRP group 1.

B. R1 is configured with VIP 10.18.0.2 on VRRP group 1 and R2 is configured with VIP 10.18.0.2 on VRRP group 1.

C. R1 is configured with VIP 10.18.0.1 on VRRP group 1 and R2 is configured with VIP 10.18.0.2 on VRRP group 0.

D. R1 is configured with VIP 10.18.0.1 on VRRP group 1 and R2 is configured with VIP 10.18.0.2 on VRRP group 1.










Correct Answer: D

An engineer is implementing a new SSID on a Cisco Catalyst 9800 Series WLC that must be broadcast on 6 GHz radios. Users will be required to use EAP-TLS to authenticate. Which wireless Layer 2 security method is required?

A. WPA2 Enterprise

B. WPA2 Personal

C. WPA3 Enterprise

D. WPA3 Personal










Correct Answer: C

Which Cisco SD-WAN component authenticates the routers and the vSmart controllers?

A. vEdge

B. Manage NMS

C. Analytics

D. vBond orchestrator










Correct Answer: D

Refer to the exhibit. What is output by this code?

A. -1 -2 -3 -4

B. 8 7 6 5

C. 4 5 6 7

D. -4 -5 -6 -7










Correct Answer: B

What are two characteristics of a directional antenna? (Choose two.)

A. commonly used to cover large areas

B. low gain

C. provides the most focused and narrow beam-width

D. receive signals equally from all directions

E. high gain








Correct Answer: CE

When does Cisco DNA Center make changes to a device?

A. when the device credentials are added

B. when the network device is assigned to the site and device controllability is turned on

C. when the network device is discovered and device controllability is turned on

D. when a NETCONF port has been configured










Correct Answer: C

Which security actions must be implemented to prevent an API injection attack?

A. Log and monitor failed attempts.

B. Use password hash with biometric authentication.

C. Validate, filter, and sanitize all incoming data.

D. Use short-lived access tokens and authenticate the apps.










Correct Answer: C

Refer to the exhibit. Which action automatically enables privilege exec mode when logging in via SSH?

A. configure a password under the line configuration.

B. configure the enable secret to be the same as the secret for user "Cisco".

C. configure privilege level 15 under the line configuration.

D. configure user "cisco" with privilege level 15.










Correct Answer: D

Refer to the exhibit. An engineer must verify the operational status of ISP 1 by testing the IP reachability of the ISP1 DNS server every 10 seconds. If the DNS server is not reachable from the CPE through the Gi0/0 interface, then the test should fail. Which two configuration sets must be used to accomplish this task? (Choose two.)

A. ip route 0.0.0.0 0.0.0.0 198.51.100.1
ip route 0.0.0.0 0.0.0.0 203.0.113.1

B. ip route 0.0.0.0 255.255.255.255 198.51.100.1
ip route 0.0.0.0 255.255.255.255 203.0.113.1

C. ip route 198.51.100.252 255.255.255.255 198.51.100.1

D. ip sla 1
icmp-echo 198.51.100.252
frequency 10
ip sla schedule 1 life forever start-time now

E. ip sla 1
dns www.cisco.com name-server 198.51.100.252
frequency 10
ip sla schedule 1 life forever start-time now








Correct Answer: CD

Which characteristic applies to a traditional WAN solution but not to a Cisco SD-WAN solution?

A. time consuming configuration and maintenance

B. centralized reachability, security, and application policies

C. low complexity and increased overall solution scale

D. operates over DTLS/TLS authenticated and secured tunnels










Correct Answer: A

In which way are EIGRP and OSPF similar?

A. Both protocols support autosummarization.

B. Both protocols use hello packets to discover neighbors.

C. Both protocols support unequal-cost load balancing.

D. Both protocols send updates using unicast addresses.










Correct Answer: B

Which JSON script is properly formatted?





A. D
Correct Answer:

In a Cisco SD-Access environment, which function is performed by the border node?

A. Connect users and devices to the fabric domain.

B. Group endpoints into IP pools.

C. Provide reachability information to fabric endpoints.

D. Provide connectivity to traditional Layer 3 networks.










Correct Answer: D

What is a characteristic of the overlay network in the Cisco SD-Access architecture?

A. It provides multicast support to enable Layer 2 flooding capability in the underlay network.

B. It provides isolation among the virtual networks and independence from the physical network.

C. It uses a traditional routed access design to provide performance and high availability to the network.

D. It consists of a group of physical routers and switches that are used to maintain the network.










Correct Answer: B

What gives priority on an egress interface, for database traffic that connected on an ingress interface, without changing the CoS value?

A. QoS group

B. policy map

C. CoS map

D. class map










Correct Answer: B

What is a difference between TCAM and the MAC address table?

A. The MAC address table supports partial matches. TCAM requires an exact match.

B. TCAM is used to make Layer 2 forwarding decisions. CAM is used to build routing tables.

C. The MAC address table is contained in CAM. ACL and QoS information is stored in TCAM.

D. Router prefix lookups happens in CAM. MAC address table lookups happen in TCAM.










Correct Answer: C

Refer to the exhibit. A network engineer must block Telnet traffic from hosts in the range of 10.100.2.248 to 10.100.2.255 to the network 10.100.3.0 and permit everything else. Which configuration must the engineer apply?





A.
















Correct Answer: B

Refer to the exhibit. What does the response "204 No Content" mean for the REST API request?

A. Interface loopback 100 is removed from the configuration.

B. Interface loopback 100 is not removed from the configuration.

C. Interface loopback 100 is not found in the configuration.

D. The DELETE method is not supported.










Correct Answer: C

An engineer uses the Design work flow to create a new network infrastructure in Cisco DNA Center. How is the physical network device hierarchy structured?

A. by organization

B. by hostname naming convention

C. by location

D. by role










Correct Answer: C

What are two characteristics of vManage APIs? (Choose two.)

A. Northbound API is based on RESTCONF and JSON.

B. Southbound API is based on NETCONF and XML.

C. Southbound API is based on RESTCONF and JSON.

D. Southbound API is based on OMP and DTLS.

E. Northbound API is RESTful using JSON.








Correct Answer: BE

Which API does Cisco DNA Center use to retrieve information about images?

A. SWIM

B. Img-Mgmt

C. PnP

D. Client Health










Correct Answer: A

What is a characteristic of the Cisco DNA Center Template Editor feature?

A. It provides a high-level overview of the health of every network device.

B. It facilitates software upgrades to network devices from a central point.

C. It uses a predefined configuration through parameterized elements or variables.

D. It facilitates a vulnerability assessment of the network devices.










Correct Answer: C

Which tunnel type allows clients to perform a seamless Layer 3 roam between a Cisco AireOS WLC and a Cisco IOS XE WLC?

A. CAPWAP

B. IPsec

C. VPN

D. Ethernet over IP










Correct Answer: A

Refer to the exhibit. CR2 and CR3 are configured with OSP

A. Which configuration, when applied to CR1, allows CR1 to exchange OSPF information with CR2 and CR3 but not with other network devices or on new interfaces that are added to CR1?





B. B
Correct Answer:

What is a characteristic of vManage?

A. It leverages the overlay management protocol to interface with WAN Edge devices.

B. It supports protocols such as OSPF to integrate with legacy network devices.

C. It requires a public IP address to allow WAN Edge devices to discover fabric components.

D. It uses NETCONF to configure vSmart devices to build the overlay network data plane.










Correct Answer: D

Refer to the exhibit. An engineer constructs an EEM applet to prevent anyone from entering configuration mode on a switch. Which snippet is required to complete the EEM applet?

A. sync yes skip yes

B. sync no skip yes

C. sync no skip no

D. sync yes skip no










Correct Answer: B

Refer to the exhibit. What are two results of the NTP configuration? (Choose two.)

A. It uses other systems as an authoritative time source.

B. It distributes the time via NTP broadcast and multicast packets.

C. It distributes the time via NTP broadcast packets.

D. It forms a peer association with another system.

E. It uses the hardware clock as an authoritative time source.








Correct Answer: AC

What is the purpose of data modeling languages?

A. to describe a data schema convertible into any data encoding format

B. to provide a framework to describe data flow patterns in networks

C. to specify algorithms necessary to decode binary-encoded protocol data units

D. to translate encoded data for interoperability between different CPU architectures










Correct Answer: A

Refer to the exhibit. An engineer must prevent VLAN 20 routes from appearing in the routing table of Switch-1. Which command set must be applied?





A.
















Correct Answer: D

Which mechanism can be used to enforce network access authentication against an AAA server if the endpoint does not support the 802.1X supplicant functionality?

A. MAC Authentication Bypass

B. MACsec

C. private VLANs

D. port security










Correct Answer: A

Which mechanism does OAuth use to strengthen REST API security when compared to BasicAuth?

A. Token

B. SSL

C. Authentication

D. TLS










Correct Answer: A

What is the API keys option for REST API authentication?

A. a predetermined string that is passed from client to server

B. a one-time encrypted token

C. a credential that is transmitted unencrypted

D. a username that is stored in the local router database










Correct Answer: A

Refer to the exhibit. The web server is configured to listen only to TCP port 8080 for all HTTP requests. Which command is required to allow Internet users to access the web server on HTTP port 80?

A. ip nat outside static tcp 10.1.1.100 8080 10.1.1.100 80

B. ip nat inside static tcp 10.1.1.100 80 10.1.1.100 8080

C. ip nat inside static tcp 10.1.1.100 8080 10.1.1.100 80

D. ip nat outside static tcp 10.1.1.100 80 10.1.1.100 8080










Correct Answer: C

Refer to the exhibit. What is achieved by this Python script?

A. It loads JSON data into an HTTP request.

B. It converts JSON data to an HTML document.

C. It counts JSON data from a website.

D. It reads JSON data into a formatted list.










Correct Answer: D

Refer to the exhibit. An engineer must configure router R1 to allow only NETCONF connections from the management VLAN. Which command completes this configuration?

A. R1(config-if)# ip access-group netconfacl in

B. R1(config)# netconf-yang ipv4 access-list name netconfacl

C. R1(config)#ip http secure-server
R1(config)# ip http accounting commands 12 default

D. R1(config-if)#ip access-group netconfacl out










Correct Answer: A

Which configuration saves the running configuration to the startup configuration and logs a "saving configuration automatically" message when a syslog message that contains "SYS-5-CONFIG_I" is received?





A. C
Correct Answer:

Refer to the exhibit. An engineer applies this configuration to R1: ip nat inside source static 192.168.10.17 192.168.27.42
Which command set should be added to complete the configuration?

A. R1(config)# interface GigabitEthernet 0/0
R1(config-if)# ip nat outside -
R1(config)# interface GigabitEthernet 0/1
R1(config-if)# ip nat inside -

B. R1(config)# interface GigabitEthernet 0/0
R1(config-if)# ip pat outside -
R1(config)# interface GigabitEthernet 0/1
R1(config-if)# ip pat inside -

C. R1(config)# interface GigabitEthernet 0/0
R1(config-if)# ip pat inside -
R1(config)# interface GigabitEthernet 0/1
R1(config-if)# ip pat outside -

D. R1(config)# interface GigabitEthernet 0/0
R1(config-if)# ip nat inside -
R1(config)# interface GigabitEthernet 0/1
R1(config-if)# ip nat outside










Correct Answer: A

Which type of roaming event occurs when a client roams across multiple mobility groups?

A. Layer1

B. Layer7

C. Layer3

D. Layer2










Correct Answer: D

A Cisco administrstor deploys a new wireless network but CAPWAP APs cannot communicate with the wireless controller. IP connectivity in the network functions properly. Which action resolves the issue?

A. Open CAPWAP UDP port 12222 in the network firewall.

B. Open CAPWAP UDP ports 5246 and 5247 in the network firewall.

C. Enable the UDP Lite feature on the WL

D. Ensure that the controller is connected to a AAA server.










Correct Answer: B

Which technique is used to protect end user devices and data from unknown file behavior?

A. crypto file ransomware protection using a file hash calculation

B. file retrospection using continuous scan and analyses

C. file sandboxing using a protected environment to analyze and simulate the behavior of unknown files

D. phishing file quarantine using an internal environment to store attached files










Correct Answer: C

A client requests a wireless solution for remote branch offices to eliminate the need for a local controller at each branch. The branch users require local termination in a specifc VLAN for local internet breakout. Which solution must be deployed?

A. central switched

B. FlexConnect local switching

C. auto-anchor mobility

D. asymmetric tunneling










Correct Answer: B

Which type of tunnel is required between two WLCs to enable intercontroller roaming?

A. CAPWAP

B. LWAPP

C. mobility

D. IPsec










Correct Answer: A

Refer to the exhibit. Which command must be applied to complete the configuration and enable RESTCONF?

A. ip http server

B. ip http client username restconf

C. ip http secure-port 443

D. ip http secure-server










Correct Answer: D

Which device, in a LISP router architecture, receives LISP map requests and determines which ETR should handle the map request?

A. proxy ETR

B. routing locator

C. map resolver

D. map server










Correct Answer: C

How does a WLC achieve stateful switchover for APs and clients?

A. The active WLC establishes a CAPWAP tunnel to the AP, and the standby WLC establishes a LWAPP tunnel to the AP.

B. The active WLC establishes a CAPWAP tunnel with the AP, and the standby WLC copies the AP database and the client database from the active WL

C. The active WLC establishes a CAPWAP tunnel with the AP and standby WLC to share the AP database information.

D. The active and standby WLCs establish separate CAPWAP tunnels to the AP.










Correct Answer: C

Refer to the exhibit. What is the purpose of the configuration?

A. The router will function in NTP in client mode.

B. The router will use 172.16.1.1 as the source for NTP packets.

C. The router is allowed to receive NTP broadcast packets.

D. The router will function as an authoritative NTP server.










Correct Answer: D

What is a consideration when designing a Cisco SD-Access underlay network?

A. It must support IPv4 and IPv6 underlay networks.

B. End user subnets and endpoints are part of the underlay network.

C. Static routing is a requirement.

D. The underlay switches provide endpoint physical connectivity for users.










Correct Answer: D

Which JSON script is properly formatted?





A.
















Correct Answer: B

Which NTP concept is used to measure the distance from a device to its authoritative time source?

A. stratum

B. NTP peer

C. GPS

D. atomic clock










Correct Answer: A

What is a characteristic of a virtual machine?

A. It is more resource efficient than a container.

B. It provides an environment completely isolated from the host OS.

C. It is more lightweight than a container.

D. It shares the host OS kernel, binaries, and libraries.










Correct Answer: B

When is GLBP preferred over HSRP?

A. When the gateway routers are a mix of Cisco and non-Cisco routers.

B. When encrypted hellos are required between gateways in a single group.

C. When the traffic load needs to be shared between multiple gateways using a single virtual IP.

D. When clients need the gateway MAC address to be the same between multiple gateways.










Correct Answer: C

Which TLV value must be added to Option 43 when DHCP is used to ensure that APs join the WLC?

A. 0x77

B. AAA

C. 0xf1

D. 642










Correct Answer: C

Refer to the Exhibit. External users require HTTP connectivity to an internal company web server that is listening on TCP port 8080. Which command set accomplishes?

A. interface G0/0
ip address 209.165.200.225 255.255.255.224
ip nat outside
interface G0/1
ip address 10.1.1.1 255.255.255.0
ip nat inside
ip nat inside source static tcp 209.165.200.225 8080 10.1.1.100 8080

B. interface G0/0
ip address 209.165.200.225 255.255.255.224
ip nat inside
interface G0/1
ip address 10.1.1.1 255.255.255.0
ip nat outside
ip nat inside source static tcp 10.1.1.1 8080 209.165.200.225 80

C. interface G0/0
ip address 209.165.200.225 255.255.255.224
ip nat outside
interface G0/1
ip address 10.1.1.1 255.255.255.0
ip nat inside
ip nat inside source static tcp 10.1.1.1 8080 209.165.200.225 80

D. interface G0/0
ip address 209.165.200.225 255.255.255.224
ip nat inside
interface G0/1
ip address 10.1.1.1 255.255.255.0
ip nat outside
ip nat inside source static tcp 209.165.200.225 80 10.1.1.100 8080










Correct Answer: C

A network engineer must configure the VTY lines on a router to achieve these results:
· Remote access should be permitted only for secure protocols.
· Only a password should be required for device authentication.
· All idle EXEC sessions must be terminated in 60 minutes.
Which configuration should be applied?

A. line vty 0 15
password Cisco123
transport input ssh
exec-timeout 60

B. line vty 0 15
login
password Cisco123
transport input ssh
exec-timeout 60

C. line vty 0 15
password Cisco123
transport input telnet ssh
exec-timeout 60

D. line vty 0 15
password Cisco123
transport input all
session-timeout 60










Correct Answer: B

How does NETCONF YANG represent data structures?

A. as strict data structures defined by RFC 6020

B. in an XML tree format

C. in an HTML format

D. as modules within a tree










Correct Answer: B

Refer to the exhibit. An engineer must modify the existing configuration so that R2 can take over as the primary router when serial interface 0/0.1 on R1 goes down. Which command must the engineer apply?

A. R2# standby 100 preempt

B. R2# standby 100 priority 100

C. R2# standby 100 track 26 decrement 10

D. R2# track 26 interface Serial0/0.1 line-protocol










Correct Answer: A

Refer to the exhibit. An engineer deploys a script to retrieve the running configuration from a NETCONF-capable Cisco IOS XE device that is configured with default settings. The script fails. Which configuration must be applied to retrieve the configuration using NETCONF?

A. print (netconf_host.get_config(`show running'))

B. port=830

C. device_params=(`name':'los-xe'})

D. hostkey_verify=True,










Correct Answer: B

Refer to the exhibit. Which action must be taken to configure a WLAN for WPA2-AES with PSK and allow only 802.11r-capable clients to connect?

A. Enable Fast Transition and FT + PSK.

B. Enable Fast Transition and PSK.

C. Change Fast Transition to Adaptive Enabled and enable FT + PSK.

D. Enable PSK and FT + PSK










Correct Answer: A

Refer to the exhibit. Which address type is 10.10.10.10 configured for?

A. outside global

B. inside global

C. outside local

D. inside local










Correct Answer: D

Refer to the exhibit. What is the result of the NTP configuration?

A. The router will use the address of loppback 0 to communicate with the NTP server.

B. The router will advertise but not listen to NTP broadcast packets.

C. The router will be used as an NTP authoritative server only if it synchronized with an outside source.

D. The router will be used as an NTP authoritative server, even if it is not synchronized with an outside source.










Correct Answer: D

Refer to the exhibit. An engineer must create a manually triggered EEM applet to enable the R2 router interface and assign an IP address to it.
What is required to complete this configuration?

A. R2(config-apple)#action 4 cli command "ip add 172.16.1.1 0.0.0.255"

B. R2(config)# event manager session cli username

C. R2(config-applet)# event oir

D. R2(config-applet)# event none sync yes










Correct Answer: D

What is stateful switchover?

A. cluster protocol used to facilitate switch failover

B. mechanism to take control from a failed RP while maintaining connectivity

C. mechanism used to prevent routing protocol loops during an RP switchover

D. First Hop Redundancy Protocol for host gateway connectivity










Correct Answer: B

Which two features are available only in next-generation rewalls? (Choose two.)

A. application awareness

B. packet filtering

C. stateful inspection

D. deep packet inspection

E. virtual private network








Correct Answer: AD

Refer to the exhibit. Which result is achieved by the CoPP configuration?

A. traffic that matches entry 10 of ACL 100 is always dropped.

B. Class-default is dropped.

C. traffic that matches entry 10 of ACL 100 is always allowed with a limited CIR.

D. traffic that matches entry 10 of ACL 100 is always allowed.










Correct Answer: D

An engineer must use flexible NetFlow on a group of switches. To prevent overloading of the flow connector, if the flow is idle for 20 seconds, the flow sample should be exported. Which command set should be applied?

A. flow record record flow
exporter owexport
record record flow
cache timeout active 120
cache timeout inactive 20
cache type immediate

B. flow monitor monitor flow
exporter owexport
record record flow
cache timeout active 120
cache timeout inactive 20
cache type immediate

C. flow monitor monitor flow
exporter record flow
cache timeout active 120
cache timeout inactive 20
cache type permanent

D. flow record record flow
match ipv6 destination ip-address
match ipv6 source ip-address
match ipv6 protocol-type view
match interface input
match interface output
match transport destination-port
collect counter bytes long










Correct Answer: B

When a branch location loses connectivity, which Cisco FlexConnect state rejects new users but allows existing users to function normally?

A. Authentication-Down/Switch-Local

B. Authentication-Down/Switching-Down

C. Authentication-Central/Switch-Local

D. Authentication-Local/Switch-Local










Correct Answer: A

Refer to the exhibit. Which action does the Python script accomplish?

A. connects to the device using Telnet and exports the routing table information

B. connects to the device using SSH and exports the routing table information

C. displays the output of the show command in an unformatted way

D. displays the output of the show command in a formatted way










Correct Answer: B

An engineer must configure interface and sensor monitoring on a router. The NMS server is located in a trusted zone with IP address 10.15.2.19. Communication between the router and the NMS server must be encrypted and password-protected using the most secure algorithms. Access must be allowed only for the NMS server and with the minimum permission levels needed. Which configuration must the engineer apply?

A. ip access-list extended nms
permit 1 host 10.15.2.19 any
snmp-server view ro internet included
snmp-server view ro ifEntry included
snmp-server group nms v3 priv notify ro access nms
snmp-server user user1 nms v3 encrypted auth md5 Password1 pri 3des Password123

B. ip access-list standard nms
permit 10.15.2.19 0.0.0.0
snmp-server view ro iso included
snmp-server view ro ifEntry included
snmp-server group nms v3 priv read ro access nms
snmp-server user user1 nms v3 auth sha Password1 pri aes 256 Password123

C. ip access-list standard nms
permit 10.15.2.19 0.0.0.0
snmp-server view rw iso included
snmp-server view rw ifEntry included
snmp-server group nms v3 auth write rw access nms
snmp-server user user1 nms v3 auth des Password1 pri des Password123

D. ip access-list standard nms
permit 10.15.2.19 255.255.255.255
snmp-server view ro iso included
snmp-server view ro ifEntry included
snmp-server group nms v3 priv read ro access nms
snmp-server user user1 nms v3 auth 3des Password1 pri aes 192 Password123










Correct Answer: B

Refer to the exhibit. An engineer attempts to configure standby group 512 on interface GigabitEthernet0/1, but the configuration is not accepted.
Which command resolves this problem?

A. standby redirects

B. standby 512 priority 100

C. standby 512 preempt

D. standby version 2










Correct Answer: D

Which type of antenna is designed to provide a 360-degree radiation pattern?

A. Yagi

B. patch

C. directional

D. omnidirectional










Correct Answer: D

Which two security mechanisms are used by Cisco Threat Defense to gain visibility into the most dangerous cyber threats? (Choose two.)

A. virtual private networks

B. file reputation

C. VLAN segmentation

D. traffic Telemetry

E. dynamic enforce policy








Correct Answer: BD

Which action is a LISP ITR responsible for?

A. responding to map-request messages

B. forwarding user data traffic

C. nding EID-to-RLOC mappings

D. accepting registration requests from ETRs










Correct Answer: C

An engineer modifies the existing ISE guest portal URL to use a static FQDN. Users immediately report that they receive certificate errors when they are redirected to the new page. Which two additional configuration steps are needed to implement the change? (Choose two.)

A. Add a new DNS record to resolve the FQDN to the PSN IP address

B. Create and sign a new CSR that contains the static FQDN entry

C. Manually configure the hosts file on each user device.

D. Disable HTTPS on the WLC under the Management menu

E. Add the FQDN entry under the WLC virtual interface








Correct Answer: AB

Which JSON script is properly formatted?





A. C
Correct Answer:

What is contained in the VXLAN header?

A. VXLAN network identifier

B. source and destination RLOC ID

C. endpoint ID

D. original Layer 2 VLAN ID










Correct Answer: D

Refer to the exhibit. Clients are reporting an issue with the voice traffic from the branch site to the central site. What is the cause of this issue?

A. There is a routing loop on the network

B. There is a high delay on the WAN links

C. traffic is load-balancing over both links, causing packets to arrive out of order

D. The voice traffic is using the link with less available bandwidth










Correct Answer: C

Which virtualization component creates VMs and performs hardware abstraction that allows multiple VMs to run at the same time?

A. container

B. Docker

C. hypervisor

D. rkt










Correct Answer: C

Refer to the exhibit. An SSID is configured and both clients can reach their gateways on the Layer 3 switch, but they cannot communicate with each other. Which action resolves this issue?

A. Set the WMM Policy to Allowed

B. Set the P2P Blocking Action to Disabled

C. Set the WMM Policy to Required

D. Set the P2P Blocking Action to Forward-UpStream










Correct Answer: B

What is a characteristic of VXLAN?

A. It extends Layer 2 and Layer 3 overlay networks over a Layer 2 underlay

B. It has a 12-byte packet header

C. It uses TCP for transport,

D. It is a multi-tenant solution.










Correct Answer: D

Which network devices secure API platforms?

A. content switches

B. web application rewalls

C. next-generation intrusion detection systems

D. Layer 3 transit network devices










Correct Answer: B

What does Call Admission Control require the client to send in order to reserve the bandwidth?

A. SIP flow information

B. Wi-Fi multimedia

C. VoIP media session awareness

D. traffic specification










Correct Answer: D

Which capability does a distributed virtual switch have?

A. use floating static routes

B. provide configuration consistency across the hosts

C. run dynamic routing protocols

D. use advanced IPsec encryption algorithms










Correct Answer: B

Which two methods are used to assign security group tags to the user in a Cisco TrustSec. architecture? (Choose two.)

A. web authentication

B. IEEE 802.1x

C. DHCP

D. modular QoS

E. policy routing








Correct Answer: BC

Which resource must the hypervisor make available to the virtual machines?

A. bandwidth

B. IP address

C. processor

D. secure access










Correct Answer: C

Refer to the exhibit. An engineer must configure a Cisco WLC with WPA2 Enterprise mode and avoid global server lists. Which action is required?

A. Enable EAP parameters

B. Apply CISCO ISE default settings

C. Select a RADIUS authentication server

D. Disable the RADIUS server accounting interim update










Correct Answer: C

Refer to the exhibit. An administrator must collect basic statistics about the approximate amount of IPv4 and IPv6 ows entering Gi0/0 using NetFlow. However, the administrator is concerned that NetFlow processing during periods of high utilization on Gi0/0 will overwhelm the router CPU. Which configuration minimizes CPU impact and keeps the data ows across Gi0/0 intact?





A.
















Correct Answer: A

Which two mechanisms are used with OAuth 2.0 for enhanced validation? (Choose two.)

A. authorization

B. custom headers

C. request management

D. authentication

E. accounting








Correct Answer: AD

Which characteristic applies to the endpoint security aspect of the Cisco Threat Defense architecture?

A. detect and block ransomware in email attachments

B. outbound URL analysis and data transfer controls

C. user context analysis

D. blocking of leless malware in real time










Correct Answer: D

Refer to the exhibit. An administrator writes a script to fetch the list of devices that are registered with Cisco DNA Center. Why does the execution abort?

A. The TLS certificate of DNA Center is invalid

B. The username or the password is incorrect

C. The "dna-center" hostname cannot be resolved to an IP address

D. The authentication URL is incorrect










Correct Answer: B

Which hypervisor requires a host OS to run and is not allowed to directly access the hosts hardware and resources?

A. native

B. bare metal

C. type 1

D. type 2










Correct Answer: D

Refer to the exhibit. The NETCONF object is sent to a Cisco IOS XE switch. What is the purpose of the object?

A. Discover the IP address of interface GigabitEthernet1

B. Remove the IP address from interface GigabitEthernet1

C. Set the description of interface GigabitEthernet1 to "1"

D. View the configuration of all GigabitEthernet interfaces










Correct Answer: A

Which protocol does Cisco SD-WAN use to protect control plane communication?

A. STUN

B. OMP

C. IPsec

D. DTLS










Correct Answer: D

Which security option protects credentials from sniffer attacks in a basicAPI authentication?

A. next-generation firewall

B. TLS or SSL for communication

C. VPN connection between client and server

D. AAA services to authenticate the API










Correct Answer: B

An engineer must configure router R1 to validate user logins via RADIUS and fall back to the local user database if the RADIUS server is not available. Which configuration must be applied?

A. aaa authentication exec default radius local

B. aaa authentication exec default radius

C. aaa authorization exec default radius local

D. aaa authorization exec default radius










Correct Answer: A

What does the Cisco WLC Layer 3 roaming feature allow clients to do?

A. maintain their IP address when roaming to an AP or controller with a different client VLAN assignment

B. maintain their connection between APs even when the AP management VLANs are different

C. maintain their connection even if the client IP address changes when roaming

D. roam seamlessly between controllers even when the controller management VLANs are different










Correct Answer: A

Which JSON script is properly formatted?





A.
















Correct Answer: A

What is the function of Cisco DNA Center in a Cisco SD-Access deployment?

A. It is responsible for the design, management, deployment, provisioning, and assurance of the fabric network devices

B. It is responsible for routing decisions inside the fabric

C. It provides integration and automation for all nonfabric nodes and their fabric counterparts

D. It possesses information about all endpoints, nodes, and external networks related to the fabric










Correct Answer: A

How do the MAC address table and TCAM differ?

A. TCAM is populated from the ARP file, and the MAC address table is populated from the switch configuration file

B. TCAM stores Layer 2 forwarding information, and the MAC address table stores QoS information

C. TCAM lookups can match only 1s and 0s, and MAC address lookups can match 1s, 0s and a third "care/don't care" state

D. TCAM is a type of memory and the MAC address table is a logical structure










Correct Answer: D

Which technology provides an overlay fabric to connect remote locations utilizing commodity data paths and improves network performance, boosts security, and reduces costs?

A. In niBand

B. VTEP

C. SD-WAN

D. VXLAN










Correct Answer: C

Which two actions are recommended as security best practices to protect REST API? (Choose two.)

A. Enable dual authentication of the session

B. Use a password hash

C. Use SSL for encryption

D. Use TACACS+ authentication

E. Enable out-of-band authentication








Correct Answer: AC

Refer to the exhibit. An engineer is configuring WebAuth on a Cisco Catalyst 9800 Series WL

A. The engineer has purchased a third-party certificate using the FQDN of the WLC as the CN and intends to use it on the WebAuth splash page. What must be configured so that the clients do not receive a certificate error?

B. Virtual IPv4 Hostname must match the CN of the certificate

C. Virtual IPv4 Address must be set to a routable address

D. Web Auth Intercept HTTPs must be enabled

E. Trustpoint must be set to the management certificate of the WLC








Correct Answer: A

Refer to the exhibit. Which configuration must be added to enable remote access only using SSHv1 or SSHv2 to this router?





A. C
Correct Answer:

Refer to the exhibit. What is the output of this code?

A. 1st_item#######: 645298791871446
2nd_item_that_must_display: jlugyydt##

B. 1st_item#######: 6452987918
2nd_item_that_m: jlugyydt##

C. 1st_item#######: 8791871446
at_must_display: jlugyydt

D. 645298791871446
##jlugyydt










Correct Answer: B

Refer to the exhibit. An engineer is troubleshooting an issue with non-Wi-Fi interference on the 5-GHz band. The engineer has enabled Cisco CleanAir and set the appropriate traps, but the AP does not change the channel when it detects significant interference. Which action will resolve the issue?

A. Enable the Avoid Persistent Non-WiFi interference option

B. Change the DCA Sensitivity option to High

C. Enable the Event Driven Radio Resource Management option

D. Disable the Avoid Foreign AP Interference option










Correct Answer: C

Refer to the exhibit. What is achieved by the XML code?

A. It displays the access list sequence numbers from the output of the show ip access-list extended p command on the terminal screen

B. It displays the output of the show ip access-list extended p command on the terminal screen

C. It reads the access list sequence numbers from the output of the show ip access-list extended p command into a dictionary list

D. It reads the output of the show ip access-list extended p command into a dictionary list










Correct Answer: D

An engineer measures the Wi-Fi coverage at a customer site The RSSI values are recorded as follows:
· Location A: -72 dBm
· Location B: -75 dBm
· Location C -65 dBm
· Location D -80 dBm
Which two statements does the engineer use to explain these values to the customer? (Choose two.)

A. The signal strength at location C is too weak to support web sur ng

B. Location D has the strongest RF signal strength

C. The RF signal strength at location B is 50% weaker than location A

D. The RF signal strength at location C is 10 times stronger than location B

E. The signal strength at location B is 10 dB better than location C








Correct Answer: CD

Where are operations related to software images located in the Cisco DNA Center GUI?

A. Services

B. Provisioning

C. Assurance

D. Design










Correct Answer: B

What is a difference between OSPF and EIGRP?

A. OSPF uses a default hello timer of 5 seconds. EIGRP uses a default hello timer of 10 seconds.

B. OSPF uses multicast addresses 224.0.0.5 and 224.0.0.6. EIGRP uses multicast address 224.0.0.10.

C. OSPF uses an administrative distance of 115. EIGRP uses an administrative distance of 160.

D. OSPF uses IP protocol number 88. EIGRP uses IP protocol number 89.










Correct Answer: B

Which feature is provided by Cisco Mobility Services Engine in a Cisco Wireless unified Network architecture?

A. It adds client packet capturing.

B. It enables NetFlow data collection.

C. It adds client tracking and location API.

D. It identifies authentication problems.










Correct Answer: C

Which unit of measure is used to measure wireless RF SNR?

A. dBi

B. dB

C. dBm

D. mW










Correct Answer: C

In a campus network design, what are two benefits of using BFD for failure detection? (Choose two.)

A. BFD speeds up routing convergence time.

B. BFD is an efficient way to reduce memory and CPU usage.

C. BFD provides fault tolerance by enabling multiple routers to appear as a single virtual router.

D. BFD provides path failure detection in less than a second.

E. BFD enables network peers to continue forwarding packets in the event of a restart.








Correct Answer: AD

Refer to the exhibit. A network engineer issues the debug command while troubleshooting a network issue. What does the output confirm?

A. ACL 100 is tracking ICMP traffic from 10.1.1.1 destined for 1.1.1.1.

B. ACL100 is tracking all traffic from 10.1.1.1 destined for 1.1.1.1.

C. ACL100 is tracking ICMP traffic from Serial1/0 destined for Serial3/0.

D. ACL100 is tracking ICMP traffic from 1.1.1.1 destined for 10.1.1.1.










Correct Answer: D

Refer to the exhibit. An engineer must update the existing configuration to achieve these results:
· Only administrators from the 192.168.1.0/24 subnet can access the vty lines.
· Access to the vty lines using clear-text protocols is prohibited.
Which command set should be applied?





A. C
Correct Answer:

Which version of NetFlow does Cisco Threat Defense utilize to obtain visibility into the network?

A. NBAR2

B. IPFIX

C. 8

D. flexible










Correct Answer: D

Refer to the exhibit. What is printed to the console when this script is run?

A. a key-value pair in tuple type

B. an error

C. a key-value pair in list type

D. a key-value pair in string type










Correct Answer: D

What is a difference between Chef and other automation tools?

A. Chef is an agentless tool that uses playbooks, and Ansible is an agent-based tool that uses cookbooks.

B. Chef is an agentless tool that uses a primary/minion architecture, and SaltStack is an agent-based tool that uses a primary/secondary architecture

C. Chef is an agent-based tool that uses cookbooks, and Ansible is an agentless tool that uses playbooks.

D. Chef uses Domain specific Language, and Puppet uses Ruby.










Correct Answer: C

An engineer must configure a new WLAN that supports 802.11r and requires users to enter a passphrase. What must be configured to support this requirement?

A. 802.1X and Fast Transition

B. FT PSK and Fast Transition

C. 802.1X and SUITEB-1X

D. FT PSK and SUITEB-1X










Correct Answer: D

Refer to the exhibit. An engineer is troubleshooting an mDNS issue in an environment where Cisco ISE is used to dynamically assign mDNS roles to users. The engineer has confirmed that ISE is sending the correct values, but name resolution is not functioning as expected. Which WLC configuration change resolves the issue?

A. Enable AAA Override.

B. Enable Aironet I

C. Set MFP client protection to Required.

D. Change NAC state to ISE NA

E.








Correct Answer: A

What is one role of the VTEP in a VXLAN environment?

A. to maintain VLAN configuration consistency

B. to forward packets to non-LISP sites

C. to provide EID-to-RLOC mapping

D. to encapsulate the tunnel










Correct Answer: D

How is CAPWAP data traffic encapsulated when running an Over the Top WLAN in a Cisco SD-Access wireless environment?

A. LISP

B. VXLAN

C. GRE

D. IPsec










Correct Answer: B

Refer to the exhibit. What does the Python code accomplish?

A. It configures interface e1/32 to be in an admin down state

B. It generates a status code of 403 because the type is incorrect.

C. It configures interface e1/32 to be in an err-disable state.

D. It returns data in JSON-RPC format.










Correct Answer: A

Refer to the exhibit. Which action must be performed to allow RESTCONF access to the device?

A. Enable the NETCONF service.

B. Enable the SSH service.

C. Enable the IOX service.

D. Enable the HTTPS service.










Correct Answer: D

Which JSON script is properly formatted?





A.
















Correct Answer: C

Which technology is used as the basis for the Cisco SD-Access data plane?

A. LISP

B. 802.1Q

C. VXLAN

D. IPsec










Correct Answer: C

How is OAuth framework used in REST API?

A. as a framework to hash the security information in the REST URL

B. by providing the external application a token that authorizes access to the account

C. as a framework to hide the security information in the REST URL

D. by providing the user credentials to the external application










Correct Answer: B

What is a characteristic of Cisco DNA southbound APIs?

A. implements monitoring by using the SOAP protocol

B. enables orchestration and automation of network devices based on intent

C. utilizes REST API

D. simpli es management of network devices










Correct Answer: D

Where is the wireless LAN controller located in a mobility express deployment?

A. The wireless LAN controller exists in a server that is dedicated for this purpose.

B. The wireless LAN controller is embedded into the access point.

C. The wireless LAN controller exists in the cloud.

D. There is no wireless LAN controller in the network.










Correct Answer: B

Refer to the exhibit. A network engineer must permit administrators to automatically authenticate if there is no response from either of the AAA servers. Which configuration achieves these results?

A. aaa authentication enable default group radius local

B. aaa authentication login default group radius

C. aaa authentication login default group tacacs+ line

D. aaa authentication login default group radius none










Correct Answer: D

What is one difference between SaltStack and Ansible?

A. SaltStack uses the Ansible agent on the box, whereas Ansible uses a Telnet server on the box.

B. SaltStack uses an API proxy agent to program Cisco boxes in agent mode, whereas Ansible uses a Telnet connection.

C. SaltStack uses SSH to interact with Cisco devices, whereas Ansible uses an event bus.

D. SaltStack is constructed with minion, whereas Ansible is constructed with YAML.










Correct Answer: D

Which protocol is used to encrypt control plane traffic between SD-WAN controllers and SD-WAN endpoints?

A. DTLS

B. IPsec

C. PGP

D. HTTPS










Correct Answer: A

A customer has a pair of Cisco 5520 WLCs set up in an SSO cluster to manage all APs. Guest traffic is anchored to a Cisco 3504 WLC located in a DMZ. Which action is needed to ensure that the EoIP tunnel remains in an UP state in the event of failover on the SSO cluster?

A. Use the same mobility domain on all WLCs.

B. Enable default gateway reachability check.

C. configure back-to-back connectivity on the RP ports.

D. Use the mobility MAC when the mobility peer is configured.










Correct Answer: D

Which configuration lters out DOT1X messages in the format shown below from being sent toward Syslog server 10.15.20.33?
Nov 20 13:47:32/553 %DOT1X-5-FAIL:Authentication failed for client (e04f.438e.de4f) on interface Gi1/0/1 AudtiSessionID 0A0B50A5000004543910739E

A. logging discriminator DOT1X facility drops DOT1X
logging host 10.15.20.33 discriminator DOT1X

B. logging discriminator DOT1X msg-body drops DOTX
logging host 10.15.20.33 discriminator DOTX

C. logging discriminator DOT1X mnemonics includes DOTX
logging host 10.15.20.33 discriminator DOT1X

D. logging discriminator DOT1X mnemonics includes DOT1X
logging host 10.15.20.33 discriminator DOTX










Correct Answer: B

Refer to the exhibit. A network engineer is troubleshooting an issue with the file server based on reports of slow file transmissions. Which two commands or command sets are required to switch SW1 to analyze the traffic from the file server with a packet analyzer? (Choose two.)

A. SW1#show monitor

B. SW1(config)#monitor session 1 source interface gigabitethernet0/3
SW1(config)#monitor session 1 destination interface gigabitethernet0/1 encapsulation replicate

C. SW1#show ip route

D. SW1#show vlan

E. SW1(config)#monitor session 1 source interface gigabitethernet0/1
SW1(config)#monitor session 1 destination interface gigabitethernet0/3 encapsulation replicate AB
Correct Answer:

What are two benefits of implementing a Cisco SD-WAN architecture? (Choose two.)

A. It enforces a single, scalable, hub-and-spoke topology.

B. It simpli es endpoint provisioning through standalone router management.

C. It allows configuration of application-aware policies with real time enforcement.

D. It improves endpoint protection by integrating embedded and cloud security features.

E. It provides resilient and effective traffic flow using MPLS.








Correct Answer: CD

Which two functions is an edge node responsible for? (Choose two.)

A. authenticates endpoints

B. provides the default entry point for fabric traffic

C. provides multiple entry and exit points for fabric traffic

D. provides the default exit point for fabric traffic

E. provides a host database that maps endpoint IDs to a current location








Correct Answer: AC

Refer to the exhibit. Which two configurations enable R1 and R2 to advertise routes into OSPF? (Choose two.)

A. R2 -
router ospf 0
network 172.16.1.0 0.0.0.255 area 0
network 172.16.2.0 0.0.0.255 area 0

B. R1 -
router ospf 0
network 192.168.1.0 255.255.255.0 area 0
network 192.168.2.0 255.255.255.0 area 0

C. R2 -
router ospf 0
network 172.16.1.0 255.255.255.0 area 0
network 172.16.2.0 255.255.255.0 area 0

D. R1 -
router ospf 0
network 192.168.1.0 0.0.0.255 area 0
network 192.168.2.0 0.0.0.255 area 0

E. R2 -
router ospf 0
network 172.16.1.0 0.0.0.255 area 0
network 172.16.2.0 255.255.255.0 area 0








Correct Answer: AD

Which Python library is used to work with YANG data models via NETCONF?

A. ncclient

B. requests

C. cURL

D. Postman










Correct Answer: A

Refer to the exhibit. A network architect has partially configured static NAT. Which commands should be added to complete the configuration?

A. R1(config)# interface GigabitEthernet 0/0
R1(config)# ip pat inside -
R1(config)# interface GigabitEthernet 0/1
R1(config)# ip pat outside -

B. R1(config)# interface GigabitEthernet 0/0
R1(config)# ip pat outside -
R1(config)# interface GigabitEthernet 0/1
R1(config)# ip pat inside -

C. R1(config)# interface GigabitEthernet 0/0
R1(config-if)# ip nat inside -
R1(config)# interface GigabitEthernet 0/1
R1(config-if)# ip nat outside -

D. R1(config)# interface GigabitEthernet 0/0
R1(config-if)# ip nat outside -
R1(config)# interface GigabitEthernet 0/1
R1(config-if)# ip nat inside










Correct Answer: D

Refer to the exhibit. An engineer must allow the FTP traffic from users on 172.16.1.0 /24 to 172.16.2.0 /24 and block all other traffic. Which configuration must be applied?

A. R1(config)# access-list 120 permit tcp 172.16.1.0 0.0.0.255 21 172.16.2.0 0.0.0.255 R1 (config)#interface giga 0/2 -
R1 (config-if)#ip access-group 120 in

B. R1(config)# access-list 120 permit tcp 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255 20 R1(config)# access-list 120 permit tcp 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255 21 R1(config)#interface giga 0/2 -
R1 (config-if)#ip access-group 120 in

C. R1 (config)# access-list 120 deny any any
R1(config)# access-list 120 permit tcp 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255 21 R1 (config)#interface giga 0/0 -
R1(config-if)#ip access-group 120 out

D. R1(config)# access-list 120 permit tcp 172.16.1.0 0.0.0.255 21 172.16.2.0 0.0.0.255 R1(config)# access-list 120 permit udp 172.16.1.0 0.0.0.255 21 172.16.2.0 0.0.0.255 R1 (config)#interface giga 0/2 -
R1(config-if)#ip access-group 120 out










Correct Answer: B

High bandwidth utilization is occurring on interface Gig0/1 of a router. An engineer must identify the ows that are consuming the most bandwidth. Cisco DNA Center is used as a flow exporter and is configured with the IP address 192.168.23.1 and UDP port 23000. Which configuration must be applied to set NetFlow data export and capture on the router?





A.
















Correct Answer: A

Which DNS record type is required to allow APs to discover a WLC by using DNS on IPv4?

A. NS

B. A

C. SOA

D. MX










Correct Answer: B

What is modularity in network design?

A. ability to bundle several functions into a single layer of the network

B. ability to create self-contained, repeatable sections of the network

C. ability to self-heal the network to prevent service outages

D. ability to scale and accommodate future needs of the network










Correct Answer: B

Refer to the exhibit. An engineer configured TACACS+ to authenticate remote users, but the configuration is not working as expected. Which configuration must be applied to enable access?

A. R1 (config)# ip tacacs source-interface Gig 0/0

B. R1 (config)# tacacs server prod -
R1(config-server-tacacs)# port 1020

C. R1 (config)# aaa authorization exec default group tacacs+ local

D. R1 (config)# tacacs server prod -
R1(config-server-tacacs)# key cisco123










Correct Answer: D

A customer has two Cisco WLCs that manage separate APs throughout a building. Each WLC advertises the same SSID but terminates on different interfaces. Users report that they drop their connections and change IP addresses when roaming. Which action resolves this issue?

A. configure high availability.

B. Enable fast roaming.

C. configure mobility groups.

D. Enable client load balancing










Correct Answer: C

What is one difference between the RIB and the FIB?

A. The RIB keeps all routing information received from peers, and the FIB keeps the minimum information necessary to make a forwarding decision.

B. The RIB works at the data plane, and the FIB works at the control plane.

C. The FIB contains routing prefixes, and the RIB contains the Layer 2 and Layer 3 information necessary to make a forwarding decision.

D. The RIB is known as the CEF table, and the FIB is known as the routing table.










Correct Answer: A

What is a characteristic of an AP operating in FlexConnect mode?

A. All traffic traverses the WLC to ensure policy enforcement on client traffic.

B. Forwarding for locally switched traffic continues when the AP loses connectivity to the WL

C. APs connect in a mesh topology and elect a root AP

D. FlexConnect enables an AP to connect to multiple WLCs.










Correct Answer: D

What is the benefit of using TCAM for IP forwarding decisions versus using the CAM table?

A. TCAM finds results based on binary, and CAM uses the longest match to find results

B. TCAM processes lookups in a hardware CPU. and CAM relies on binary masks to find results.

C. TCAM finds results based on masks, and CAM finds results basing on exact match.

D. TCAM uses low cost hardware memory to store addresses, and CAM uses expensive hardware memory.










Correct Answer: C

Refer to the exhibit. Two indirectly connected routers fail to form an OSPF neighborship. What is the cause of the issue?

A. failing hello packets between the two routers

B. DR/BDR selection dispute

C. MTU mismatch

D. OSPF network type mismatch










Correct Answer: C

What is a characteristic of a Type 2 hypervisor?

A. It is completely independent of the operating system.

B. It is installed on an operating system and supports other operating systems.

C. It eliminates the need for an underlying operating system.

D. Its main task is to manage hardware resources between different operating systems.










Correct Answer: B

What are two benefits of implementing a traditional WAN instead of an SD-WAN solution? (Choose two.)

A. lower control plane abstraction

B. faster fault detection

C. simplified troubleshooting

D. comprehensive configuration standardization

E. lower data plane overhead








Correct Answer: CD

Which technology uses network traffic telemetry, contextual information, and file reputation to provide insight into cyber threats?

A. security services

B. security intelligence

C. segmentation

D. threat defense










Correct Answer: B

Which IEEE standard provides the capability to permit or deny network connectivity based on the user or device identity?

A. 802.1d

B. 802.1w

C. 802.1q

D. 802.1x










Correct Answer: D

Refer to the exhibit.

The CPE router acts as a DHCP server for the locally attached LAN. After DHCP snooping is enabled on the switch where the DHCP clients are connected, clients are unable to obtain their configuration from the DHCP server. What is the cause of this issue?

A. The IP address of the DHCP server is in the excluded DHCP range.

B. The configuration of Gi0/1 is missing the ip helper-address 192.168.255.1 command.

C. The DHCP server drops DHCP packets carrying Option 82 and an empty relay agent IP address.

D. The excluded DHCP range contains the subnet address of the entire LAN network.










Correct Answer: C

Which solution simpli es management of secure access to network resources?

A. RFC 3580-based solution to enable authenticated access leveraging RADIUS and AV pairs

B. 802.1AE to secure communication in the network domain

C. ISE to automate network access control leveraging RADIUS AV pairs

D. TrustSec to logically group internal user environments and assign policies










Correct Answer: C

What is the recommended minimum SNR for data applications on wireless networks?

A. 20

B. 25

C. 15

D. 10










Correct Answer: A

What does the Cisco DNA Center Authentication API provide?

A. list of VLAN names

B. client health status

C. access token to make calls to Cisco DNA Center

D. list of global issues that are logged in Cisco DNA Center










Correct Answer: C

What does the destination MAC on the outer MAC header identify in a VXLAN packet?

A. the leaf switch

B. the next hop

C. the remote switch

D. the remote spine










Correct Answer: B

What does the statement print(format(0.8, '.0%')) display?
Correct Answer: D


















Correct Answer: D

An engineer must implement a configuration to allow a network administrator to connect to the console port of a router and authenticate over the network. Which command set should the engineer use?

A. aaa new-model
aaa authentication login console local

B. aaa new-model
aaa authentication login console group radius

C. aaa new-model
aaa authentication login default enable

D. aaa new-model
aaa authentication enable default










Correct Answer: B

When a DNS host record is configured for a new Cisco AireOS WLC, which hostname must be added to allow APs to successfully discover the WLC?

A. CONTROLLER-CAPWAP-CISCO

B. CISCO-CONTROLLER-CAPWAP

C. CAPWAP-CISCO-CONTROLLER

D. CISCO-CAPWAP-CONTROLLER










Correct Answer: D

Refer to the exhibit. An engineer tries to log in to router R1. Which configuration enables a successful login?

A. R1#username admin privilege 15 -
aaa authorization exec default local

B. R1#username admin privilege 15 -
aaa authorization exec default local
netconf-yang

C. R1#netconf-yang -
username admin privilege 15 secret cisco123
aaa new-model
aaa authorization exec default local

D. R1#aaa new-model -
aaa authorization exec default local
enable aaa admin privilege 15










Correct Answer: C

Which statement must be used to export the contents of the devices object in JSON format?


A. json.repr(Devices)

B. json.loads(Devices)

C. json.print(Devices)

D. json.dumps(Devices)










Correct Answer: D

Why does the vBond orchestrator have a public IP?

A. to allow for global reachability from all WAN Edges in the Cisco SD-WAN and to facilitate NAT traversal

B. to provide access to Cisco Smart Licensing servers for license enablement

C. to enable vBond to learn the public IP of WAN Edge devices that are behind NAT gateways or in private address space

D. to facilitate downloading and distribution of operational and security patches










Correct Answer: A

Why would a small or mid-size business choose a cloud solution over an on-premises solution?

A. Cloud provides greater ability for customization than on-premises.

B. Cloud provides more control over the implementation process than on-premises.

C. Cloud provides lower upfront cost than on-premises.

D. Cloud provides higher data security than on-premises.










Correct Answer: C

Which two new security capabilities are introduced by using a next-generation firewall at the Internet edge? (Choose two.)

A. stateful packet inspection

B. integrated intrusion prevention

C. NAT

D. VPN

E. application-level inspection








Correct Answer: BE

Refer to the exhibit. An engineer builds an EEM script to apply an access list. Which statement must be added to complete the script?

A. action 6.0 cli command "ip access-list extended 101"

B. action 3.1 cli command "ip access-list extended 101"

C. event none

D. action 2.1 cli command "ip access-list extended 101"










Correct Answer: C

Refer to the exhibit. An engineer is troubleshooting an issue with client devices triggering excessive power changes on APs in the 2.4 GHz band.
Which action resolves this issue?

A. Disable Aironet I

B. Set the 802.11b/g/n DTIM interval to 0.

C. Enable MFP Client Protection.

D. Disable Coverage Hole Detection.










Correct Answer: D

Refer to the exhibit. What is the effect of these commands on the BR and HQ tunnel interfaces?


A. The keepalives are sent every 3 seconds and 5 retries.

B. The tunnel line protocol goes down when the keepalive counter reaches 5.

C. The keepalives are sent every 5 seconds and 3 retries.

D. The tunnel line protocol goes down when the keepalive counter reaches 6.










Correct Answer: C

By default, which virtual MAC address does HSRP group 30 use?

A. 05:0c:5e:ac:07:30

B. 00:00:0c:07:ac:1e

C. 00:43:19:74:89:1e

D. 00:05:0c:07:ac:30










Correct Answer: B

Which NTP mode must be activated when using a Cisco router as an NTP authoritative server?

A. primary

B. peer

C. broadcast client

D. server










Correct Answer: B

Refer to the exhibit.

Which router is elected as the VRRP primary virtual router?

A. Router A

B. Router B

C. Router C

D. Router D










Correct Answer: C

An engineer applies this EEM applet to a router:

What does the applet accomplish?

A. It generates a syslog message every 600 seconds on the status of the speci ed MAC address.

B. It compares syslog output to the MAC address table every 600 seconds and generates an event when no match is found.

C. It compares syslog output to the MAC address table every 600 seconds and generates an event when there is a match.

D. It checks the MAC address table every 600 seconds to see if the speci ed address has been learned.










Correct Answer: D

Which authorization framework gives third-party applications limited access to HTTP services?

A. IPsec

B. GRE

C. Basic Auth

D. OAuth 2.0










Correct Answer: D

How does Cisco Express Forwarding switching differ from process switching on Cisco devices?

A. Cisco Express Forwarding switching saves memory by storing adjacency tables in dedicated memory on the line cards, and process switching stores all tables in the main memory.

B. Cisco Express Forwarding switching uses adjacency tables built by the CDP protocol, and process switching uses the routing table.

C. Cisco Express Forwarding switching uses dedicated hardware processors, and process switching uses the main processor.

D. Cisco Express Forwarding switching uses a proprietary protocol based on IS-IS for MAC address lookup, and process switching uses the MAC address table.










Correct Answer: A

Refer to the exhibit. What is the result of running this code?

A. A list of lists is created.

B. A list of new VLANs is created.

C. An error is displayed.

D. A dictionary is created.










Correct Answer: B

Refer to the exhibit. The administrator configures an ERSPAN session, but no packets are received on the destination host. Which action is required to complete the configuration?

A. Ensure that the ERSPAN destination addresses are not reachable through the Mgmt-vrf VR

B. Ensure that the ERSPAN destination is reachable from the switch.

C. configure the ERSPAN destination VLAN as an RSPAN VLAN.

D. Enable the ERSPAN session.










Correct Answer: D

Refer to the exhibit. Which command is required on router R1 to start receiving RESTCONF requests?

A. R1(config)# ip http accounting commands 12 default

B. R1(config)# ip http server

C. R1(config)# restconf

D. R1(config)# ip http access-class 12










Correct Answer: C

What is a command-line tool for consuming REST APIs?

A. Python requests

B. Postman

C. cURL

D. Firefox










Correct Answer: C

An engineer receives a report that an application exhibits poor performance. On the switch where the server is connected, this syslog message is visible: SW_MATM-4-MACFLAP_NOTIF: Host 0054.3962.7651 in vlan 14 is apping between port Gi1/0/1 and port Gi1/0/2.
What is causing the problem?

A. undesirable load-balancing configuration on the switch

B. invalid port channel configuration on the switch

C. wrong SFP+ and cable connected between the server and the switch

D. failed NIC on the server










Correct Answer: A

Refer to the exhibit. Why does the OSPF neighborship fail between the two interfaces?

A. The MTU is not the same.

B. The OSPF timers are different.

C. There is a mismatch in the OSPF interface network type.

D. The IP subnet mask is not the same.










Correct Answer: D

Which technology enables a redundant supervisor engine to take over when the primary supervisor engine fails?

A. SSO

B. FHRP

C. graceful restart

D. NSF










Correct Answer: A

A customer requires their wireless data traffic to egress at the switch port of the access point. Which access point mode supports this?

A. FlexConnect

B. Sniffer

C. Bridge

D. Monitor










Correct Answer: A

What is a capability of the Cisco DNA Center southbound API?

A. It adds support for managing non-Cisco devices from Cisco DNA Center.

B. It connects to ITSM services such as ServiceNow.

C. It sends webhooks from Cisco DNA Center when alerts are triggered.

D. It allows administrators to make API calls to Cisco DNA Center.










Correct Answer: A

Refer to the exhibit. Which command set enables router R2 to be configured via NETCONF?

A. R1(config)# netconf -
R1(config)# ip http secure-server

B. R1(config) # username Netconf privilege 15 password example_password
R1(config)# netconf-yang -
R1(config)# netconf-yang feature candidate-datastore

C. R1(config)# snmp-server manager -
R1(config)# snmp-server community ENCOR rw

D. R1(config)# snmp-server manager -
R1(config)# snmp-server community ENCOR ro










Correct Answer: B

In the Cisco DNA Center Image Repository, what is a golden image?

A. The latest software image that is available for a specific device type.

B. The Cisco recommended software image for a specific device type.

C. A software image that is compatible with multiple device types.

D. A software image that meets the compliance requirements of the organization.










Correct Answer: B

A wireless administrator must create a new web authentication corporate SSID that will be using ISE as the external RADIUS server. The guest VLAN must be speci ed after the authentication completes. Which action must be performed to allow the ISE server to specify the guest VLAN?

A. Enable AAA Override.

B. Enable Network Access Control State.

C. Set AAA Policy name.

D. Set RADIUS Pro ling.










Correct Answer: D

An engineer must configure an EXEC authorization list that first checks a AAA server then a local username. If both methods fail, the user is denied. Which configuration should be applied?

A. aaa authorization exec default local group radius none

B. aaa authorization exec default group radius local none

C. aaa authorization exec default group radius local

D. aaa authorization exec default local group tacacs+










Correct Answer: C

Refer to the exhibit.

A company requires that all wireless users authenticate using dynamic key generation. Which configuration must be applied?

A. AP(config-if-ssid)# authentication open eap eap_methods

B. AP(config-if-ssid)# authentication dynamic open wep_dynamic

C. AP(config-if-ssid)# authentication dynamic wep wep_methods

D. AP(config-if-ssid)# authentication open wep wep_methods










Correct Answer: D

Refer to the exhibit. An engineer must deny HTTP traffic from host A to host B while allowing all other communication between the hosts. Which command set accomplishes this task?

A. SW1(config)# mac access-list extended HOST-A-B
SW1(config-ext-macl)# permit host aaaa.bbbb.cccc aaaa.bbbb.dddd
SW1(config)# ip access-list extended DENY-HTTP
SW1(config-ext-nacl)# deny tcp host 10.1.1.10 host 10.1.1.20 eq www
SW1(config)# vlan access-map DROP-MAC 10
SW1(config-access-map)# match mac address HOST-A-B
SW1(config-access-map)# action drop
SW1(config)# vlan access-map HOST-A-B 20
SW1(config-access-map)# match ip address DENY-HTTP
SW1(config-access-map)# action drop
SW1(config)# vlan filter HOST-A-B vlan 10

B. SW1(config)# ip access-list extended DENY-HTTP
SW1(config-ext-nacl)# deny tcp host 10.1.1.10 host 10.1.1.20 eq www
SW1(config)# ip access-list extended MATCH_ALL
SW1(config-ext-nacl)# permit ip any any
SW1(config)# vlan access-map HOST-A-B 10
SW1(config-access-map)# match ip address DENY-HTTP
SW1(config-access-map)# action drop
SW1(config)# vlan access-map HOST-A-B 20
SW1(config-access-map)# match ip address MATCH_ALL
SW1(config-access-map)# action forward
SW1(config)# vlan filter HOST-A-B vlan 10

C. SW1(config)# mac access-list extended HOST-A-B
SW1(config-ext-macl)# permit host aaaa.bbbb.cccc aaaa.bbbb.dddd
SW1(config)# ip access-list extended DENY-HTTP
SW1(config-ext-nacl)# permit tcp host 10.1.1.10 host 10.1.1.20 eq www
SW1(config)# vlan access-map DROP-MAC 10
SW1(config-access-map)# match mac address HOST-A-B
SW1(config-access-map)# action forward
SW1(config)# vlan access-map HOST-A-B 20
SW1(config-access-map)# match ip address DENY-HTTP
SW1(config-access-map)# action drop
SW1(config)# vlan filter HOST-A-B vlan 10












Correct Answer: B

A network engineer wants to configure console access to a router without using AAA so that the privileged exec mode is entered directly after a user provides the correct login credentials. Which action achieves this goal?

A. configure a RADIUS or TACACS+ server and use it to send the privilege level.

B. configure login authentication privileged on line con 0.

C. configure privilege level 15 on line con 0.

D. configure a local username with privilege level 15.










Correct Answer: B

Refer to the exhibit.

What is output by this code?

A. 0 5

B. 0 1 2 3 4 5

C. 0 1 2 3 4

D. (0,5)










Correct Answer: C

What is one benefit of implementing a data modeling language?

A. use XML style of data formatting

B. interoperability to allow unlimited implementations

C. machine-oriented logic and language-facilitated processing

D. conceptual representation makes interpretation simple










Correct Answer: C

Refer to the exhibit.

What is generated by the script?

A. the router processes

B. the cdp neighbors

C. the routing table

D. the running configuration










Correct Answer: D

What is a benefit of YANG modules?

A. tightly coupled models with encoding to improve performance

B. easier multivendor interoperability provided by common or industry models

C. avoidance of ecosystem fragmentation by having fixed modules that cannot be changed

D. single protocol and model coupling to simplify maintenance and support










Correct Answer: B

Refer to the exhibit.

An engineer must save the configuration of router R2 using the NETCONF protocol. Which script must be used?

A. 

B. 

C. 

D. 










Correct Answer: A

Which language defines the structure or modeling of data for NETCONF and RESTCONF?

A. YAML

B. XML

C. JSON

D. YANG










Correct Answer: C

Refer to the exhibit.

What is displayed when the code is run?

A. The answer is 100

B. The answer is 5

C. The answer is 25

D. The answer is 70










Correct Answer: A

What is the purpose of an integration API in Cisco DNA Center?

A. Obtain information about clients, sites, and topology from Cisco DNA Center.

B. Enable external systems to take actions in response to an event.

C. Allow the platform into approval chains in ITSM.

D. Enable discovery and control of the network by using HTTPS verbs.










Correct Answer: B

Refer to the exhibit.

What is the value of the variable list after the code is run?

A. [1, 2, 10]

B. [1, 2, 3, 10]

C. [1, 2, 10, 4]

D. [1, 10,10,10]










Correct Answer: C

Which signal strength and noise values meet the minimum SNR for voice networks?

A. signal strength -66 dBm, noise 90 dBm

B. signal strength -67 dBm, noise 91 dBm

C. signal strength -68 dBm, noise 89 dBm

D. signal strength -69 dBm, noise 94 dBm










Correct Answer: B

A customer requires their wireless network to be fully functional, even if the wireless controller fails. Which wireless design supports these requirements?

A. FlexConnect

B. mesh

C. centralized

D. embedded










Correct Answer: A

Which two conditions occur when the primary route processor fails on a switch that is using dual route processors with stateful switchover? (Choose two.)

A. Data forwarding can continue along known paths until routing protocol information is restored.

B. Data forwarding is stopped until the routing protocols reconverge after the switchover.

C. The standby route processor is fully initialized and state information is maintained.

D. User sessions are immediately recreated on the new active route processor.

E. The standby route processor initialization is started when the primary router processor fails.








Correct Answer: AC

Refer to the exhibit.

Which configuration must be added to R2 to enable PC3 to obtain a DHCP address and successfully ping PC1?

A. Router(config)# vrf definition PRODUCTION
Router(config-vrf)# address-family ipv4
Router(config)# interface GigabitEthernet 0/0
Router(config-if)# vrf forwarding PRODUCTION
Router(config-if)# ip address 10.199.0.1 255.255.252.0
Router(config)# ip dhcp pool R&D
Router(dhcp-config)# vrf PRODUCTION

B. Router(config)# vrf definition PRODUCTION
Router(config-vrf)# rd 1:100 -
Router(config)# router eigrp 100
Router(config-rtr)# redistribute vrf PRODUCTION

C. Router(config)# vrf definition PRODUCTION
Router(config-vrf)# vnet tag 100
Router(config)# interface GigabitEthernet 0/0
Router(config-if)# vnet trunk -

D. Router(config)# vrf definition PRODUCTION
Router(config-vrf)# rd 1:100 -
Router(config-vrf)# address-family ipv4
Router(config)# router eigrp 100
Router(config-rtr)# route-target export 1:100










Correct Answer: A

Which device is responsible for nding EID-to-RLOC mapping when traffic is sent to a LISP-capable site?

A. map resolver

B. egress tunnel router

C. map server

D. ingress tunnel router










Correct Answer: C

Which option works with a DHCP server to return at least one WLAN management interface IP address during the discovery phase and is dependent upon the VCI of the AP?

A. Option 15

B. Option 43

C. Option 125

D. Option 42










Correct Answer: B

Refer to the exhibit.

PC 2 cannot communicate with PC 4. Which configuration resolves this issue?

A. SW1(config)# interface Gigabitethernet 2/1
SW1(config-if)# switchport mode trunk

B. SW1(config)# interface Gigabitethernet 2/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10

C. SW1(config)# interface Gigabitethernet 2/1
SW1(config-if)# switchport trunk allowed vlan add 10

D. SW1(config)# interface Gigabitethernet 2/1
SW1(config-if)# switchport vlan mapping 10 10










Correct Answer: C

A customer has 20 stores located throughout a city. Each store has a single Cisco AP managed by a central WL

A. The customer wants to gather analytics for users in each store. Which technique supports these requirements?

B. angle of arrival

C. presence

D. trilateration

E. hyperlocation








Correct Answer: D

Refer to the exhibit.

Two switches are interconnected using interface GigabitEthernet0/0 on both sides. While configuring one of the switches, a network engineer receives the logging message. Which action resolves this issue?

A. Block VLAN1 on the trunk interface GigabitEthernet0/0.

B. configure interface GigabitEthernet0/0 as an access port.

C. configure interface GigabitEthernet0/0 as a trunk port.

D. Shutdown interface GigabitEthemet0/0 and bring it back up.










Correct Answer: B

By default, which virtual MAC address does HSRP group 12 use?

A. 00:00:0c:07:ac:0c

B. 00:05:5e:00:0c:12

C. 00:5e:0c:07:ac:12

D. 05:43:84:57:29:2c










Correct Answer: A

Refer to the exhibit.

An engineer configures a new WLAN that will be used for secure communications; however, wireless clients report that they are able to communicate with each other. Which action resolves this issue?

A. Enable Client Exclusions.

B. Enable P2P Blocking.

C. Disable Aironet I

D. Enable Wi-Fi Direct Client Policy.










Correct Answer: A

Refer to the exhibit.

What happens to access interfaces where VLAN 222 is assigned?

A. STP BPDU guard is enabled.

B. A description "RSPAN" is added.

C. They are placed into an inactive state.

D. They cannot provide Po

E.








Correct Answer: C

Refer to the exhibit.

Which command is required to validate that an IP SLA configuration matches the traffic between the branch office and the central site?

A. R1# show ip sla group schedule

B. R1# show ip route

C. R1# show ip sla configuration

D. R1# show ip sla statistics










Correct Answer: C

Refer to the exhibit.

The administrator must extend the configuration of the switch to perform remote logging using syslog according to these requirements:
· syslog server: 203.0.113.11 reachable through Gi0/0
· initial message severity: notifications
· message transport: reliable
Which two commands must be added to the configuration to accomplish this goal? (Choose two.)

A. logging monitor notifications

B. logging host 203.0.113.11 vrf Mgmt-vrf transport tcp

C. logging source-Interface GigabitEthernet0/0 vrf Mgmt-vrf

D. logging trap notifications

E. logging host 203.0.113.11 vrf Mgmt-vrf








Correct Answer: BE

Which two prerequisites must be met before Cisco DNA Center can provision device? (Choose two.)

A. Cisco DNA Center must have the software image for he provisioned device in its image repository.

B. The provisioned device must be put into bootloader mode.

C. The provisioned device must be configured with CLI and SNMP credentials that are known to Cisco DNA Center.

D. Cisco DNA Center must have IP connectivity to the provisioned device.

E. The provisioned device must recognize Cisco DNA Center as its LLDP neighbor.








Correct Answer: CE

In Cisco DNA Center, what is used to publish events and notifications to a third-party product such as IPAM?

A. intent API

B. southbound SDK

C. integration API

D. RESTful API










Correct Answer: B

Router R1 must be configured as a UDP responder on port 6336. Which configuration accomplishes this task?

A. (config)#ip sla responder udp-echo ipaddress 10.10.10.1 port 6336

B. (config)#ip sla responder udp-echo ipv4 10.10.10.1 port 6336

C. (config)#ip sla responder ipaddress 10.10.10.1 port 6336

D. (config-if)#ip sla responder udp-port ipaddress 10.10.10.1 port 6336










Correct Answer: A

Refer to the exhibit. An engineer must configure an ERSPAN tunnel that mirrors traffic from Linux1 on Switch1 to Linux2 on Switch2. Which command must be added to the destination configuration to enable the ERSPAN tunnel?

A. (config-mon-erspan-src-dst)# no shut

B. (config-mon-erspan-src-dst)# traffic bidirectional

C. (config-mon-erspan-src-dst)# monitor session 1 activate

D. (config-mon-erspan-src-dst)# ip address 10.10.10.10










Correct Answer: D

Refer to the exhibit.

Which configuration enables fallback to local authentication and authorization when no TACACS+ server is available?

A. Router(config)# aaa fallback local

B. Router(config)# aaa authentication login FALLBACK local
Router(config)# aaa authorization exec FALLBACK local

C. Router(config)# aaa authentication login default local
Router(config)# aaa authorization exec default local

D. Router(config)# aaa authentication login default group tacacs+ local
Router(config)# aaa authorization exec default group tacacs+ local










Correct Answer: D

Which configuration protects the password for the VTY lines against over-the-shoulder attacks?

A. line vty 0 15
password $2$FpM7f82!

B. username admin secret 7 6j809J23kpp438337113N7%e$

C. line vty 0 4
password $2$FpM7f82!

D. service password-encryption










Correct Answer: D

Refer to the exhibit.

Remote users cannot access the Internet but can upload files to the storage server. Which configuration must be applied to allow Internet access?

A. ciscoasa(config)# access-list MAIL_AUTH extended permit udp any any eq http ciscoasa(config)# aaa authentication listener http outside redirect

B. ciscoasa(config)# access-list MAIL_AUTH extended permit tcp any any eq www ciscoasa(config)# aaa authentication listener http inside redirect

C. ciscoasa(config)# access-list MAIL_AUTH extended permit tcp any any eq http ciscoasa(config)# aaa authentication listener http inside port 43

D. ciscoasa(config)# access-list HTTP_AUTH extended permit udp any any eq http ciscoasa(config)# aaa authentication listener http outside port 43










Correct Answer: B

Refer to the exhibit.

Extended access-list 100 is configured on interface GigabitEthernet 0/0 in an inbound direction, but it does not have the expected behavior of allowing only packets to or from 192.168.0.0/16. Which command set properly configures the access list?

A. R1(config)#no access-list 100 deny ip any any

B. R1(config)#no access-list 100 seq 10
R1(config)#access-list 100 seq 40 deny ip any any

C. R1(config)#ip access-list extended 100
R1(config-ext-nacl)#5 permit ip any any

D. R1(config)#ip access-list extended 100
R1(config-ext-nacl)#no 10










Correct Answer: D

Which security measure mitigates a man-in-the-middle attack of a REST API?

A. password hash

B. SSL certificates

C. nonrepudiation feature

D. biometric authentication










Correct Answer: B

Refer to the exhibit.

Users cannot reach the web server at 192.168.100.1. What is the root cause for the failure?

A. The server is attempting to load balance between links 10.100.100.1 and 10.100.200.1.

B. There is a loop in the path to the server.

C. The gateway cannot translate the server domain name.

D. The server is out of service.










Correct Answer: B

What is one method for achieving REST API security?

A. using a combination of XML encryption and XML signatures

B. using HTTPS and TLS encryption

C. using a MDS hash to verify the integrity

D. using built-in protocols known as Web Services Security










Correct Answer: B

What is a benefit of using segmentation with TrustSec?

A. Integrity checks prevent data from being modified in transit.

B. Packets sent between endpoints on a LAN are encrypted using symmetric key cryptography.

C. Security group tags enable network segmentation.

D. Firewall rules are streamlined by using business-level profiles.










Correct Answer: D

Refer to the exhibit.

A network administrator must configure router B to allow traffic only from network 10.100.2.0 to networks outside of router

A. Which configuration must be applied?

B. RouterB(config)# access-list 101 permit ip 10.100.2.0 0.0.0.255 any
RouterB(config)# access-list 101 deny any
RouterB(config)# int g0/0/0 -
RouterB(config-if)# ip access-group 101 out

C. RouterB(config)# access-list 101 permit ip 10.100.3.0 0.0.0.255 any
RouterB(config)# access-list 101 deny any
RouterB(config)# int g0/0/0 -
RouterB(config-if)# ip access-group 101 out
RouterB(config)# int g0/0/1 -
RouterB(config-if)# ip access-group 101 out

D. RouterB(config)# access-list 101 permit ip 10.100.2.0 0.0.0.255 any
RouterB(config)# access-list 101 deny any
RouterB(config)# int g0/0/2 -
RouterB(config-if)# ip access-group 101 in

E. RouterB(config)# access-list 101 permit ip 10.100.2.0 0.0.0.255 any
RouterB(config)# int g0/0/0 -
RouterB(config-if)# ip access-group 101 out
RouterB(config)# int g0/0/1 -
RouterB(config-if)# ip access-group 101 out








Correct Answer: D

How is traffic classi ed when using Cisco TrustSec technology?

A. with the IP address

B. with the VLAN

C. with the security group tag

D. with the MAC address










Correct Answer: C

Refer to the exhibit.

How should the programmer access the list of VLANs that were received via the API call?

A. VlanNames[`response']

B. VlanNames[0]

C. VlanNames[`Vlan1']

D. list(VlanNames)










Correct Answer: D

An EEM applet contains this command:
event snmp oid 1.3.6.1.4.3.8.0.5.8.7.1.3 get-type next entry-op gt entry-val 80 poll-interval 8
What is the result of the command?

A. An SNMP event is generated when the value equals 80% for eight polling cycles.

B. An SNMP event is generated when the value is greater than 80% for eight polling cycles.

C. An SNMP event is generated when the value reaches 80%.

D. An SNMP variable is monitored and an action is triggered when the value exceeds 80%.










Correct Answer: D

Refer to the exhibit.

What does this Python script do?

A. enters the TACACS+ username for a specific IP address

B. reads the username for a specific IP address from a light database

C. writes the username for a specific IP address into a light database

D. enters the RADIUS username for a specific IP address










Correct Answer: B

Refer to the exhibit.

What is output by this code?

A. 0 5

B. 0 1 2 3 4 5

C. 0 1 2 3 4

D. (0,5)










Correct Answer: B

Which statement describes the Cisco SD-Access plane functionality for fabric-enabled wireless?

A. The control plane traffic is sent to the WLC through VXLAN, and the data plane traffic is sent to the WLC through CAPWAP tunnels.

B. Control plane traffic and data plane traffic are sent to the WLC through CAPWAP tunnels.

C. The control plane traffic is sent to the WLC through CAPWAP tunnels, and the data plane traffic is sent from the AP to the fabric edge switch through VXLAN.

D. Control plane traffic and data plane traffic are sent to the WLC through VXLAN.










Correct Answer: C

A company hires a network architect to design a new OTT wireless solution within a Cisco SD-Access Fabric wired network. The architect wants to register access points to the WLC tofficentrally switch the traffic. Which AP mode must the design include?

A. local

B. bridge

C. FlexConnect

D. fabric










Correct Answer: A

Which two methods are used to interconnect two Cisco SD-Access Fabric sites? (Choose two.)

A. SD-Access transit

B. fabric interconnect

C. wireless transit

D. IP-based transit

E. SAN transit








Correct Answer: AD

What is a characteristic of Cisco SD-WAN?

A. uses unique per-device feature templates

B. requires manual secure tunnel configuration

C. uses control plane connections between routers

D. operates over DTLS/TLS authenticated and secured tunnels










Correct Answer: D

What is the centralized control policy in a Cisco SD-WAN deployment?

A. set of statements that defines how routing is performed

B. set of rules that governs nodes authentication within the cloud

C. list of ordered statements that define user access policies

D. list of enabled services for all nodes within the cloud










Correct Answer: A

Which function is performed by vSmart in the Cisco SD-WAN architecture?

A. aggregation and distribution of VPN routing information

B. execution of localized policies

C. facilitation of NAT detection and traversal

D. redistribution between OMP and other routing protocols










Correct Answer: B

How do cloud deployments compare to on-premises deployments?

A. Cloud deployments provide a better user experience across world regions, whereas on-premises deployments depend upon region-specific conditions.

B. Cloud deployments mandate a secure architecture, whereas on-premises deployments are inherently unsecure.

C. Cloud deployments must include automation infrastructure, whereas on-premises deployments often lack the ability for automation.

D. Cloud deployments are inherently unsecure, whereas a secure architecture is mandatory for on-premises deployments.










Correct Answer: C

When voice services are deployed over a wireless environment, which service must be disabled to ensure the quality of calls?

A. priority queuing

B. dynamic transmit power control

C. aggressive load balancing

D. Fastlane

 










Correct Answer: A

What is an OVF?

A. a package that is similar to an IMG and that contains an OVA file used to build a virtual machine

B. an alternative form of an ISO that is used to install the base operating system of a virtual machine

C. the third step in a P2V migration

D. a package of files that is used to describe a virtual machine or virtual appliance A
Correct Answer:

Refer to the exhibit.

An engineer configures routing between all routers and must build a configuration to connect R1 to R3 via a GRE tunnel. Which configuration must be applied?

A. R1 -
interface Tunnel1
ip address 1.1.1.13 255.255.255.0
tunnel source Loopback0
tunnel destination x.y.z.110
R3 -
interface Tunnel
ip address 1.1.1.31 255.255.255.0
tunnel source Loopback0
tunnel destination x.y.z.160

B. R1 -
interface Tunnel1
ip address 1.1.1.13 255.255.255.0
tunnel source Loopback0
tunnel destination x.y.z.160
R3 -
interface Tunnel1
ip address 1.1.1.31 255.255.255.0
tunnel source Loopback0
tunnel destination x.y.z.110

C. R1 -
interface Tunnel2
ip address 1.1.1.12 255.255.255.0
tunnel source Loopback0
tunnel destination x.y.z.125
R2 -
interface Tunnel1
ip address 1.1.1.125 255.255.255.0
tunnel source Loopback0
tunnel destination x.y.z.110
interface Tunnel3
ip address 1.1.1.125 255.255.255.0
tunnel source Loopback0
tunnel destination x.y.z.160
R3 -
interface Tunnel2
ip address 1.1.1.32 255.255.255.0
tunnel source Loopback0
tunnel destination x.y.z.125

D. R1 -
interface Tunnel1
ip address 1.1.1.13 255.255.255.0
tunnel source Loopback0
tunnel destination x-y.z.110
R3 -
interface Tunnel1
ip address 1.1.1.31 255.255.255.0
tunnel source Loopback0
tunnel destination x.y.z.125










Correct Answer: B

Which function does a virtual switch provide?

A. RAID storage for virtual machines

B. connectivity between virtual machines

C. CPU context switching for multitasking between virtual machines

D. emulation of power for virtual machines










Correct Answer: B

Two Cisco switches are logically configured as a single switch using Cisco Stackwise technology. This will result in virtually combining which two planes? (Choose two.)

A. Data Plane

B. Control Plane

C. Forwarding Plane

D. Management Plane

E. Bearer Plane








Correct Answer: BD

Please select the correct option that shows the correct combination for the Type 1 Hypervisor.

A. Hardware; Hypervisor; Guest OS

B. Hardware; Host OS; Hypervisor; Guest OS

C. Host OS; Hypervisor; Guest OS

D. Hardware; Host OS; Guest OS










Correct Answer: A

Select the prerequisites for configuring LISP from the below options. (Choose two.)

A. Determine the type of LISP deployment you intend to deploy

B. One can directly deploy LISP without determining the type.

C. LISP configuration requires the datak9 license.

D. LISP configuration requires the advanced ip services license.










Correct Answer: AC

Select the benefits of implementing Cisco DNA Center. (Choose all that apply.)

A. simplified management

B. Automatic VPN tunnelling

C. One click configuration

D. Policy Driven Provisioning

E. Ensure Network & Appliance performance








Correct Answer: ADE

A network administrator need to configure Net flow on the devices in his network. He has Source IP Address, Destination IP Address, Source Port number & Destination port number. What additional information do he need to configure Net flow.

A. Layer 3 Protocol type

B. Encryption type

C. ToS (Type of Service) byte

D. Input Logical Interface

E. Hashing Algorithm

F. Transform-set details






Correct Answer: ACD

A network administrator is configuring a configuration management tool for some network devices that does not support agent. Select what option will you pick from the below options to successfully configure configuration management tool for that device.

A. Agent based configuration

B. Agent Less configuration

C. Proxy-agent configuration

D. None of the above










Correct Answer: C

Select the devices from the below options that can be fart of Cisco SDWAN Solution. (Choose two.)

A. ISR 2900

B. ASR 1000

C. IR8300

D. FTD 1120

E. ASR 9000








Correct Answer: BC

What is the purpose of the weight attribute in an EID-to-RLOC mapping?

A. It determines the administrative distance of LISP generated routes in the RI

B. It indicates the load-balancing ratio between ETRs of the same priority.

C. It indicates the preference for using LISP over native IP connectivity.

D. It identifies the preferred RLOC address family.










Correct Answer: B

A network engineer is designing a QoS policy for voice and video applications. Which software queuing feature provides strict-priority servicing?

A. Class-Based Weighted Fair Queuing

B. Low Latency Queuing

C. Link Fragmentation

D. Automatic QoS










Correct Answer: B

What is a characteristic of traffic shaping?

A. drops out-of-profile packets

B. causes TCP retransmits when packets are dropped

C. can be applied in both traffic directions

D. queues out-of-profile packets until the buffer is full










Correct Answer: D

What is a characteristic of para-virtualization?

A. Para-virtualization allows the host hardware to be directly accessed.

B. Para-virtualization guest servers are unaware of one another.

C. Para-virtualization lacks support for containers.

D. Para-virtualization allows direct access between the guest OS and the hypervisor.










Correct Answer: D

What is a Type 2 hypervisor?

A. installed as an application on an already installed operating system

B. also referred to as a "bare metal hypervisor" because it sits directly on the physical server

C. runs directly on a physical server and includes its own operating system

D. supports over-allocation of physical resources










Correct Answer: A

What is a characteristic of a Type 1 hypervisor?

A. It is referred to as a hosted hypervisor.

B. It is completely independent of the operating system.

C. Problems in the base operating system can affect the entire system.

D. It is installed on an operating system and supports other operating systems above it.










Correct Answer: B

Refer to the exhibit.

Which antenna emits this radiation pattern?

A. omnidirectional

B. RP-TNC

C. dish

D. Yagi










Correct Answer: A

Refer to the exhibit.


A. router bgp 65002
neighbor 10.0.1.2 remote-as 65002
network 10.0.2.0 255.255.255.0

B. router bgp 65001
neighbor 10.0.1.2 remote-as 65002
redistribute static

C. router bgp 65001
neighbor 10.0.1.2 remote-as 65002
network 10.0.1.0 255.255.255.0

D. router bgp 65001
neighbor 10.0.1.2 remote-as 65002
network 10.0.2.0 255.255.255.0

 










Correct Answer: D

What are two best practices when designing a campus Layer 3 infrastructure? (Choose two.)

A. configure passive-interface on nontransit links.

B. Implement security features at the core.

C. Summarize routes from the aggregation layer toward the core layer.

D. Tune Cisco Express Forwarding load balancing hash for ECMP routing.

E. Summarize from the access layer toward the aggregation layer.








Correct Answer: CD

Refer to the exhibit.

Which configuration must be applied to ensure that the preferred path for traffic from AS 65010 toward AS 65020 uses the R2 to R4 path?

A. R4(config)# router bgp 65020 -
R4(config-router)# bgp default local-preference 300
R5(config)# router bgp 65020 -
R5(config-router)# bgp default local-preference 200

B. R2(config)# router bgp 65010 -
R2(config-router)# bgp default local-preference 300
R1(config)# router bgp 65010 -
R1(config-router)# bgp default local-preference 200

C. R2(config)# router bgp 65010 -
R2(config-router)# bgp default local-preference 200
R1(config)# router bgp 65010 -
R1(config-router)# bgp default local-preference 300

D. R4(config)# router bgp 65020 -
R4(config-router)# bgp default local-preference 200
R5(config)# router bgp 65020 -
R5(config-router)# bgp default local-preference 300










Correct Answer: B

Refer to the exhibit.

An engineer must reduce the number of Type 1 and Type 2 LSAs that are advertised to R4 within OSPF area 0. Which configuration must be applied?

A. R1# conf t -
Router(config)# router ospf 1 -
Router(config-router)# prefix-suppression

B. R4# conf t -
Router(config)# router ospf 1 -
Router(config-router)# summary-address 10.0.0.0 255.255.255.0

C. R2# conf t -
Router(config)# interface Gig0/0
Router(config-router)# ip ospf prefix-suppression

D. R2# conf t -
Router(config)# int Gig0/0 -
Router(config-if)# ip summary-address 10.0.0.0 255.255.255.0










Correct Answer: A

An engineer is connected to a Cisco router through a Telnet session. Which command must be issued to view the logging messages from the current session as soon as they are generated by the router?

A. logging host

B. terminal monitor

C. service timestamps log uptime

D. logging buffer










Correct Answer: B

You have configured router R1 with multiple VRF's in order to support multiple customer VPN networks. If you wanted to see the best path for the 10.2.1.0.24 route in VRF Green, what command would you use?

A. show ip route vrf Green 10.2.1.0

B. show ip route 10.2.1.0 vrf Green

C. show route all 10.2.1.0

D. show ip route 10.2.1.0 Green










Correct Answer: A

Which of the following are benefits from implementing the use of VXLAN's in a network? (Choose two)

A. Increased scalability since VXLAN extends the IF field to 24 bits, providing up to 16 million unique ID values.

B. Makes the implementation of Spanning Tree more efficient.

C. Can be used to replace layer 3 routing protocols and increase routing efficiency at layer 2.

D. Supports Equal Cost Multi-pathing (ECMP) so that load balancing over multiple links can be used.










Correct Answer: AD

Which component of TCP defines the maximum packet size that a host interface is able to accept on ingress?

A. MTU

B. PATH MTU

C. Window size

D. MRU










Correct Answer: D

Which of the following are examples of Type 2 hypervisors? (Choose three.)

A. VMware ESXi

B. Oracle VirtualBox

C. Oracle Solaris Zones

D. Microsoft Hyper-V

E. Microsoft Virtual PC








Correct Answer: BCE

EIRP (Effective Isotropic Radiated Power) is the actual amount of signal leaving the antenna. It is a measurement value in db and is based on which three components? (Choose three.)

A. Transmit Power

B. RSSI

C. Cable Loss

D. Antenna Gain

E. SNR








Correct Answer: ACD

A switch is attached to router R1 on its gig 0/0 interface. Fort security reasons, you want to prevent R1 from sending OSPF hellos to the switch.
Which command should be enabled to accomplish this?

A. R1(config-router)#ip ospf hello disable

B. R1(config-router)#ip ospf hello-interval 0

C. R1(config)#passive-interface Gig 0/0

D. R1(config-router)#passive-interface Gig 0/0










Correct Answer: D

What are some of the key differences between HSRPv1 and HSRPv2? (Choose two.)

A. HSRPv1 uses the multicast address of 224.0.0.102 while HSRPv2 uses 225.0.0.2.

B. HSRP uses a group range of 0-255, while HSRP uses a group range of 0-4095.

C. HSRPv1 uses seconds based timers, while HSRPv2 uses milliseconds based timers.

D. HSRPv1 provides support for IPv6, while HSRPv2 supports IPv4 only.










Correct Answer: BC

Which of the following are valid Port Aggregation Protocol (PAgP) modes? (Choose two.)

A. On

B. Active

C. Passive

D. Auto

E. Desirable








Correct Answer: DE

Which of the following are true statements regarding the Virtual Router Redundancy Protocol (VRRP) feature? (Choose two.)

A. Pre-emption is enabled by default

B. The router priority is a configurable value from 0-4095

C. MD5 authentication is supported with VRRP

D. Secondary IP addresses are supported with VRRP

E. VRRP can only be used with Cisco devices








Correct Answer: AD

You want to securely implement the Network Time Protocol (NTP) on your network. What two mechanisms are available to secure NTP? (Choose two.)

A. IPSec communication

B. MD5 authentication keys

C. Role based access control (RBAC)

D. access-group configuration










Correct Answer: BD

Which Cisco EIGRP K-values are set to zero by default? (Choose three.)

A. Bandwidth

B. Load

C. Total Delay

D. Reliability

E. MTU








Correct Answer: BDE

What are the four stages of obtaining an IP address lease from a DHCP server?

A. Discover, Offer, Release, Renew

B. Discover, Obtain, Request, Renew

C. Determine, Obtain, Release, Acknowledge

D. Discover, Offer, Request, Acknowledge










Correct Answer: D

A new multicast server is being added to an existing PIM Sparse modefinetwork. Which device in this network must the new server register with before its multicast traffic can be dispersed throughout the network?

A. IGMP Querier

B. Local PIM router

C. Local IGMP switch

D. Rendezvous Point (RP)










Correct Answer: D

You want to create a policy that allows all TCP traffic in the port range of 20 to 110, except for telnet traffic, which should be dropped. Which of the following access control lists will accomplish this?

A. deny tcp any any eq 22
permit tcp any any gt 20 lt 110

B. permit tcp any any range 22 443
deny tcp any any eq 23

C. deny tcp any any eq 23
permit tcp any any

D. deny tcp any any eq 23
permit tcp any any range 20 110










Correct Answer: D

In a Cisco SD-Access network architecture, what is the role of the Fabric Edge Node?

A. It manages endpoint to device relationships

B. It connects external layer 3 networks to the SDA fabric

C. It connects wired endpoints to the SDA fabric

D. It connects wireless endpoints to the SDA fabric










Correct Answer: C

Which of the following are features typically only found in a Next Generation (NextGen) firewall? (Choose two.)

A. Network Address Translation (NAT)

B. Secure remote access VPN (RA VPN)

C. Deep packet inspection

D. reputation based malware detection

E. IPSec site-to-site VPN








Correct Answer: CD

JSON web tokens (JWT) are used to secure JSON based communications. Which of the following fields make up a JWT? (Choose three.)

A. Header

B. Trailer

C. Payload

D. Sequence number

E. Signature








Correct Answer: ACE

Ansible is being used in a network for configuration and management automation. Which of the following are true statements regarding Ansible? (Choose two.)

A. Requires an agent on the end device.

B. Utilizes the concept of playbooks to execute the configuration.

C. Uses a pull model, where the end devices pull configuration files from the Ansible server.

D. Utilizes SS

E.








Correct Answer: BD

In a Cisco Software defined Networking (SDN) architecture, what is used to describe the API communication between the SDN controller and the network elements (routers and switches) that it manages?

A. Southbound API

B. Northbound API

C. Westbound API

D. Eastbound API.










Correct Answer: A

In a Cisco VXLAN based network, which of the following best describes the main function of a VXLAN Tunnel Endpoint (VTEP)?

A. A device that performs VXLAN encapsulation and decapsulation.

B. It is a 24 bit segment ID that defines the broadcast domain.

C. It is the Logical interface where the encapsulation and de-encapsulation occurs.

D. It is a device that performs tunneling using GR

E.








Correct Answer: A

What are two valid modes that Cisco Express Forwarding can operate in? (Choose two.)

A. Central CEF mode

B. Dense CEF mode

C. Sparse CEF mode

D. Distributed CEF mode

E. Routed CEF mode








Correct Answer: AD

You need to weigh the pros and cons of deploying a premise-based data center versus using a cloud-based data center deployment. What is an advantage of using a premise-based solution? (Choose two.)

A. Lower application latency for end users

B. Easily scalable

C. Lower capital costs

D. Reduced deployment times

E. Increased control over the environment








Correct Answer: AE

Which Quality of Service (QoS) mechanism allows for the creation of multiple levels of QoS policy, providing a more granular degree of traffic management?

A. Policing

B. H-QoS

C. Congestion avoidance

D. Dual Policy










Correct Answer: B

Which Quality of Service (QoS) mechanism allows the network administrator to control the maximum rate of traffic received or sent on a given interface?

A. Policing

B. Marking

C. Queueing

D. classification










Correct Answer: A

Refer to the following two images regarding QoS traffic Shaping and traffic Policing:
Image A:

Image B:

Based on the images, which of the following are true? (Choose two.)

A. Image A depicts the result of traffic Shaping

B. Image A depicts the result of traffic Policing

C. Image B depicts the result of traffic Shaping

D. Image B depicts the result of traffic Policing










Correct Answer: BC

In a Cisco SD-Access fabric architecture, which of the following are valid device roles (Choose three.)

A. Control Plane Node

B. Access routing device

C. Edge Node

D. Border Node

E. Distributed Node








Correct Answer: ACD

Which of the following are valid statements when configuring Nonstop Forwarding (NSF) with Stateful Switchover (SSO) on a Cisco device? (Choose two.)

A. supports multicast routing protocols

B. Supports IPv4 and IPv6

C. Nonstop Forwarding requires SSO to also be configured

D. HSRP is not supported with NSF/SSO

E. Improper implementation of NSF/SSO can result in routing loops








Correct Answer: CD

In a Cisco SD-Access wireless network, which device is used as an entry and exit point in and out of the fabric?

A. fabric edge node

B. control plane node

C. fabric border node

D. fabric access points










Correct Answer: C

The Overlay Management Protocol (OMP) is used as the control plane protocol and forms peers between the VSmart Controller and the SD-WAN edge devices. OMP is responsible for advertising which three types of routes in the SD-WAN network? (Choose three.)

A. OMP routes

B. TLOCs

C. MP-BGP

D. LISP routes

E. Service routes








Correct Answer: ABE

Which of the following are the three components of the three-tier hierarchical networking model used in the classical Cisco networks design? (Choose three.)

A. Distribution

B. Core

C. Access

D. Leaf

E. Spine








Correct Answer: ABC

Which of the following are the two components of the two-tier modern data center design? (Choose two.)

A. Distribution

B. Core

C. Access

D. Leaf

E. Spine








Correct Answer: EF

In a Cisco SD-WAN network, which VPN identifier is reserved for carrying out-of-band network management traffic?

A. VPN 0

B. VPN 1

C. VPN 512

D. VPN 514










Correct Answer: C

In a Cisco SD-WAN network, which VPN identifier is reserved as the transport VPN, carrying control traffic?

A. VPN 0

B. VPN 1

C. VPN 512

D. VPN 514










Correct Answer: A

Which Cisco SD-WAN component acts as a single pane of glass for management and offers centralized fault, performance, accounting, and configuration management?

A. vBond

B. vEdge

C. vSmart

D. vManage










Correct Answer: D

You need to implement a First Hop Redundancy Protocol (FHRP) in a dual stack (IPv4 and IPV6) environment that utilizes devices from multiple different vendors. Which protocol best meets these needs?

A. HSRP

B. GLBP

C. VRRPv1

D. VRRPv2










Correct Answer: D

A wireless client roams from one Access Point to another Access Point using a different switch in a Cisco SD-Access network. If only a single Wireless Lan Controller in involved, what roaming methods is being used?

A. L3 roaming

B. inter-xTR

C. auto anchor

D. bridged roaming










Correct Answer: B

In a Cisco SD-Access network where VXLAN is used for encapsulating data packets, what is the minimum MTU setting that devices should be configured with?

A. 1492

B. 1500

C. 1518

D. 1550










Correct Answer: D

Which Cisco Locator/ID Separation Protocol (LISP) device receives packets from remote site facing devices and either decapsulates the LISP packets or routes them natively?

A. ITR

B. ETR

C. MS

D. MR










Correct Answer: A

Which of the following statements regarding the use of Bidirectional Forwarding Detection (BFD) in a Cisco SD-WAN environment are true?

A. BFD cannot be disabled on SD-WAN routers.

B. OSPFv3 is not supported with BF

C. In addition to link failure detection, it is also used to measure loss and latency used by application aware routing.

D. Is not typically enabled for OMP.

E. Does not support BGP.








Correct Answer: AC

Which of the following statements are true regarding the Link Management Protocol (LMP) when used in the Cisco Stackwise virtual link? (Choose two.)

A. It determines the switch priority.

B. It negotiates the version of the virtual header

C. It verifies link integrity via bidirectional forwarding

D. It performs auto discovery of other active Stackwise switches










Correct Answer: BC

The Gig0/0 interface of two routers is directly connected with a 1G Ethernet link. Which configuration must be applied to the interface of both routers to establish an OSPF adjacency without maintaining a DR/BDR relationship?

A. interface Gig0/0 ip ospf network non-broadcast

B. interface Gig0/0 ip ospf network point-to-multipoint

C. interface Gig0/0 ip ospf network point-to-point

D. interface Gig0/0 ip ospf network broadcast










Correct Answer: C

Refer to the exhibit.

An engineer configures VRRP and issues the show commands to verify operation. What does the engineer confirm about VRRP group 1 from the output?

A. Communication between VRRP members is encrypted using MD5.

B. There is no route to 10.10.1.1/32 in R2's routing table.

C. R1 is primary if 10.10.1.1/32 is in its routing table.

D. If R1 reboots, R2 becomes the primary virtual router until R2 reboots.










Correct Answer: C

Refer to the exhibit. An administrator troubleshoots intermittent connectivity from internal hosts to an external public server. Some internal hosts can connect to the server while others receive an ICMP Host Unreachable message, and these hosts change over time. What is the cause of this issue?

A. The NAT ACL and NAT pool share the same name.

B. The translation does not use address overloading.

C. The NAT ACL does not match all internal hosts.

D. The NAT pool netmask is excessively wide.










Correct Answer: B

What is the function of the LISP map resolver?

A. to connect a site to the LISP-capable part of a core network publish the EID-to-RLOC mappings for the site, and respond to map-request messages

B. to advertise routable non-LISP traffic from one address family to LISP sites in a different address family

C. to send traffic to non-LISP sites when connected to a service provider that does not accept nonroutable EIDs as packet sources

D. to decapsulate map-request messages from ITRs and forward the messages to the MS










Correct Answer: D

Refer to the exhibit. An attacker can advertise OSPF fake routes from 172.16.20.0 network to the OSPF domain and black hole traffic. Which action must be taken to avoid this attack and still be able to advertise this subnet into OSPF?

A. configure 172.16.20.0 as a stub network.

B. configure graceful restart on the 172.16.20.0 interface.

C. configure a passive interface on R2 toward 172.16.20.0.

D. Apply a policy to filter OSPF packets on R2.










Correct Answer: D

Refer to the exhibit. What is the result when a switch that is running PVST+ is added to this network?

A. Both switches operate in the PVST+ mode.

B. Spanning tree is disabled automatically on the network.

C. Both switches operate in the Rapid PVST+ mode.

D. DSW2 operates in Rapid PVST + and the new switch operates in PVST+.










Correct Answer: D

Which protocol is responsible for data plane forwarding in a Cisco SD-Access deployment?

A. IS-IS

B. OSPF

C. VXLAN

D. LISP










Correct Answer: C

Refer to the exhibit. Which Python code parses the response and prints "18:32:21.474 UTC Sun Mar 10 2019"?

A. print(response['result'][0]('simple_time'])

B. print(response['result']['body']( 'simple_time'])

C. print(response['body']['simple_time'])

D. print(response['jsonrpc']['body'][ 'simple_time'])










Correct Answer: B

Refer to the exhibit. An engineer configures the trunk and proceeds to configure an ESPAN session to monitor VLANs 10, 20, and 30. Which command must be added to complete this configuration?

A. Device(config-mon-erspan-src-dst)# no vrf 1

B. Device(config-mon-erspan-src)# no filter vlan 30

C. Device(config-mon-erspan-src-dst)# mtu 1460

D. Device(config-mon-erspan-src-dst}# erspan-id 6










Correct Answer: A

An administrator is configuring NETCONF using the following XML string. What must the administrator end the request with?
<?xml version="1.0" encoding="UTF-8" ?>
<rpc message-id="9.0">

A. </rpc>]]>]]>

B. <rpc message-id="9.0"><notification-off/>

C. </rpc-reply>

D. </rpc>










Correct Answer: A

Which Python snippet should be used to store the devices data structure in a JSON file?



A. 

B. 

C. 

D.










Correct Answer: C

A large campus network has deployed two wireless LAN controllers to manage the wireless network WLC1 and WLC2 have been configured as mobility peers. A client device roams from AP1 on WLC1 to AP2 on WLC2, but the controller's client interfaces are on different VLANs. How do the wireless LAN controllers handle the inter-subnet roaming?

A. WLC1 marks the client with an anchor entry in its own database. The database entry is copied to the new controller and marked with a foreign entry on WLC2.

B. WLC2 marks the client with an anchor entry in its own database. The database entry is copied to the new controller and marked with a foreign entry on WLC1.

C. WLC1 marks the client with a foreign entry in its own database. The database entry is copied to the new controller and marked with an anchor entry on WLC2.

D. WLC2 marks the client with a foreign entry in its own database. The database entry is copied to the new controller and marked with an anchor entry on WLC1.










Correct Answer: B

By default, which virtual MAC address does HSRP group 25 use?

A. 04:30:83:88:4c:19

B. 00:00:0c:07:ac:25

C. 05:5c:5e:ac:0c:25

D. 00:00:0c:07:ac:19










Correct Answer: B

In a Cisco Catalyst switch equipped with two supervisor modules an administrator must temporarily remove the active supervisor from the chassis to perform hardware maintenance on it. Which mechanism ensures that the active supervisor removal is not disruptive to the network operation?

A. VRRP

B. HSRP

C. NSF/NSR

D. SSO










Correct Answer: D

Which function does a fabric AP perform in a Cisco SD-Access deployment?

A. It updates wireless clients' locations in the fabric.

B. It connects wireless clients to the fabric.

C. It manages wireless clients' membership information in the fabric.

D. It configures security policies down to wireless clients in the fabric.










Correct Answer: B

Refer to the exhibit. What is the effect of introducing the sampler feature into the Flexible NetFlow configuration on the router?

A. NetFlow updates to the collector are sent 50% less frequently.

B. Every second IPv4 packet is forwarded to the collector for inspection.

C. CPU and memory utilization are reduced when compared with what is required for full NetFlow.

D. The resolution of sampling data increases, but it requires more performance from the router.










Correct Answer: C

A. 

B. 

C. 

D. B
Correct Answer:

Refer to the exhibit. An engineer has configured an IP SLA for UDP echos. Which command is needed to start the IP SLA to lest every 30 seconds and continue until stopped?

A. ip sla schedule 100 life forever

B. ip sla schedule 30 start-time now life forever

C. ip sla schedule 100 start-time now life 30

D. ip sla schedule 100 start-time now life forever










Correct Answer: C

What is the calculation that is used to measure the radiated power of a signal after it has gone through the radio, antenna cable, and antenna?

A. mW

B. ERIP

C. dBm

D. dBi










Correct Answer: B

Which Quality of Service (QoS) mechanism is used to identify traffic flow and to use DSCP, IP Precedence values, and MPLS EXP bits to create different priority levels?

A. Policing

B. Marking

C. Queueing

D. classification










Correct Answer: D

Refer to the exhibit. An engineer must configure an ERSPAN tunnel that mirrors traffic from Linux1 on Switch1 to Linux2 on Switch2. Which command must be added to the destination configuration to enable the ERSPAN tunnel?

A. (config-mon-erspan-dst-src)# erspan-id 172.16.10.10

B. (config mon erspan-dst-src)# erspan-id 110

C. (config-mon-erspan-dst-src)# no shut

D. (config-mon-erspan-dst-src)# origin ip address 172.16.10.10










Correct Answer: B

What are two characteristics of Cisco SD-Access elements? (Choose two.)

A. The border node is required for communication between fabric and nonfabric devices.

B. traffic within the fabric always goes through the control plane node.

C. Fabric endpoints are connected directly to the border node.

D. The control plane node has the full RLOC-to-EID mapping database.

E. The border node has the full RLOC-to-EID mapping database.








Correct Answer: AD

When is an external antenna used inside a building?

A. only when using Mobility Express

B. only when using 2.4 GHz

C. when it provides the required coverage

D. only when using 5 GHz










Correct Answer: C

Refer to the exhibit. R1 and R2 are directly connected, but the BGP session does not establish. Which action must be taken to build an eBGP session?

A. configure no neighbor 192.168.12.1 shutdown under R2 BGP process.

B. configure neighbor 2.2.2.2 remote-as 65002 under R1 BGP process.

C. configure ip route 1.1.1.1 0.0.0.0 192.168.12.1 on R2.

D. configure neighbor 192.168.12.1 activate under R2 BGP process.

states#:~:text=Idle%20(Admin)%20means%20that%20the,!&text=This%20is%20a%20good%20way,BGP% 20section%20of%20the%20configuration










Correct Answer: A

A company requires a wireless solution to support its main office and multiple branch locations. All sites have local Internet connections and a link to the main office for corporate connectivity. The branch offices are managed centrally. Which solution should the company choose?

A. Cisco DNA Spaces

B. Cisco unified Wireless Network

C. Cisco Mobility Express

D. Cisco Catalyst switch with embedded controller










Correct Answer: A

Which QoS feature uses the IP Precedence bits in the ToS field of the IP packet header to partition traffic into different priority levels?

A. marking

B. shaping

C. policing

D. classification










Correct Answer: A

Refer to the exhibit. Which two commands are required on router R1 to block FTP and allow all other traffic from the Branch 2 network? (Choose two.)

A. access-list 101 deny tcp 10.0.2.0 0.0.0.255 host 10.0.101.3 eq ftp access-list 101 deny tcp 10.0.2.0 0.0.0.255 host 10.0.101.3 eq ftp-data access-list 101 permit ip any any

B. access-list 101 deny tcp 10.0.2.0 0.0.0.255 host 10.0.101.3 eq ftp-data access-list 101 permit ip any any

C. interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 ip access-group 101 out

D. access-list 101 deny tcp 10.0.2.0 0.0.0.255 host 10.0.101.3 eq ftp access-list 101 permit ip any any

E. interface GigabitEthernet0/0 ip address 10.0.101.1 255.255.255.252 ip access-group 101 in BD
Correct Answer:

A company recently decided to use RESTCONF instead of NETCONF, and many of their NETCONF scripts contain the operation <edit-config> (operation="create"). Which RESTCONF operation must be used to replace these statements?

A. PUT

B. CREATE

C. GET

D. POST










Correct Answer: B

An engineer is configuring RADIUS-Based Authentication with EAP MS-CHAPv2 is configured on a client device. Which outer method protocol must be configured on the ISE to support this authentication type?

A. LDAP

B. EAP-FAST

C. EAP-TLS

D. PEAP










Correct Answer: C

An engineer must protect the password for the VTY lines against over-the-shoulder attacks. Which configuration should be applied?

A. line vty 0 15 password XD822j

B. service password-encryption

C. username netadmin secret 7 $1$42J31k98867Pyh4QzwXyZ4

D. username netadmin secret 9 $9$vFpMf8elb4RVV8$seZ/bDA










Correct Answer: B

Refer to the exhibit. Hosts FC1, PC2; and PC3 must access resources on Server1. An engineer configures NAT on Router R1 to enable the communication and enters the show command to verify operation. Which IP address is used by the hosts when they communicate globally to Server1?

A. random addresses in the 155.1.1.0/24 range

B. 155.1.1.1

C. their own address in the 10.10.10.0/24 range

D. 155.1.1.5










Correct Answer: D

Using the EIRP formula, what parameter is subtracted to determine the EIRP value?

A. transmitter power

B. antenna cable loss

C. antenna gain

D. signal-to-noise ratio










Correct Answer: C

What is one main REST security design principle?

A. separation of privilege

B. password hashing

C. con dential algorithms

D. OAuth










Correct Answer: A

Refer to the exhibit. R1 has a BGP neighborship with a directly connected router on interface Gi0/0. Which command set is applied between the iterations of show ip bgp 2.2.2.2?

A. R1(config)#no ip route 192.168.50.2 255.255.255.255 Gi0/0

B. R1(config)#ip route 2.2.2.2 255.255.255.255 192.168.50.2

C. R1(config)#router bgp 65002 R1(config-router)#neighbor 192.168.50.2 shutdown

D. R1(config)#router bgp 65001 R1(config-router)#neighbor 192.168.50.2 shutdown B
Correct Answer:

After a redundant route processor failure occurs on a Layer 3 device, which mechanism allows for packets to be forwarded from a neighboring router based on the most recent tables?

A. BFD

B. RP failover

C. NSF

D. RPVST+










Correct Answer: C

By default, which virtual MAC address does HSRP group 15 use?

A. c0:42:31:98:86:0f

B. 05:af:1c:0f:ac:15

C. 00:00:0c:07:ac:0f

D. 05:5e:ac:07:0c:0f










Correct Answer: C

An engineer must provide wireless coverage in a square office. The engineer has only one AP and believes that it should be placed it in the middle of the room.
Which antenna type should the engineer use?

A. directional

B. polarized

C. omnidirectional

D. Yagi










Correct Answer: C

Which technology reduces the implementation of STP and leverages both unicast and multicast?

A. VLAN

B. VPC

C. VXLAN

D. VSS










Correct Answer: D

A customer has recently implemented a new wireless infrastructure using WLC-5520s at a site directly next to a large commercial airport. Users report that they intermittently lose Wi-Fi connectivity, and troubleshooting reveals it is due to frequent channel changes. Which two actions x this issue? (Choose two.)

A. Enable DFS channels because they are immune to radar interference.

B. Restore the DCA default settings because this automatically avoids channel interference.

C. Remove UNII-2 and Extended UNII-2 channels from the 5 Ghz channel list.

D. Disable DFS channels to prevent interference with Doppler radar.

E. configure channels on the UNII-2 and the Extended UNII-2 sub-bands of the 5 Ghz band only.








Correct Answer: CD

Refer to the exhibit.

Which GRE tunnel configuration command is missing on R2?

A. tunnel source 172.16.1.0

B. tunnel source 200.1.1.1

C. tunnel destination 200.1.1.1

D. tunnel source 192.168.1.2










Correct Answer: B

When does a Cisco StackWise primary switch lose its role?

A. when a switch with a higher priority is added to the stack

B. when a stack member fails

C. when the priority value of a stack member is changed to a higher value

D. when the stack primary is reset










Correct Answer: D

Refer to the exhibit. A network engineer troubleshoots an issue with the port channel between SW1 and SW2. Which command resolves the issue?

A. SW2(config-if)#switchport mode trunk

B. SW1(config-if)#channel-group 10 mode active

C. SW1(config-if)#channel-group 10 mode desirable

D. SW2(config-if)#channel-group 10 mode on

 










Correct Answer: B

How do stratum levels relate to the distance from a time source?

A. Stratum 0 devices are connected directly to an authoritative time source.

B. Stratum 1 devices are connected directly to an authoritative time source.

C. Stratum 15 devices are connected directly to an authoritative time source.

D. Stratum 15 devices are an authoritative time source.










Correct Answer: B

A customer has a wireless network deployed within a multi-tenant building. The network provides client access, location-based services and is monitored using
Cisco DNA Center. The security department wants to locate and track malicious devices based on threat signatures. Which feature is required for this solution?

A. malicious rogue rules on Cisco DNA Center

B. malicious rogue rules on the WLC

C. Cisco aWIPS policies on the WLC

D. Cisco aWIPS policies on Cisco DNA Center










Correct Answer: B

In a Cisco SD-Access wireless environment, which device is responsible for hosting the anycast gateway?

A. fusion router

B. control plane node

C. fabric border node

D. fabric edge node










Correct Answer: D

Refer to the exhibit. The port channel between the switches does not work as expected. Which action resolves the issue?

A. Interface Gi0/1 on Switch1 must be configured as desirable.

B. Trunking must be enabled on both interfaces on Switch2.

C. Interface Gi0/0 on Switch2 must be configured as passive.

D. Interface Gi0/1 on Switch2 must be configured as active.










Correct Answer: D

Refer to the exhibit. Which set of commands is required to configure and verify the VRF for Site 1 Network A on router R1?

A. R1#ip routing R1#(config)#ip vrf 100 R1#(config-vrf)#rd 100:1 R1#(config-vrf)# address family ipv4 ! R1(config)#interface Gi0/2 R1(config- if)#ip address 10.0.1.1 255.255.255.0 R1#show ip route

B. R1#ip routing R1#(config)#ip vrf 100 ! R1(config)#interface Gi0/2 R1(config-if)#ip address 10.0.1.1 255.255.255.0 R1#showip route

C. R1#ip routing R1#(config)#ip vrf 100 ! R1(config)#interface Gi0/2 R1(config-if)#ip vrf forwarding 100 R1(config-if)#ip address 10.0.1.1 255.255.255.0 R1#show ip vrf

D. R1#ip routing R1#(config)#ip vrf 100 ! R1(config)#interface Gi0/2 R1(config-if)#ip address 10.0.1.1 255.255.255.0 R1#show ip vrf C
Correct Answer:

How does Protocol Independent Multicast function?

A. In sparse mode, it establishes neighbor adjacencies and sends hello messages at 5-second intervals.

B. It uses the multicast routing table to perform the multicast forwarding function.

C. It uses unicast routing information to perform the multicast forwarding function.

D. It uses broadcast routing information to perform the multicast forwarding function.










Correct Answer: C

Which VXLAN component is used to encapsulate and decapsulate Ethernet frames?

A. VNI

B. GRE

C. VTEP

D. EVPN










Correct Answer: C

Refer to the exhibit. Assuming all links are functional, which path does PC1 take to reach DSW1?

A. PC1 goes from ALSW1 to DSW2 to CORE to DSW1.

B. PC1 goes from ALSW1 to DSW2 to ALSW2 to DSW1.

C. PC1 goes from ALSW1 to DSW2 to DSW1.

D. PC1 goes from ALSW1 to DSW1.










Correct Answer: D

By default, which virtual MAC address does HSRP group 22 use?

A. c0:41:99:98:06:16

B. 00:00:0c:07:ac:16

C. 00:00:0c:07:ac:22

D. c0:07:0c:ac:00:22










Correct Answer: B

Refer to the exhibit. Both controllers are in the same mobility group. Which result occurs when client 1 roams between APs that are registered to different controllers in the same WLAN?

A. The client database entry moves from controller A to controller B

B. A CAPWAP tunnel is created between controller A and controller B

C. Client 1 uses an EoIP tunnel to contact controller A

D. Client 1 contacts controller B by using an EoIP tunnel










Correct Answer: A

Where in Cisco DNA Center is documentation of each API call organized by its functional area?

A. Developer Toolkit

B. platform management

C. platform bundles

D. Runtime Dashboard










Correct Answer: A

Refer to the exhibit. An engineer must protect the CPU of the router from high rates of NTP, SNMP, and SSH traffic. Which two configurations must be applied to drop these types of traffic when it continuously exceeds 320 kbps? (Choose two.)

A. R1(config-pmap)#class CLASS-CoPP-Management R1(config-pmap-c)#police 32 conform-action transmit exceed-action drop violate-action transmit

B. R1(config)#policy-map POLICY-CoPP R1(config-pmap)#class CLASS-CoPP-Management R1(config-pmap-c)#police 320000 conform-action transmit exceed-action drop violate-action drop

C. R1(config)#policy-map POLICY-CoPP R1(config-pmap)#class CLASS-CoPP-Management R1(config-pmap-c)#police 320000 conform-action transmit exceed-action transmit violate-action drop

D. R1(config)#control-plane R1(config-cp)# service-policy output POLICY-CoPP

E. R1(config)#control-plane R1(config-cp)# service-policy input POLICY-CoPP








Correct Answer: BE

Which free application has the ability to make REST calls against Cisco DNA Center?

A. API Explorer

B. REST Explorer

C. Postman

D. Mozilla










Correct Answer: C

If AP power level is increased from 25 mW to 100 mW, what is the power difference in dBm?

A. 6 dBm

B. 14 dBm

C. 17 dBm

D. 20 dBm










Correct Answer: A

What is the result when an active route processor fails in a design that combines NSF with SSO?

A. The standby route processor temporarily forwards packets until route convergence is complete.

B. An NSF-aware device immediately updates the standby route processor RIB without churning the network.

C. An NSF-capable device immediately updates the standby route processor RIB without churning the network.

D. The standby route processor immediately takes control and forwards packets along known routes D
Correct Answer:

Refer to the exhibit. Which command is required to verify NETCONF capability reply messages?

A. show netconf rpc-reply

B. show netconf | section rpc-reply

C. show netconf schema | section rpc-reply

D. show netconf xml rpc-reply










Correct Answer: C

Which A record type should be configured for access points to resolve the IP address of @ wireless LAN controller using ONS?

A. CISCO.CONTROLLER localdomain

B. CISCO.CAPWAP.CONTROLLER localdomain

C. CISCO-CONTROLLER localdomain

D. CISCO-CAPWAP-CONTROLLER.localdomain

 










Correct Answer: D

Which activity requires access to Cisco DNA Center CLI?

A. provisioning a wireless LAN controller

B. creating a configuration template

C. upgrading the Cisco DNA Center software

D. graceful shutdown of Cisco DNA Center










Correct Answer: D

A customer wants to connect a device to an autonomous Cisco AP configured as a WG

A. The WGB is configured properly: however, it fails to associate to a
CAPWAP-enabled AP. Which change must be applied in the advanced WLAN settings to resolve this issue?

B. Enable Aironet I

C. Enable passive client.

D. Disable AAA override.

E. Disable FlexConnect local switching.








Correct Answer: A

By default, which virtual MAC address does HSRP group 32 use?

A. 04:19:01:05:2e:32

B. 05:5e:5c:ac:0c:32

C. 00:00:0c:07:ac:20

D. 00:5e:0c:07:ac:20










Correct Answer: C

Which two Cisco SD-WAN components exchange OMP information? (Choose two.)

A. WAN Edge

B. vBond

C. vManage

D. vAnalytics

E. vSmart








Correct Answer: AE

What does the number in an NTP stratum level represent?

A. The number of hops it takes to reach the authoritative time source

B. The amount of offset between the device clock and true time

C. The number of hops it takes to reach the primary time server

D. The amount of drift between the device clock and true time










Correct Answer: A

Refer to the exhibit. Clients report that they cannot connect to this SSID using the provided PSK. Which action will resolve this issue?

A. Apply the correct interface to this WLAN

B. Apply the changes this SSID

C. Select the PSK under authentication key management

D. define the correct Radio Policy.










Correct Answer: C

Which QoS queuing method transmits packets out of the interface in the order the packets arrive?

A. custom

B. weighted-fair

C. FIFO

D. priority










Correct Answer: C

Which two results occur if Cisco DNA Center loses connectivity to devices in the SD-Access fabric? (Choose two.)

A. Users lose connectivity

B. Already connected users are unaffected but new users cannot connect

C. All devices reload after detecting loss of connection to Cisco DNA Center

D. User connectivity is unaffected

E. Cisco DNA Center is unable to collect monitoring data in Assurance








Correct Answer: AE

Refer to the exhibit. The connection between SW1 and SW2 is not operational. Which two actions resolve the issue? (Choose two.)

A. configure switchport nonegotiate on SW1

B. configure switchport nonegotiate on SW2

C. configure switchport mode access on SW2

D. configure switchport mode trunk on SW2

E. configure switchport mode dynamic desirable on SW2








Correct Answer: BE

Refer to the exhibit. A company has an internal wireless network with a hidden SSID and RADIUS-based client authentication for increased security. An employee attempts to manually add the company network to a laptop, but the laptop does not attempt to connect to the network. The regulatory domains of the access points and the laptop are identical. Which action resolves this issue?

A. Ensure that the "Connect even if this network is not broadcasting" option is selected.

B. Change the security type to WPA2-Personal AES.

C. Use the empty string as the hidden SSID network name.

D. Limit the enabled wireless channels on the laptop to the maximum channel range that is supported by the access points.










Correct Answer: A

How do the RIB and the FIB differ?

A. RIB is derived from the control plane, and the FIB is derived from the RI

B. FIB is derived from the control plane, and the RIB is derived from the data plane.

C. RIB contains the interface for a destination, and the FIB contains the next hop information.

D. FIB contains routes learned through a dynamic routing protocol and the RIB contains routes that are static or directly connected.










Correct Answer: A

What does a YANG model provide?

A. standardized data structure independent of the transport protocols

B. creation of transport protocols and their interaction with the OS

C. user access to interact directly with the CLI of the device to receive or modify network configurations

D. standardized data structure that can be used only with NETCONF or RESTCONF transport protocols










Correct Answer: D

A system must validate access rights to all its resources and must not rely on a cached permission matrix. If the access level to a given resource is revoked but is not reflected in the permission matrix, the security is violated. Which term refers to this REST security design principle?

A. economy of mechanism

B. complete mediation

C. separation of privilege

D. least common mechanism










Correct Answer: B

Refer to the exhibit. Which command set completes the ERSPAN session configuration?

A. monitor session 11 type erspan-destination destination interface GigabitEthemet4 source erspan-id 11 ip address 10.10.10.10

B. monitor session 12 type erspan-destination destination interface GigabitEthernet4 source erspan-id 12 ip address 10.10.10.10

C. monitor session 11 type erspan-destination destination interface GigabitEthernet4 source erspan-id 12 ip address 10.100.10.10

D. monitor session 12 type erspan-destination destination interface GigabitEthernet4 source erspan-id 11 ip address 10.10.10.10 C
Correct Answer:

"HTTP/1.1 204 No Content" is returned when the curl -i -X DELETE command is issued. Which situation has occurred?

A. The command succeeded in deleting the object.

B. The object was located at the URI, but it could not be deleted

C. The object could not be located at the URI path.

D. The URI was invalid.










Correct Answer: A

Refer to the exhibit. Which configuration is required to summarize the Area 2 networks that are advertised to Area 0?

A. RouterB(config)# router ospf 1 RouterB(config-router)# area 2 range 192.168.36.0 255.255.252.0

B. RouterB(config)# router ospf 1 RouterB(config-router)# network 192.168.38.0 255.255.255.0

C. RouterB(config)# router ospf 1 RouterB(config-router)# network 192.168.38.0 255.255.252.0

D. RouterB(config)# router ospf 1 RouterB(config-router)# area 2 range 192.168.36.0 255.255.255.0 A
Correct Answer:

Based on the router's API output in JSON format below, which Python code will display the value of the "role" key?


A. 

B. 

C. 

D. 










Correct Answer: B

What is the recommended minimum SNR for voice applications on wireless networks?

A. 10

B. 15

C. 20

D. 25










Correct Answer: D

Refer to the exhibit. What are two results of the NAT configuration? (Choose two.)

A. Packets with a destination of 200.1.1.1 are translated to 10.1.1.1 or .2, respectively.

B. A packet that is sent to 200 1.1.1 from 10.1.1.1 is translated to 209.165.201.1 on R1.

C. R1 is performing NAT for inside addresses and outside address.

D. R1 looks at the destination IP address of packets entering S0/0 and destined for inside hosts.

E. R1 processes packets entering E0/0 and S0/0 by examining the source IP address.








Correct Answer: BC

A network engineer must configure a switch to allow remote access for all feasible protocols Only a password must be requested for device authentication and all idle sessions must be terminated in 30 minutes. Which configuration must be applied?

A. line vty 0 15 password cisco transport input telnet ssh exec-timeout 30 0

B. line vty 0 15 password cisco transport input all exec-timeout 0 30

C. username cisco privilege 15 cisco line vty 0 15 transport input telnet ssh login local exec-timeout 0 30

D. line console 0 password cisco exec-timeout 30 0










Correct Answer: B

Refer to the exhibit. An engineer configures a trunk between SW1 and SW2 but tagged packets are not passing. Which action xes the issue?

A. configure SW1 with dynamic auto mode on interface FastEthernet0/1.

B. configure the native VLAN to be the same VLAN on both switches on interface FastEthernet0/1.

C. configure SW2 with encapsulation dot1q on interface FastEthernet0/1.

D. configure FastEthernet0/1 on both switches for static trunking.










Correct Answer: C

A server running Linux is providing support for virtual machines along with DNS and DHCP services for a small business. Which technology does this represent?

A. container

B. Type 1 hypervisor

C. Type 2 hypervisor

D. hardware pass-thru










Correct Answer: B

Which features does Cisco EDR use to provide threat detection and response protection?

A. containment, threat intelligence, and machine learning

B. rewalling and intrusion prevention

C. container-based agents

D. cloud analysis and endpoint firewall controls










Correct Answer: A

Refer to the exhibit. Only administrators from the subnet 10.10.10.0/24 are permitted to have access to the router. A secure protocol must be used for the remote access and management of the router instead of clear-text protocols. Which configuration achieves this goal?

A. 

B. 

C. 

D. 










Correct Answer: A

An engineer is configuring Local WebAuth on a Cisco Wireless LAN Controller. According to RFC 5737, which virtual IP address must be used in this configuration?

A. 172.20.10.1

B. 192.168.0.1

C. 1.1.1.1

D. 192.0.2.1










Correct Answer: B

Refer to the exhibit. The OSPF neighborship fails between two routers. What is the cause of this issue?

A. The OSPF process is stopped on the neighbor router.

B. The OSPF router ID is missing on this router.

C. The OSPF router ID is missing on the neighbor router.

D. There is an MTU mismatch between the two routers.










Correct Answer: D