Cisco.Braindumps v by.Toni.259q. Exam Code: Exam Name: Cisco implementing cisco switched networks

Transcription

1 Cisco.Braindumps v by.Toni.259q Number: Passing Score: 825 Time Limit: 120 min File Version: Exam Code: Exam Name: Cisco implementing cisco switched networks Sections 1. A 2. B 3. C 4. D

2 Exam A QUESTION 1 Which two statements are true about port BPDU Guard and BPDU filtering? (Choose two.) A. BPDU guard can be enabled globally, whereas BPDU filtering must be enabled on a per-interface basis. B. When globally enabled, BPDU port-guard and BPDU filtering apply only to PortFast enabled ports. C. When globally enabled, BPDU port-guard and BPDU filtering apply only to trunking-enabled ports. D. When a BPDU is received on a BPDU port-guard enabled port, the interface goes into the err-disabled state. E. When a BPDU is received on a BPDU filtering enabled port, the interface goes into the err-disabled state. F. When a BPDU is received on a BPDU filtering enabled port, the interface goes into the STP blocking state. Correct Answer: BD QUESTION 2 Which two statements about the various implementations of STP are true? (Choose two.) A. Common Spanning Tree maintains a separate spanning-tree instance for each VLAN configured in the network. B. The Spanning Tree Protocol (STP) is an evolution of the IEEE 802.1w standard. C. Per-VLAN Spanning Tree (PVST) supports 802.1Q trunking. D. Per-VLAN Spanning Tree Plus(PVST+) is an enhancement to 802.1Q specification and is supported only on Cisco devices. E. Rapid Spanning Tree Protocol (RSTP) includes features equivalent to Cisco PortFast, UplinkFast, and BackboneFast for faster network reconvergence. F. Multiple Spanning Tree (MST) assumes one spanning-tree instance for the entire Layer 2 network, regardless of the multiple number of VLANs. Correct Answer: DE QUESTION 3 How are STP timers and state transitions affected when a topology change occurs in an STP environment? A. All ports will temporarily transition to the learning state for a period equal to the max age timer plus the forward delay interval. B. All ports will transition temporarily to the learning state for a period equal to the forward delay interval. C. The default aging time for MAC address entries will be reduced for a period of the max age timer plus the forward delay interval. D. The default hello time for configuration BPDUs will be reduced for the period of the max age timer. QUESTION 4 What two things will occur when an edge port receives a BPDU? (Choose two.)

3 A. The port immediately transitions to the Forwarding state. B. The switch generates a Topology Change Notification (TCN) BPDU. C. The port immediately transitions to the err-disable state. D. The port becomes a normal STP switch port. Correct Answer: BD QUESTION 5 What will occur when a nonedge switch port that is configured for Rapid Spanning Tree does not receive a BPDU from its neighbor for three consecutive hello time intervals? A. RSTP information is automatically aged out. B. The port sends a TCN to the root bridge. C. The port moves to listening state. D. The port becomes a normal spanning tree port. Correct Answer: A QUESTION 6 Which option correctly identifies the Cisco IOS switching methods in descending order from the fastest method to the slowest method? A. CEF, distributed CEF (dcef), fast switching, process switching B. distributed CEF (dcef), CEF, fast switching, process switching C. fast switching, process switching, distributed CEF (dcef), CEF D. process switching, fast switching, distributed CEF (dcef), CEF E. process switching, distributed CEF (dcef), CEF, fast switching F. process switching, CEF, distributed CEF (dcef), fast switching Correct Answer: B QUESTION 7 Which three statements are true of the Link Aggregation Control Protocol (LACP)? (Choose three.) A. LACP is used to connect to non-cisco devices. B. LACP packets are sent with the command channel-group 1 mode desirable. C. LACP packets are sent with the command channel-group 1 mode active. D. Standby interfaces should be configured with a higher priority. E. Standby interfaces should be configured with a lower priority. Correct Answer: ACD

4 QUESTION 8 Which two statements are true when the extended system ID feature is enabled? (Choose two.) A. The BID is made up of the bridge priority value (2 bytes) and bridge MAC address (6 bytes). B. The BID is made up of the bridge priority (4 bits), the system ID (12 bits), and a bridge MAC address (48 bits). C. The BID is made up of the system ID (6 bytes) and bridge priority value (2 bytes). D. The system ID value is the VLAN ID (VID). E. The system ID value is a unique MAC address allocated from a pool of MAC addresses assigned to the switch or module. F. The system ID value is a hex number used to measure the preference of a bridge in the spanning-tree algorithm. Correct Answer: BD /Reference: QUESTION 9 Which three statements about STP timers are true? (Choose three.) A. STP timers values (hello, forward delay, max age) are included in each BPDU. B. A switch is not concerned about its local configuration of the STP timers values. It will only consider the value of the STP timers contained in the BPDU it is receiving. C. To successfully exchange BPDUs between two switches, their STP timers value (hello, forward delay, max age) must be the same. D. If any STP timer value (hello, forward delay, max age) needs to be changed, it should at least be changed on the root bridge and backup root bridge. E. On a switched network with a small network diameter, the STP hello timer can be tuned to a lower value to decrease the load on the switch CPU. F. The root bridge passes the timer information in BPDUs to all routers in the Layer 3 configuration. Correct Answer: ABD QUESTION 10 Which two statements concerning STP state changes are true? (Choose two.) A. Upon bootup, a port transitions from blocking to forwarding because it assumes itself as root. B. Upon bootup, a port transitions from blocking to listening because it assumes itself as root. C. Upon bootup, a port transitions from listening to forwarding because it assumes itself as root. D. If a forwarding port receives no BPDUs by the max_age time limit, it will transition to listening. E. If a forwarding port receives an inferior BPDU, it will transition to listening.

5 F. If a blocked port receives no BPDUs by the max_age time limit, it will transition to listening. Correct Answer: BF QUESTION 11 In a customer's network, VLAN Trunking Protocol (VTP) is running with a domain named main1. VLANs 1,2,3,4,5,10,20 are active on the network. Suddenly the whole network goes down. No traffic is being passed on VLANs 2,3,4,5,10,20, however traffic passes on VLAN 1 and indicates all switches are operational. Right before the network problem occurred, a switch named TEST1 was added to the network. What three configuration issues on TEST1 could be causing the network outage? (Choose three.) A. TEST1 is configured as a VTP server with a different domain name. B. TEST1 is not configured to participate in VTP. C. TEST1 is configured as a VTP server with the domain name main1. D. TEST1 has a lower VTP configuration revision than the current VTP revision. E. TEST1 has a higher VTP configuration revision than the current VTP revision. F. TEST1 is configured with only VLAN1. EF QUESTION 12 Which statement is true about RSTP topology changes? A. Only nonedge ports moving to the blocking state generate a TC BPDU. B. Any loss of connectivity generates a TC BPDU. C. Any change in the state of the port generates a TC BPDU. D. Only nonedge ports moving to the forwarding state generate a TC BPDU. E. If either an edge port or a nonedge port moves to a block state, then a TC BPDU is generated. Correct Answer: D QUESTION 13 Switch R1 is configured to use the VLAN Trunking Protocol (VTP). What does R1 advertise in its VTP domain? A. The VLAN ID of all known VLANs, the management domain name, and the total number of trunk links on the switch. B. The VLAN ID of all known VLANs, a 1-bit canonical format (CF1 Indicator), and the switch configuration revision number. C. The management domain name, the switch configuration revision number, the known VLANs, and their specific parameters. D. A 2-byte TPID with a fixed value of 0x8100 for the management domain number, the switch configuration revision number, the known VLANs, and their specific parameters.

6 QUESTION 14 VTP switches use advertisements to exchange information with each other. Which of the following advertisement types are associated with VTP? (Choose three) A. Domain advertisements B. Advertisement requests from clients C. Subset advertisements D. Summary advertisements Correct Answer: BCD QUESTION 15 Switch R1 is part of the Company VTP domain. What's true of VTP Pruning within this domain? A. It does not prune traffic from VLANs that are pruning-ineligible B. VLAN 1 is always pruning-eligible C. it will prune traffic from VLANs that are pruning-ineligible D. VLAN 2 is always pruning-ineligible Correct Answer: A QUESTION 16 Switch R1 is configured with VTP. Which two VTP modes will make R1 capable of creating and deleting VLANs on itself? (Choose two) A. Client B. Server C. Transparent D. Pass-through E. Nonegotiate Correct Answer: BC QUESTION 17 Two Company switches are connected via a trunk link. In this network, the original frame is encapsulated and an additional header is added before the frame is carried over a trunk link. At the receiving end, the header is removed and the frame is forwarded to the assigned VLAN. This describes which technology? A. DISL B. ISL C. DTP D. IEEE 802.1Q E. MPLS

7 Correct Answer: B QUESTION 18 The Lead2pass Company core switches use 802.1Q trunks to connect to each other. How does 802.1Q trunking keep track of multiple VLANs? A. It tags the data frame with VLAN information and recalculates the CRC value B. It encapsulates the data frame with a new header and frame check sequence C. It modifies the port index of a data frame to indicate the VLAN D. It adds a new header containing the VLAN ID to the data frame Correct Answer: A QUESTION 19 Which three statements are correct with regard to the IEEE 802.1Q standard? (Choose three) A. The IEEE 802.1Q frame format adds a 4 byte field to a Ethernet frame B. The packet is encapsulated with a 26 byte header and a 4 byte FCS C. The protocol uses point-to-multipoint connectivity D. The protocol uses point-to-point connectivity E. The IEEE 802.1Q frame uses multicast destination of 0x c F. The IEEE 802.1Q frame retains the original MAC destination address Correct Answer: ADF QUESTION 20 Switch R1 has been configured with DTP using the desirable option. Which statement describes Dynamic Trunking Protocol (DTP) desirable mode? A. The interface actively attempts to convert the link to a trunk link. B. The interface is put into permanent trunking mode but prevented from generating DTP frames. C. The interface is put into permanent trunking mode and negotiates to convert the link into a trunk link. D. The interface is put into a passive mode, waiting to convert the link to a trunk link. Correct Answer: A QUESTION 21 Which switch command enables a trunking protocol that appends a four byte CRC to the packet? A. CompanySwitch(config-if)#switchport trunk encapsulation dot1q B. CompanySwitch(config-if)#switchport trunk encapsulation itef C. CompanySwitch(config-if)#switchport trunk encapsulation fddi

8 D. CompanySwitch(config-if)#switchport trunk encapsulation isl Correct Answer: D QUESTION 22 While using a packet analyzer, you notice four additional bytes being added to the packets in the Company network. Which protocol inserts a four byte tag into the Ethernet frame and recalculates CRC value? A. DTP B. VTP C Q D. ISL QUESTION 23 You need to configure a new Company switch to support DTP. Which DTP switchport mode parameter sets the switch port to actively send and respond to DTP negotiation frames? A. Access B. Nonegotiate C. Trunk D. Dynamic desirable E. Dynamic auto Correct Answer: D QUESTION 24 A new Company switch was just configured using the "switchport trunk native vlan 7" command. What does this interface command accomplish? A. Causes the interface to apply ISL framing for traffic on VLAN 7 B. Configures the trunking interface to forward traffic from VLAN 7 C. Configures the interface to be a trunking port and causes traffic on VLAN 7 to be 802.1q tagged D. Configures the trunking interface to send traffic from VLAN 7 untagged Correct Answer: D QUESTION 25 Which statement is true regarding the configuration of ISL trunks? A. A Catalyst switch cannot have ISL and IEEE 802.1q trunks enabled. B. All Catalyst switches support ISL trunking.

9 C. A Catalyst switch will report giants if one side is configured for ISL while the other side is not. D. ISL trunking requires that native VLANs match. QUESTION 26 Which of the following technologies would an Internet Service Provider use to support overlapping customer VLAN ID's over transparent LAN services? A q tunneling B. ATM C. SDH D. IP Over Optical Networking E. ISL Correct Answer: A QUESTION 27 If you were to configure an ISL Ethernet trunk between two Cisco switches, named R1 and R2, what would you have to include at the end of the link for the trunk to operate correctly? (Choose two) A. An identical VTP mode. B. An identical speed/duplex. C. An identical trunk negotiation parameter. D. An identical trunk encapsulation parameter. Correct Answer: BD QUESTION 28 You are the network administrator at Company and switch R1 is configured as shown below: interface GigabitEthernet0/1 switchport mode trunk switchport trunk encapsulation dot1q switchport trunk native vlan 5 If untagged frames are arriving on interface GigabitEthernet0/1 of R1, which of the following statement are correct? A. Untagged frames are automatically assumed to be in VLAN 5. B. Untagged frames are defaulted to VLAN 1 traffic. C. Untagged frames are dropped because all packets are tagged when dot1q trunked. D. Untagged frames are determined on the other switch E. Untagged frames are not supported on 802.1Q trunks. Correct Answer: A

10 QUESTION 29 If you were to set up a VLAN trunk over a Fast Ethernet link on switch R1, which trunk mode would you set the local port to on R1 if you wanted it to respond to requests from its link partner (R2) and become a trunk? A. Auto B. Negotiate C. Designate D. Nonegotiate Correct Answer: A QUESTION 30 Which of the following trunking modes are unable to request their ports to convert their links into trunk links? (Choose two) A. Negotiate B. Designate C. Nonegotiate D. Auto E. Manual F. Off D QUESTION 31 ISL is being configured on a Company switch. Which of the following choices are true regarding the ISL protocol? (Choose two) A. It can be used between Cisco and non-cisco switch devices. B. It calculates a new CRC field on top of the existing CRC field. C. It adds 4 bytes of protocol-specific information to the original Ethernet frame. D. It adds 30 bytes of protocol-specific information to the original Ethernet frame. Correct Answer: BD QUESTION 32 You are the network administrator tasked with designing a switching solution for the Company network. Which of the following statements describing trunk links are INCORRECT? (Choose four) A. The trunk link belongs to a specific VLAN. B. Multiple trunk links are used to connect multiple end user devices. C. A trunk link only supports native VLAN.

11 D. Trunk links use to identify a VLAN. E. The native VLAN of the trunk link is the VLAN that the trunk uses for untagged packets. Correct Answer: ABCD QUESTION 33 Switch R1 has been configured with the root guard feature. What statement is true if the spanning tree enhancement Root Guard is enabled? A. If BPDUs are not received on a non-designated port, the port is moved into the STP loop-inconsistent blocked state B. If BPDUs are received on a PortFast enabled port, the port is disabled. C. If superior BPDUs are received on a designated port, the interface is placed into the root-inconsistent blocked state. D. If inferior BPDUs are received on a root port, all blocked ports become alternate paths to the root bride. QUESTION 34 What does the global command "udld enable" accomplish? A. Enables all fiber-optic LAN ports for Unidirectioinal Link Detection (UDLD) B. Enables all copper media LAN ports for Unidirectioinal Link Detection (UDLD) C. Overrides the default UDLS setting for all ports D. Globally enables all ports on the device for Unidirectional Link Detection (UDLS) Correct Answer: A QUESTION 35 Which three statements about the MST protocol (IEEE 802.1S) are true? (Choose three) A. To verify the MST configuration, the show pending command can be used in MST configuration mode. B. When RSTP and MSTP are configured; UplinkFast and BackboneFast must also be enabled. C. All switches in the same MST region must have the same VLAN-to-instance mapping, but different configuration revision numbers. D. All switches in an MST region, except distribution layer switches, should have their priority lowered from the default value E. An MST region is a group of MST switches that appear as a single virtual bridge to adjacent CST and MST regions. F. Enabling MST with the "spanning-tree mode mst" global configuration command also enables RSTP. Correct Answer: AEF

12 QUESTION 36 Company uses MSTP within their switched LAN. What is the main purpose of Multiple Instance Spanning Tree Protocol (MSTP)? A. To enhance Spanning Tree troubleshooting on multilayer switches B. To reduce the total number of spanning tree instances necessary for a particular topology C. To provide faster convergence when topology changes occur in a switched network D. To provide protection for STP when a link is unidirectional and BPDUs are being sent but not received Correct Answer: B QUESTION 37 Which of the following specifications is a companion to the IEEE 802.1w Rapid Spanning Tree Protocol (RSTP) algorithm, and warrants the use multiple spanning-trees? A. IEEE 802.1s (MST) B. IEEE 802.1Q (CST) C. Cisco PVST+ D. IEEE 802.1d (STP) Correct Answer: A QUESTION 38 Which of the following specifications will allow you to associate VLAN groups to STP instances so you can provide multiple forwarding paths for data traffic and enable load balancing? A. IEEE 802.1d (STP) B. IEEE 802.1s (MST) C. IEEE 802.1q (CST) D. IEEE 802.1w (RSTP) Correct Answer: B QUESTION 39 Which three items are configured in MST configuration submode? (Choose three) A. Region name B. Configuration revision number C. VLAN instance map D. IST STP BPDU hello timer E. CST instance map F. PVST+ instance map Correct Answer: ABC

13 QUESTION 40 By default, all VLANs will belong to which MST instance when using Multiple STP? A. MST00 B. MST01 C. the last MST instance configured D. none Correct Answer: A QUESTION 41 Which MST configuration statement is correct? A. MST configurations can be propagated to other switches using VTP. B. After MST is configured on a Switch, PVST+ operations will also be enabled by default. C. MST configurations must be manually configured on each switch within the MST region. D. MST configurations only need to be manually configured on the Root Bridge. E. MST configurations are entered using the VLAN Database mode on Cisco Catalyst switches. QUESTION 42 While logged into a Company switch you issue the following command: CompanySwitch(config-mst)#instance 10 vlan What does this command accomplish? A. It enables a PVST+ instance of 10 for vlan 11 and vlan 12 B. It enables vlan 11 and vlan 12 to be part of the MST region 10 C. It maps vlan 11 and vlan 12 to the MST instance of 10. D. It creates an Internal Spanning Tree (IST) instance of 10 for vlan 11 and vlan 12 E. It create a Common Spanning Tree (CST) instance of 10 for vlan 11 and vlan 12 F. It starts two instances of MST, one instance for vlan 11 and another instance for vlan 12. QUESTION 43 The Lead2pass network administrator maps VLAN 10 through 20 to MST instance 2. How will this information be propagated to all appropriate switches? A. Information will be carried in the RSTP BPDUs. B. It will be propagated in VTP updates.

14 C. Information stored in the Forwarding Information Base and the switch will reply on query. D. Multiple Spanning Tree must be manually configured on the appropriate switches. Correct Answer: D QUESTION 44 On a multilayer Catalyst switch, which interface command is used to convert a Layer 3 interface to a Layer 2 interface? A. switchport access vlan vlan-id B. switchport C. switchport mode access D. no switchport Correct Answer: B QUESTION 45 Which statement is true about RSTP topology changes? A. Only nonedge ports moving to the blocking state generate a TC BPDU. B. Any loss of connectivity generates a TC BPDU. C. Any change in the state of the port generates a TC BPDU. D. Only nonedge ports moving to the forwarding state generate a TC BPDU. E. If either an edge port or a nonedge port moves to a block state, then a TC BPDU is generated. Correct Answer: D QUESTION 46 What two pieces of information will the show vlan id 5 command display? (Choose two.) A. Ports in VLAN 5 B. Utilization C. VLAN information on port 0/5 D. Filters E. MTU and type Correct Answer: AE QUESTION 47 When you issue a command show port 3/1 on an Ethernet port, you observe the 'Giants' column has a nonzero entry. What could cause of this?

15 A. IEEE 802.1Q B. IEEE C. Misconfigured NIC D. User configuration E. All of the above Correct Answer: A QUESTION 48 You are responsible for increasing the security within the Company LAN. Of the following choices listed below, which is true regarding layer 2 security and mitigation techniques? A. Enable root guard to mitigate ARP address spoofing attacks. B. Configure DHCP spoofing to mitigate ARP address spoofing attacks. C. Configure PVLANs to mitigate MAC address flooding attacks. D. Enable root guard to mitigate DHCP spoofing attacks. E. Configure dynamic APR inspection (DAI) to mitigate IP address spoofing on DHCP untrusted ports. F. Configure port security to mitigate MAC address flooding Correct Answer: F /Reference: /Reference: : Use the port security commands to mitigate MAC-spoofing attacks. The port security command provides the capability to specify the MAC address of the system connected to a particular port. The command also provides the ability to specify an action to take if a port-security violation occurs. However, as with the CAM tableoverflow attack mitigation, specifying a MAC address on every port is an unmanageable solution. Hold-down timers in the interface configuration menu can be used to mitigate ARP spoofing attacks by setting the length of time an entry will stay in the ARP cache. Reference: NetworkSecurity.html QUESTION 49 When an attacker is using switch spoofing to perform VLAN hopping, how is the attacker able to gather information? A. The attacking station uses DTP to negotiate trunking with a switch port and captures all traffic that is allowed on the trunk B. The attacking station tags itself with all usable VLANs to capture data that is passed through the switch, regardless of the VLAN to which the data belongs. C. The attacking station will generate frames with two 802.1Q headers to cause the switch to forward the frames to a VLAN that would be inaccessible to the attacker through legitimate means. D. The attacking station uses VTP to collect VLAN information that is sent out and then tags itself with the domain information in order to capture the data. Correct Answer: A

16 QUESTION 50 Which two statements about layer 2 network attacks are true? (Choose two) A. ARP spoofing attacks are attempts to redirect traffic to an attacking host by encapsulating a false 802.1Q header on a frame and causing traffic to be delivered to the wrong VLAN. B. ARP spoofing attacks are attempts to redirect traffic to an attacking host by sending an ARP message with a forged identity to a transmitting host. C. MAC address flooding is an attempt to force a switch to send all information out every port by overloading the MAC address table. D. ARP spoofing attacks are attempts to redirect traffic to an attacking host by sending an ARP packet that contains the forged address of the next hop router. E. MAC address flooding is an attempt to redirect traffic to a single port by associating that port with all MAC addresses in the VLAN. Correct Answer: BC QUESTION 51 Which statement is true about DHCP spoofing operation? A. DHCP spoofing and SPAN cannot be used on the same port of a switch. B. To prevent a DHCP spoofing, the DHCP server must create a static ARP entry that cannot be updated by a dynamic ARP packet. C. To prevent a DHCP spoofing, the switch must have DHCP server services disabled and a static entry pointing towards the DHCP server. D. DHCP spoofing can be prevented by placing all unused ports in an unused VLAN. Correct Answer: B QUESTION 52 In the use of 802.1X access control, which three protocols are allowed through the switch port before authentication takes place? (Choose three) A. EAP-over-LAN B. EAP MD5 C. STP D. protocols not filtered by an ACL E. CDP F. TACACS+ Correct Answer: ACE QUESTION 53 VLAN maps have been configured on switch R1. Which of the following actions are taken in a VLAN map that does not contain a match clause? A. Implicit deny feature at end of list.

17 B. Implicit deny feature at start of list. C. Implicit forward feature at end of list D. Implicit forward feature at start of list. Correct Answer: A QUESTION 54 Given the configuration on a switch interface, what happens when a host with the MAC address of is directly connected to the switch port? switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security mac-address switchport port-security violation shutdown A. The host will be allowed to connect. B. The port will shut down. C. The host can only connect through a hub/switch where is already connected. D. The host will be refused access. Correct Answer: A QUESTION 55 You need to configure port security on switch R1. Which two statements are true about this technology? (Choose two) A. Port security can be configured for ports supporting VoIP. B. With port security configured, four MAC addresses are allowed by default. C. The network administrator must manually enter the MAC address for each device in order for the switch to allow connectivity. D. With port security configured, only one MAC addresses is allowed by default. E. Port security cannot be configured for ports supporting VoIP. Correct Answer: AD QUESTION 56 Which statement is true about Layer 2 security threats? A. MAC spoofing attacks allow an attacking device to receive frames intended for a different network host. B. Port scanners are the most effective defense against dynamic ARP inspection. C. MAC spoofing, in conjunction with ARP snooping, is the most effective counter-measure against reconnaissance attacks that use dynamic ARP inspection (DAI) to determine vulnerable attack points. D. Dynamic ARP inspection in conjunction with ARP spoofing can be used to counter DHCP snooping attacks. E. DHCP snooping sends unauthorized replies to DHCP queries. F. ARP spoofing can be used to redirect traffic to counter dynamic ARP inspection.

18 Correct Answer: A QUESTION 57 An attacker is launching a DoS attack with a public domain hacking tool that is used to exhaust the IP address space available from the DHCP servers for a period of time. Which procedure would best defend against this type of attack? A. Configure only trusted interfaces with root guard. B. Implement private VLANs (PVLANs) to carry only user traffic. C. Implement private VLANs (PVLANs) to carry only DHCP traffic. D. Configure only untrusted interfaces with root guard. E. Configure DHCP spoofing on all ports that connect untrusted clients. F. Configure DHCP snooping only on ports that connect trusted DHCP servers. Correct Answer: F QUESTION 58 In order to enhance security on the Company network, users must be authenticated using 802.1X. When authentication is required, where must 802.1X be configured in order to connect a PC to a switch? A. Switch port and local router port B. Switch port, client PC, and authentication server C. Client PC only D. Switch port only Correct Answer: B QUESTION 59 Which statement is true about 802.1x port-based authentication? A. TACACS+ is the only supported authentication server type. B. If a host initiates the authentication process and does not receive a response, it assumes it is not authorized. C. RADIUS is the only supported authentication server type. D. Before transmitting data, an 802.1x host must determine the authorization state of the switch. E. Hosts are required to have a 802.1x authentication client or utilize PPPoE. QUESTION 60 Which three statements are true about the dynamic ARP inspection (DAI) feature? (Choose three)

19 A. DAI can be performed on ingress ports only. B. DAI can be performed on both ingress and egress ports. C. DAI is supported on access ports, trunk ports, EtherChannel ports, and private VLAN ports. D. DAI should be enabled on the root switch for particular VLANs only in order to secure the ARP caches of hosts in the domain. E. DAI should be configured on all access switch ports as untrusted and on all switch ports connected to other switches as trusted. F. DAI is supported on access and trunk ports only. Correct Answer: ACE QUESTION 61 What are three required steps to configure DHCP snooping on a switch? (Choose three.) A. Configure the switch to insert and remove DHCP relay information (option-82 field) in forwarded DHCP request messages. B. Configure DHCP snooping globally. C. Configure the switch as a DHCP server. D. Configure DHCP snooping on an interface. E. Configure all interfaces as DHCP snooping trusted interfaces. F. Configure DHCP snooping on a VLAN or range of VLANs. Correct Answer: BDF QUESTION 62 What does the global configuration command "ip arp inspection vlan 10-12,15" accomplish? A. Discards ARP packets with invalid IP-to-MAC address bindings on trusted ports B. Validates outgoing ARP requests for interfaces configured on VLAN 10, 11, 12, or 15 C. Intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings D. Intercepts all ARP requests and responses on trusted ports QUESTION 63 What is true about access control on bridged and routed VLAN traffic? (Choose three) A. Router ACLs can be applied to the input and output directions of a VLAN interface. B. Bridged ACLs can be applied to the input and output directions of a VLAN interface. C. Only router ACLs can be applied to a VLAN interface. D. VLAN maps and router ACLs can be used in combination. E. VLAN maps can be applied to a VLAN interface Correct Answer: ABD

20 QUESTION 64 A switch has been configured with Private VLANs. With that type of PVLAN port should the default gateway be configured? A. Trunk B. Isolated C. Primary D. Community E. Promiscuous Correct Answer: E QUESTION 65 Which statement is true about the Forward Information Base (FIB) table? A. The FIB is derived from the IP routing table and is optimized for maximum lookup throughput. B. The FIB table is derived from the Address Resolution Protocol table, and it contains Layer 2 rewrite (MAC) information for the next hop. C. When the FIB table is full, a wildcard entry redirects traffic to the Layer 3 engine. D. The FIB lookup is based on the Layer 2 destination MAC address. Correct Answer: A QUESTION 66 The Lead2pass Company network needs to pass traffic between VLANs. Which device should be used to accomplish this? A. Hub B. Switch C. Router D. Bridge

21 Exam B QUESTION 1 Inter-VLAN routing has been implemented in the Company network. In VLAN routing, what are some of the disadvantages of designing a router-on-stick configuration? (Choose three) A. InterVLAN routing cannot be filtered by the router. B. The router becomes a single point of failure for the network. C. Routers will not route STP BPDUs. D. There is a possibility of inadequate bandwidth for each VLAN. E. Additional overhead on the router can occur. F. NetFlow Switching is required for InterVLAN accounting. Correct Answer: BDE QUESTION 2 Which of the following could be used to provide a Layer 3 data path between separate VLANs? (Choose two.) A. VLAN trunking B. An external router C. An internal route processor D. VLAN capable bridge E. EtherChannel Correct Answer: BC QUESTION 3 You are configuring a Cisco multilayer switch for the Company network. Which command would you use to configure a port to act as a routed interface? A. ip routing B. switchport mode trunk C. no switchport D. switchport trunk native vlan 1 QUESTION 4 Which two statements about VLAN hopping are true? (Choose two) A. Attacks are prevented by utilizing the port-security feature. B. An end station attempts to gain access to all VLANs by transmitting Ethernet frames in the 802.1q encapsulation. C. Configuring an interface with the "switchport mode dynamic" command will prevent VLAN hopping. D. An end station attempts to redirect VLAN traffic by transmitting Ethernet frames in the 802.1q

22 encapsulation. E. Configuring an interface with the "switchport mode access" command will prevent VLAN hopping. Correct Answer: BE QUESTION 5 What is one method that can be used to prevent VLAN hopping on the network? A. Configure VACLs. B. Configure all frames with two 802.1Q headers. C. Enforce username/password combinations. D. Explicitly turn off Dynamic Trunking Protocol (DTP) on all unused ports. E. All of the above Correct Answer: D QUESTION 6 On a 3550 EMI switch, which three types of interfaces can be used to configure HSRP? (Choose three) A. SVI interface B. Access port C. EtherChannel port channel D. Loopback interface E. Routed port F. BVI interface Correct Answer: ACE QUESTION 7 Which of the following protocols enables a group of routers to form a single virtual router, and then use the real IP address of a router as the gateway address? A. HSRP B. IRDP C. Proxy ARP D. GLBP E. VRRP Correct Answer: E QUESTION 8 Which router redundancy protocol cannot be configured for interface tracking?

23 A. GLBP B. HSRP C. RPR D. VRRP E. SLB F. RPR+ Correct Answer: D QUESTION 9 HSRP has been configured between two Company devices. Which of the following describe reasons for deploying HSRP? (Choose three) A. HSRP provides redundancy and fault tolerance B. HSRP allows one router to automatically assume the function of the second router if the second router fails C. HSRP allows one router to automatically assume the function of the second router if the second router starts D. HSRP provides redundancy and load balancing Correct Answer: ABD QUESTION 10 Which describes the default load balacing scheme used by the Gateway Load Balancing Protocol (GLBP)? A. Per host using a strict priority scheme B. Per session using a round-robin scheme C. Per session using a strict priority scheme D. Per GLBP group using a strict priority scheme E. Per host basis using a round robin-scheme F. Per GLBP group using a round-robin scheme Correct Answer: E QUESTION 11 Which protocol specified by RFC 2281 provides network redundancy for IP networks, ensuring that user traffic immediately and transparently recovers from first-hop failures in network edge devices or access circuits? A. ICMP B. IRDP C. HSRP D. STP

24 QUESTION 12 Which two statements are true about the Hot Standby Router Protocol (HSRP)? (Choose two) A. Load sharing with HSRP is achieved by creating multiple subinterfaces on the HSRP routers. B. Routers configured for HSRP can belong to multiple groups and multiple VLANs. C. Load sharing with HSRP is achieved by creating HSRP groups on the HSRP routers. D. All routers configured for HSRP load balancing must be configured with the same priority. E. Routers configured for HSRP must belong to only one group per HSRP interface. Correct Answer: BC QUESTION 13 Which two statements are true about HSRP, VRRP, and GLBP? (Choose two) A. GLBP and VRRP allow for MD5 authentication, whereas HSRP does not. B. HSRP allows for multiple upstream active links being simultaneously used, whereas GLBP does not. C. GLBP allows for router load balancing of traffic from a network segment without the different host IP configurations required to achieve the same results with HSRP. D. Unlike HSRP and VRRP, GLBP allows automatic selection and simultaneous use of multiple available gateways. E. GLBP allows for router load balancing of traffic from a network segment by utilizing the creation of multiple standby groups. D QUESTION 14 Which protocol allows for the automatic selection and simultaneous use of multiple available gateways as well as automatic failover between those gateways? A. VRRP B. GLBP C. IRDP D. HSRP Correct Answer: B QUESTION 15 In which three HSRP states do routers send hello messages? (Choose three.) A. Learn B. Speak C. Standby D. Listen

25 E. Active F. Remove Correct Answer: BCE QUESTION 16 What are three possible router states of HSRP routers on a LAN? (Choose three.) A. Standby B. Established C. Active D. Idle E. Backup F. Init Correct Answer: ACF QUESTION 17 HSRP has been configured between two Company devices. What kind of message does an HSRP configured router send out every 3 seconds? A. Retire B. Coup C. Resign D. Send E. Hello Correct Answer: E QUESTION 18 Which one of the statements below correctly describes the Virtual Router Redundancy Protocol (VRRP), which is being used in the Company network to provide redundancy? A. A VRRP group has one active and one or more standby virtual routers. B. A VRRP group has one master and one or more backup virtual routers. C. A VRRP group has one master and one redundant virtual router. Correct Answer: B QUESTION 19 In the hardware address c07.ac0a, what does 07.ac represent? A. HSRP well-known physical MAC address

26 B. Vendor code C. HSRP router number D. HSRP group number E. HSRP well-known virtual MAC address Correct Answer: E QUESTION 20 Which first-hop redundancy solution listed would supply clients with MAC address C07.AC0A for group 10 in response to an ARP request for a default gateway? A. IRDP B. Proxy ARP C. GLBP D. HSRP E. VRRP F. IP Redirects Correct Answer: D QUESTION 21 Regarding high availability, with the MAC address c07.ac03, what does the "03" represent? A. The GLBP group number B. The type of encapsulation C. The HSRP router number D. The VRRP group number E. The HSRP group number F. The active router number Correct Answer: E QUESTION 22 Which two statements about the HSRP priority are true? (Choose two) A. To assign the HSRP router priority in a standby group, the standby group-number priority priority-value global configuration command must be used. B. The default priority of a router is zero (0). C. The no standby priority command assigns a priority of 100 to the router. D. Assuming that preempting has also been configured, the router with the lowest priority in an HSRP group would become the active router. E. When two routers in an HSRP standby group are configured with identical priorities, the router with the highest configured IP address will become the active router. E

27 QUESTION 23 Which three protocols have been developed for IP routing redundancy to protect against first-hop router failure? (Choose three.) A. GLBP B. ICMP C. MSTP D. HSRP E. VRRP F. NHRP Correct Answer: ADE QUESTION 24 Which three statements are true of a default HSRP configuration? (Choose three.) A. The Standby hello time is 2 seconds. B. Two HSRP groups are configured. C. The Standby track interface priority decrement is 10. D. The Standby hold time is 10 seconds E. The Standby priority is 100. F. The Standby delay is 3 seconds. DE QUESTION 25 What three tasks must a network administrator perform to properly configure Hot Standby Routing Protocol (HSRP)? (Choose three) A. Define the encapsulation type. B. Define the standby router. C. Define the standby IP address. D. Enable the standby priority. Correct Answer: BCD QUESTION 26 You want to allow Router R1 to immediately become the active router if its priority is highest than the active router fails. What command would you use if you wanted to configure this? A. en standby 1 preempt

28 B. standby 1 preempt enable C. standby 1 preempt D. hot standby 1 preempt QUESTION 27 With route processor redundancy (RPR+), the redundant supervisor engine is fully initialized and configured, which shortens the switchover time if the active supervisor engine fails. Which three statements are true about the RPR+ operations when the redundant supervisor engine switched over the failed primary supervisor engine? (Choose three) A. Static IP routes are maintained across a switchover because they are configured from entries in the configuration file. B. Information about dynamic routing states, maintained on the active supervisor engine, is synchronized to the redundant supervisor engine and is transferred during the switchover. C. Information about dynamic routing states, maintained on the active supervisor engine, is not synchronized to the redundant supervisor engine and is lost on switchover. D. The Forwarding Information Base (FIB) tables are cleared on a switchover. As a result, routed traffic is interrupted until route tables reconverge. E. Static IP routes are cleared across a switchover and recreated from entries in the configuration file on the redundant supervisor engine. F. The Forwarding Information Base (FIB) tables are maintained during the switchover. As a result, routed traffic continues without any interruption when the failover occurs. Correct Answer: ACD QUESTION 28 Which statement best describes Cisco supervisor engine redundancy using Stateful Switchover? A. Switchover ensures that Layer 2 through Layer 4 traffic is not interrupted. B. Redundancy requires BGP, OSPF, EIGRP, or IS-IS. C. Redundancy provides fast supervisor switchover for all Cisco Catalyst 6500 series switches. D. Switchover can be caused by clock synchronization failure between supervisors. Correct Answer: D QUESTION 29 Which three of the following network features are methods used to achieve high availability? (Choose three) A. Spanning Tree Protocol (STP) B. Delay reduction C. Hot Standby Routing Protocol (HSRP) D. Dynamic routing protocols E. Quality of Service (QoS)

29 F. Jitter management Correct Answer: ACD QUESTION 30 Routers R1 and R2 are configured for HSRP as shown below: Router R1: interface ethernet 0 ip address standby 35 ip standby 35 priority 100 interface ethernet 1 ip address standby 34 ip Router R2: interface ethernet 0 ip address standby 35 ip interface ethernet 1 ip address standby 34 ip standby 34 priority 100 You have configured the routers R1 & R2 with HSRP. While debugging router R2 you notice very frequent HSRP group state transitions. What is the most likely cause of this? A. physical layer issues B. no spanning tree loops C. use of non-default HSRP timers D. failure to set the command standby 35 preempt Correct Answer: A QUESTION 31 Which three WLAN statements are true? (Choose three) A. A lightweight AP receives control and configuration from a WLAN controller to which it is associated. B. A wireless client operating at a lower data rate in a particular WLAN will delay all clients in that same WLAN C. Ad hoc mode allows mobile clients to connect directly without an intermediate AP. D. Another term for infrastructure mode is independent service set (IBSS). E. The Aironet 1230 access point is an example of an access point that operates solely as a lightweight access point. F. WLANs are designed to share the medium and can easily handle an increased demand of channel contention. Correct Answer: ABC

30 QUESTION 32 Which description correctly describes a MAC address flooding attack? A. The attacking device crafts ARP replies intended for valid hosts. The MAC address of the attacking device then becomes the destination address found in the Layer 2 frames sent by the valid network device. B. The attacking device crafts ARP replies intended for valid hosts. The MAC address of the attacking device then becomes the source address found in the Layer 2 frames sent by the valid network device. C. The attacking device spoofs a destination MAC address of a valid host currently in the CAM table. The switch then forwards frames destined for the valid host to the attacking device. D. The attacking device spoofs a source MAC address of a valid host currently in the CAM table. The switch then forwards frames destined for the valid host to the attacking device. E. Frames with unique, invalid destination MAC addresses flood the switch and exhaust CAM table space. The result is that new entries cannot be inserted because of the exhausted CAM table space, and traffic is subsequently flooded out all ports. F. Frames with unique, invalid source MAC addresses flood the switch and exhaust CAM table space. The result is that new entries cannot be inserted because of the exhausted CAM table space, and traffic is subsequently flooded out all ports. Correct Answer: F QUESTION 33 What are two methods of mitigating MAC address flooding attacks? (Choose two.) A. Place unused ports in a common VLAN. B. Implement private VLANs. C. Implement DHCP snooping. D. Implement port security. E. Implement VLAN access maps. Correct Answer: DE QUESTION 34 Why is BPDU guard an effective way to prevent an unauthorized rogue switch from altering the spanning-tree topology of a network? A. BPDU guard can guarantee proper selection of the root bridge. B. BPDU guard can be utilized along with PortFast to shut down ports when a switch is connected to the port. C. BPDU guard can be utilized to prevent the switch from transmitteing BPDUs and incorrectly altering the root bridge election. D. BPDU guard can be used to prevent invalid BPDUs from propagating throughout the network. Correct Answer: B QUESTION 35 What two steps can be taken to help prevent VLAN hopping? (Choose two.)

31 A. Place unused ports in a common unrouted VLAN B. Enable BPDU guard C. Implement port security D. Prevent automatic trunk configuration E. Disable CDP on ports where it is not necessary Correct Answer: AD QUESTION 36 Which statement is true about voice VLANs? * A. The voice VLAN feature is enabled by default. B. When the voice VLAN feature is enabled, all untagged voice and data traffic is sent through the voice VLAN. C. The default CoS value is 1 for incoming voice and data traffic. D. The IP phone overrides the priority of all incoming data traffic (tagged and untagged) and sets the CoS value to 0. Correct Answer: D QUESTION 37 Which three statements are true about routed ports on a multilayer switch? (Choose three) A. A routed port can support VLAN subinterfaces. B. A routed port will take an IP address assignment. C. A routed port can be configured with routing protocols. D. A routed port is a virtual interface on the multilayer switch. E. A routed port is a only associated with one VLAN. F. A routed port is a physical interface on the multilayer switch. Correct Answer: BCF QUESTION 38 Which three statements are true about CEF? (Choose three.) A. The FIB table is derived from the IP routing table. B. The adjacent table is derived from the ARP table. C. CEF IP destination prefixes are stored in the TCAM table, from the least specific to the most specific entry. D. When the CEF TCAM table is full, packets are dropped. E. When the adjacency table is full, a CEF TCAM table entry points to the Layer 3 engine to redirect the adjacency. F. The FIB lookup is based on the Layer 3 destination address prefix (shortest match). Correct Answer: ABE

32 QUESTION 39 With CEF, prefixes that require exception processing can be cached with one of which four special adjacencies? (Choose four) A. Forward B. Null C. Glean D. Kick E. Discard F. Drop Correct Answer: BCEF QUESTION 40 Which two statements are true about trust boundaries? (Choose two.) A. Classifying and marking traffic should be done as close to the traffic source as possible. B. Classifying and marking traffic should be done at the distribution layer. C. Traffic is classified and marked as it travels through the network. D. If untrusted traffic enters a switch, it can be marked with a new QoS value appropriate for the policy in place. E. The trust boundary moves depending on the type of traffic entering the network. Correct Answer: AD QUESTION 41 Which three statements are true about DAI? (Choose three.) A. DAI determines the validity of an ARP packet based on the valid MAC address-to-ip address bindings stored in the DHCP Snooping database. B. DAI forwards all ARP packets received on a trusted interface without any checks. C. DAI determines the validity of an ARP packet based on the valid MAC address-to-ip address bindings stored in the CAM table. D. DAI forwards all ARP packets received on a trusted interface after verifying and inspecting the packet against the DAI table. E. DAI intercepts all ARP packets on untrusted ports F. DAI is used to prevent against a DHCP Snooping attack. Correct Answer: ABE QUESTION 42 A network administrator would like to configure 802.1x port-based authentication, however, the client

33 workstation is not 802.1x compliant. What is the only supported authentication server that can be used? A. TACACS with LEAP extensions B. TACACS+ C. RADIUS with EAP extensions D. LDAP QUESTION 43 A standalone wireless AP solution is being installed into the campus infrastructure. The access points appear to boot correctly, however, wireless clients are not obtaining correct access. You verify that the local switch configuration connected to the access point appears as the following: interface ethernet 0/1 switchport access vlan 10 switchport mode access spanning-tree portfast mls qos trust dscp What is the most likely issue causing the problem? * A. QoS trust should not be configured on a port attached to a standalone AP. B. QoS trust for switchport mode access should be defined as "cos". C. switchport mode should be defined as "trunk" with respective QoS. D. switchport access vlan should be defined as "1". QUESTION 44 Wireless has been operating correctly in the campus infrastructure. After the wireless controllers are upgraded from LWAPP to CAPWAP, access points no longer boot and operate normally. What is the most likely issue causing this problem? A. VLAN assignments B. DHCP option 43 C. PoE D. ACL E. QoS Correct Answer: D QUESTION 45 A network is deployed using best practices of the enterprise campus network model, including users with desktop computers connected via IP phones. Given that all components are QoS-capable, where are the two optimal locations for trust boundaries to be configured by the network administrator? (Choose two.) *