Q1. Which two advantages does CoPP have over receive path ACLs? (Choose two.)
A. Only CoPP applies to IP packets and non-IP packets.
B. Only CoPP applies to receive destination IP packets.
C. A single instance of CoPP can be applied to all packets to the router, while rACLs require multiple instances.
D. Only CoPP can rate-limit packets.
Answer: A,D
Explanation:
Control Plane Policing – CoPP is the Cisco IOS-wide route processor protection mechanism. As illustrated in Figure 2, and similar to rACLs, CoPP is deployed once to the punt path of the router. However, unlike rACLs that only apply to receive destination IP packets, CoPP applies to all packets that punt to the route processor for handling. CoPP therefore covers not only receive destination IP packets, it also exceptions IP packets and non-IP packets. In addition, CoPP is implemented using the Modular QoS CLI (MQC) framework for policy construction. In this way, in addition to simply permit and deny functions, specific packets may be permitted but rate-limited. This behavior substantially improves the ability to define an effective CoPP policy. (Note: that “Control Plane Policing” is something of a misnomer because CoPP generally protects the punt path to the route processor and not solely the control plane.)
Reference: http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html
Q2. What are the three variants of NTPv4? (Choose three.)
A. client/server
B. broadcast
C. symmetric
D. multicast
E. asymmetric
F. unicast
Answer: A,B,C
Q3. Which two statements about the OSPF two-way neighbor state are true? (Choose two.)
A. Each neighbor receives its own router ID in a hello packet from the other neighbor.
B. Each neighbor receives a hello message from the other neighbor.
C. It is valid only on NBMA networks.
D. It is valid only on point-to-point networks.
E. Each neighbor receives an acknowledgement of its own hello packet from the other neighbor.
F. Each neighbor receives the router ID of the other neighbor in a hello packet from the other neighbor.
Answer: A,E
Q4. Which statement is true regarding the UDP checksum?
A. It is used for congestion control.
B. It cannot be all zeros.
C. It is used by some Internet worms to hide their propagation.
D. It is computed based on the IP pseudo-header.
Answer: D
Explanation:
The method used to compute the checksum is defined in RFC 768: “Checksum is the 16-bit one's complement of the one's complement sum of a pseudo header of information from the IP header, the UDP header, and the data, padded with zero octets at the end (if necessary) to make a multiple of two octets.” In other words, all 16-bit words are summed using one's complement arithmetic. Add the 16-bit values up. Each time a carry-out (17th bit) is produced, swing that bit around and add it back into the least significant bit. The sum is then one's complemented to yield the value of the UDP checksum field. If the checksum calculation results in the value zero (all 16 bits 0) it should be sent as the one's complement (all 1s).
Reference: http://en.wikipedia.org/wiki/User_Datagram_Protocol
Q5. Refer to the exhibit.
Which VLANs are permitted to send frames out port FastEthernet0/1?
A. 100 - 200
B. 4 - 100
C. 1 and 4 - 100
D. 3 and 4 - 100
Answer: D
Explanation:
Traffic on the native vlan does not get tagged as it crosses a trunk, so there is no dot1q tag in the first place to be filtered. And you don’t need to allow the native vlan. But if we force to tag the native vlan (with the “switchport trunk native vlan tag” command) then if the native vlan is not in the “allowed vlan” list it will be dropped.
Q6. DRAG DROP
Drag each spanning-tree feature on the left to the matching statement on the right.
Answer:
Q7. Refer to the exhibit.
What will be the extended community value of this route?
A. RT:200:3000 RT:200:9999
B. RT:200:9999 RT:200:3000
C. RT:200:3000
D. RT:200:9999
Answer: D
Explanation:
Here the route map is being used to manually set the extended community RT to 200:9999
Q8. Which three factors does Cisco PfR use to calculate the best exit path? (Choose three.)
A. quality of service
B. packet size
C. delay
D. loss
E. reachability
F. administrative distance
Answer: C,D,E
Explanation:
Cisco PfR selects an egress or ingress WAN path based on parameters that affect application performance, including reachability, delay, cost, jitter, and Mean Opinion Score (MOS).
Reference: http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/performance-routing-pfr/product_data_sheet0900aecd806c4ee4.html
Q9. Which term describes an EIGRP route that has feasible successors?
A. active
B. passive
C. redistributed
D. invalid
Answer: B
Explanation:
A topology table entry for a destination can have one of two states. A route is considered in the Passive state when a router is not performing a route recomputation. The route is in Active state when a router is undergoing a route recomputation. If there are always feasible successors, a route never has to go into Active state and avoids a route recomputation.
When there are no feasible successors, a route goes into Active state and a route recomputation occurs. A route recomputation commences with a router sending a query packet to all neighbors. Neighboring routers can either reply if they have feasible successors for the destination or optionally return a query indicating that they are performing a route recomputation. While in Active state, a router cannot change the next-hop neighbor it is using to forward packets. Once all replies are received for a given query, the destination can transition to Passive state and a new successor can be selected.
Reference: http://docwiki.cisco.com/wiki/Enhanced_Interior_Gateway_Routing_Protocol
Q10. Refer to the exhibit.
If the traffic flowing from network 192.168.254.0 to 172.16.250.0 is unencrypted, which two actions must you take to enable encryption? (Choose two).
A. Configure the transform-set on R2 to match the configuration on R1.
B. Configure the crypto map on R2 to include the correct subnet.
C. Configure the ISAKMP policy names to match on R1 and R2.
D. Configure the crypto map names to match on R1 and R2.
E. Configure the Diffie-Hellman keys used in the ISAKMP policies to be different on R1 and R2.
Answer: A,B
Explanation:
A transform set combines an encryption method and an authentication method. During the IPsec security association negotiation with ISAKMP, the peers agree to use a particular transform set to protect a particular data flow. The transform set must be the same for both peers. Also, the crypto map on R2 points to the address name of VPN, which includes 172.16.0.0/16, but it should be the local subnet of 192.168.0.0/16