Q1. DRAG DROP
Drag and drop the BGP state on the left to the action that defines it on the right.
Answer:
Q2. Which two fields reside in the initial CHAP challenge packet? (Choose two.)
A. the authentication name of the challenger
B. a random hash value generated by the device
C. the hashed packet type ID
D. the packet type ID in clear text
Answer: A,D
Explanation:
When a caller A dials in to an access server B, The Access server sends across the link an initial Type 1 authentication packet called a Challenge. This Challenge packet contains a randomly generated number, an ID sequence number to identify the challenge (sent in clear text) and the authentication name of the challenger.
Reference: http://www.rhyshaden.com/ppp.htm
Q3. Which three options are three of the default EIGRP administrative distances? (Choose three.)
A. Internal, 90
B. External, 170
C. Summary, 5
D. Outside Local, 100
E. Inside Local, 180
F. Inside Global, 1
Answer: A,B,C
Explanation:
The following table lists the default administrative distances for various routing protocols used on Cisco routers.
Routing Protocol
Administrative distance
Directly connected interface
0
Static route out an interface
1
Static route to next-hop address
1
DMNR - Dynamic Mobile Network Routing
3
EIGRP summary route
5
External BGP
20
Internal EIGRP
90
IGRP
100
OSPF
110
IS-IS
115
Routing Information Protocol (RIP)
120
Exterior Gateway Protocol (EGP)
140
On Demand Routing (ODR)
160
External EIGRP
170
Internal BGP
200
Floating Static Route (ex. DHCP-learned)
254
Unknown
255
Reference: http://en.wikipedia.org/wiki/Administrative_distance
Q4. Refer to the exhibit.
Which two issues can cause the interface VLAN10 to be down/down? (Choose two.)
A. The VLAN is inactive or has been removed from the VLAN database.
B. STP is in a forwarding state on the port.
C. A Layer 2 access port is configured with VLAN10, but is in a down/down state.
D. The autostate exclude feature was used on interface VLAN10.
Answer: A,C
Q5. What is a key advantage of Cisco GET VPN over DMVPN?
A. Cisco GET VPN provides zero-touch deployment of IPSEC VPNs.
B. Cisco GET VPN supports certificate authentication for tunnel establishment.
C. Cisco GET VPN has a better anti-replay mechanism.
D. Cisco GET VPN does not require a secondary overlay routing infrastructure.
Answer: D
Explanation:
DMVPN requires overlaying a secondary routing infrastructure through the tunnels, which results in suboptimal routing while the dynamic tunnels are built. The overlay routing topology also reduces the inherent scalability of the underlying IP VPN network topology. Traditional point-to-point IPsec tunneling solutions suffer from multicast replication issues because multicast replication must be performed before tunnel encapsulation and encryption at the IPsec CE (customer edge) router closest to the multicast source. Multicast replication cannot be performed in the provider network because encapsulated multicasts appear to the core network as unicast data. Cisco’s Group Encrypted Transport VPN (GET VPN) introduces the concept of a trusted group to eliminate point-to-point tunnels and their associated overlay routing. All group members (GMs) share a common security association (SA), also known as a group SA. This enables GMs to decrypt traffic that was encrypted by any other GM. (Note that IPsec CE acts as a GM.) In GET VPN networks, there is no need to negotiate point-to- point IPsec tunnels between the members of a group, because GET VPN is “tunnel-less.”
Reference: Group Encrypted Transport VPN (Get VPN) Design and Implementation Guide PDF
Q6. Which authentication method does OSPFv3 use to secure communication between neighbors?
A. plaintext
B. MD5 HMAC
C. PKI
D. IPSec
Answer: D
Explanation:
In order to ensure that OSPFv3 packets are not altered and re-sent to the device, causing the device to behave in a way not desired by its system administrators, OSPFv3 packets must be authenticated. OSPFv3 uses the IPsec secure socket API to add authentication to OSPFv3 packets. This API supports IPv6. OSPFv3 requires the use of IPsec to enable authentication. Crypto images are required to use authentication, because only crypto images include the IPsec API needed for use with OSPFv3.
Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-15-sy-book/ip6-route-ospfv3-auth-ipsec.html
Q7. Which mechanism does Cisco recommend for CE router interfaces that face the service provider for an EVPL circuit with multiple EVCs and multiple traffic classes?
A. HCBWFQ
B. LLQ
C. tail drop
D. WRED
Answer: A
Explanation:
In a simple handoff, packets may be discarded in the service provider network, either because of congestion on a link without an appropriate QoS policy or because of a policer QoS configuration on the service provider network that serves to rate limit traffic accessing the WAN core. To address these issues, QoS on the CE device is applied at a per-port level. A QoS service policy is configured on the outside Ethernet interface, and this parent policy includes a shaper that then references a second or subordinate (child) policy that enables queueing within the shaped rate. This is called a hierarchical CBWFQ (HCBWFQ) configuration.
Reference: http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/Ethernet_Acces s_for_NG_MAN_WAN_V3-1_external.html
Q8. DRAG DROP
Drag and drop the OTV component on the left to the function it performs on the right.
Answer:
Q9. Which two options are disadvantages of a commingled dual-tier WAN rate-based Ethernet circuit? (Choose two.)
A. It requires the maintenance of separate chassis.
B. It has limited scalability.
C. It requires additional CPU resources at the subscriber end.
D. It is more difficult to secure.
E. It can increase the likelihood of packet drops.
Answer: A,E
Q10. Refer to the exhibit.
Which statement about the output is true?
A. The flow is an HTTPS connection to the router, which is initiated by 144.254.10.206.
B. The flow is an HTTP connection to the router, which is initiated by 144.254.10.206.
C. The flow is an HTTPS connection that is initiated by the router and that goes to 144.254.10.206.
D. The flow is an HTTP connection that is initiated by the router and that goes to 144.254.10.206.
Answer: A
Explanation:
We can see that the connection is initiated by the Source IP address shown as 144.254.10.206. We also see that the destination protocol (DstP) shows 01BB, which is in hex and translates to 443 in decimal. SSL/HTTPS uses port 443.