Untitled

When creating a network security solution, which two pieces of information should you have obtained previously to assist in designing the solution? (Choose two) A. A list of existing network applications currently in use on the network B. Network audit results to uncover any potential security holes C. A planned Layer 2 design solution D. A proof-of-concept plan E. Device configuration templates

A. A list of existing network applications currently in use on the network B. Network audit results to uncover any potential security holes

Refer to the exhibit Which three statements are true? (Choose three) A. A trunk will be formed B. Only VLANs 1-1001 will travel across the trunk link C. The native VLAN for switch B is VLAN 1 D. DTP is not running on switch A E. DTP packets are sent from switch B

A. A trunk will be formed C. The native VLAN for switch B is VLAN 1 E. DTP packets are sent from switch B

Refer to the exhibit Refer to the above. HSRP was implemented and configured on two switches while scheduled network maintenance was performed After the two switches have finished rebooting, you notice via show commands that Switch2 is the HSRP active router. Which two items are the most likely cause of Switch1 not becoming the active router? (Choose two) A. Booting has been delayed B. The standby group number does not match the VLAN number C. IP addressing is incorrect D. Preemption is disabled E. Standby timers are incorrect F. IP redirect is disabled

A. Booting has been delayed D. Preemption is disabled

Which statement about the Port Aggregation Protocol is true? A. Configuration changes made on the port-channel interface apply to all physical ports assigned to the port-channel interface B. Configuration changes made on a physical port that is a member of a port-channel interface apply to the port-channel interface C. Configuration changes are not permitted with Port Aggregation Protocol. Instead, the standardized Link Aggregation Control Protocol should be used if configuration changes are required D. The physical port must first be disassociated from the port-channel interface before any configuration changes can be made

A. Configuration changes made on the port-channel interface apply to all physical ports assigned to the port-channel interface

The company LAN is being saturated with broadcasts and multicast traffic. What could you do to help a network with many multicast and broadcasts? A. Creating smaller broadcast domains by implementing VLANs B. Separate nodes into different hubs C. Creating larger broadcast domains by implementing VLANs D. Separate nodes into different switches E. All of the above

A. Creating smaller broadcast domains by implementing VLANs

Which two DTP modes permit trunking between directly connected devices? (Choose two) A. Dynamic desirable (VTP domain A) to dynamic desirable (VTP domain A) B. Dynamic desirable (VTP domain A) to dynamic desirable (VTP domain B) C. Dynamic auto (VTP domain A) to dynamic auto (VTP domain A) D. Dynamic auto (VTP domain A) to dynamic auto (VTP domain B) E. Dynamic auto (VTP domain A) to negotiate (VTP domain A) F. Negotiate (VTP domain A) to negotiate (VTP domain B)

A. Dynamic desirable (VTP domain A) to dynamic desirable (VTP domain A) F. Negotiate (VTP domain A) to negotiate (VTP domain B)

Which two statements about HSRP, VRRP, and GLBP are true? (Choose two) A. GLBP allows for router load balancing of traffic from a network segment without the different host IP configuration needed to achieve the same results with HSRP B. GLBP allows for router load balancing of traffic from a network segment by utilizing the creation of multiple standby groups C. GLBP and VRRP allows for MD5 authentication, whereas HSRP does not D. Unlike HSRP and VRRP, GLBP allows automatic selection and simultaneous use of multiple available gateways E. HSRP allows for multiple upstream active links being simultaneously used, whereas GLBP does not

A. GLBP allows for router load balancing of traffic from a network segment without the different host IP configuration needed to achieve the same results with HSRP D. Unlike HSRP and VRRP, GLBP allows automatic selection and simultaneous use of multiple available gateways

What is the effect of configuring the following command on a switch? Switch(config)# spanning-tree portfast bpdufilter default A. If BPDUs are received by a port configured for PortFast, then PortFast is disabled and the BPDUs are processed normally B. If BPDUs are received by a port configured for PortFast, they are ignored and none are sent C. If BPDUs are received by a port configured for PortFast, the port transitions to the forwarding sate D. The command enables BPDU filtering on all ports regardless of whether they are configured for BPDU filtering at the interface level Correct Answer: A

A. If BPDUs are received by a port configured for PortFast, then PortFast is disabled and the BPDUs are processed normally

Private VLANs can be configured as which three port types? (Choose three) A. Isolated B. Protected C. Private D. Associated E. Promiscuous F. Community

A. Isolated E. Promiscuous F. Community

Which three statements about Dynamic ARP inspection are true? (Choose three) A. It determines the validity of an ARP packet based on the valid MAC address-to-IP address bindings stored in the DHCP snooping database VCE to PDF Converter | www.vce2pdf.com B. It forwards all ARP packets received on a trusted interface without any checks C. It determinates the validity of an ARP packet based on the valid MAC address-to-IP address bindings stored in the CAM table D. It forwards all ARP packets received on a trusted interface after verifying and inspecting the packet against the Dynamic ARP inspection table E. It intercepts all ARP packets on untrusted ports F. It is used to prevent against a DHCP snooping attack

A. It determines the validity of an ARP packet based on the valid MAC address-to-IP address bindings stored in the DHCP snooping database VCE to PDF Converter | www.vce2pdf.com B. It forwards all ARP packets received on a trusted interface without any checks E. It intercepts all ARP packets on untrusted ports

By itself, what does the command aaa new-model enable? A. It globally enables AAA on the switch, with default lists applied on the VTYs B. Nothing; you must also specify which protocol (RADIUS or TACACS) will be used for AAA C. It enables AAA on all dot1x ports D. Nothing; you must also specify where (console, TTY, VTY, dot1x) AAA is being applied

A. It globally enables AAA on the switch, with default lists applied on the VTYs

When you create a network implementation for a VLAN solution, what is one procedure that you should include in your plan? A. Perform an incremental implementation of components B. Implement entire solution an then test end-to-end to make sure that it is performing as designed C. Implement trunking of all VLANs to ensure that traffic is crossing the network as needed before performing any pruning of VLANs D. Test the solution on the production networks in off hours

A. Perform an incremental implementation of components

Which three items are configured in MST configuration submode? (Select Three) A. Region name B. Configuration revision number C. VLAN instance map D. IST STP BPDU hello timer E. CST instance map F. PVST+ instance map

A. Region name B. Configuration revision number C. VLAN instance map

Which two RSTP port roles include the port as part of the active topology? (Choose two) A. Root B. Designated C. Alternate D. Backup E. Forwarding F. Learning

A. Root B. Designated Correct Answer: AB

Refer to the exhibit Which four statements about this GLBP topology are true? (Choose four) A. Router A is responsible for answering ARP request sent to the virtual IP address B. If router A becomes unavailable, router B forwards packets sent to the virtual MAC address of router A C. If another router is added to this GLBP group, there would be two backup AVGs D. Router B is in GLBP listen state E. Router A alternately responds to ARP request with different virtual addresses F. Router B transitions from blocking state to forwarding state when it becomes the AVG VCE to PDF

A. Router A is responsible for answering ARP request sent to the virtual IP address B. If router A becomes unavailable, router B forwards packets sent to the virtual MAC address of router A C. If another router is added to this GLBP group, there would be two backup AVGs E. Router A alternately responds to ARP request with different virtual addresses

In the use of 802.1x access control, which three protocols are allowed through the switch port before authentication takes place? Select three A. STP B. CDP C. EAP MD5 D. TACACS+ E. EAP-over-LAN F. Protocols not filtered by an ACL

A. STP B. CDP E. EAP-over-LAN

In which three HSRP states do routers send hello messages? (Choose three) A. Standby B. Learn C. Listen A. Standby Correct Answer: ADE

A. Standby D. Speak E. Active

On a multilayer Cisco Catalyst switch, which interface command is used to convert a Layer 3 interface to a Layer 2 interface? A. Switchport B. No switchport C. Switchport mode access D. Switchport access vlan vlan-id

A. Switchport

When an attacker is using switch spoofing to perform VLAN hopping, how is the attacker able to gather information? A. The attacking station uses DTP to negotiate trunking with a switch port and captures all traffic that is allowed on the trunk B. The attacking station tags itself with all usable VLANs to capture data that is passed through the switch, regardless of the VLAN to which the data belongs C. The attacking station generates frames with two 802.1Q headers to cause the switch to forward the frames to a VLAN that would be inaccessible to the attacker through legitimate means D. The attacking station uses VTP to collect VLAN information that is sent out and then tags itself with the domain information to capture the data

A. The attacking station uses DTP to negotiate trunking with a switch port and captures all traffic that is allowed on the trunk

Refer to the exhibit Based on the debug output, which three statements about HSRP are true? (Choose three) A. The final active router is the router with IP address 172.16.11.111 B. The router with IP address 172.16.11.111 has preempt configured C. The priority of the router with IP address 172.16.11.112 is preferred over the router with IP address 172.16.11.111 D. The IP address 172.16.11.115 is the virtual HSRP IP address E. The router with IP address 172.16.11.112 has nonpreempt configured F. The router with IP address 172.16.11.112 I using default HSRP priority

A. The final active router is the router with IP address 172.16.11.111 B. The router with IP address 172.16.11.111 has preempt configured D. The IP address 172.16.11.115 is the virtual HSRP IP address

Refer to the exhibit, which is from a Cisco Catalyst 3560 Series Switch Which statement about the Layer 3 routing functionality of the interface is true? A. The interface is configured correctly for Layer 3 routing capabilities B. The interface needs and additional configuration entry to enable IP routing protocols C. Since the interface is connected to a host device, the spanning-tree portfast command must be added to the interface D. An SVI interface is needed to enable IP routing for network 192.20.135.0

A. The interface is configured correctly for Layer 3 routing capabilities

What does the interface subcommand switch port voice vlan 222 indicate? A. The port is configured for both data and voice traffic B. The port is fully dedicated to forwarding voice traffic C. The port operates as an FXS telephony port D. Voice traffic is directed to VLAN 222

A. The port is configured for both data and voice traffic

The web servers WS_1 and WS_2 need to be accessed by external and internal users. For security reasons, the servers should not communicate with each other, although they are located on the same subnet. However, the server do need to communicate with a database server located in the inside network. Which configuration isolates the servers from each other? A. The switch ports 3/1 and 3/2 are defined as secondary VLAN isolated ports. The ports connecting to the two firewalls are defined as primary VLAN promiscuous ports B. The switch ports 3/1 and 3/2 are defined as secondary VLAN community ports. The ports connecting to the two firewalls are defined as primary VLAN promiscuous ports C. The switch ports 3/1 and 3/2 and the ports connecting to the two firewalls are defined as primary VLAN promiscuous ports D. The switch ports 3/1 and 3/2 and the ports connecting to the two firewalls are defined as primary VLAN community ports

A. The switch ports 3/1 and 3/2 are defined as secondary VLAN isolated ports. The ports connecting to the two firewalls are defined as primary VLAN promiscuous ports

Refer to the exhibit GLBP has been configured on the network. When the interface serial0/0/1 on router R1 goes down, how is traffic coming from Host1 handled? A. The traffic coming from Host1 and Host2 is forwarded through router R2 with no disruption B. The traffic coming from Host2 is forwarded through router R2 with no disruption. Host1 sends an ARP request to resolve the MAC address for the new virtual gateway C. The traffic coming from both hosts is temporarily interrupted while the switchover to make R2 active occurs D. The traffic coming from Host2 is forwarded through router R2 with no disruption. The traffic from Host1 is dropped due to the disruption of the load balancing feature configured for the GLBP group

A. The traffic coming from Host1 and Host2 is forwarded through router R2 with no disruption

Refer to the above. Three switches are configured for HSRP Switch1 remains in the HSRP listen state. What is the most likely cause of this status? A. This is normal operation B. The standby group number does not match de VLAN number C. Ip addressing is incorrect D. Priority commands are incorrect E. Standby timers are incorrect

A. This is normal operation

Which two statements correctly describe VTP? (Choose two) A. Transparent mode always has a configuration revision number of 0 B. Transparent mode cannot modify a VLAN database C. Client mode cannot forward received VTP advertisements D. Client mode synchronizes its VLAN database from VTP advertisements E. Server mode can synchronize across VTP domains

A. Transparent mode always has a configuration revision number of 0 D. Client mode synchronizes its VLAN database from VTP advertisements

Which two components should be part of a security implementation plan? (Choose two) A. Detailed list of personnel assigned to each task within the plan B. A Layer 2 spanning-tree design topology C. Rollback guidelines D. Placing all unused access ports in VLAN 1 to proactively manage port security E. Enabling SNMP access to Cisco Discovery Protocol data for logging and forensic analysis Correct

B. A Layer 2 spanning-tree design topology C. Rollback guidelines

Which three statements about routed ports on a multilayer switch are true? (Choose three) A. A routed port can support VLAN subinterfaces B. A routed port takes an IP address assignment C. A routed port can be configured with routing protocols D. A routed port is a virtual interface on the multilayer switch E. A routed port is associated only with one VLAN F. A routed port is a physical interface on the multilayer switch

B. A routed port takes an IP address assignment C. A routed port can be configured with routing protocols F. A routed port is a physical interface on the multilayer switch

You have configured a Cisco Catalyst switch to perform Layer 3 routing via an SVI and you have assigned that interface to VLAN 20. To check the status of SVI, you issue the show interfaces vlan 20 command at the CLI prompt. You see from the output display that the interface is in an up/up state. What must be true in a SVI configuration to bring the VLAN and line protocol ip? A. The port must be physically connected to another Layer 3 device B. At least one port in VLAN 20 must be active C. The Layer3 routing protocol must be operational and receiving routing updated from neighboring peer devices D. Because this is a virtual interface, the operational status is always in an "up/up" state Correct Answer: B

B. At least one port in VLAN 20 must be active always in an "up/up" state Correct Answer: B

Why BPDU guard an effective way to prevent an unauthorized rogue switch from altering the spanning-tree topology of a network? A. BPDU guard can guarantee proper selection of the root bridge B. BPDU guard can be utilized along with PortFast to shutdown ports when a switch is connected to the port C. BPDU guard can bu utilized to prevent the switch from transmitting BPDUs and incorrectly alternating the root bridge election D. BPDU guard can be used to prevent invalid BPDUs from propagating throughout the network

B. BPDU guard can be utilized along with PortFast to shutdown ports when a switch is connected to the port

How does VTP pruning enhance network bandwidth? A. By restricting unicast traffic across VTP domains B. By reducing unnecessary flooding of traffic to inactive VLANs C. By limiting the spreading of VLAN information D. By disabling periodic VTP updates

B. By reducing unnecessary flooding of traffic to inactive VLANs

Refer to the exhibit All network links are FastEthernet. Although there is complete connectivity throughout the network, Front Line users report that they experience slower network performance when accessing the server farm than the Reception office experiences. Which statements are true? (Choose two) A. Changing the bridge priority of S1 to 4096 would improve network performance B. Changing the bridge priority of S1 to 36864 would improve network performance C. Changing the bridge priority of S2 to 36864 would improve network performance D. Changing the bridge priority of S3 to 4096 would improve network performance E. Disabling the Spanning Tree Protocol would improve network performance F. Upgrading the link between S2 and S3 to Gigabit Ethernet would improve performance Correct

B. Changing the bridge priority of S1 to 36864 would improve network performance D. Changing the bridge priority of S3 to 4096 would improve network performance

Refer to the exhibit Which two of the following statements are true? (Choose two) A. DHCP snooping is enabled for 155 Vlans B. DHCP snooping is enabled for a single Vlan C. DHCP snooping is not enbabled for any VLan D. Option 82 is enabled for VLAN 155 E. Portfast Fa0/5 and Fa0/6 should be kept shutdown as these are untrusted ports

B. DHCP snooping is enabled for a single Vlan D. Option 82 is enabled for VLAN 155 Correct Answer: BD

What action should you be prepared to take when verifying a security solution? A. Having alternative addressing and VLAN schemes B. Having a rollback plan in case of unwanted or unexpected results C. Running a test script against all possible security threats to insure that the solution will mitigate all potential threats D. Isolating and testing each security domain individually to insure that the security design will meet overall requirements when placed into production VCE to PDF Converter | www.vce2pdf.com as an entire system

B. Having a rollback plan in case of unwanted or unexpected results

Which of the following specification will allow you to: associate VLAN groups to STP instances so you can provide multiple forwarding paths for data traffic and enable load balancing? A. IEEE 802.1d (STP) B. IEEE 802.1s (MST) C. IEEE 802.1Q (CST) D. IEEE 802.1w (RSTP)

B. IEEE 802.1s (MST)

A network is deployed using recommended practices of the enterprise campus network model, including users with desktop computers connected via IP phones. Given that all components are QoS-capable, where are the two optimal locations for trust boundaries to be configured by the network administrator? (Choose two) A. Host B. IP phone C. Access layer switch D. Distribution layer switch E. Core layer switch Correct Answer: BC

B. IP phone C. Access layer switch

Which two items best describe a Cisco IOS IP SLA responder? (Choose two) A. Required at the destination to implement Cisco IOS IP SLA services B. Improves measurement accuracy C. Required for VoIP jitter measurements D. Provides security on Cisco IOS IP SLA messages via LEAP or EAP-FAST authentication E. Responds to one Cisco IOS IP SLA operation per port F. Stores the resulting test statistics

B. Improves measurement accuracy C. Required for VoIP jitter measurements

Which two statements about HSRP are true? (Choose two) A. Load sharing with HSRP is achieved by creating multiple subinterfaces on the HSRP routers B. Load sharing with HSRP is achieved by creating HSRP groups on the HSRP routers C. Routers configured for HSRP must belong only to one group per HSRP interface D. Routers configured for HSRP can belong to multiple groups and multiple VLANs E. All routers configured for HSRP load balancing must be configured with the same priority Correct Answer: BD

B. Load sharing with HSRP is achieved by creating HSRP groups on the HSRP routers D. Routers configured for HSRP can belong to multiple groups and multiple VLANs

Which of the following statements is true about the 80/20 rule (Select all that apply)? A. 20 percent of the traffic on a network segments should be local B. No more than 20 percent of the network traffic should be able to move across a backbone C. No more than 80 percent of the network traffic should be able to move across a backbone D. 80 percent of the traffic on a network segment should be local

B. No more than 20 percent of the network traffic should be able to move across a backbone D. 80 percent of the traffic on a network segment should be local

What is the result of entering the command port-channel load-balance src-dst-ip on an EtherChannel link? A. Packets are distributed across the ports in the channel based on the source and destination MAC addresses B. Packets are distributed across the ports in the channel based on both the source and destination IP addresses C. Packets are balanced across the ports in the channel based first on the source MAC address, then on the destination MAC address, then on the IP address D. Packets are distributed across the access ports in the channel based first on the source IP address and then on the destination IP addresses Correct Answer: B

B. Packets are distributed across the ports in the channel based on both the source and destination IP addresses

A switch has been configured with PVLANs. With what type of PVLAN port should the default gateway be configured? A. Isolated B. Promiscuous C. Community D. Primary E. Trunk

B. Promiscuous

What does the command udld reset accomplish? A. Allows a UDLD port to automatically reset when it has been shut down B. Resets all UDLD enabled ports that have been shutdown C. Removes all UDLD configurations from interfaces that were globally enabled D. Removes all UDLD configurations from interfaces that were enabled per-port

B. Resets all UDLD enabled ports that have been shutdown

Refer to the exhibit Which VRRP statement about the roles of the master virtual router and the backup virtual router is true? A. Router A is the master virtual router, and router B is the backup virtual router. When router A fails, router B becomes the master virtual router. When router A recovers, router B maintains the role of master virtual route B. Router A is the master virtual router, and router B is the backup virtual router. When Router A fails, Router B will become the master virtual router. When Router A recovers, it will regain the master virtual router role VCE to PDF Converter | www.vce2pdf.com C. Router B is the master virtual router, and router A is the backup virtual router. When router B fails, router A becomes the master virtual router. When router B recovers, router A maintains the role of master virtual router D. Router B is the master virtual router, and router A is the backup virtual router. When Router B fails, Router A will become the master virtual router. When Router B recovers, it will regain the master virtual router role Correct Answer: B

B. Router A is the master virtual router, and router B is the backup virtual router. When Router A fails, Router B will become the master virtual router. When Router A recovers, it will regain the master virtual router role

Which two statements are true about recommended practices that are to be used in a local VLAN solution design where layer 22 traffic is to be kept to a minimum? (Choose two) A. Routing should occur at the access layer if voice VLANs are utilized. Otherwise, routing should occur at the distribution layer B. Routing may be performed at all layers but is most commonly done at the core and distribution layers C. Routing should not be performed between VLANs located on separate switches D. VLANs should be local to a switch E. VLANs should be localized to a single switch unless voice VLANs are being utilized

B. Routing may be performed at all layers but is most commonly done at the core and distribution layers D. VLANs should be local to a switch

Refer to the exhibit Which statement is true? A. Cisco Express Forwarding load balancing has been disabled B. SVI VLAN 30 connects directly to the 10.1.30.0/24 network due to a valid glean adjacency C. VLAN 30 is not operational because no packet or byte counts are indicated VCE to PDF Converter | www.vce2pdf.com D. The IP Cisco Express Forwarding configuration is capable of supporting IPv6

B. SVI VLAN 30 connects directly to the 10.1.30.0/24 network due to a valid glean adjacency

Refer to the exhibit Which two statements about this Layer 3 security configuration example are true? (Choose two) A. Static IP source can be configured only on a routed port B. Source IP and MAC filtering on VLANs 10 and 11 will occur C. SHCP snooping will be enabled automatically on the access VLANs D. IP source Guard is enabled E. The switch will drop the configured MAC and IP address source bindings and forward all other traffic

B. Source IP and MAC filtering on VLANs 10 and 11 will occur D. IP source Guard is enabled

Refer to the exhibit Switch S1 has been configured with the command spanning-tree mode rapid-pvst. Switch S3 has been configured with the command spanning-tree mode mst. Switch S2 is running the IEEE 802.1D instance of Spanning-tree. What is the result? A. IEEE 802.1w and IEEE 802.1s are compatible. IEEE 802.1d is incompatible. Switches S1 and S3 can pass traffic between themselves. Neither can pass traffic to switch S2 B. Switches S1, S2, and S3 can pass traffic between themselves C. Switches S1, S2, and S3 can pass traffic between themselves. However, I f the topology is changed, switch S2 does not receive notification of the VCE to PDF Converter | www.vce2pdf.com change D. IEEE 802.1d, 802.1w, and 802.1s are incompatible. All three switches must use the same standard or no traffic can pass between any of the switches

B. Switches S1, S2, and S3 can pass traffic between themselves

The following command was issued on a router that is being configured as the active HSRP router Standby ip 10.2.1.1 Which statement about this command is true? A. This command will not work because the HSRP group information is missing B. The HSRP MAC address will be 0000.0c07.ac00 C. The HSRP MAC address will be 0000.0c07.ac01 D. The HSRP MAC address will be 0000.070c.ac11 VCE to PDF Converter | www.vce2pdf.com E. This command will not work because the active parameter is missing

B. The HSRP MAC address will be 0000.0c07.ac00

Q71 What is the result of entering the command spanning-tree loopguard default? A. The command enables loop guard and root guard B. The command changes the status of loop guard from the default of disabled to enabled C. The command activates loop guard on point-to-multipoint links in the switched network VCE to PDF Converter | www.vce2pdf.com D. The command disables EtherChannel guard

B. The command changes the status of loop guard from the default of disabled to enabled

Refer to the exhibit A. The default gateway addresses of both host should be set to the IP addresses of both routers B. The default gateway address of each host should be set to the virtual IP address C. The hosts learn the proper default gateway IP address from router A D. The hosts have different default gateway IP addresses and different MAC addresses for each router

B. The default gateway address of each host should be set to the virtual IP address

Which two statements describe a routed switch port on a multilayer switch? (Choose two) A. Layer 2 switching and Layer 3 routing are mutually supported B. The port is not associated with any VLAN C. The routed switch port supports VLAN subinterfaces D. The routed switch port is used when a switch has only one port per VLAN or subnet E. The routed switch port ensures that STP remains in the forwarding state

B. The port is not associated with any VLAN D. The routed switch port is used when a switch has only one port per VLAN or subnet

Refer to the exhibit From the configuration shown, what can be determined? A. The sticky addresses are only those manually configured MAC addresses enabled with the sticky keyword B. The remaining secure MAC addresses are learned dynamically, converted to sticky secure MAC addresses, and added to the running configuration C. A voice VLAN is configured in this example, so port security should be set for a maximum of 2 D. A security violation restricts the number of addresses to a maximum of 10 addresses per access VLAN and voice VLAN. The port is shutdown if more than 10 devices per VLAN attempt to access the port

B. The remaining secure MAC addresses are learned dynamically, converted to sticky secure MAC

What two things occur when an RSTP edge port receives a BPDU? (Choose two) A. The port immediately transitions to the forwarding state VCE to PDF Converter | www.vce2pdf.com B. The switch generates a Topology Change Notification BPDU C. The port immediately transitions to the err-disable state D. The port becomes a normal STP switch port

B. The switch generates a Topology Change Notification BPDU D. The port becomes a normal STP switch port

Refer to the exhibit Why are users from VLAN 100 unable to ping users on VLAN 200? A. Encapsulation on the switch is wrong B. Trunking must be enabled on Fa0/1 C. The native VLAN is wrong D. VLAN 1 needs the no shutdown command E. IP routing must be enabled on the switch Correct Answer: B

B. Trunking must be enabled on Fa0/1

During the implementation of a voice solution, which two required items are configured at an access layer switch that will be connected to an IP phone to provide VoIP communication? (Choose two) A. Allowed codecs B. Untagged VLAN C. Auxiliary VLAN D. Cisco Unified Communications Manager IP address E. RSTP

B. Untagged VLAN C. Auxiliary VLAN

What are some virtues of implementing en-to-end VLANs? (Choose two) A. End-to-end VLANs are easy to manage B. Users are grouped into VLANs independent of a physical location C. Each VLAN has a common set of security and resource requirements for all members VCE to PDF Converter | www.vce2pdf.com D. Resources are restricted to a single location

B. Users are grouped into VLANs independent of a physical location C. Each VLAN has a common set of security and resource requirements for all members VCE to PDF

Which two characteristics apply to Cisco Catalyst 6500 Series Switch supervisor redundancy using NSF? (Choose two) A. Supported by RIPv2, OSPF, IS-IS, and EIGRP B. Uses the FIB table C. Supports IPv4 and IPv6 multicast D. Prevents route flapping E. Independent of SSO F. NSF combined with SSO enables supervisor engine load balancing

B. Uses the FIB table D. Prevents route flapping

What can be concluded about VLANs 200 and 202? A. VLAN 202 carries traffic from promiscuous ports to isolated, community, and other promiscuous ports in the same VLAN. VLAN 200 carries traffic between community ports and to promiscuous ports B. VLAN 202 carries traffic from promiscuous ports to isolated, community, and other promiscuous ports in the same VLAN. VLAN 200 carries traffic from isolated ports to a promiscuous port C. VLAN 200 carries traffic from promiscuous ports to isolated, community, and other promiscuous ports in the same VLAN. VLAN 202 carries traffic between community ports and to promiscuous ports D. VLAN 200 carries traffic from promiscuous ports to isolated, community, and other ports in the same VLAN. VLAN 202 carries traffic from isolated ports to a promiscuous port

B. VLAN 202 carries traffic from promiscuous ports to isolated, community, and other promiscuous ports in the same VLAN. VLAN 200 carries traffic from isolated ports to a promiscuous port

Refer to the exhibit The network operations center has received a call stating that users in VLAN 107 are unable to access resources through router 1. What is the cause of this problem? VCE to PDF Converter | www.vce2pdf.com A. VLAN 107 does not exist on switch A B. VTP is pruning VLAN 107 C. VLAN 107 is not configured on the trunk D. Spanning tree is not enabled on VLAN 107 Correct Answer: B

B. VTP is pruning VLAN 107

Refer to the exhibit DHCP snooping is enabled for selected VLANs to provide security on the network. How do the switch ports handle the DHCP messages? A. A DHCPOFFER packet from a DHCP server received on Ports Fa2/1 and Fa2/2 is dropped B. DHCP packet received on ports Fa2/1 and Fa2/2 is drooped if the MAC address and the DHCP client hardware address does not match Snooping database C. A DHCP received on ports Fa2/1 and Fa2/2 is forwarded without being tested D. A DHCPRELEASE message received on ports Fa2/1 and Fa2/2 has a MAC address in the DHCP snooping binding database, but the interface information in the binding database does not match the interface on which the message was received and is dropped

C. A DHCP received on ports Fa2/1 and Fa2/2 is forwarded without being tested

Refer to the exhibit All links in this network are layer 2, fast Ethernet 100 Mb/s and operating as trunks. After a failure, the link between ASW-1 and DSW.1 has incorrectly come back up at 10 Mb/s although it is connected Which one of the following will occur as a result of this failure? A. There will be no change to the forwarding path to traffic from ASW-1 B. ASW1 will block Fa0/24 in order to maintain the shortest path to the root bridge DSW-1 C. ASW-1 will block Fa0/23 in order to maintain the shortest path to the root bridge DSW-1 D. ASW-1 will elect DSW-2 as the root primary since it is close than DSW-1

C. ASW-1 will block Fa0/23 in order to maintain the shortest path to the root bridge DSW-1

For the configuration shown, which is the recommended method of providing inter VLAN routing? A. Determine which switch is the root bridge then connect a router on a stick to it B. Configure SVIs on the core switches VCE to PDF Converter | www.vce2pdf.com C. Configure SVIs on the distribution switches D. Configure SVIs on the access layer switches

C. Configure SVIs on the distribution switches

Refer to the exhibit What does the command channel-group 1 mode desirable do? A. Enables LACP unconditionally B. Enables PAgP only if PAgP device is detected C. Enables PAgP unconditionally D. Enables EtherChannel only E. Enables LACP only if an LACP device is detected

C. Enables PAgP unconditionally

Which statement correctly describes enabling BPDU guard on an access port that is also enabled for PortFast? A. Upon startup, the port transmits 10 BPDUs. If the port receives a BPDU, PortFast and BPDU guard are disabled on that port and it assumes normal STP operation B. The access port ignores any received BPDU C. If the port receives a BPDU, it is placed into the error-disable state D. BPDU guard is configured only globally and the BPDU filter is required for port-level configuration

C. If the port receives a BPDU, it is placed into the error-disable state

Which statement best describes implementing a Layer 3 EtherChannel? A. EtherChannel is a Layer2 feature and not a Layer 3 feature B. Implementation requires switchport mode trunk and matching parameters between switches C. Implementation requires disabling switchport mode D. A Layer3 address is assigned to the physical interface

C. Implementation requires disabling switchport mode

What does the global configuration command ip arp inspection vlan 10-12, 15 accomplish? A. Validates outgoing ARP request for interfaces configured on VLAN 10, 11, 12, or 15 B. Intercepts all ARP requests and responses on trusted ports C. Intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings D. Discards ARP packets with invalid IP-to-MAC address bindings on trusted ports

C. Intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings

On a company switch named R1 you configure the following: Ip arp inspection vlan 10-12, 15 What is the purpose of this global configuration command made on R1? A. Discards ARP packets with invalid IP-to-MAC address bindings on trusted ports B. Validates outgoing ARP requests for interfaces configured on VLAN 10, 11, 12, or 15 C. Intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings D. Intercepts all ARP requests and responses on trusted ports VCE to PDF Converter | www.vce2pdf.com E. None of the other alternatives apply

C. Intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings Correct Answer: C

Refer to the exhibit Which two statements are true? (Choose two) A. Interface gigabitethernet 0/1 has been configured as Layer 3 ports B. Interface gigabitethernet 0/1 does not appear in the show vlan output because switchport is enabled C. Interface gigabitethernet 0/1 does not appear in the show vlan output because it is configured as a trunk interface VCE to PDF Converter | www.vce2pdf.com D. VLAN2 has been configured as the native VLAN for the 802.1q trunk on interface gigabitethernet 0/1 E. Traffic on VLAN 1 that is sent out gigabitethernet 0/1 will have an 802.1q header applied F. Traffic on VLAN 2 that is sent out gigabitethernet 0/1 will have an 802.1q header applied

C. Interface gigabitethernet 0/1 does not appear in the show vlan output because it is configured as a trunk F. Traffic on VLAN 2 that is sent out gigabitethernet 0/1 will have an 802.1q header applied

Which MST configuration statement is correct? A. MST configurations can be propagated to other switches using VTP B. After MST is configured on a Switch, PVST+ operations will also be enabled by default C. MST configuration must be manually configured on each switch within the MST region VCE to PDF Converter | www.vce2pdf.com D. MST configurations only need to be manually configured on the Root Bridge E. MST configuration are entered using the VLAN Database mode on Cisco Catalyst switches

C. MST configuration must be manually configured on each switch within the MST region VCE to PDF Converter | www.vce2pdf.com

A campus infrastructure supports wireless clients via Cisco Aironet AG Series 1230, 1240, and 1250 access points. With DNS and DHCP configured, the 1230 and 1240 access points appear to boot and operate normally. However, the 1250 access points do not seem to operate correctly What is the most likely cause of this problem? VCE to PDF Converter | www.vce2pdf.com A. DHCP with option 150 B. DHCP with option 43 C. PoE D. DNS E. Switch port does not support gigabit speeds

C. PoE

Which statement about 802.1x port-based authentication is true? A. Host are required to have an 802.1x authentication client or utilize PPPoE B. Before transmitting data, an 802.1x host must determine the authorization state of the switch C. RADIUS is the only supported authentication server type D. If a host initiates the authentication process and does not receive a response, it assumes it is not authorized Correct

C. RADIUS is the only supported authentication server type

When configuring port security on a Cisco Catalyst switch port, what is the default action taken by the switch if a violation occurs? A. Protect (drop packets with unknown source addresses) B. Restrict (increment Security Violation counter) C. Shutdown (access or trunk port) D. Transition (the access port to a trunking port)

C. Shutdown (access or trunk port)

Refer to the exhibit You have configured an interface to be an SVI for Layer 3 routing capabilities. Assuming that all VLANs have been correctly configured, what can be determined? A. Interface gigabitethernet0/2 will be excluded form Layer 2 switching and enabled for Layer 3 routing B. The command switchport autostate exclude should be entered in global configuration mode, not subinterface mode, to enable a Layer2 port to be configured for Layer 3 routing C. The configured port is excluded in the calculation of the status of the SVI D. The interface is missing IP configuration parameters; therefore, it will only function at Layer 2 Correct

C. The configured port is excluded in the calculation of the status of the SVI

Refer to the exhibit What happens when one more user is connected to interface FastEthernet5/1? A. All secure addresses age out and are removed from the secure address list. The security violation counter increments B. The first address learned on the port is removed from the secure address list and is replaced with the new address C. The interface Is placed into the error-disabled state immediately, and an SNMP trap notification is sent D. The packet with the new source addresses are dropped until a sufficient number of secure MAC addresses are removed from the secure address list

C. The interface Is placed into the error-disabled state immediately, and an SNMP trap notification is sent

Which statement is a characteristic of multi-VLAN access ports? A. The port has to support STP PortFast B. The auxiliary VLAN is for data service and is identified by the PVID C. The port hardware is set as an 802.1Q trunk D. The voice service and data service use the same trust boundary

C. The port hardware is set as an 802.1Q trunk

Refer to the exhibit form the DHCP server connected to switch SW_A. what would the outcome be if Host_B initiated an ARP spoof attack toward Host_A? A. The spoof packets are inspected at the ingress port of switch SW_A and are permitted B. The spoof packets are inspected at the ingress port of switch SW_A and are dropped VCE to PDF Converter | www.vce2pdf.com C. The spoof packets are not inspected at the ingress port of switch SW_A and are permitted D. The spoof packets are not inspected at the ingress port of switch SW_A and are dropped Correct Answer: C

C. The spoof packets are not inspected at the ingress port of switch SW_A and are permitted

Refer to the exhibit What happens to traffic within VLAN 14 with a source address of 172.16.10.5? A. The traffic is forwarded to the TCAM for further processing B. The traffic is forwarded to the router processor for further processing C. The traffic is dropped D. The traffic is forwarded without further processing

C. The traffic is dropped Correct Answer: C

Refer to the exhibit Which statement about the private VLAN configuration is true? A. Only VLAN 503 will be the community PVLAN, because multiple community PVLANs are not allowed B. Users of VLAN 501 and 503 will be able to communicate C. VLAN 502 is a secondary VLAN D. VLAN 502 will be a standalone VLAN, because it is not associated with any other VLANs

C. VLAN 502 is a secondary VLAN

Private VLANS can be configured as which three of these port types? (Choose three) A. Isolated B. Protected C. Private D. Associated E. Promiscuous F. Community

Correct AEF A. Isolated E. Promiscuous F. Community

Which statements about the configuration and application of port access control lists is true? A. PACLs can be applied in the inbound or outbound direction of a Layer2 physical interface B. At Layer 2, a MAC address PACL takes precedence over any existing Layer 3 PACL C. When you apply a port ACL trunk port, the ACL filters traffic on all VLANs present on the trunk port D. PACL are not supported on EtherChannel interfaces

Correct Answer: When you apply a port ACL trunk port, the ACL filters traffic on all VLANs present on the trunk port

Refer to the exhibit Which statement is true? A. IP traffic matching access list ABC is forwarded through VLANs 5-10 B. IP traffic matching VLAN 5-10 is forwarded, and all other traffic is dropped C. All VLAN traffic matching VLAN 5-10 is forwarded, and all traffic matching access list ABC is dropped D. All VLAN traffic in VLANs 5-10 that match access list ABC is forwarded, and all other traffic is dropped

D. All VLAN traffic in VLANs 5-10 that match access list ABC is forwarded, and all other traffic is dropped

Refer to the exhibit What information can be derived from the output? A. Interfaces FastEthernet3/1 and FastEthernet3/2 are connected to devices that are sending BPDUs with a superior root bridge parameter and no traffic is forwarded across the ports. B. After the sending BPDUs has stopped, the interfaces must be shutdown administratively, and brought back up to resume normal operation C. Devices connected to interfaces FastEthernet3/1 and FastEthernet3/2 are sending BPDUs with a superior root bridge parameter, but traffic is still forwarded across the ports D. Devices connected to interfaces FastEthernet3/1 and FastEthernet3/2 are sending BPDUs with a superior root bridge parameter and no traffic is forwarded across the ports. After the inaccurate BPDUs have been stopped, the interfaces automatically recover and resume normal operation E. Interfaces FastEthernet3/1 and FastEthernet3/2 are candidates for becoming the STP root port, but neither can realize that role until BPDUs with a superior root bridge parameter are no longer received on at least one of the interfaces

D. Devices connected to interfaces FastEthernet3/1 and FastEthernet3/2 are sending BPDUs with a superior root bridge parameter and no traffic is forwarded across the ports. After the inaccurate BPDUs have been stopped, the interfaces automatically

What action should a network administrator take to enable VTP pruning on an entire management domain? A. Enable VTP pruning on any client switch in the domain B. Enable VTP pruning on every switch in the domain C. Enable VTP pruning on any switch in the management domain D. Enable VTP pruning on a VTP server in the management domain

D. Enable VTP pruning on a VTP server in the management domain

What is one method that can be used to prevent VLAN hopping? A. Configure ACLs B. Enforce username and password combinations C. Configure all frames wit 802.1Q headers D. Explicitly turn off DTP on all unused ports E. Configure VACLs

D. Explicitly turn off DTP on all unused ports

Which statement about 802.1Q trunking is true? A. Both switches must be in the same VTP domain B. The encapsulation type on both ends of the trunk does not have to match C. The native VLAN on both ends of the trunk must be VLAN 1 D. In 802.1Q trunking, all VLAN packets are tagged on the trunk link, except the native VLAN

D. In 802.1Q trunking, all VLAN packets are tagged on the trunk link, except the native VLAN

Refer to the exhibit and the partial configuration of switch SW_A and SW_B STP is configured on all switches in the network. SW_B receives this error message on the console port: 00:06:34 %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/5 (not half duplex), with SW_A FastEthernet0/4 (half duplex), with TBA05071417 (CatK-B) 0/4 (half duplex) What is the possible outcome of the problem? A. The root port on switch SW_A will automatically transition to full-duplex mode B. The root port on switch SW_B will fall back to full-duplex mode C. The interfaces between switches SW_A and SW_B will transition to a blocking state D. Interface Fa0/6 on switch SW_B will transition to a forwarding state and create a bridging loop Correct

D. Interface Fa0/6 on switch SW_B will transition to a forwarding state and create a bridging loop Correct

What is needed to verify that a newly implemented security solution is performing as expected? A. A detailed physical and logical topology B. A cost analysis of the implemented solution C. Detailed logs from the AAA and SNMP servers D. Results from audit testing of the implemented solution

D. Results from audit testing of the implemented solution

When configuring private VLANs, which configuration task must you do first? A. Configure the private VLAN port parameters B. Configure and map the secondary VLAN to the primary VLAN C. Disable IGMP snooping D. Set the VTP mode to transparent

D. Set the VTP mode to transparent

You are the administrator of a switch and currently all host-connected ports are configured with the portfast command. You have received a new directive from your manager that states that, in the future, any host-connected port that receives a BPDU should automatically disable PortFast and begin transmitting BPDUs. Which command will support this new requirement? A. Switch(config)#spanning-tree portfast bpduguard default B. Switch(config)#spanning-tree bpduguard enable C. Switch(config)#spanning-tree bpdufilter enable D. Switch(config)#spanning-tree portfast bpdufilter default

D. Switch(config)#spanning-tree portfast bpdufilter default

Refer to the exhibit and the partial configuration on router R1 and R2 HSRP is configured on the network to provide network redundancy for the IP traffic. The network administrator noticed that R2 does not become active when the R1 serial0 interface goes down. What should be changed in the configuration to fix the problem? A. R2 should be configured with an HSRP virtual address B. R2 should be configured with a standby priority of 100 C. The Serial0 interface on router R2 should be configured with a decrement value of 20 D. The Serial0 interface on router R1 should be configured with a decrement value of 20 Correct Answer: D

D. The Serial0 interface on router R1 should be configured with a decrement value of 20

Refer to the exhibit Host A and Host B are connected to the Cisco Catalyst 3550 switch and have been assigned to their respective VLANs. The rest of the 3550 configuration is the default configuration. Host A is able to ping its default gateway, 10.10.10.1, but is unable to ping Host B. given the output in the exhibit, which statement is true? A. HSRP must be configured on SW1 B. A separate router is needed to support inter-VLAN routing C. Interface VLAN 10 must be configured on the SW1 D. The global configuration command ip routing must be configured on the SW1 switch VCE to PDF E. VLANs 10 and 15 must be created in the VLAN database mode F. VTP must be configured to support inter-VLAN routing

D. The global configuration command ip routing must be configured on the SW1 switch VCE to PDF

Which operational feature of an Ether switch disables a port on a point-to-point link if the port does not receive traffic while Layer 1 status is up? A. BackboneFast B. UplinkFast C. Loop Guard D. UDLD aggressive mode E. Fast Link Pulse burst F. Link Control Word

D. UDLD aggressive mode

Which protocol will enable a group of routers to form a single virtual router and will use the real IP address of a router as the gateway address? A. Proxy ARP B. HSRP C. IRDP D. VRRP E. GLBP

D. VRRP

Three Cisco Catalyst switches have been configured with a first-hop redundancy protocol. While reviewing some show commands, debug output, and the syslog, you discover the following information What conclusion can you infer from this information? A. VRRP is initializing and operating correctly B. HSRP is initializing and operating correctly C. GLBP is initializing and operating correctly VCE to PDF Converter | www.vce2pdf.com D. VRRP is not exchanging three hello messages properly E. HSRP is not exchanging three hello messages properly F. GLBP is not exchanging three hello messages properly

E. HSRP is not exchanging three hello messages properly

In the hardware address 0000.0c07.ac0a, what does 07.ac represent? A. Vendor code B. HSRP group number C. HSRP router number D. HSRP well-known physical MAC address E. HSRP well-known virtual MAC address

E. HSRP well-known virtual MAC address

Which statement is true about Layer 2 security threats? A. MAC spoofing in conjunction with ARP snooping, is the most effective counter-measure reconnaissance attacks that use Dynamic ARP Inspection to determine vulnerable attack points B. DHCP snooping sends unauthorized replies to DHCP queries C. ARP spoofing can be used to redirect traffic to counter Dynamic ARP Inspection D. Dynamic ARP Inspection in conjunction with ARP spoofing can be used to counter DHCP snooping attacks E. MAC spoofing attacks allow an attacking device to receive frames intended for a different network host F. Port scanners are the most effective defense against Dynamic ARP Inspection

E. MAC spoofing attacks allow an attacking device to receive frames intended for a different network host

When you enable port security on an interface that is also configured with a voice VLAN, what is the maximum number of secure MAC addresses that should be set on the port? A. No more than one secure MAC address should be set B. The default is set C. The IP phone should use a dedicated port, therefore only one MAC address is needed per port D. No value is needed if the switchport priority extend command is configured E. No more than two secure MAC addresses should be set

E. No more than two secure MAC addresses should be set Correct Answer: E

Refer to the exhibit Host A has sent an ARP message to the default gateway IP address 10.10.10.1. Which statement is true? A. Because of the invalid timers that are configured, DSw1 does not reply B. DSw1 replies with the IP address of the next AVF C. DSw1 replies with the MAC address of the next AVF D. Because of the invalid timers that are configured, DS2 does not reply E. DSw2 replies with the IP address of the next AVF F. DSw2 replies with the MAC address of the next AVF

F. DSw2 replies with the MAC address of the next AVF

Which description correctly describes a MAC address flooding attack? A. The attacking device crafts ARP replies intended for valid hosts. The MAC address of the attacking device then becomes the destination address found in the Layer 2 frames sent by the valid network device B. The attacking device crafts ARP replies intended for valid hosts. The MAC address of the attacking device the becomes the source address found in the Layer2 frames sent by the valid network device C. The attacking device spoofs a destination MAC address of a valid host currently in the CAM table. The switch the forwards frames destined for the valid host to the attacking device D. The attacking device spoofs a source MAC address of a valid host currently in the CAM table. The switch the forward frames destined for the valid host to the attacking device. E. Frames with unique, invalid destination MAC addresses flood the switch and exhaust CAM table space. The result is that new entries cannot be inserted because of the exhausted CAM table space, and traffic is subsequently flooded out all ports. F. Frames with unique, invalid source MAC addresses flood the switch and exhaust CAM table space. The result is that new entries cannot be inserted VCE to

F. Frames with unique, invalid source MAC addresses flood the switch and exhaust CAM table space.