You are on page 1of 563

CCNP-SWITCH_IPHELPER_April_2018

Number: 300-115
Passing Score: 790
Time Limit: 120 min
File Version: 10.0

300-115 - Implementing Cisco IP Switched Networks

Updated - April 2018 by IPHELPER

Exam A - MCQs - Cisco Official
Exam B - Simlet HSRP
Exam C - Simlet VTPv3
Exam D - HSRP Ferris Plastics

Exam E - HSRP Hotspot Certprepare
Exam F - Simulation Labs
Exam G - Drag and Drop - Official
Exam H - Drag and Drop - Concepts
Exam I - MCQs April 2017 - Contribute
Exam J - MCQs May 2017 - Contribute
Exam K - MCQs June 2017 - Contribute
Exam L - MCQs August 2017 - Contribute
Exam M - MCQs Sept-Oct-Nov 2017 - Contribute
Exam N - MCQs Dec 2017_Feb-March 2018 - Contribute
Exam O - MCQs April 2018 - Contribute

CONTRIBUTED ONLY POOLS
- THIS IS FROM CANDIDATES FROM CERTPREPARE BASED ON WHAT THEY CAN REMEMBER IN THEIR EXAM.
- REMEMBER THESE ARE NOT OFFICIALLY WRITTEN CISCO QUESTIONS.

Sections
1. Layer 2 Technologies
2. Infrastructure Security
3. Infrastructure Services
4. Mix QUESTIONS

MCQs - Cisco Official

QUESTION 1
What is the maximum number of switches that can be stacked using Cisco StackWise?

A. 4
B. 5
C. 8
D. 9
E. 10
F. 13

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Up to 9 Cisco Catalyst switches can be stacked together to build single logical StackWise switch since Cisco IOS XE Release 3.3.0SE. Prior to Cisco IOS XE
Release3.3.0SE, up to 4 Cisco Catalyst switches could be stacked together.

Reference: http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3850-series-switches/qa_c67-722110.html

QUESTION 2
A network engineer wants to add a new switch to an existing switch stack. Which configuration must be added to the new switch before it can be added to
the switch stack?

A. No configuration must be added.
B. stack ID
C. IP address
D. VLAN information
E. VTP information

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Switch Stack Offline Configuration
You can use the offline configuration feature to provision (to supply a configuration to) a new switch before it joins the switch stack. You can configure in
advance the stack member number, the switch type, and the interfaces associated with a switch that is not currently part of the stack. The configuration that
you create on the switch stack is called the provisioned configuration . The switch that is added to the switch stack and that receives this configuration is
called the provisioned switch.
You manually create the provisioned configuration through the switch stack-member-number provision type global configuration command. The provisioned
configuration is automatically created when a switch is added to a switch stack and when no provisioned configuration exists.
When you configure the interfaces associated with a provisioned switch (for example, as part of a VLAN), the switch stack accepts the configuration, and the
information appears in the running configuration. The interface associated with the provisioned switch is not active, operates as if it is administratively shut
down, and the no shutdown interface configuration command does not return it to active service. The interface associated with the provisioned switch does
not appear in the display of the specific feature; for example, it does not appear in the show vlan user EXEC command output.
The switch stack retains the provisioned configuration in the running configuration whether or not the provisioned switch is part of the stack. You can save the
provisioned configuration to the startup configuration file by entering the copy running-config startup-config privileged EXEC command. The startup
configuration file ensures that the switch stack can reload and can use the saved information whether or not the provisioned switch is part of the switch
stack.
Effects of Adding a Provisioned Switch to a Switch Stack
When you add a provisioned switch to the switch stack, the stack applies either the provisioned configuration or the default configuration. Table 5-1 lists the
events that occur when the switch stack compares the provisioned configuration with the provisioned switch.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swstack.html

QUESTION 3
What percentage of bandwidth is reduced when a stack cable is broken?

A. 0
B. 25
C. 50
D. 75
E. 100

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Physical Sequential Linkage
The switches are physically connected sequentially, as shown in Figure 3. A break in any one of the cables will result in the stack bandwidth being reduced to
half of its full capacity. Subsecond timing mechanisms detect traffic problems and immediately institute failover. This mechanism restores dual path flow
when the timing mechanisms detect renewed activity on the cable.
Figure 3. Cisco StackWise Technology Resilient Cabling

Reference: http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3750-series-switches/prod_white_paper09186a00801b096a.html

QUESTION 4
Refer to the exhibit.

Which set of configurations will result in all ports on both switches successfully bundling into an EtherChannel?

A. switch1
channel-group 1 mode active
switch2
channel-group 1 mode auto
B. switch1
channel-group 1 mode desirable
switch2
channel-group 1 mode passive
C. switch1
channel-group 1 mode on
switch2

channel-group 1 mode auto
D. switch1
channel-group 1 mode desirable
switch2
channel-group 1 mode auto

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The different etherchannel modes are described in the table below:

Both the auto and desirable PAgP modes allow interfaces to negotiate with partner interfaces to determine if they can form an EtherChannel based on criteria
such as interface speed and, for Layer 2 EtherChannels, trunking state and VLAN numbers.
Interfaces can form an EtherChannel when they are in different PAgP modes as long as the modes are compatible. For example:
An interface in the desirable mode can form an EtherChannel with another interface that is in the desirable or auto mode.

An interface in the auto mode can form an EtherChannel with another interface in the desirable mode.
An interface in the auto mode cannot form an EtherChannel with another interface that is also in the auto mode because neither interface starts PAgP
negotiation.
An interface in the on mode that is added to a port channel is forced to have the same characteristics as the already existing on mode interfaces in the
channel.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-1_13_ea1/configuration/guide/3550scg/swethchl.html

QUESTION 5
Refer to the exhibit.

How can the traffic that is mirrored out the GigabitEthernet0/48 port be limited to only traffic that is received or transmitted in VLAN 10 on the
GigabitEthernet0/1 port?

A. Change the configuration for GigabitEthernet0/48 so that it is a member of VLAN 10.
B. Add an access list to GigabitEthernet0/48 to filter out traffic that is not in VLAN 10.
C. Apply the monitor session filter globally to allow only traffic from VLAN 10.
D. Change the monitor session source to VLAN 10 instead of the physical interface.

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
To start a new flow-based SPAN (FSPAN) session or flow-based RSPAN (FRSPAN) source or destination session, or to limit (filter) SPAN source traffic to
specific VLANs, use the monitor session filter global configuration command.
Usage Guidelines
You can set a combined maximum of two local SPAN sessions and RSPAN source sessions. You can have a total of 66 SPAN and RSPAN sessions on a
switch or switch stack.
You can monitor traffic on a single VLAN or on a series or range of ports or VLANs. You select a series or range of VLANs by using the [ , | -] options.
If you specify a series of VLANs, you must enter a space before and after the comma. If you specify a range of VLANs, you must enter a space before and
after the hyphen ( -).
VLAN filtering refers to analyzing network traffic on a selected set of VLANs on trunk source ports. By default, all VLANs are monitored on trunk source ports.
You can use the monitor session session_number filter vlan vlan-id command to limit SPAN traffic on trunk source ports to only the specified VLANs.
VLAN monitoring and VLAN filtering are mutually exclusive. If a VLAN is a source, VLAN filtering cannot be enabled. If VLAN filtering is configured, a VLAN
cannot become a source.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/network_management/command_reference/
b_nm_3se_3850_cr/b_nm_3se_3850_cr_chapter_010.html#wp3875419997

QUESTION 6
Refer to the exhibit.

A network engineer wants to analyze all incoming and outgoing packets for an interface that is connected to an access switch. Which three items must be

configured to mirror traffic to a packet sniffer that is connected to the distribution switch? (Choose three.)

A. A monitor session on the distribution switch with a physical interface as the source and the remote SPAN VLAN as the destination
B. A remote SPAN VLAN on the distribution and access layer switch
C. A monitor session on the access switch with a physical interface source and the remote SPAN VLAN as the destination
D. A monitor session on the distribution switch with a remote SPAN VLAN as the source and physical interface as the destination
E. A monitor session on the access switch with a remote SPAN VLAN source and the physical interface as the destination
F. A monitor session on the distribution switch with a physical interface as the source and a physical interface as the destination

Correct Answer: BCD
Section: (none)
Explanation

Explanation/Reference:
Explanation:
You can analyze network traffic passing through ports or VLANs by using SPAN or RSPAN to send a copy of the traffic to another port on the switch or on
another switch that has been connected to a network analyzer or other monitoring or security device. SPAN copies (or mirrors) traffic received or sent (or
both) on source ports or source VLANs to a destination port for analysis.
RSPAN supports source ports, source VLANs, and destination ports on different switches (or different switch stacks), enabling remote monitoring of multiple
switches across your network. The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in
all participating switches. The RSPAN traffic from the source ports or VLANs is copied into the RSPAN VLAN and forwarded over trunk ports carrying the
RSPAN VLAN to a destination session monitoring the RSPAN VLAN. Each RSPAN source switch must have either ports or VLANs as RSPAN sources. The
destination is always a physical port.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

QUESTION 7
After an EtherChannel is configured between two Cisco switches, interface port channel 1 is in the down/down state. Switch A is configured with channel-
group 1 mode active, while Switch B is configured with channel-group 1 mode desirable. Why is the EtherChannel bundle not working?

A. The switches are using mismatched EtherChannel negotiation modes.
B. The switch ports are not configured in trunking mode.
C. LACP priority must be configured on both switches.
D. The channel group identifier must be different for Switch A and Switch B.

Correct Answer: A
Section: (none)

which is a PAGP mode.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swethchl.Explanation Explanation/Reference: Explanation: Here we have a situation where one switch is using active mode.html QUESTION 8 An EtherChannel bundle has been established between a Cisco switch and a corporate web server. You can not mix the LACP and PAGP protocols to form an etherchannel. and the other is using desirable. Enable Cisco Express Forwarding to allow for more effective traffic sharing over the EtherChannel bundle. . B. What should be done on the Cisco switch to allow for better EtherChannel utilization to the corporate web server? A. The network administrator noticed that only one of the EtherChannel links is being utilized to reach the web server. Adjust the EtherChannel load-balancing method based on destination IP addresses.cisco. Here is a summary of the various etherchannel modes: Reference: http://www. which is an LACP mode.

if the traffic on a channel only goes to a single MAC address (which is the case in this example. Adjust the EtherChannel load-balancing method based on source IP addresses. C. Use the option that provides the greatest variety in your configuration. IP addresses. Use link-state tracking to allow for improved load balancing of traffic upon link failure to the server. and either source mode. B. All VLAN traffic is sent to the SPAN destination interface. Correct Answer: E Section: (none) Explanation Explanation/Reference: Explanation: EtherChannel load balancing can use MAC addresses. D. Use of source addresses or IP addresses can result in a better load balance. The mode you select applies to all EtherChannels that you configure on the switch. 52 What is the result of the implemented command? A. Reference: http://www. or both. For example. Disable spanning tree on all interfaces that are participating in the EtherChannel bundle.cisco. E. E.html QUESTION 9 Interface FastEthernet0/1 is configured as a trunk interface that allows all VLANs. destination mode. The trunk’s native VLAN must be changed to something other than VLAN 1.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4. 39. 39. D. use of the destination MAC address results in the choice of the same link in the channel each time. or Layer 4 port numbers. Traffic from VLANs 1 to 8.C. Correct Answer: E Section: (none) Explanation Explanation/Reference: Explanation: . since all traffic is going to the same web server). Filtering a trunked SPAN port effectively disables SPAN operations for all VLANs. Traffic from VLAN 4 is not sent to the SPAN destination interface. and 52 is replicated to the SPAN destination port. This command is configured globally: monitor session 2 filter vlan 1 – 8.

QUESTION 11 After the implementation of several different types of switches from different vendors. but not necessarily the logical topology.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/span.html/index. Even though multiple routing neighbors can be formed over a layer 2 network. This example shows how to monitor VLANs 1 through 5 and VLAN 9 when the SPAN source is a trunk interface: Switch(config)# monitor session 2 filter vlan 1 – 5 .The “monitor session filter” command is used to specify which VLANS are to be port mirrored using SPAN. D. then each router will only have the single switch port that it connects to as its neighbor. B. The routers are connected via a Layer 2 switch. The engineer notices only a single neighbor that uses Cisco Discovery Protocol. only the physical port that it connects to will be seen as a CDP neighbor. Link Layer Discovery Protocol C. Which vendor-neutral protocol could be used to resolve this issue? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: If all of the routers are connected to each other using a layer 2 switch. 9 Reference: http://www. What would cause the output to show only the single neighbor? A. C. CDP can be used to determine the physical topology. Directed Response Protocol Correct Answer: B Section: (none) . Cisco Express Forwarding is enabled locally. Local Area Mobility B. Cisco Discovery Protocol advertisements are inconsistent between the local and remote devices. IP routing is disabled on neighboring devices. a network engineer notices that directly connected devices that use Cisco Discovery Protocol are not visible.html#wp1066836 QUESTION 10 A network engineer notices inconsistent Cisco Discovery Protocol neighbors according to the diagram that is provided. but it has several routing neighbor relationships. NetFlow D.cisco.

Ensure that all switch interconnects are configured as trunks to allow VTP information to be transferred. such as the Cisco Discovery Protocol (CDP). and neighbors on an IEEE 802 local area network.shtml . and version. Configure a different native VLAN on all new switches that are configured as VTP clients. CISCO and cisco are two different domain names. principally wired Ethernet. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: VTP allows switches to advertise VLAN information between other members of the same VTP domain. Make sure that if EtherChannels are created between two switches. make sure that the password is the same on both sides. C. Reference: http://en.cisco. Reference: http://www.org/wiki/Link_Layer_Discovery_Protocol QUESTION 12 Several new switches have been added to the existing network as VTP clients. Provision one of the new switches to be the VTP server and duplicate information from the existing network.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080890613. password. One of the switches must be the VTP server in a VTP domain. VTP allows a consistent view of the switched network across all switches. capabilities. VLANs are not passing from the VTP server (existing network) to the VTP clients. Make sure that the VLANs are active in all the devices. All VLAN changes must be done on this switch in order to have them propagated to the VTP clients. B. What must be done to fix this? A. The VTP domain name must match and it is case sensitive.Explanation Explanation/Reference: Explanation: The Link Layer Discovery Protocol (LLDP) is a vendor-neutral link layer protocol in the Internet Protocol Suite used by network devices for advertising their identity. However. D. There are several reasons why the VLAN information can fail to be exchanged. Make sure that no password is set between the server and client. LLDP performs functions similar to several proprietary protocols. All of the new switches have been configured with the same VTP domain. If any password is set. Verify these items if switches that run VTP fail to exchange VLAN information: VTP information only passes through a trunk port. Remove the VTP domain name from all switches with "null" and then replace it with the new domain name. Make sure that all ports that interconnect switches are configured as trunks and are actually trunking. only Layer 2 EtherChannels propagate VLAN information.wikipedia.

Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: VTP version 1 and VTP version 2 do not propagate configuration information for extended-range VLANs (VLAN numbers 1006 to 4094). the VLANs in the range 1006 to 4094 are removed from VTP control.cisco. VTP authentication is required when using extended VLANs because of their ability to cause network instability. Enable VTP version 3. Switch C receives VLAN information from the VTP server Switch A. the extended VLANs are not being propagated to other VTP switches.1SY/config_guide/sup2T/vtp. B. Reference: http://www.pdf QUESTION 14 Refer to the exhibit. D. You must configure extended-range VLANs manually on each network device. Switch A. C. B. What is the most probable cause of this behavior? . What should be configured for extended VLANs? A. VTP version 3 supports extended-range VLANs (VLAN numbers 1006 to 4094).com/en/US/docs/switches/lan/catalyst6500/ios/15. If you convert from VTP version 3 to VTP version 2. VTP does not support extended VLANs and should be manually added to all switches.QUESTION 13 After implementing VTP. but Switch B does not receive any VLAN information. which supports extended VLAN propagation. and C are trunked together and have been properly configured for VTP. Ensure that all switches run the same Cisco IOS version. Extended VLANs will not propagate to different IOS versions when extended VLANs are in use.

A. B.shtml QUESTION 15 Refer to the exhibit. Reference: http://www. D. Switch A. C. B. What would cause this issue? A.cisco. but transparent switches do forward VTP advertisements that they receive out their trunk ports in VTP Version 2. Switch B is configured with an access port to Switch A. but Switch C is not receiving traffic from certain VLANs. A VTP authentication mismatch occurred between Switch A and Switch B. The VTP revision number of Switch B is higher than that of Switch A. Switch B has all VLANs. . while Switch C is configured with a trunk port to Switch B.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080094c52. B. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: VTP transparent switches do not participate in VTP. Switch B is configured in transparent mode. and C are trunked together and have been properly configured for VTP. A VTP transparent switch does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements. The VTP revision number of the Switch B is higher than that of Switch A. The trunk between Switch A and Switch B is misconfigured.

The alternative port moves to the forwarding state if there is a failure on the designated port for the segment. * Backup port – A backup/redundant path to a segment where another bridge port already connects. The port roles have been adjusted based on the interface bandwidth and timers of the new Cisco Catalyst switches. VTP pruning is disabled by default. This path is different than using the root port. The best explanation for why switch C is not seeing traffic from only some of the VLANs. RSTP bridge port roles: * Root port – A forwarding port that is the closest to the root bridge in terms of path cost * Designated port – A forwarding port for every LAN segment * Alternate port – A best alternate path to the root bridge. a switch floods broadcast. B.” What is the reason for this change? A. D. VTP pruning is configured globally on all switches and it removed VLANs from the trunk interface that is connected to Switch C. These ports are allowed to immediately enter the forwarding state rather than passively wait for the network to converge. The administrator has defined the switch as the root in the STP domain. is that VTP pruning has been configured. The backup port applies only when a single switch has . VTP pruning blocks unneeded flooded traffic to VLANs on trunk ports that are included in the pruning-eligible list. The trunk between Switch A and Switch B is misconfigured. QUESTION 16 After the recent upgrade of the switching infrastructure.C. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: VTP pruning increases network available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to reach the destination devices. and unknown unicast traffic across all trunk links within a VTP domain even though receiving switches might discard them. Without VTP pruning. IEEE 802. D.1D STP and PortFast have been configured by default on all newly implemented Cisco Catalyst switches. C. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: RSTP works by adding an alternative port and a backup port compared to STP.1D STP. the network engineer notices that the port roles that were once “blocking” are now defined as “alternate” and “backup. The new switches are using RSTP instead of legacy IEEE 802. multicast.

html QUESTION 17 An administrator recently configured all ports for rapid transition using PortFast.cisco. most links operate in full-duplex mode and are treated as point-to-point links by RSTP. A port that operates in full-duplex is assumed to be point-to-point. VTP pruning D. STP is unable to achieve rapid transition for trunk links.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146. D. * Disabled port – Not strictly part of STP. PBR Correct Answer: C Section: (none) . The STP root bridge selection is forcing key ports to remain in non-rapid transitioning mode. In switched networks today. a network administrator can manually disable a port Reference: http://www.two links to the same segment (collision domain). This makes them candidates for rapid transition to the forwarding state. while a half-duplex port is considered as a shared port by default. C.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146. not on trunk links. This automatic link type setting can be overridden by explicit configuration. the switch must be attached to a hub. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: RSTP can only achieve rapid transition to the forwarding state on edge ports and on point-to-point links.cisco. What is the reason for this? A. Reference: http://www.html QUESTION 18 Which technique automatically limits VLAN traffic to only the switches that require it? A. The switch does not have the processing power to ensure rapid transition for all ports. DTP in nonegotiate C. RSTP has been enabled per interface and not globally. To have two links to the same collision domain. it has been determined that several ports are not transitioning as they should. B. access lists B. The link type is automatically derived from the duplex mode of a port. After testing.

Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: You can configure the amount of time that an entry (the packet source MAC address and port that packet ingresses) remain in the MAC table.Explanation Explanation/Reference: Explanation: VTP pruning enhances network bandwidth use by reducing unnecessary flooded traffic. E. B. C. and flooded unicast packets to only the switches that require it.html#wp1020444 QUESTION 19 What effect does the mac address-table aging-time 180 command have on the MAC address-table? A. ARP requests will be processed less frequently by the switch. The default timeout period will be 360 seconds. VTP pruning is disabled. By default. perform this task: . multicast. unknown. To configure the aging time for all MAC addresses. The MAC address-table will hold addresses 180 seconds longer than the default of 10 minutes.cisco. VTP pruning increases available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to access the appropriate network devices. This is how long a dynamic MAC address will remain in the CAM table. D. The MAC address-table will be flushed every 3 minutes.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/vtp. such as broadcast. Reference: http://www.

What solution allows the network switch to automatically recover from such an issue? A. IP Event Dampening D.This example shows how to set the aging time for entries in the MAC address table to 600 seconds (10 minutes): switch# configure terminal switch(config)# mac-address-table aging-time 600 Reference: http://www. As designed. macros B.cisco.html#wp1126206 QUESTION 20 While working in the core network building. errdisable autorecovery C. the link did not recover. a technician accidently bumps the fiber connection between two core switches and damages one of the pairs of fiber. Bidirectional Forwarding Detection Correct Answer: B Section: (none) Explanation . After the damaged cable was replaced. the link was placed into a non-forwarding state due to a fault with UDLD. command aliases E.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/ MACAddress.

The SDM VLAN template causes the MAC address-table to overflow. The idea behind requiring administrative action is so that a human engineer can intercede. by removing an unapproved device) without the need for administrative intervention. all processing overflow is sent to the CPU which can have a major impact on the performance of the switch. or a broadcast storm. What is the root cause of this issue? A. some configurations may be prone to accidental violations. UDLD failure. The SDM template is causing the CPU of the switch to spike during peak working hours. Choosing the VLAN template will actually disable routing (number of entry for unicast or multicast route is zero) in hardware. such as the detection of a loopback. The first eight lines (up to Security ACEs) represent approximate hardware boundaries set when a template is used.Explanation/Reference: Explanation: There are a number of events which can disable a link on a Catalyst switch. manual intervention by an administrator is necessary to restore the interface to working order. and (ideally) correct the issue. this can be done by issuing shutdown followed by no shutdown on the interface. D. and a steady recurrence of these can amount to a huge time sink for the administrative staff. This is where errdisable autorecovery can be of great assistance. The VLAN receives additional frames from neighboring switches. The switch needs to be rebooted before the SDM template takes effect. This gives the offending issue a chance to be cleared by the user (for example. However.net/blog/2009/sep/14/errdisable-autorecovery/ QUESTION 21 A network engineer deployed a switch that operates the LAN base feature set and decides to use the SDM VLAN template. generate the number of TCAM entries listed for security and QoS ACEs. The ACL merge algorithm. C. The VLAN template disables routing in hardware. By default. B. as opposed to the original access control entries (ACEs) configured by the user. . Reference: http://packetlife. There is no way to edit template category individual values. We can configure the switch to automatically re-enable any error-disabled interfaces after a specified timeout period. The switch reload is required to use a new SDM template. assess. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: SDM Template Notes: All templates are predefined. If the boundary is exceeded.

Reference: http://www. but not a destination.cisco. A port-channel interface (an EtherChannel) can be a SPAN source. SPAN encapsulation replication must be enabled to capture EtherChannel destination traffic. Trunk ports or EtherChannels can be configured as sources and mixed with nontrunk sources. but not a destination.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/44921-swdatabase-3750ss-44921. the network administrator notices that not all traffic is being replicated to the management server. . C. B.html#wp1040905 QUESTION 23 Refer to the exhibit. What is a cause for this issue? A.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/span. RSPAN must be used to capture EtherChannel bidirectional traffic. VLAN filters are required to ensure traffic mirrors effectively.cisco. After configuring SPAN to monitor this port. You can configure both Layer 2 and Layer 3 ports and EtherChannels as SPAN sources. The port channel can be used as a SPAN source. Reference: http://www. SPAN can monitor one or more source ports or EtherChannels in a single SPAN session. You can configure ports or EtherChannels in any VLAN as SPAN sources.html QUESTION 22 An access switch has been configured with an EtherChannel port. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: A source port or EtherChannel is a port or EtherChannel monitored for traffic analysis. D.

but network loops would occur because the load-balancing methods do not match. B. Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: An etherchannel will form if one end is active and the other is passive. The EtherChannels would form and both devices would use the dst-ip load-balancing method because Switch1 is configured with EtherChannel mode active. D. C. The table below summarizes the results for LACP channel establishment based on the . The EtherChannels would form and function properly even though the load-balancing and EtherChannel modes do not match.What is the result of the configuration? A. The EtherChannels would form. The EtherChannels would not form because the load-balancing method must match on the devices.

The settings will be applied to the EtherChannel bundle and all associated physical interfaces. all channels (manually configured.cisco. any configuration that you apply to the physical interfaces affects only the interface where you apply the configuration. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: After you configure an EtherChannel. but not on the associated physical ports. As a result.html . The storm control configuration will be accepted. B. and not at the physical interface level.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/31sg/configuration/guide/conf/channel. Reference: http://www. those ports will be dropped from the EtherChannel interface (put in suspended state).html#wp1020804 QUESTION 24 A network engineer tries to configure storm control on an EtherChannel bundle. but will only be present on the physical interfaces. The configuration will be rejected because storm control is not supported for EtherChannel.cisco. Therefore. D. Storm Control is an exception to this rule. although each switch involved in the etherchannel can have non matching parameters for load balancing. PagP. or LACP) use the same load-balancing. you should configure Storm Control at the EtherChannel Interface level. any configuration that you apply to the port-channel interface affects the EtherChannel. This is true for the switch globally. What is the result of the configuration? A. you cannot configure Storm Control on some of the members of an EtherChannel. The storm control settings will appear on the EtherChannel. Storm Control must be configured on all or none of the ports. C. For example. If you configure Storm Control on only some of the ports.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/54sg/configuration/guide/config/channel.configuration of each side of a link: LACP Channel Establishment Load balancing can only be configured globally. Reference: http://www.

VSS formed by two Cisco Catalyst 6500 Series Switches with the Virtual Switching Supervisor 720-10GE. forward traffic based on Cisco Express Forwarding C. Normal UDLD operations that prevent traffic loops. combining for an active 1400-Gbps switching capacity per VSS. and scaling system bandwidth capacity to 1.html QUESTION 26 After UDLD is implemented. Both chassis are kept in sync with the inter-chassis Stateful Switchover (SSO) mechanism along with Nonstop Forwarding (NSF) to provide nonstop communication even in the event of failure of one of the member supervisor engines or chassis. provide nonstop forwarding in the event of failure of one of the member supervisors Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: VSS is network system virtualization technology that pools multiple Cisco Catalyst 6500 Series Switches into one virtual switch. UDLD is enabled globally. Reference: http://ciscorouterswitch. Correct Answer: B Section: (none) Explanation .QUESTION 25 What is the function of NSF? A. provide automatic failover to back up supervisor in VSS mode D. The port then transitions into the errdisable state. the data plane and switch fabric with capacity of 720 Gbps of supervisor engine in each chassis are active at the same time on both chassis. B. a Network Administrator noticed that one port stops receiving UDLD packets. UDLD timers are inconsistent. D. In a VSS.4 Tbps.com/article-cisco-catalyst-6500-series-vss-1440-124536783. UDLD port is configured in aggressive mode. boosting nonstop communications. C.over-blog. This port continues to reestablish until after eight failed retries. forward traffic simultaneously using both supervisors B. Which option describes what causes the port to go into the errdisable state? A. increasing operational efficiency. Only one of the virtual switch members has the active control plane. Switches would operate as a single logical virtual switch called a virtual switching system 1440 (VSS1440).

C. This enables UDLD in normal mode.html QUESTION 27 After reviewing UDLD status on switch ports. UDLD moved into aggressive mode after inconsistent acknowledgements were detected. when a port on a bidirectional link that has a UDLD neighbor relationship established stops receiving UDLD packets. the port is disabled. Reference: http://packetlife. Which spanning-tree technology is used to accomplish backup root port selection? A. which is not necessarily an error condition. UDLD is disabled on all interfaces. The bidirectional status of “unknown” indicates that the port will go into the disabled state because it stopped receiving UDLD packets from its neighbor. UDLD tries to reestablish the connection with the neighbor. the status will transition to bidirectional. The UDLD port is placed in the “unknown” state for 5 seconds until the next UDLD packet is received on the interface. STP immediately replaces the root port with an alternative root port. B.net/blog/2011/mar/7/udld/ QUESTION 28 Pilot testing of the new switching infrastructure finds that when the root port is lost. The port will remain operational during this time. Reference: http://www. an engineer notices that the. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: By default. We can enable UDLD globally on the device.” Which statement describes what this indicates about the status of the port? A.Explanation/Reference: Explanation: With UDLD aggressive mode enabled. When UDLD is finally enabled on the other end. D. PortFast C. The port is fully operational and no known issues are detected. or individually on specific interfaces with the command udld port. so when UDLD is first enabled and does not detect a neighbor the link state is considered unknown. It would be prohibitively difficult to coordinate the configuration of UDLD on both ends of a link at the same time. PVST+ B.cisco. BackboneFast . After eight failed retries.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/udld.

Switches send and receive spanning-tree frames. Which two elements are used to accomplish this? (Choose two. Reference: http://www. If a network segment in the spanning tree fails and a redundant path exists. port-priority B. except for self-looping ports. UplinkFast provides fast convergence after a direct link failure and achieves load balancing between redundant Layer 2 links using uplink groups. forward-timers D.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swstpopt. link type E. as it would with the normal spanning-tree procedures.D. only one of which is forwarding at any given time. the spanning-tree algorithm recalculates the spanning-tree topology and activates the standby path.cisco. an uplink group consists of the root port (which is forwarding) and a set of blocked ports.html QUESTION 29 A network engineer must adjust the STP interface attributes to influence root port selection. Specifically. UplinkFast E. you can accelerate the choice of a new root port when a link or switch fails or when the spanning tree reconfigures itself. The uplink group provides an alternate path in case the currently forwarding link fails. root guard Correct Answer: AB Section: (none) Explanation Explanation/Reference: Explanation: Spanning tree forces redundant data paths into a standby (blocked) state.) A. The root port transitions to the forwarding state immediately without going through the listening and learning states. UDLD Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: I f a switch loses connectivity. By enabling UplinkFast with the spanning-tree uplinkfast global configuration command. Loop Guard F. called . cost C. it begins using the alternate paths as soon as the spanning tree selects a new root port. An uplink group is a set of Layer 2 interfaces (per VLAN).

at regular intervals. Upgrade the PFC to support the latest load balancing methods. Ensure that IP CEF is enabled globally to support all load balancing methods. The mode applies to all EtherChannels that are configured on the switch. the spanning-tree port priority and path cost settings control which port is put in the forwarding state and which is put in the blocking state.html QUESTION 31 Refer to the exhibit. You configure the load balancing and forwarding method with use of the port-channel load-balance {dst-ip | dst-mac | src-dst-ip | src-dst-mac | src-ip | src-mac} global configuration command. including switch and MAC addresses. B. Reference: http://www. Spanning tree uses this information to elect the root switch and root port for the switched network and the root port and designated port for each switched segment. and path cost.html QUESTION 30 A network engineer must set the load balance method on an existing port channel. The spanning-tree port priority value represents the location of a port in the network topology and how well it is located to pass traffic. Reference: http://www.cisco. EtherChannel load balancing can use MAC addresses or IP addresses. or both source and destination addresses. Which action must be done to apply a new load balancing method? A. BPDUs contain information about the sending switch and its ports.bridge protocol data units (BPDUs). The path cost value represents the media speed. Configure the new load balancing method using port-channel load-balance. D. switch priority. source or destination addresses. Correct Answer: A Section: (none) Explanation Explanation/Reference: Example: EtherChannel balances the traffic load across the links in a channel through the reduction of part of the binary pattern that the addresses in the frame form to a numerical value that selects one of the links in the channel. Adjust the switch SDM back to “default”.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swstp. port priority. The switches do not forward these frames but use them to construct a loop-free path. When two ports on a switch are part of a loop. .com/c/en/us/support/docs/lan-switching/etherchannel/12023-4. C.cisco.

The interface is configured as the source of the SPAN session. C. There is a duplex mismatch on the interface. Reference: http://www. The interface is configured as the target of the SPAN session.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612. the state of the destination port is up/down by design. B. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: With the SAPN destination port. The interface shows the port in this state in order to make it evident that the port is currently not usable as a production port.A network engineer investigates a recent network failure and notices that one of the interfaces on the switch is still down. There is a layer 1 physical issue. E.cisco. D. There is a speed mismatch on the interface.shtml QUESTION 32 While doing network discovery using Cisco Discovery Protocol. it is found that rapid error tracking is not currently enabled. Which option must be enabled to allow for enhanced reporting mechanisms using Cisco Discovery Protocol? . This is the normal operational state for SPAN destinations. What is causing the line protocol on this interface to be shown as down? A.

1 to 4094.xml&pid=2&converted=0 QUESTION 33 Which technique allows specific VLANs to be strictly permitted by the administrator? A. To restrict the traffic a trunk carries. Cisco Discovery Protocol logging options Correct Answer: A Section: (none) Explanation Explanation/Reference: CDP Version 1 — This is the first version of CDP which was used for the discovery of Cisco devices in the network. trunk allowed VLANs D. All VLAN IDs. a trunk port sends traffic to and receives traffic from all VLANs. L2P tunneling Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: By default. you can remove VLANs from the allowed list. Cisco Discovery Protocol version 2 B. transparent bridging C.A. Cisco IOS Embedded Event Manager C. Cisco Discovery Protocol source interface E. This is the default version on all switches.cisco. use the “switchport trunk .com/CiscoSB/GetArticle. are allowed on each trunk. However. which is used to track down errors and minimize costly downtime. VTP pruning B. Reference: http://sbkb. VLAN access-list E. This version is mainly used for backward compatibility. logging buffered D.aspx? docid=0ed03cbac49b446ab390a657917d817c_Cisco_Discovery_Protocol_CDP__Properties_Settings_on_Sx500_S. preventing traffic from those VLANs from passing over the trunk. It allows you to track instances even if the native VLAN ID or port duplex states do not match between connecting devices. CDP Version 2 — This is the most recent version of CDP which has enhanced features such as rapid reporting mechanism.

” This prevents the interface from generating DTP frames. DOT1Q Correct Answer: CF .) A. the IT manager has prohibited users from dynamically establishing trunks with their associated upstream switch. and is enabled by default. D. DLCI F. Which two actions can prevent interface trunking? (Choose two. DTP C. Disable DTP on a per interface basis. You can use this command only when the interface switchport mode is access or trunk. ISL D. DTP causes increased traffic. Reference: http://www. otherwise the link will be a non-trunking link.ciscopress.asp?p=2181837&seqNum=8 QUESTION 35 Which two protocols can be automatically negotiated between switches for trunking? (Choose two. HDLC E.1_13_ea1/configuration/guide/swvlan. C. Apply BPDU guard and BPDU filter. You must manually configure the neighboring interface as a trunk interface to establish a trunk link. PPP B. Configure trunk and access interfaces manually. To disable DTP.com/articles/article. but may be disabled. Enable switchport block on access ports.cisco. Correct Answer: AB Section: (none) Explanation Explanation/Reference: Explanation: The Dynamic Trunking Protocol (DTP) is used to negotiate forming a trunk between two Cisco devices.allowed vlan remove vlan-list” interface configuration command to remove specific VLANs from the allowed list.com/en/US/docs/switches/lan/catalyst3550/software/release/12.html QUESTION 34 For security reasons. configure “switchport nonegotiate.) A. B. Reference: http://www.

What is the problem? A. After each update to the VTP server. . Verify connected trunk ports. After verifying all VTP settings. B. The first thing that should be done is to verify that the trunk ports are connected and up. E. B. Reference: https://learningnetwork.cisco. D.com/servlet/JiveServlet/previewBody/14792-102-1-57313/Dynamic%20Trunking%20Protocol. Another switch in the domain has a higher revision number than the server.1Q or ISL trunking encapsulation.Section: (none) Explanation Explanation/Reference: Explanation: Switches such as the Catalyst 3550 that are capable of either 802. QUESTION 37 After configuring new data VLANs 1020 through 1030 on the VTP server. a network engineer notices that none of the VTP clients are receiving the updates. it takes up to 4 hours propagate. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: VTP should never need to have the switch reloaded or the VTP process to restart in order for it to work. D. the switchport trunk encapsulation [dot1q | isl | negotiate] interface command must be used prior to the switchport mode trunk command. Restart the VTP process on the new switch. The VTP version number must be set to version 3. VTP must be stopped and restarted on the server. the network engineer notices that the new switch is not receiving the list of VLANs from the server. The VTP server must be reloaded. C. Reload the new switch. C. Reload the VTP server. Which action resolves this problem? A.PDF QUESTION 36 A network is running VTPv2.

C. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Pruning unnecessary VLANs from the trunk can be performed with one of two methods: Manual pruning of the unnecessary VLAN on the trunk—This is the best method. the secret key from the password string is saved in the VLAN database file. Which enhancement to a spanning-tree design prevents unnecessary traffic from crossing the extended LAN segment? A. Instead. Modify the spanning-tree priorities to dictate the traffic flow. VTP pruning is the best choice. the method runs the pruned VLAN on trunks. but it does not appear in plain text in the configuration.cisco. Configure manual trunk pruning between the two locations. Reference: http://www. VTP-pruned VLANs on a trunk are still part of the spanning tree. you can directly configure the password secret key. When hidden. VTP-pruned VLANs do not reduce the number of spanning tree port instances. VTP versions 1 and 2 propagate only VLANs 1 to 1005. the key associated with the password is saved in hexadecimal format in the running configuration. Create a Layer 3 transit VLAN to segment the traffic between the sites. and it avoids the use of the spanning tree. You must reenter the password if you enter a takeover command in the domain. . When you enter the secret keyword. VTP pruning—Avoid this method if the goal is to reduce the number of STP instances. you cannot convert from VTP version 3 to version 1 or 2. B.com/en/US/docs/switches/lan/catalyst3560/software/release/12. If extended VLANs are configured. Since the question asked for the choice that is an enhancement to the STP design. D. Therefore. Instead. Support for extended range VLAN (VLANs 1006 to 4094) database propagation. Use VTP pruning on the trunk interfaces.Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: VTP version 3 supports these features that are not supported in version 1 or version 2: Enhanced authentication—You can configure the authentication as hidden or secret.2_52_se/configuration/guide/swvtp.html#wp1316856 QUESTION 38 A network engineer is extending a LAN segment between two geographically separated data centers.

1024 D. VTP pruning removed all unused VLANs.cisco. Reference: https://supportforums. or use the “issue the switchport trunk allowed vlan add vlan-list” command instead to add these 3 VLANS to the other defined allowed VLANs. 1001 C. 2048 E. Allowing additional VLANs across the trunk introduced a loop in the network. C. You would also need to explicitly allow the other working VLANs to this configuration command.30 is issued. and 30) are allowed to traverse the switch trunk interface. 4095 F.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080890613.Reference: http://www. 1000 B. 4096 Correct Answer: B Section: (none) Explanation . What is the root cause of the problem? A.cisco. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: The “switchport trunk allowed vlan” command will only allow the specified VLANs. and overwrite any others that were previously defined. ISL was unable to encapsulate more than the already permitted VLANs across the trunk.com/document/11836/how-define-vlans-allowed-trunk-link QUESTION 40 When you design a switched network using VTPv2. D. 20. B. how many VLANs can be used to carry user traffic? A. After the command switchport trunk allowed vlan 10.20. all other existing VLANs no longer pass traffic over the trunk.shtml QUESTION 39 The network manager has requested that several new VLANs (VLAN 10. The command effectively removed all other working VLANs and replaced them with the new VLANs.

Only VTP version 3 supports extended VLANs (1-4095). Control traffic is tagged. C. Which protocol does the network engineer configure on both devices to accomplish this? A.Explanation/Reference: Explanation: VTP versions 1 and 2 Supports normal VLAN numbers (1-1001). IRDP B. Cisco Discovery Protocol is not supported. NDP D. Reference: http://cciememo. with the defined native VLAN. except when the native VLAN is set to 1. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: The “vlan dot1q tag native” will tag all untagged frames. LLDP C.blogspot. LLTD Correct Answer: B Section: (none) Explanation . so the open standard protocol must be configured. QUESTION 42 A network engineer has just deployed a non-Cisco device in the network and wants to get information about it from a connected device.com/2012/11/difference-between-vtp-versions. All frames within the native VLAN are tagged. It allows control traffic to pass using the non-default VLAN. It removes the 4-byte dot1q tag from every frame that traverses the trunk interface(s). including control traffic.html QUESTION 41 What does the command vlan dot1q tag native accomplish when configured under global configuration? A. B. D.

Reference: http://en. principally wired Ethernet. For their disaster recovery feature to operate successfully.cisco.Explanation/Reference: Explanation: The Link Layer Discovery Protocol (LLDP) is a vendor-neutral link layer protocol in the Internet Protocol Suite used by network devices for advertising their identity. perform these steps: 1. allowed VLAN list B. all of the configured VLANs are allowed to send and receive traffic across the link. and neighbors on an IEEE 802 local area network. This keeps traffic from the VLANs from passing over the trunk link. VACL D.org/wiki/Link_Layer_Discovery_Protocol QUESTION 43 A manager tells the network engineer to permit only certain VLANs across a specific trunk interface. However. Note: The allowed VLAN list on both the ends of the trunk link should be the same. Which spanning-tree feature satisfies this requirement? A. they require the switchport to enter a forwarding state immediately. Rapid Spanning-Tree B. LLDP performs functions similar to several proprietary protocols. such as the Cisco Discovery Protocol (CDP). capabilities. Which option can be configured to accomplish this? A. For Integrated Cisco IOS Software based switches. L2P tunneling Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: When a trunk link is established. To restrict the traffic that a trInk carries. issue the switchport trunk vlan-Iist interface configuration command. the application server team has indicated that they must not have the standard 30 second delay before their switchport enters a forwarding state.wikipedia. Reference: https://supportforums.com/document/11836/how-define-vlans-allowed-trunk-link QUESTION 44 For client server failover purposes. VLANs 1 through 1005 are allowed on each trunk by default. Spanning-Tree Timers . VLAN traffic can be removed from the allowed list. This removes specific VLANs from the allowed list. VTP pruning C.

Spanning-Tree PortFast E. The port still participates in STP. PortFast immediately transitions the port into STP forwarding mode upon linkup. switch# show spanning-tree vlan 10 brief Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: . So if the port is to be a part of the loop. Example configuration: Switch-C# configure terminal Switch-C(config)# interface range fa0/3 . switch# show spanning-tree summary E.C. switch# show spanning-tree brief D. the port eventually transitions into STP blocking mode. Spanning-Tree Fast Forward Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: In order to allow immediate transition of the port into forwarding state.aspx?b=CCNP_Studies_Switching&seqNum=36 QUESTION 45 Which command does a network engineer use to verify the spanning-tree status for VLAN 10? A.informit. Spanning-Tree FastPort D.24 Switch-C(config-if-range)# sp–nning-tree portfast Reference: http://www. enable the STP PortFast feature. switch# show spanning-tree bridge C.com/library/content. switch# show spanning-tree vlan 10 B.

The switch with the non-default domain name restores back to "null" upon reboot. ---. VTP summary advertisements are sent out of all ports with the new domain name.9000 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Example output: SW2#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol rstp Root ID Priority 24586 Address 0014. which statement describes what happens when a domain name is configured on one of the switches? A.cisco.232 P2p Reference: http://www.4180 Cost 9 Port 216 (Port-channel21) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 001c. C.57d8.com/en/US/docs/ios/lanswitch/command/reference/lsw_s2. Correct Answer: C Section: (none) . If all switches currently have the default VTP domain name "null".html QUESTION 46 A new network that consists of several switches has been connected together via trunking interfaces.216 P2p Po23 Altn BLK 9 128. All other switches with the default domain name become VTP clients. --. D. B. Switches with higher revision numbers does not accept the new domain name.f2d2. --------. -------.Nbr Type ------------------. --------------------------- Po21 Root FWD 9 128.

featuring an access Switch A. RSTP B. VLANs. MST. RPVST+ Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Multiple Spanning Tree (MST) extends the IEEE 802. PVST+ E. Summary advertisements – sent out every 300 seconds and every time a change occurs on the VLAN database. there are 1000 VLANs. Contained in a summary advertisement: VTP version Domain name Configuration revision number Time stamp MD5 encryption hash code Reference: https://rowell. . connected to two Building Distribution submodule Switches D1 and D2. The network is expected to grow and add many new VLANs in the future. and the network administrator typically seeks to achieve load balancing on the access switch uplinks based on even or odd VLANs—or any other scheme deemed appropriate.net/configuring-cisco-vtp/ QUESTION 47 A network engineer is setting up a new switched network. Which Spanning Tree Protocol should be used to reduce switch resources and managerial burdens that are associated with multiple spanning-tree instances? A. In this setup. If the switch hears a VTP advertisement it will automatically learn the VTP domain name. MST D. and the configuration revision number. on the other hand.Explanation Explanation/Reference: Explanation: By default. The main purpose of MST is to reduce the total number of spanning-tree instances to match the physical topology of the network and thus reduce the CPU cycles of a switch. PVST C. PVRST+ runs STP instances for each VLAN and does not take into consideration the physical topology that might not require many different STP topologies. a switch will have a domain name of NULL and no password. uses a minimum number of STP instances to match the number of physical topologies present. Figure 3-15 shows a common network design.1w RST algorithm to multiple spanning trees.dionicio.

SDM templates are used to configure ACLs that protect networks and specific hosts from unnecessary or unwanted traffic. To allocate hardware resources for different usages. SDM templates are used to configure system resources in the switch to optimize support for specific features.com/2011/05/chapter-03-implementing-spanning-tree_19. Rather than maintaining 1000 spanning trees. use the default template to balance resources. B. Reference: http://ciscodocuments. for example. D. and use access template to obtain maximum ACL usage. depending on how the switch is used in the network. reducing the need for switch resources. each switch needs to maintain only two spanning trees.blogspot. SDM templates are configured by accessing the switch using the web interface.html QUESTION 48 Which statement about the use of SDM templates in a Cisco switch is true? A. depending on how the switch is used in the network. SDM templates are used to create Layer 3 interfaces (switch virtual interfaces) to permit hosts in one VLAN to communicate with hosts in another VLAN. SDM templates are used to configure a set of ACLs that allows the users to manage the flow of traffic handled by the route processor. You can select a template to provide maximum system usage for some functions. the switch SDM templates prioritize system . Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: You can use SDM templates to configure system resources in the switch to optimize support for specific features.Figure 3-15: VLAN Load Balancing Figure 3-15 illustrates two links and 1000 VLANs. C. E. The 1000 VLANs map to two MST instances.

com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_55_se/configuration/guide/swsdm. access D. VLAN B. Reference: http://www. Reference: http://www.2_55_se/configuration/guide/swsdm. It would typically be selected for a Layer 2 switch. access C. typically required for a router or aggregator in the center of a network. Routing — The routing template maximizes system resources for Ipv4 unicast routing.pdf QUESTION 49 Which SDM template disables routing and supports the maximum number of unicast MAC addresses? A. routing .cisco. VLAN B. routing Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: To allocate ternary content addressable memory (TCAM) resources for different usages. VLANs — The VLAN template disables routing and supports the maximum number of unicast MAC addresses.pdf QUESTION 50 Which SDM template is the most appropriate for a Layer 2 switch that provides connectivity to a large number of clients? A.cisco. the switch SDM templates prioritize system resources to optimize support for certain features.com/en/US/docs/switches/lan/catalyst3560/software/release/12.resources to optimize support for certain features. Default — The default template gives balance to all functions. You can select SDM templates to optimize these features: Access — The access template maximizes system resources for access control lists (ACLs) to accommodate a large number of ACLs. default C. default D.

com/en/US/docs/switches/lan/catalyst3560/software/release/12.cisco. what is the default period of time after which a MAC address ages out and is discarded? A.Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: To allocate ternary content addressable memory (TCAM) resources for different usages. Default—The default template gives balance to all functions. typically required for a router or aggregator in the center of a network. 100 seconds B. 600 seconds Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: To configure the aging time for all MAC addresses. 300 seconds D.pdf QUESTION 51 In a Cisco switch. the switch SDM templates prioritize system resources to optimize support for certain features. You can select SDM templates to optimize these features: Access—The access template maximizes system resources for access control lists (ACLs) to accommodate a large number of ACLs.2_55_se/configuration/guide/swsdm. Routing—The routing template maximizes system resources for Ipv4 unicast routing. 180 seconds C. Reference: http://www. It would typically be selected for a Layer 2 switch. VLANs—The VLAN template disables routing and supports the maximum number of unicast MAC addresses (clients). perform this task: .

More than 64 MAC addresses are added to the content-addressable memory. To disable MAC-move notification. A MAC address or host moves between different switch ports. B. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: mac-address-table notification mac-move To enable MAC-move notification.html QUESTION 52 If a network engineer applies the command mac-address-table notification mac-move on a Cisco switch port. when is a syslog message generated? A. A new MAC address is removed from the content-addressable memory. C.com/en/US/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/MACAddress. use the no form of this command.cisco. A new MAC address is added to the content-addressable memory. Mac-address-table notification mac-move [counter [syslog]] no mac-address-table notification mac-move [counter [syslog]] Syntax Description .Reference: http://www. use the mac-address-table notification mac-move command in global configuration mode. D.

cable unplugged C.Usage Guidelines MAC-move notification generates a syslog message whenever a MAC address or host moves between different switch ports. routing loop B.cisco. STP loop guard D.com/en/US/docs/ios/lanswitch/command/reference/lsw_m1.html QUESTION 53 Which option is a possible cause for an errdisabled interface? A. security violation Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: There are various reasons for the interface to go into errdisable. Reference: http://www. The reason can be: Duplex mismatch Port channel misconfiguration BPDU guard violation UniDirectional Link Detection (UDLD) condition Late-collision detection Link-flap detection Security violation Port Aggregation Protocol (PAgP) flap Layer 2 Tunneling Protocol (L2TP) guard DHCP snooping rate-limit Incorrect GBIC / Small Form-Factor Pluggable (SFP) module or cable .

The show errdisable recovery command shows the default error-disable recovery state for all the possible conditions.cisco. 600 seconds Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: After you fix the root problem. In this case. 100 seconds C. 300 seconds D.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00806cd87b. Address Resolution Protocol (ARP) inspection Inline power Reference: http://www. The errdisable recovery command allows you to choose the type of errors that automatically reenable the ports after a specified amount of time.shtml QUESTION 54 What is the default value for the errdisable recovery interval in a Cisco switch? A.-------------- udld Disabled bpduguard Disabled security-violatio Disabled channel-misconfig Disabled pagp-flap Disabled dtp-flap Disabled link-flap Disabled l2ptguard Disabled psecure-violation Disabled gbic-invalid Disabled dhcp-rate-limit Disabled . cat6knative#show errdisable recovery ErrDisable Reason Timer Status ----------------. 30 seconds B. the ports are still disabled if you have not configured errdisable recovery on the switch. Issue the shutdown command and then the no shutdown interface mode command on the associated interface in order to manually reenable the ports. you must reenable the ports manually.

Each device broadcasts periodic advertisements to all of its neighbors.2_58_se/configuration/guide/swlldp. LLDP-MED is an extension to LLDP that operates between endpoint devices and network devices. Reference: http://www.com/en/US/docs/switches/metro/me3400/software/release/12. It specifically provides support for voice over IP (VoIP) applications and provides additional TLVs for capabilities discovery.cisco.shtml QUESTION 55 Which statement about LLDP-MED is true? A.mac-limit Disabled unicast-flood Disabled arp-inspection Disabled Timer interval: 300 seconds Interfaces that will be enabled at the next timeout: Note: The default timeout interval is 300 seconds and. Reference: http://www. and inventory management. by default. LLDP-MED is an extension to LLDP that operates only between network devices. C. C. LLDP-MED is an extension to LLDP that operates only between endpoint devices. the timeout feature is disabled. LLDP-MED is an extension to LLDP that operates between routers that run BGP.pdf QUESTION 56 Which statement about Cisco devices learning about each other through Cisco Discovery Protocol is true? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: LLDP for Media Endpoint Devices (LLDP-MED) is an extension to LLDP that operates between endpoint devices such as IP phones and network devices such as switches. Each device sends periodic advertisements to multicast address 01:00:0C:CC:CC:CC. Power over Ethernet.cisco. B. network policy. . Each device sends periodic advertisements to a central device that builds the network topology. D.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00806cd87b. B.

memory errors Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Type-Length-Value fields (TLVs) are blocks of information embedded in CDP advertisements. . hardware platform B.php?id=cdp QUESTION 57 Which option lists the information that is contained in a Cisco Discovery Protocol advertisement? A. hardware platform D. These multicast packets may be received by Cisco switches and other networking devices that support CDP into their connected network interface. out each connected network interface. memory errors. Each device sends periodic advertisements to all IP addresses in its ARP table. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Cisco devices send periodic CDP announcements to the multicast destination address 01-00-0c-cc-cc-cc. native VLAN IDs. hardware platform. port-duplex.D. memory errors C. native VLAN IDs.spravcesite. Reference: http://network. port-duplex. port-duplex. native VLAN IDs.net/subdom/network/index. Table 21 summarizes the TLV definitions for CDP advertisements.

C.Reference: http://www. LLDP can discover only Windows servers. B. Correct Answer: A Section: (none) Explanation . LLDP can discover up to two devices per port.cisco.html QUESTION 58 Which option describes a limitation of LLDP? A. LLDP does not support TLVs.com/en/US/docs/ios/12_2/configfun/configuration/guide/fcf015. D. LLDP cannot provide information about VTP.

B.Explanation/Reference: Explanation: LLDP Versus Cisco Discovery Protocol TLV Comparison Reference: http://www. capabilities.cisco.com/en/US/technologies/tk652/tk701/technologies_white_paper0900aecd804cd46d. UDLD is a Cisco-proprietary Layer 2 protocol that enables devices to monitor the physical status of links and detect unidirectional failures. . and neighbors on a local area network.html QUESTION 59 Which statement about the UDLD protocol is true? A. UDLD is a Cisco-proprietary Layer 2 protocol that enables devices to advertise their identity.

D. UDLD detects the existence of unidirectional links. active and aggressive C. UDLD is a standardized Layer 2 protocol that enables devices to advertise their identity.com/en/US/docs/switches/lan/catalyst6500/ios/12. When a unidirectional link is detected. UDLD puts the affected port into the errdisabled state and alerts the user.2SX/configuration/guide/udld. When a unidirectional link is detected.2SX/configuration/guide/udld.html QUESTION 60 Which option lists the modes that are available for configuring UDLD on a Cisco switch? A. normal and standby Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: The Cisco-proprietary UDLD protocol monitors the physical configuration of the links between devices and ports that support UDLD. normal and passive E. normal and aggressive B.com/en/US/docs/switches/lan/catalyst6500/ios/12. Reference: http://www.C. UDLD puts the affected port into the errdisabled state and alerts the user. normal and active D.html QUESTION 61 What is the default interval at which Cisco devices send Cisco Discovery Protocol advertisements? . and neighbors on a local area network.cisco.cisco. UDLD detects the existence of unidirectional links. capabilities. UDLD can operate in either normal or aggressive mode. UDLD is a standardized Layer 2 protocol that enables devices to monitor the physical status of links and detect unidirectional failures. Reference: http://www. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: The Cisco-proprietary UDLD protocol monitors the physical configuration of the links between devices and ports that support UDLD.

. Devices discover each other by listening at that address. Advertisements supported and configured in Cisco software are sent. directly connected devices. C. 300 seconds Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Cisco Discovery Protocol is a Layer 2. which indicates the length of time a receiving device should hold Cisco Discovery Protocol information before discarding it. by default.com/en/US/docs/ios-xml/ios/cdp/configuration/15-mt/nm-cdp-discover. 30 seconds B. D. Reference: http://www. media-independent.A. Each device configured for Cisco Discovery Protocol advertises at least one address at which the device can receive messages and sends periodic advertisements (messages) to the well-known multicast address 01:00:0C:CC:CC:CC. Advertisements contain time-to-live information. To disable it globally. use the “no cdp enable interface” configuration command. 60 seconds C. Cisco Discovery Protocol is enabled by default. B. use the “no cdp run” command. To disable CDP on an interface. CDP is disabled by default and can be enabled globally with the command cdp run. CDP is enabled by default and can be disabled globally with the command no cdp enable. CDP also is enabled on supported interfaces by default. They also listen to messages to learn when interfaces on other devices are up or go down. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: CDP is enabled on your router by default. and network-independent protocol that networking applications use to learn about nearby. which means the Cisco IOS software will receive CDP information. 120 seconds D. CDP is enabled by default and can be disabled globally with the command no cdp run. every 60 seconds. CDP is disabled by default and can be enabled globally with the command cdp enable.html QUESTION 62 Which statement about Cisco Discovery Protocol configuration on a Cisco switch is true? A.cisco.

1q frame? A.com/en/US/docs/ios/12_2/configfun/command/reference/frf015.html#wp1017573 QUESTION 63 What is the size of the VLAN field inside an 802. 1024 Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: A standard (non-voice VLAN port) access switch port can belong to only a single VLAN.cisco. 2 D. If more than one VLAN is needed. 1 C.wikipedia.094 VLANs Reference: http://en.1Q QUESTION 64 What is the maximum number of VLANs that can be assigned to an access switchport without a voice VLAN? A. The hexadecimal values of 0x000 and 0xFFF are reserved. the port should be configured as a .Reference: http://www.org/wiki/IEEE_802. All other values may be used as VLAN identifiers. 12-bit C. 8-bit B. 0 B. allowing up to 4. 32-bit Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: The VLAN field is a 12-bit field specifying the VLAN to which the frame belongs. 16-bit D.

Which option shows the expected result if a show vlan command is issued? A.trunk port. . QUESTION 65 Refer to the exhibit.

.B. C. D.

When you disable voice VLAN.html QUESTION 67 In which portion of the frame is the 802. the port has been configured both as a trunk and as a switchport in data vlan 10. storm control Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Voice VLAN Configuration Guidelines You should configure voice VLAN on switch access ports. ignoring the switchport access VLAN 10 command. QUESTION 66 Which feature is automatically enabled when a voice VLAN is configured. Obviously.Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: In this case. within the Ethernet header B. The Port Fast feature is automatically enabled when voice VLAN is configured. Use the show vlan privileged EXEC command to see if the VLAN is present (listed in the display). Reference: http://www.1_22_ea11x/configuration/guide/swvoip.1q header found? A. a port can not be both. port-security C. the Port Fast feature is not automatically disabled. but not automatically disabled when a voice VLAN is removed? A. the port will actually be used as a trunk. so even though Cisco IOS will accept both. The voice VLAN should be present and active on the switch for the IP phone to correctly communicate on the voice VLAN. portfast B.com/en/US/docs/switches/lan/catalyst2950/software/release/12. spanning tree D. within the Ethernet payload .cisco.

within the Ethernet FCS D. Instead.org/wiki/IEEE_802. within the Ethernet source MAC address Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Frame format Insertion of 802.1Q QUESTION 68 Which VLAN range is eligible to be pruned when a network engineer enables VTP pruning on a switch? A.wikipedia.1Q does not encapsulate the original frame.C. it adds a 32-bit field between the source MAC address and the EtherType/ length fields of the original frame Reference: http://en. for Ethernet frames. VLANs 2-4094 Correct Answer: C Section: (none) Explanation . VLANs 2-1001 D. VLANs 1-1001 B.1Q tag in an Ethernet frame 802. VLANs 1-4094 C.

Reference: http://www. bpdguard Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: VTP ensures that all switches in the VTP domain are aware of all VLANs. Reference: http://www. there are occasions when VTP can create unnecessary traffic. VTP pruning B.com/c/en/us/support/docs/lan-switching/vtp/10558-21. VLANs 2 – 1001 are pruning eligible. even in situations in which few users are connected in that VLAN.Explanation/Reference: Explanation: VTP pruning should only be enabled on VTP servers.php QUESTION 69 Which feature must be enabled to eliminate the broadcasting of all unknown traffic to switches that are not participating in the specific VLAN? A. storm control D. All switches in the network receive all broadcasts. port-security C. but VLAN 1 can’t be pruned because it’s an administrative VLAN. However. All unknown unicasts and broadcasts in a VLAN are flooded over the entire VLAN.com/VTP-Pruning.html#vtp_pruning QUESTION 70 Refer to the exhibit. . Both VTP versions 1 and 2 supports pruning.orbit-computer-solutions.cisco. By default. all the clients in the VTP domain will automatically enable VTP pruning. VTP pruning is a feature that you use in order to eliminate or prune this unnecessary traffic.

Disable VTP pruning and disable 802. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Only VTP servers can add new VLANs to the switched network. you will need to enable 802. . B. Enable VTP pruning and disable 802. Update the VTP revision number.The users in an engineering department that connect to the same access switch cannot access the network. C. Then. Change VTP mode to server and enable 802.1q. D. QUESTION 71 Refer to the exhibit. The network engineer found that the engineering VLAN is missing from the database. so to enable vlan 10 on this switch you will first need to change the VTP mode from client to server. Which action resolves this problem? A.1q.1q.1Q trunking to pass this new VLAN along to the other switches.

but users in company A are not able to access network resources in company B when DTP is enabled.dat and ensure that the switch with lowest MAC address is the VTP server. Delete vlan. .The network switches for two companies have been connected and manually configured for the required VLANs. Which action resolves this problem? A.

PPP encapsulation with a virtual template B. The only viable solution is that there is a DTP issues and so you must instead manually configure the trunk ports between these two switches so that the VLAN information can be sent to each switch. Cisco Discovery Protocol version 2 carries native VLAN information. but version 1 does not. Disable DTP and document the VTP domain mismatch. QUESTION 73 Which statement about using native VLANs to carry untagged frames is true? A. Of these. Link Aggregation Protocol at the access layer C.1Q is supported by multiple vendors since ISL is a Cisco proprietary protocol. The VTP domain names do match and they are both VTP servers so there are no issues there. D. Consider that this is a multivendor environment. only 802. .B. Enable the company B switch with the vtp mode server command. QUESTION 72 A network engineer must implement Ethernet links that are capable of transporting frames and IP traffic for different broadcast domains that are mutually isolated. Which Cisco IOS switching feature can be used to achieve the task? A. dot1q VLAN trunking D. 802. There are 2 different methods for trunking. Manually force trunking with switchport mode trunk on both switches.1Q and ISL. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Since the number of existing VLANs differ on the switches (9 on A and 42 on B) we know that there is a problem with VTP or the trunking interfaces. Inter-Switch Link Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Here the question asks for transporting “frames and IP traffic for different broadcast domains that are mutually isolated” which is basically a long way of saying VLANs so trunking is needed to carry VLAN information. C.

Reference: http://www. Cisco Discovery Protocol version 3 carries native VLAN information. A multilayer switch has been configured to send and receive encapsulated and tagged frames. C.ciscopress. B.B.com/articles/article. D.asp?p=29803&seqNum=3 QUESTION 74 Refer to the exhibit. spanning-tree bpdu-filter is enabled. Cisco Discovery Protocol version 1 carries native VLAN information. both with native VLAN mismatch. VLAN 2013 on the multilayer switch is configured as the native VLAN. Which option is the cause of the spanning-tree error? A. Cisco Discovery Protocol version 1 and version 2 carry native VLAN information. but version 2 does not. C. but versions 1 and 2 do not. VLAN ID 1 should not be used for management traffic because its unsafe.1q trunks are on both sides. D. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Cisco Discovery Protocol (CDP) version 2 passes native VLAN information between Cisco switches. Correct Answer: C Section: (none) Explanation . you will see CDP error messages on the console output. If you have a native VLAN mismatch. VLAN spanning-tree in SW-2 is configured. 802.

The “vtp pruning” command prunes VLANs automatically.1Q trunks.com/library/content. Failure to do this causes Cisco switches to partially shut down the trunk port because having mismatched native VLANs can result in spanning-tree loops. but 1 (the default native VLAN) on the other switch. C. you must ensure that you choose a common native VLAN for each port in the trunk. Reference: http://www. VTP pruning B. access list C. B.cisco. VLAN access-map Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Cisco advocates the benefits of pruning VLANs in order to reduce unnecessary frame flooding. however. If you use 802. switchport trunk allowed VLAN D.aspx?b=CCNP_Studies_Switching&seqNum=25 QUESTION 75 A network engineer must improve bandwidth and resource utilization on the switches by stopping the inefficient flooding of frames on trunk ports where the frames are not needed. Upgrade to VTP version 3 for advanced feature set support. not via DTP messages. Manually prune default VLAN with switchport trunk allowed vlans remove. Use trunk pruning vlan 1. the trunk still remains up for other VLANs. If spanning tree detects a native VLAN mismatch.informit. Enable VTP pruning on the VTP server. which stops the inefficient flooding of frames where they are not needed. . D. spanning tree blocks local native VLAN traffic and the remote switch native VLAN traffic on the trunk. Reference: http://www.html QUESTION 76 Which action allows a network engineer to limit a default VLAN from being propagated across all trunks? A.Explanation/Reference: Here we see that the native VLAN has been configured as 2013 on one switch.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/24330-185. Native VLAN mismatches are detected via spanning tree and Cisco Discovery Protocol (CDP). Which Cisco IOS feature can be used to achieve this task? A.

Support 1547 MTU only Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: The default system MTU for traffic on Catalyst switches is 1500 bytes. VLAN 1 is not VTP pruning eligible so it cannot be done via VTP pruning. Support 1522 layer 3 IP and IPX packet D.1q Q-in-Q encapsulation? A. Reference: http://www. QUESTION 77 What is required for a LAN switch to support 802. Support 1504 MTU or higher C.1Q tunneling (Q-in-Q) feature increases the frame size by 4 bytes when the extra tag is added. The “trunk pruning vlan 1” option is not a valid command.html QUESTION 78 Refer to the exhibit.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/configuration/guide/swtunnel. Because the 802. Support less than 1500 MTU B.Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Manaully pruning the default VLAN (1) can only be done with the “switchport trunk allowed vlans remove” command. .cisco. you must configure all switches in the service-provider network to be able to process maximum frames by increasing the switch system MTU size to at least 1504 bytes.

Which action allows interface G0/1 to always actively forward traffic in the port-channel? A.How many bytes are added to each frame as a result of the configuration? A.1Q trunking. except the native VLAN. Configure LACP port-priority on G0/1 to 1. B. C. all VLAN packets are tagged on the trunk link. 4-bytes except the native VLAN B. G0/3. LACP uses the port priority with the port number to form the port identifier. Two bytes are used for the tag protocol identifier (TPID). Reference: http://www. G0/2. the lower the priority. The default is 32768. the other two bytes for tag control information (TCI). LACP traffic goes through G0/4 because it is the highest interface ID. Configure LACP port-priority on G0/1 to 65535. A VLAN tag adds 4 bytes to the frame. The higher the number. The port priority can be configured automatically or through the CLI. D. Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: A LACP port priority is configured on each port using LACP. and G0/4 between two switches using Ethernet port-channel. The valid range is from 1 to 65535. The port priority determines which ports should be put in standby mode when there is a hardware limitation that prevents all compatible ports from aggregating.html#wp1081491 . QUESTION 79 A network engineer configured a fault-tolerance link on Gigabit Ethernet links G0/1. 8-bytes except the native VLAN C.com/c/en/us/td/docs/ios/12_2sb/feature/guide/gigeth. Configure G0/1 as half duplex and G0/2 as full duplex. 4-bytes including native VLAN D.cisco. 8-bytes including native VLAN Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: In 802.

on: PagP will not run. desirable. desirable. If a device on one side of the channel does not support PagP.QUESTION 80 Which statement about the use of PagP link aggregation on a Cisco switch that is running Cisco IOS Software is true? A. desirable-desirable. The channel is forced to remain down. and on. PagP modes are off. Only the combinations auto-desirable. and on. 4. Only the combinations active-active. . PagP modes are active. Only the combinations of auto-desirable. the device on the other side must have PagP set to on. desirable. desirable-desirable. Only the combinations active-desirable. desirable. PagP modes are off. and on-on allow the formation of a channel. and on-on allow the formation of a channel. and on-on will allow a channel to be formed. and on. Only the combinations auto-desirable. desirable-desirable. 1. desirable-desirable. 3.html QUESTION 81 Refer to the exhibit. PagP modes are active. desirable: PagP is running actively. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: PagP modes are off. Only the combinations auto-auto. off: PagP will not run. and on-on allow the formation of a channel. such as a router. desirable-desirable. The formation of a channel is desired and initiated. active. The PagP modes are explained below. D.cisco. and on-on allow the formation of a channel. 2. it is not initiated. however. and on. desirable-desirable. The channel is forced to come up. Reference: http://www.com/c/en/us/support/docs/switches/catalyst-2900-xl-series-switches/21041-131. and on-on will allow a channel to be formed. and on. B. The formation of a channel is desired. auto. auto: PagP is running passively. auto. desirable. C.

Which EtherChannel negotiation protocol is configured on the interface f0/13 – f0/15? A. Link Combination Control Protocol .

The channel is forced to come up. however. and on. . In this example. The peer (in active state) initiates negotiation (when it sends out an LACP packet) which we receive and answer. auto: PAgP is running passively. desirable: PAgP is running actively. The Link Aggregate Control Protocol (LACP) trunking supports four modes of operation: On: The link aggregation is forced to be formed without any LACP negotiation . and on-on will allow a channel to be formed. 1. 2. Passive: The switch does not initiate the channel but does understand inbound LACP packets. 4.B. This is similar to the desirable mode of PAgP. desirable. which is operating in desirable mode. Active: We can form an aggregate link and initiate the negotiation. Port Aggregation Protocol C. Link Aggregation Control Protocol Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: PAgP modes are off. we see that fa 0/13. The formation of a channel is desired and initiated. the switch neither sends the LACP packet nor processes any inbound LACP packet. it is not initiated. fa0/14. 3. This is similar to the auto mode in PAgP. desirable-desirable. and fa0/15 are all in Port Channel 12. . Only the combinations auto-desirable. off: PAgP will not run. which is only a PAgP mode. The formation of a channel is desired. The channel is forced to remain down. We do not send or understand the LACP packet. This is similar to the off state for PAgP. on: PAgP will not run. eventually to form the aggregation channel with the peer. This is similar to the on state for PAgP. QUESTION 82 Refer to the exhibit. auto. Port Combination Protocol D. Off: The link aggregation is not formed.In other words. The link aggregate is formed if the other end runs in LACP active or passive mode.

B. the network engineer configured an EtherChannel on interfaces Fa1/0 and Fa0/1 of the server farm switch. as shown here: Server_Switch#sh etherchannel load-balance EtherChannel Load-Balancing Operational State (src-mac): Non-IP: Source MAC address IPv4: Source MAC address IPv6: Source IP address Server_Switch# HoweIer. To increase bandwidth. traffic is still slow. Change the load-balance method to dst-mac. Which action can the engineer take to resolve this issue? A. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Since this traffic is coming from PC-1. Upgrade the switch IOS to IP services image. Disable EtherChannel load balancing. C.Users of PC-1 experience slow connection when a webpage is requested from the server. D. and since the load balancing method is source MAC. the source MAC address will always be that of PC-1. traffic will only be using one of the port channel links. The load balancing method should be changed to destination MAC. . Contact Cisco TAC to report a bug on the switch. since the web server has two NICs traffic will be load balanced across both MAC addresses.

Which statement describes what happens to all ports in the bundle? A. and on. auto. PAgP changes the port speed and duplex for all ports in the bundle. PAgP changes the port speed and duplex for all ports in the bundle. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: PAgP aids in the automatic creation of EtherChannel links. D. The restrictions are: •PAgP does not form a bundle on ports that are configured for dynamic VLANs. such as a router. A switch can support up to eight compatibly configured Ethernet interfaces in an EtherChannel.html QUESTION 84 Which statement about using EtherChannel on Cisco IOS switches is true? A. PAgP drops the ports that do not match the configuration. If speed and duplex change when a bundle exists.cisco. A switch can support up to eight compatibly configured Ethernet interfaces in an EtherChannel. When a bundle already exists and a VLAN of a port is modified. A switch can support up to 10 compatibly configured Ethernet interfaces in an EtherChannel. PAgP does not change the port speed and duplex for all ports in the bundle until the switch is rebooted. Some restrictions are deliberately introduced into PAgP. A switch can support up to 10 compatibly configured Ethernet interfaces in an EtherChannel. C. Only the combinations auto-desirable. The EtherChannel provides full-duplex bandwidth up to 800 Mbps only for Fast EtherChannel or 16 Gbps only for Gigabit EtherChannel. desirable. B. desirable-desirable. The device on the other side must have PAgP set to on if a device on one side of the channel does not support PAgP. PAgP packets are sent between EtherChannel-capable ports in order to negotiate the formation of a channel. PAgP changes the port speed but not the duplex for all ports in the bundle. all ports in the bundle are modified to match that VLAN. B. The EtherChannel provides full-duplex bandwidth up to 1000 Mbps only for Fast EtherChannel or 10 Gbps only for Gigabit EtherChannel.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4. The EtherChannel provides full-duplex bandwidth up to 1000 Mbps only for Fast EtherChannel or 8 Gbps only for Gigabit EtherChannel. •PAgP does not group ports that operate at different speeds or port duplex.QUESTION 83 A network engineer changed the port speed and duplex setting of an existing EtherChannel bundle that uses the PAgP protocol. . The EtherChannel provides full-duplex bandwidth up to 800 Mbps only for Fast EtherChannel or 8 Gbps only for Gigabit EtherChannel. D. C. PAgP requires that all ports in the channel belong to the same VLAN or are configured as trunk ports. Reference: http://www. and on-on allow the formation of a channel. •PAgP modes are off.

Each EtherChannel can consist of up to eight compatibly configured Ethernet interfaces. .com/c/en/us/support/docs/lan-switching/etherchannel/12023-4. and all must be configured as either Layer 2 or Layer 3 interfaces. The EtherChannel provides full-duplex bandwidth up to 800 Mbps (Fast EtherChannel) or 8 Gbps (Gigabit EtherChannel) between your switch and another switch or host.cisco.Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: An EtherChannel consists of individual Fast Ethernet or Gigabit Ethernet links bundled into a single logical link. All interfaces in each EtherChannel must be the same speed. Reference: http://www.html QUESTION 85 Refer to the exhibit.

and Fa0/15 successfully formed a Layer 3 physical port-channel interface using an open standard protocol. B. Fa0/14.Which statement about switch S1 is true? A. Fa0/14. D. and Fa0/15 successfully formed a Layer 3 port-channel interface using a Cisco proprietary protocol. Physical port Fa0/13. Fa0/14. Logical port Fa0/13. Logical port Fa0/13. Correct Answer: A . C. and Fa0/15 successfully formed a Layer 2 port-channel interface using an open standard protocol. and Fa0/15 successfully formed a Layer 2 physical port-channel interface using a Cisco proprietary protocol. Physical port Fa0/13. Fa0/14.

RSTP selectively sends 802. Reference: http://www.1D switches. 802.1D BPDU after the port migration-delay timer has expired.html QUESTION 87 When two MST instances (MST 1 and MST 2) are created on a switch. but when a RSTP switch receives an 802. B. as opposed to PagP. which is Cisco proprietary. When a port is initialized. if the RSTP switch is using 802.1d BPDU. but when a RSTP switch receives a 802.1d does not understand RSTP BPDUs because they are different versions. the switch processes all BPDUs received on that port and ignores the protocol type.1D switch and starts using only 802. the migrate-delay timer is started (specifies the minimum time during which RSTP BPDUs are sent).1d does not understand RSTP BPDUs because they are different versions. 802.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/spantree.1d to communicate.1D BPDUs on a port and receives an RSTP BPDU after the timer has expired.1d BPDU and eventually the two switches run 802. D. but when a RSTP switch receives a 802. 802.1d BPDU and eventually the two switches run 802. and the (SU) means they are in use and operating at layer 2. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: For backward compatibility with 802. The protocol used for this port channel shows as LACP. which is a standards based protocol.1d understands RSTP BPDUs because they are the same version.1D BPDUs.1d BPDU.1D configuration BPDUs and TCN BPDUs on a per-port basis. but when a RSTP switch receives a 802. However. it restarts the timer and starts using RSTP BPDUs on that port. QUESTION 86 What happens on a Cisco switch that runs Cisco IOS when an RSTP-configured switch receives 802. it responds with a 802.1d to communicate. it responds with an 802. it does not respond with a 802.1d BPDU and eventually the two switches run 802. If the switch receives an 802.1d BPDU.cisco. and RSTP BPDUs are sent. C.1d BPDU? A.1d to communicate. 802.1d understands RSTP BPDUs because they are the same version. it does not respond with a 802. it assumes that it is connected to an 802. While this timer is active.Section: (none) Explanation Explanation/Reference: Explanation: These three ports show that they are in Port Channel 1.1d BPDU.1d BPDU. what is the total number of spanning-tree instances running on the switch? .

Reference: http://www. even if regions A and B are interconnected. for example. MST maintains multiple spanning tree instances. All other MST instances are numbered from 1 to 4094.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/spantree. All MST instances within the same region share the same protocol timers. In the case for this question.cisco. there will be the 2 defined MST instances. MST instance 1 in region A is independent of MST instance 1 in region B. A CIST is a collection of the ISTs in each MST region. By default. MST establishes and maintains IST. all VLANs are assigned to the IST. CIST. which are 68sername6868eed within MST BPDUs. and so forth. The IST is the only spanning tree instance that sends and receives BPDUs. 3 D. such as root bridge ID. 1 B. the number of BPDUs that need to be processed to support multiple spanning tree instances is 68sernamcantly reduced. 2 C. Because the MST BPDU carries information for all instances. The CST interconnects the MST regions and single spanning trees. . All of the other spanning tree instance information is contained in MSTP records (M-records). and the special 0 instance.html QUESTION 88 Refer to the exhibit. for a total of 3 instances. 4 Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Unlike other spanning tree protocols. root path cost. An MST instance is local to the region. known as the IST. Instance 0 is a special instance for a region. Within each MST region.A. but each MST instance has its own topology parameters. in which all the spanning tree instances are independent. and CST spanning trees: An IST is the spanning tree that runs in an MST region.

Modify the spanning-tree port-priority on SW2 f1/1 to 16 and f1/0 to 0.f1/0 and f1/1 have the same end-to-end path cost to the designated bridge. D. Modify the spanning-tree port-priority on SW2 f1/1 to 0 and f1/0 to 16. C. Modify the spanning-tree port-priority on SW1 f1/1 to 0 and f1/0 to 16. Correct Answer: C Section: (none) Explanation . Modify the spanning-tree port-priority on SW1 f1/1 to 16 and f1/0 to 0. B. Which action is needed to modify the Layer 2 spanning-tree network so that traffic for PC1 VLAN from switch SW3 uses switchport f1/1 as a primary port? A.

Reference: http://www.1_9_ea1/configuration/guide/swstp.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.Explanation/Reference: Explanation: If a loop occurs.html#wp1105354 QUESTION 89 Refer to the exhibit. If all LAN ports have the same priority value. . STP considers port priority when selecting a LAN port to put into the forwarding state. You can assign higher priority values to LAN ports that you want STP to select first and lower priority values to LAN ports that you want STP to select last. configurable in increments of 16. The possible priority range is 0 through 240 (default 128). A lower path cost represents higher-speed transmission and is preferred. STP puts the LAN port with the lowest LAN port number in the forwarding state and blocks other LAN ports.

Correct Answer: D Section: (none) Explanation .19 and all ports are forwarding. C. it has the lowest priority value for VLAN 1. D. The switch priority value is zero. The bridge priority is 1 and all ports are forwarding. B. The bridge priority is 128.Why would the switch be considered as a root bridge? A. The switch priority for VLAN 1 and the macro specifies “This Bridge is the root”.

com/en/US/docs/switches/lan/catalyst2950/software/release/12. interface f0/15 D.Explanation/Reference: Explanation: For priority. which option will be the new root port for VLAN 10? A. interface f0/14 C.cisco. The lower the number. Reference: http://www.1_9_ea1/configuration/guide/swstp. All ports are members of VLAN 10.html#wp1020666 QUESTION 90 Refer to the exhibit. the default is 32768. interface f0/21 . interface f0/13 B. Considering the default cost of upstream bridges to the root bridge is equal. the more likely the switch will be chosen as the root switch. the range is 0 to 61440 in increments of 4096.

this process could take from 30-60 seconds.Blocking – A port that would cause a switching loop. Which Layer 2 enhancement can be used to eliminate this delay? A. Total Path Cost to root .Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Root Port election on each bridge Each (non-Root) bridge has exactly one Root Port. from the direction of Root Bridge) Connected Bridge ID . Configure port duplex and speed to auto negotiation.lowest prevails In this case.lowest prevail– Local Port ID . fa0/21 has the lowest cost. 3. Configure port to duplex full and speed 1000.com/extreme/topics/802_1d_spanning_tree_election_rules QUESTION 91 A network engineer is trying to deploy a PC on a network. Reference: https://community. no user data is sent or received but it may go into forwarding mode if the other links in use were to fail and the spanning tree algorithm determines the port may transition to the forwarding state. it takes 30 to 60 seconds for the PC to see any activity on the network interface card. Configure no switchport. These steps are outlined as follows. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: When first powered on.extremenetworks. which represents the best path to the Root Bridge.lowest prevails Connected Port ID (Port Priority + Port#) . so it will be the root port. C.Learning – While the port does not yet forward frames (packets) it does learn source addresses from frames received and adds them to the filtering . The engineer observes that when the PC is connected to the network. 2.Listening – The switch processes BPDUs and awaits possible new information that would cause it to return to the blocking state. each port goes through 4 states to ensure that there are no physical loops in the layer 2 broadcast domain. B.lowest prevails (local Root Port cost added upon receipt of Configuration – PDUs on that port. 1. D. With the initial version of spanning tree. BPDU data is still received in blocking state. Configure spanning-tree portfast.

and forwarding states should be used. learning. The port goes into root-inconsistent state and stops forwarding traffic. . STP still monitors incoming BPDUs that would indicate it should return to the blocking state to prevent a loop.us/Home/ethernet-and-ip/spanning-tree-protocol QUESTION 92 A network engineer configured an Ethernet switch using these commands. If an interface is enabled for portfast receives BDPU. Reference: http://net. If an interface is enabled for portfast receives BDPU. C. normal operation. learning. the port does not go through the spanning-tree listening. Switchone(config) # Spanning-tree portfast bpdufilter default Which statement about the spanning-tree portfast feature on the switch is true? A. B. C. The port goes into loop-inconsistent state and stops forwarding traffic. then the default action of STP of listening. learning. The port goes into errdisabled state and stops forwarding traffic. the “Spanning-tree portfast bpdufilter default” command specifies that if a BPDU is received on that port. and forwarding states. If an interface is enabled for portfast receives BDPU. B. and forwarding states. D. QUESTION 93 Which statement describes what happens when a port configured with root guard receives a superior BPDU? A.cmed. the port goes through the spanning-tree listening. D.Forwarding – A port receiving and sending data. If an interface is enabled for portfast receives BDPU. database (switching database) 4. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: STP PortFast causes a Layer 2 LAN interface configured as an access port to enter the forwarding state immediately. the port is shut down immediately. However. The port goes into BPDU-inconsistent state and stops forwarding traffic. STP PortFast causes a Layer 2 LAN interface configured as an access port to enter the forwarding state immediately. bypassing the listening and learning states. bypassing the listening and learning states. the port goes into the spanning-tree inconsistent state.

No more than 100 VLANs can be active on a switch configured as a PoA. C.cisco. It is available only on a Cisco Catalyst 6500 Series chassis. No traffic is forIarded across this port. Converting a port channel to mLACP can cause a service disruption. follow these guidelines and restrictions: PFC3A mode does not support the mLACP for server access feature.html . the root guard enforces the position of the root bridge. If the bridge receives superior STP Bridge Protocol Data Units (BPDUs) on a root guard-enabled port. root bridge ports are all designated ports.com/en/US/docs/switches/lan/catalyst6500/ios/12.cisco. In this way. unless two or more ports of the root bridge are connected together. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: When configuring mLACP for Server Access. root guard moves this port to a root-inconsistent STP state.Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: The root guard ensures that the port on which root guard is enabled is the designated port. The DHD system priority must be lower (higher numerically) than the PoA system priority. B. This root-inconsistent state is effectively equal to a listening state.2SX/configuration/guide/mlacp_server_support. mLACP does not support multiple neighbors. Reference: http://www.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00800ae96b. D. It is not available in VSS. mLACP does not support half-duplex links. VSS mode does not support the mLACP for server access feature. It does not support 1Gb links. Normally. Converting a port channel to mLACP can cause a service disruption. Reference: http://www.shtml QUESTION 94 Which statement about restrictions for multichassis LACP is true? A.

The VSS transitions to the dual active recovery mode.cisco. 8 D. 6 C. and only the new active virtual switch continues to forward traffic. Reference: http://www. D.QUESTION 95 What is the maximum number of 10 Gigabit Ethernet connections that can be utilized in an EtherChannel for the virtual switch link? A. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Q. The VSS transitions to the dual active recovery mode. and both virtual switch members continue to forward traffic independently. B. 4 B.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b. C.html QUESTION 96 Which statement describes what happens if all VSL connections between the virtual switch members are lost? A. Both virtual switch members cease to forward traffic. The virtual switch members reload. 12 Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: The VSS is made up of the following: Virtual switch members: Cisco Catalyst 6500 Series Switches (up to two switches with initial release) deployed with the Virtual Switching Supervisor 720 10GE Virtual switch link (VSL): 10 Gigabit Ethernet connections (up to eight using EtherChannel) between the virtual switch members. What happens if all VSL connections between the virtual switch members are lost? .

The switch shuts down and waits for the VSL link to be restored before sending traffic. The new active virtual switch continues to forward traffic on all links. Reference: http://www. The dual active state is detected rapidly (subsecond) by any of the following three methods: Enhancement to PagP used in MEC with connecting Cisco switches L3 Bidirectional Forwarding Detection (BFD) configuration on a directly connected link (besides VSL) between virtual switch members or through an L2 link through an access layer switch L2 Fast-Hello Dual-Active Detection configuration on a directly connected link (besides VSL) between virtual switch members (supported with 12. All interfaces are shut down in the formerly active virtual switch member. all interfaces except the VSL interfaces are in an operationally shut down state in the formerly active virtual switch member. but the new active virtual switch forwards traffic on all links. all interfaces except the VSL interfaces are in an operationally shut down state in the formerly active virtual switch member.cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b. Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: In the dual active recovery mode. If for some rare reason all VSL connections are lost between the virtual switch members leaving both the virtual switch members up. C. Reference: http://www.html QUESTION 97 Which statement describes what happens when a switch enters dual active recovery mode? A. The switch continues to forward traffic out all links and enables spanning tree on VSL link and all other links to prevent loops.cisco. D. The new active virtual switch continues to forward traffic on all links. The VSS detects which system was last in active state and shuts down the other switch. the VSS will transition to the dual active recovery mode. VSLs can be configured with up to eight links between the two switches across any combination of line cards or supervisor ports to provide a high level of redundancy.A.html QUESTION 98 A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping database.2(33) SXI) In the dual active recovery mode. B.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b. What is the solution to avoid the snooping database from being rebuilt after every device reboot? .

2. B. Use IP Source Guard to protect the DHCP binding table entries from being lost upon rebooting. C. A DHCP snooping database agent should be configured. 5. Apply ip dhcp snooping trust on all interfaces with dynamic addresses. Enable DHCP snooping on at least one VLAN. 4.html#wp1090479 QUESTION 99 Which portion of AAA looks at what a user has access to? A.cisco. authorization B.com/en/US/docs/switches/lan/catalyst6500/ios/12. Enable DHCP snooping for all VLANs that are associated with the switch. the trust state of all interfaces is untrusted. Disable Option 82 for DHCP data insertion. D. auditing Correct Answer: A Section: (none) Explanation . E. This step ensures that database entries are restored after a restart or switchover. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Minimum DHCP Snooping Configuration The minimum configuration steps for the DHCP snooping feature are as follows: 1. 3. Configure the DHCP snooping database agent. The feature is not active until you complete this step. By default. Reference: http://www.2SX/configuration/guide/snoodhcp. Ensure that DHCP server is connected through a trusted interface. Define and configure the DHCP server. accounting D.A. Enable DHCP snooping globally. By default. authentication C. DHCP snooping is inactive on all VLANs.

(config)# aaa authentication login default radius local B. the network team is considering enabling dynamic ARP inspection alongside DHCP snooping. you can define AAA authorization with a named list or authorization method. . and reporting.Explanation/Reference: Explanation: AAA consists of the following three elements: Authentication: Identifies users by login and password using challenge and response methodology before the user even gains access to the network. (config)# aaa authentication login default local radius D. you could get a log of when users logged in and when they logged out.techrepublic. Which solution ensures that the server maintains network reachability in the future? A. (config)# aaa authentication login radius local Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: In the command “aaa authentication login login radius local” the second login is the name of the AAA method. so it will primarily use RADIUS for authentication and fail over to the local user database only if the RADIUS server is unreachable. Reference: http://www. which would be specific to the individual user rights. (config)# aaa authentication login login radius local C. You can use accounting to see what users do once they are authenticated and authorized. Authorization: After initial authentication. For more protection against malicious attacks. QUESTION 101 A server with a statically assigned IP address is attached to a switch that is provisioned for DHCP snooping. For example. authorization looks at what that authenticated user has access to do. Accounting: The last "A" is for accounting. auditing. RADIUS or TACACS+ security servers perform authorization for specific privileges by defining attribute-value (AV) pairs. Disable DHCP snooping information option.com/blog/data-center/what-is-aaa-and-how-do-you-configure-it-in-the-cisco-ios/ QUESTION 100 Which command creates a login authentication method named “login” that will primarily use RADIUS and fail over to the local user database? A. with accounting. Depending on your security options. In the Cisco IOS. It provides a way“o” collecting security information that you can use for billing. It also lists radius first then local. it can also support encryption.

Trust the interface that is connected to the server with the ip dhcp snooping trust command. Reference: http://www. Disable VTP and manually assign VLANs.cisco. D. To ensure network reachability to the server. the switch forwards the packet only if it is valid. Dynamic ARP inspection ensures that only valid ARP requests and responses are relayed.B. The switch performs these activities: Intercepts all ARP requests and responses on untrusted ports Verifies that each of these intercepted packets has a valid IP-to-MAC address binding before updating the local ARP cache or before forwarding the packet to the appropriate destination. It intercepts. the DHCP snooping binding database. Configure VTP Transparent Mode.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/guide/scg3750/swdynarp. and discards ARP packets with invalid IP-to-MAC address bindings.html QUESTION 102 A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN. Drops invalid ARP packets Dynamic ARP inspection determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database. If the ARP packet is received on a trusted interface. Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Dynamic ARP inspection is a security feature that validates ARP packets in a network. Enable VTP version 3. configure a static DHCP snooping binding entry on the switch. C. C. On untrusted interfaces. the switch forwards the packet without any checks. Correct Answer: C Section: (none) Explanation . Ensure all switches are configured as VTP server mode. logs. D. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the switch. Configure a static DHCP snooping binding entry on the switch. Verify the source MAC address of all untrusted interfaces with ip dhcp snooping verify mac-address command. B. This capability protects the network from certain man-in-the-middle attacks. Which configuration must be made before the private VLAN is configured? A.

asp?p=29803&seqNum=6 QUESTION 103 DHCP snooping and IP Source Guard have been configured on a switch that connects to several client workstations. The IP address of one of the workstations does not match any entries found in the DHCP binding database.cisco. Private VLANs are configured in the context of a single switch and cannot have members on other switches. When IP source guard is enabled with this option. and its associated VLAN number. The interface that is connected to the workstation in question will be put into the errdisabled state. clients are not receiving an IP address via the DHCP server. Traffic will pass accordingly after the new IP address is populated into the binding database. B. IP Source Guard with the ip verify source port- security command is configured under the interfaces that connect to all DHCP clients on the switch. Which option is the cause of this issue? .ciscopress. Reference: http://www. If there is no match. Packets from the workstation will be rate limited according to the default values set on the switch. When IP source guard is enabled with this option.Explanation/Reference: Explanation: You must configure VTP to transparent mode before you can create a private VLAN. its associated MAC address. You can configure IP source guard with source IP address filtering. IP traffic is filtered based on the source IP address. However. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: The IP source binding table has bindings that are learned by DHCP snooping or are manually configured (static IP source bindings). Which statement describes the outcome of this scenario? A. The switch uses the IP source binding table only wIen IP source guard is enabled. Private VLANs also carry TLVs that are not known to all types of Cisco switches. or with source IP and MAC address filtering.com/articles/article. C. An entry in this table has an IP address. The switch forwards traffic only when the source IP and MAC addresses match an entry in the IP source binding table. The switch forwards IP traffic when the source IP address matches an entry in the DHCP snooping binding database or a binding in the IP source binding table. D. The packets originating from the workstation are assumed to be spoofed and will be discarded. IP traffic is filtered based on the source IP and MAC addresses. Reference: http://www.html#ipsourceguard QUESTION 104 A DHCP configured router is connected directly to a switch that has been provisioned with DHCP snooping. the packets are assumed to be spoofed and will be discarded.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/72846-layer2-secftrs-catl3fixed.

No VLANs exist on the switch and/or the switch is configured in VTP transparent mode. DHCP snooping must be enabled on all VLANs.cisco. The switch is configured for sdm prefer routing as the switched database management template. The configured SVIs on the switch have been removed for the associated interfaces. Which option is the cause of the problem? A. E. even if they are not utilized for dynamic address allocation. The MAC address of the DHCP client is learned as a secure address only when the switch receives non-DHCP data traffic.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-2_25_see/configuration/guide/3550SCG/ swdhcp82. The DHCP client interfaces have storm control configured. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: When you enable both IP Source Guard and Port Security. B. C. B. D. The local DHCP server is disabled prior to enabling IP Source Guard. The DHCP server does not support information option 82. D. using the ip verify source port-security interface configuration command.html#wp1069615 QUESTION 105 A switch is added into the production network to increase port capacity. Layer 2 interfaces by filtering traffic based on the DHCP snooping binding . but is unable to configure ip verify source under several of the interfaces. Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: IP source guard is a security feature that restricts IP traffic on nonrouted. C.A. The interfaces are configured as Layer 3 using the no switchport command. Reference: http://www. The MAC address in the DHCP packet is not learned as a secure address. Static DHCP bindings are not configured on the switch. or the client is not assigned an IP address. A network engineer is configuring the switch for DHCP snooping and IP Source Guard. there are two caveats: The DHCP server must support option 82.

C. its associated MAC address. SNMP traps are sent by default when broadcast traffic reaches 65% of the lower-level threshold. The switchport is disabled when unicast traffic reaches 75% of the total interface bandwidth. A port access control list (ACL) is applied to the interface. B. the switch blocks all IP traffic received on the interface. In which three ways does this command impact the traffic? (Choose three. Reference: http://www. including access and trunk ports.html#wp1069615 QUESTION 106 The command storm-control broadcast level 75 65 is configured under the switch port connected to the corporate mail server. The switch drops broadcasts when they reach 75% of bandwidth. An entry in this table has an IP address. D. and its associated VLAN number.cisco. You can configure IP source guard with source IP address filtering or with source IP and MAC address filtering. IP source guard is supported only on Layer 2 ports.database and on manually configured IP source bindings. You can use IP source guard to prevent traffic attacks caused when a host tries to use the IP address of its neighbor. After IP source guard is enabled on an interface.) A. The switch resumes forwarding broadcasts when they are below 65% of bandwidth. The IP source binding table has bindings that are learned by DHCP snooping or are manually configured (static IP source bindings). F. You can enable IP source guard when DHCP snooping is enabled on an untrusted interface. Correct Answer: CDF Section: (none) Explanation Explanation/Reference: Explanation: . Only broadcast traffic is limited by this particular storm control configuration. The switch uses the IP source binding table only when IP source guard is enabled. Multicast traffic is dropped at 65% and broadcast traffic is dropped at 75% of the total interface bandwidth.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-2_25_see/configuration/guide/3550SCG/ swdhcp82. The port ACL allows only IP traffic with a source IP address in the IP source binding table and denies all other traffic. E. except for DHCP packets allowed by DHCP snooping.

cisco.In this case. the broadcast keyword was used so only broadcast traffic is limited. switch(config)# errdisable recovery cause psecure-violation C. switch(config)# switchport port-security aging type inactivity E. Which command accomplishes this task? A. the network team has been overwhelmed with port reset requests. switch(config)# errdisable recovery interval 180 B. switch(config)# switchport port-security protect D.html QUESTION 107 After port security is deployed throughout an enterprise campus.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-2_25_see/configuration/guide/3550SCG/swtrafc. switch(config)# errdisable recovery cause security-violation Correct Answer: B Section: (none) Explanation Explanation/Reference: . Reference: http://www. They decide to configure the network to automate the process of re-enabling user ports.

switch# show mac address-table address <mac address> Correct Answer: AE Section: (none) Explanation Explanation/Reference: Explanation: These two commands will show the MAC address table.-----------.pdf QUESTION 108 The network monitoring application alerts a network engineer of a client PC that is acting as a rogue DHCP server.Explanation: When a secure port is in the error-disabled state. switch# show ip verify source D. Reference: http://www. switch# show port-security C.---. switch# show mac address-table B.7b00.cisco. including the switch port that the particular host is using. you can bring it out of this state automatically by configuring the errdisable recovery cause psecure-violation global configuration command or you can manually reenable it by entering the shutdown and no shut down interface configuration commands.) A.-------------------- 0010. If a port is in per-VLAN errdisable mode.e289 Dynamic 1 FastEthernet0/1 0010.0de0. This is the default mode. you can also use clear errdisable interface name vlan range command to re-enable the VLAN on the port. You can also customize the time to recover from the specified error disable cause (default is 300 seconds) by entering the errdisable recovery interval interval command. switch# show ip arp inspection E.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/53SG/configuration/config/port_sec. Which two commands help trace this PC when the MAC address is known? (Choose two.1540 Dynamic 2 FastEthernet0/5 . Here is an example output: Switch> show mac-address-table Dynamic Addresses Count: 9 Secure Addresses (User-defined) Count: 0 Static Addresses (User-defined) Count: 0 System Self Addresses Count: 41 Total MAC addresses: 50 Non-static Address Table: Destination Address Address Type VLAN Destination Port ------------------.

storm control B. creating excessive traffic and degrading network performance. or multicast packets. Dynamic ARP Inspection Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Storm control prevents traffic on a LAN from being disrupted by a broadcast.7b00. multicast. unicast. Reference: http://www. aaa new-model B. SDM routing C. mistakes in network configuration.cisco. aaa authorization D.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_22ea/SCG/scg/swtrafc. By default. aaa accounting Correct Answer: A Section: (none) . a network engineer discovered an unusually high level of broadcast traffic coming from one of the switch interfaces.0010. Storm control uses rising and falling thresholds to block and then restore the forwarding of broadcast.1545 Dynamic 2 FastEthernet0/5 QUESTION 109 While troubleshooting a network outage. Storm control is configured for the switch as a whole but operates on a per-port basis. storm control is disabled. Cisco IOS parser D. A LAN storm occurs when packets flood the LAN.html QUESTION 110 Which command globally enables AAA on a device? A. aaa authentication C. You can also set the switch to shut down the port when the rising threshold is reached. Errors in the protocol-stack implementation. or unicast storm on a port. Which option decreases consumption of bandwidth used by broadcast traffic? A. or users issuing a denial-of-service attack can cause a storm. integrated routing and bridging E.

. Network — Applies to network connections. you are defining a particular list of authorization methods for the indicated authorization type. refer to the chapter "Configuring Authentication Proxy" in the "Traffic Filtering“and Firewalls" part of this book” Comma“ds — Applies to the EXEC mode com”ands a user issues. When you create a named method list. network B. SLIP. including global configuration commands. or ARAP connection. or all methods defined are exhausted. EXEC — Applies to the attributes associated with a user EXEC terminal session.Explanation Explanation/Reference: Explanation: To configure AAA authentication. This can include a PPP. Command authorization attempts authorization for all EXEC mode commands. IP mobile C. Cisco IOS software uses the first method listed to authorize users for specific network services. EXEC D. Reverse Access — Applies to reverse Telnet sessions. This process continues until there is successful communication with a listed authorization method. thus ensuring a backup system in case the initial method fails. the Cisco IOS software selects the next method listed in the method list. enable AAA by using the aaa new-model global configuration command. auth-proxy Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Method lists for authorization define the ways that authorization will be performed and the sequence in which these methods will be performed. and ARAP connections? A.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfathen. associated with a specific privilege level. For detailed information on the authentication proxy feature. Method lists enable you to designate one or more security protocols to be used for authorization. if that method fails to respond. Reference: http://www. SLIP. in sequence. AAA features are not available for use until you enable AAA globally by issuing the aaa new-model command. A method list is simply a named list describing the authorization methods to be queried (such as RADIUS or TACACS+).html QUESTION 111 Which AAA Authorization type includes PPP. Method lists are specific to the authorization type requested: Auth-proxy — Applies specific security policies on a per-user basis.

TACACS+ C. RADIUS with CoA D. Because the switch acts as the proxy. Reference: http://www.cisco. RADIUS using VSA Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: With 802. the authentication service is transparent to the client.com/c/en/us/td/docs/switches/lan/catalyst2940/software/release/12-1_19_ea1/configuration/guide/2940scg_1/sw8021x.pdf QUESTION 113 Refer to the exhibit.cisco. . RADIUS with EAP Extension B. The Remote Authentication Dial-In User Service (RADIUS) security system with Extensible Authentication Protocol (EAP) extensions is the only supported authentication server.Reference: http://www.1x.1x? A.html QUESTION 112 Which authentication service is needed to configure 802. the authentication server — performs the actual authentication of the client. The authentication server validates the identity of the client and notifies the switch whether or not the client is authorized to access the LAN and switch services.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfathor.

no username with password linepass D. meaning that credentials are not required and all sessions are allowed access immediately. . none required B.Which login credentials are required when connecting to the console port in this output? A. which lists none as the authentication method. QUESTION 114 Refer to the exhibit. username cisco with password cisco C. None means no authentication. login authentication default Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Here the console has been configured with the NO_AUTH name.

QUESTION 115 Which type of information does the DHCP snooping binding database contain? .” The AAA default login preference is stated in order from first to last. local username. line password. RADIUS server. local username Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: sessions use the vty lines. if that fails use the line password. Finally. Line password. in which order does the device check the login credentials? A. local username C. where the configured authentication method is named “default. RADIUS server. local username. so here the “aaa authentication login default group radius local line” means to use RADIUS first. line password B. Line password. then if that fails use the local user database.When a network administrator is attempting an SSH connection to the device. RADIUS server D. RADIUS server.

A. the switch forwards the packet without any checks. VTP pruning D. trusted hosts with leased IP addresses C. the switch forwards the packet only if it is valid. Utilizes the DHCP snooping binding database to validate subsequent requests from untrusted hosts. If the ARP packet is received on a trusted interface. DHCP snooping Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Dynamic ARP inspection determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database. untrusted hosts with leased IP addresses B. Builds and maintains the DHCP snooping binding database.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp. the DHCP snooping binding database.pdf QUESTION 116 Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a trusted database? A. On untrusted interfaces. which contains information about untrusted hosts with leased IP addresses. untrusted hosts with available IP addresses D. storm control C. Reference: http://www. trusted hosts with available IP addresses Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: DHCP snooping is a security feature that acts like a firewall between untrusted hosts and trusted DHCP servers.cisco. . The DHCP snooping feature performs the following activities: Validates DHCP messages received from untrusted sources and filters out invalid messages. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the switch. Rate-limits DHCP traffic from trusted and untrusted sources. Dynamic ARP Inspection B.

Before globally enabling DHCP snooping on the switch. Reference: http://www. ip dhcp snooping trust B.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/72846-layer2-secftrs-catl3fixed.Reference: http://www. ip dhcp snooping C.html QUESTION 117 Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP server? A. ip dhcp trust D. community port D. promiscuous port B.cisco.cisco. including the community and isolated host ports? A. If a Layer 2 LAN port is connected to a DHCP server. make sure that the devices acting as the DHCP server and the DHCP relay agent are configured and enabled.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp. configure the port as trusted by entering the “ip dhcp snooping trust” interface configuration command. isolated port C. If a Layer 2 LAN port is connected to a DHCP client. ip dhcp snooping information Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: When configuring DHCP snooping. follow these guidelines: DHCP snooping is not active until you enable the feature on at least one VLAN.html QUESTION 118 Which private VLAN access port belongs to the primary VLAN and can communicate with all interfaces. trunk port Correct Answer: A . configure the port as untrusted by entering the no ip dhcp snooping trust interface configuration command. and enable DHCP globally on the switch.

Reference: http://www. The promiscuous port can communicate with all interfaces. Each port is completely isolated from all other ports in the isolated VLAN. Isolated — An isolated port is a host port that belongs to an isolated secondary VLAN. You may want to do this for load-balancing or redundancy purposes. This port has complete isolation from other ports within the same private VLAN domain. Private VLANs block all traffic to isolated ports except traffic from promiscuous ports. promiscuous VLAN Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Understanding Primary. Traffic received from an isolated port is forwarded only to promiscuous ports.Section: (none) Explanation Explanation/Reference: Explanation: The types of private VLAN ports are as follows: Promiscuous — A promiscuous port belongs to the primary VLAN. Community ports communicate with other ports in the same community VLAN and with associated promiscuous ports.cisco. You can associate a secondary VLAN to more than one promiscuous port.html QUESTION 119 Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional traffic upstream from the hosts toward the promiscuous ports and the gateway? A. as long as the promiscuous port and secondary VLANs are within the same primary VLAN. associated to that port. primary VLAN C. You can have several promiscuous ports in a primary VLAN. Isolated. community VLAN D. except that it can communicate with associated promiscuous ports. Each promiscuous port can have several secondary VLANs. You can have more than one isolated port in a specified isolated VLAN. isolated VLAN B. These interfaces are isolated from all other interfaces in other communities and from all isolated ports within the private VLAN domain. and Community Private VLANs .com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/PrivateVLANs. that belong to those secondary VLANs associated to the promiscuous port and associated with the primary VLAN. Community — A community port is a host port that belongs to a community secondary VLAN. You can also have secondary VLANs that are not associated to any promiscuous port. or no secondary VLANs. including the community and isolated host ports.

static ARP database Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Information About Dynamic ARP Inspection DAI is used to validate ARP requests and responses as follows: Intercepts all ARP requests and responses on untrusted ports.Primary VLANs and the two types of secondary VLANs (isolated and community) have these characteristics: Primary VLAN — The primary VLAN carries traffic from the promiscuous ports to the host ports. Drops invalid ARP packets.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/PrivateVLANs. all the traffic remains isolated within each one.cisco. both isolated and community. Reference: http://www.html QUESTION 120 Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC address binding? A. and to other promiscuous ports. dynamic routing database D. Community VLAN — A community VLAN is a secondary VLAN that carries upstream traffic from the community ports to the promiscuous port and to other host ports in the same community. DAI can determine the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a DHCP snooping binding database. Isolated VLAN — An isolated VLAN is a secondary VLAN that carries unidirectional traffic upstream from the hosts toward the promiscuous ports.html QUESTION 121 .cisco. Each isolated VLAN can have several isolated ports. This database is built by DHCP snooping when it is enabled on the VLANs and on the device. Verifies that a packet has a valid IP-to-MAC address binding before updating the ARP cache or forwarding the packet. You can configure multiple community VLANs in a private VLAN domain. and the traffic from each isolated port also remains completely separate. You can configure multiple isolated VLANs in a private VLAN domain. It may also contain static entries that you have created. Reference: http://www. DHCP snooping database B. dynamic ARP database C. The ports within one community can communicate. but these ports cannot communicate with ports in any other community or isolated VLAN in the private VLAN.com/c/en/us/td/docs/switches/datacenter/nexus1000/hyperv/sw/5_2_1_s_m_1_5_2/troubleshooting/configuration/guide/ n1000v_troubleshooting/n1000v_trouble_19dhcp.

spanning-tree portfast D. DHCP snooping B.cisco. VTP pruning D. VLAN trunking Correct Answer: A Section: (none) Explanation . storm control B. this error message appears: Static IP source binding can only be configured on switch port.When IP Source Guard with source IP filtering is enabled on an interface.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/ b_sec_152ex_2960-x_cg_chapter_01110. When IP source guard with source IP filtering is enabled on an interface. the source IP address filter is applied on all the VLANs. which feature must be enabled on the access VLAN for that interface? A. If you are enabling IP source guard on a trunk interface with multiple VLANs and DHCP snooping is enabled on all the VLANs. private VLAN Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: IP Source Guard Configuration Guidelines • You can configure static IP bindings only on nonrouted ports.html QUESTION 122 Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or broadcast traffic? A. You can enable this feature when 802.1x port-based authentication is enabled. Reference: http://www. If you enter the ip source binding mac-address vlan vlan-id ip-address interface interface-id global configuration command on a routed interface. DHCP snooping must be enabled on the access VLAN for that interface. port security C. storm control C.

router(config-if)#storm-control action shutdown B. which creates excessive traffic and degrades network performance. or unicast traffic storm on physical interfaces from either mistakes in network configurations or from users issuing a DoS attack. Reference: http://3c3cc. router(config-if)#storm-control action enable Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Configuring the Traffic Storm Control Shutdown Mode To configure the traffic storm control shutdown mode on an interface. multicast. router(config-if)#storm-control action error D.Explanation/Reference: Explanation: A traffic storm occurs when packets flood the LAN. perform this task: . The traffic storm control feature prevents LAN ports from being disrupted by a broadcast.com/c/en/us/td/docs/routers/7600/ios/122SR/configuration/guide/swcg/dos. router(config-if)#storm-control action trap C.pdf QUESTION 123 Which command would a network engineer apply to error-disable a switchport when a packet-storm is detected? A.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/storm.html

QUESTION 124
A network engineer configures port security and 802.1x on the same interface. Which option describes what this configuration allows?

A. It allows port security to secure the MAC address that 802.1x authenticates.
B. It allows port security to secure the IP address that 802.1x authenticates.
C. It allows 802.1x to secure the MAC address that port security authenticates.
D. It allows 802.1x to secure the IP address that port security authenticates.

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
802.1X and Port Security
You can configure port security and 802.1X on the same interfaces. Port security secures the MAC addresses that 802.1X authenticates. 802.1X processes
packets before port security processes them, so when you enable both on an interface, 802.1X is already preventing inbound traffic on the interface from
unknown MAC addresses.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-cfg/sec_portsec.html

QUESTION 125
Which feature describes MAC addresses that are dynamically learned or manually configured, stored in the address table, and added to the running
configuration?

A. sticky
B. dynamic
C. static
D. secure

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
With port security, you can configure MAC addresses to be sticky. These can be dynamically learned or manually configured, stored in the address table, and
added to the running configuration. If these addresses are saved in the configuration file, the interface does not need to dynamically relearn them when the
switch restarts. Although sticky secure addresses can be manually configured, it is not recommended.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.pdf

QUESTION 126
On which interface can port security be configured?

A. static trunk ports
B. destination port for SPAN
C. EtherChannel port group
D. dynamic access point

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

Explanation:
Port Security and Port Types
You can configure port security only on Layer 2 interfaces. Details about port security and different types of interfaces or ports are as follows:
Access ports — You can configure port security on interfaces that you have configured as Layer 2 access ports. On an access port, port security applies
only to the access VLAN.
Trunk ports — You can configure port security on interfaces that you have configured as Layer 2 trunk ports. VLAN maximums are not useful for access
ports. The device allows VLAN maximums only for VLANs associated with the trunk port.
SPAN ports — You can configure port security on SPAN source ports but not on SPAN destination ports.
Ethernet Port Channels — Port security is not supported on Ethernet port channels.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-cfg/sec_portsec.html

QUESTION 127
When you configure private VLANs on a switch, which port type connects the switch to the gateway router?

A. promiscuous
B. community
C. isolated
D. trunked

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
There are mainly two types of ports in a Private VLAN: Promiscuous port (P-Port) and Host port. Host port further divides in two types – Isolated port (I-Port)
and Community port (C-port).
Promiscuous port (P-Port): The switch port connects to a router, firewall or other common gateway device. This port can communicate with anything else
connected to the primary or any secondary VLAN. In other words, it is a type of a port that is allowed to send and receive frames from any other port on
the VLAN.
Host Ports:
- Isolated Port (I-Port): Connects to the regular host that resides on isolated VLAN. This port communicates only with P-Ports.
- Community Port (C-Port): Connects to the regular host that resides on community VLAN. This port communicates with P-Ports and ports on the
same community VLAN.

Reference: http://en.wikipedia.org/wiki/Private_VLAN

QUESTION 128
When you configure a private VLAN, which type of port must you configure the gateway router port as?

A. promiscuous port
B. isolated port
C. community port
D. access port

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
There are mainly two types of ports in a Private VLAN: Promiscuous port (P-Port) and Host port. Host port further divides in two types – Isolated port (I-Port)
and Community port (C-port).
Promiscuous port (P-Port): The switch port connects to a router, firewall or other common gateway device. This port can communicate with anything else
connected to the primary or any secondary VLAN. In other words, it is a type of a port that is allowed to send and receive frames from any other port on
the VLAN.
Host Ports:
- Isolated Port (I-Port): Connects to the regular host that resides on isolated VLAN. This port communicates only with P-Ports.
- Community Port (C-Port): Connects to the regular host that resides on community VLAN. This port communicates with P-Ports and ports on the same
community VLAN.

Reference: http://en.wikipedia.org/wiki/Private_VLAN

Q32 SIMULATION
SWITCH.com is an IT company that has an existing enterprise network comprised of two layer 2 only switches; DSW1 and ASW1. The topology diagram
indicates their layer 2 mapping. VLAN 20 is a new VLAN that will be used to provide the shipping personnel access to the server. Corporate polices do not
allow layer 3 functionality to be enabled on the switches. For security reasons, it is necessary to restrict access to VLAN 20 in the following manner:
• Users connecting to VLAN 20 via portfO/1 on ASW1 must be authenticated before they are given access to the network. Authentication is to be done via a
Radius server:
• Radius server host: 172.120.40.46
• Radius key: rad123
• Authentication should be implemented as close to the host as possible.
• Devices on VLAN 20 are restricted to the subnet of 172.120.40.0/24.
• Packets from devices in the subnet of 172.120.40.0/24 should be allowed on VLAN 20.
• Packets from devices in any other address range should be dropped on VLAN 20.

• Filtering should be implemented as close to the serverfarm as possible.
The Radius server and application servers will be installed at a future date. You have been tasked with implementing the above access control as a pre-
condition to installing the servers. You must use the available IOS switch features.

Answer: The configuration:
Step1: Console to ASW1 from PC console 1
ASW1(config)#aaa new-model
ASW1(config)#radius-server host 172.120.39.46 key rad123
ASW1(config)#aaa authentication dot1x default group radius
ASW1(config)#dot1x system-auth-control
ASW1(config)#inter fastEthernet 0/1
ASW1(config-if)#switchport mode access
ASW1(config-if)#dot1x port-control auto
ASW1(config-if)#exit
ASW1#copy run start

Step2: Console to DSW1 from PC console 2
DSW1(config)#ip access-list standard 10
DSW1(config-ext-nacl)#permit 172.120.40.0 0.0.0.255
DSW1(config-ext-nacl)#exit
DSW1(config)#vlan access-map PASS 10

DSW1(config-access-map)#match ip address 10
DSW1(config-access-map)#action forward
DSW1(config-access-map)#exit
DSW1(config)#vlan access-map PASS 20
DSW1(config-access-map)#action drop
DSW1(config-access-map)#exit
DSW1(config)#vlan filter PASS vlan-list 20
DSW1#copy run start

QUESTION 129
Which configuration command ties the router hot standby priority to the availability of its interfaces?

A. standby group
B. standby priority
C. backup interface
D. standby track

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The standby track interface configuration command ties the router hot standby priority to the availability of its interfaces and is useful for tracking interfaces
that are not configured for HSRP. When a tracked interface fails, the hot standby priority on the device on which tracking has been configured decreases by
10. If an interface is not tracked, its state changes do not affect the hot standby priority of the configured device. For each interface configured for hot
standby, you can configure a separate list of interfaces to be tracked.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/configuration/guide/swhsrp.html

QUESTION 130
What is the default HSRP priority?

A. 50
B. 100
C. 120
D. 1024

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/configuration/guide/swhsrp.html#wp1044327

QUESTION 131
Which option is a benefit of using VSS?

A. reduces cost
B. simplifies configuration
C. provides two independent supervisors with two different control planes
D. removes the need for a First Hop Redundancy Protocol

Correct Answer: D

Section: (none)
Explanation

Explanation/Reference:
Explanation: First Hop Redundancy Protocols (FHRPs) such as VRRP and HSRP were designed to allow for a highly available first IP route hop for host
systems. FHRPs allow two (or more) distinct routers to share a common IP address providing a redundant Layer-3 default gateway for end nodes. The VSS
system creates a single logical router at Layer 3. This VSS routing instance fulfills this first-hop role without the need for a dedicated protocol. The VSS IP
route is highly available due to MEC and the resiliency of the VSS system. VSS eliminates the need for FHRP at the aggregation layer of the data center.

Reference: http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/vssdc_integrate.html

QUESTION 132
Which First Hop Redundancy Protocol is an IEEE Standard?

A. GLBP
B. HSRP
C. VRRP
D. OSPF

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
A comparison of the three First Hop Redundancy Protocols are listed below:

Reference: http://cciethebeginning.wordpress.com/2008/08/23/router-high-availability-protocol-comparison-2/

QUESTION 133
What is the default amount by which the hot standby priority for the router is decremented or incremented when the interface goes down or comes back up?

A. 1
B. 5
C. 10
D. 15

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The standby track interface configuration command ties the router hot standby priority to the availability of its interfaces and is useful for tracking interfaces
that are not configured for HSRP. When a tracked interface fails, the hot standby priority on the device on which tracking has been configured
decreases by 10. If an interface is not tracked, its state changes do not affect the hot standby priority of the configured device. For each interface configured
for hot standby, you can configure a separate list of interfaces to be tracked.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/configuration/guide/swhsrp.html

QUESTION 134
What is the maximum number of virtual MAC addresses that GLBP allows per group?

A. 2
B. 4
C. 6
D. 8

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

Explanation:
GLBP Virtual MAC Address Assignment
A GLBP group allows up to four virtual MAC addresses per group. The AVG is responsible for assigning the virtual MAC addresses to each member of the
group. Other group members request a virtual MAC address after they discover the AVG through hello messages. Gateways are assigned the next MAC
address in sequence. A virtual forwarder that is assigned a virtual MAC address by the AVG is known as a primary virtual forwarder. Other members of the
GLBP group learn the virtual MAC addresses from hello messages. A virtual forwarder that has learned the virtual MAC address is referred to as a secondary
virtual forwarder.

Reference: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html#wp1039651

QUESTION 135
Which gateway role is responsible for answering ARP requests for the virtual IP address in GLBP?

A. active virtual forwarder
B. active virtual router
C. active virtual gateway
D. designated router

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
GLBP Active Virtual Gateway
Members of a GLBP group elect one gateway to be the active virtual gateway (AVG) for that group. Other group members provide backup for the AVG in the
event that the AVG becomes unavailable. The AVG assigns a virtual MAC address to each member of the GLBP group. Each gateway assumes
responsibility for forwarding packets sent to the virtual MAC address assigned to it by the AVG. These gateways are known as active virtual forwarders
(AVFs) for their virtual MAC address.
The AVG is responsible for answering Address Resolution Protocol (ARP) requests for the virtual IP address. Load sharing is achieved by the AVG
replying to the ARP requests with different virtual MAC addresses.

Reference: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html

QUESTION 136
Which VRRP router is responsible for forwarding packets that are sent to the IP addresses of the virtual router?

A. virtual router master

B. virtual router backup
C. virtual router active
D. virtual router standby

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
VRRP Definitions

VRRP Router A router running the Virtual Router Redundancy
Protocol. It may participate in one or more
virtual routers.

Virtual Router An abstract object managed by VRRP that acts
as a default router for hosts on a shared LAN.
It consists of a Virtual Router Identifier and
a set of associated IP address(es) across a
common LAN. A VRRP Router may backup one or
more virtual routers.

IP Address Owner The VRRP router that has the virtual router's
IP address(es) as real interface address(es’.
This is the router that, when up, will respond
to packets addressed to one of these IP
addresses for ICMP pings, TCP connections,
etc.

Primary IP Address An IP address selected from the set of real
interface addresses. One possible selection
algorithm is to always select the first
address. VRRP advertisements are always sent
using the primary IP address as the source of
the IP packet.

Virtual Router Master The VRRP router that is assuming the
responsibility of forwarding packets sent to
the IP address(es) associated with the virtual

router, and answering ARP requests for these
IP addresses. Note that if the IP address
owner is available, then it will always become
the Master.

Reference: http://www.ietf.org/rfc/rfc3768.txt

QUESTION 137
Which command correctly configures standby tracking for group 1 using the default decrement priority value?

A. standby 1 track 100
B. standby 1 track 100 decrement 1
C. standby 1 track 100 decrement 5
D. standby 1 track 100 decrement 20

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The default decrement value for HSRP standby tracking is 10. There is no need to explicitly state the value if the desired value is the default value.

QUESTION 138
Which command configures an HSRP group to become a slave of another HSRP group?

A. standby slave
B. standby group track
C. standby follow
D. standby group backup

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Perform this task to configure multiple HSRP client groups.
The “standby follow” command configures an HSRP group to become a slave of another HSRP group.
HSRP client groups follow the master HSRP with a slight, random delay so that all client groups do not change at the same time.

Reference: http://www.cisco.com/en/US/docs/ios-xml/ios/ipapp_fhrp/configuration/15-mt/fhp-hsrp-mgo.html

QUESTION 139
Refer to the exhibit.

Which option describes the reason for this message in a GLBP configuration?

A. Unavailable GLBP active forwarder
B. Incorrect GLBP IP address
C. HSRP configured on same interface as GLBP
D. Layer 2 loop

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
This section provides information you can use to troubleshoot your configuration.

%GLBP-4-DUPADDR: Duplicate address

The error message indicates a possible layer2 loop and STP configuration issues.
In order to resolve this issue, issue the show interface command to verify the MAC address of the interface. If the MAC address of the interface is the same
as the one reported in the error message, then it indicates that this router is receiving its own hello packets sent. Verify the spanning-tree topology and check
if there is any layer2 loop. If the interface MAC address is different from the one reported in the error message, then some other device with a MAC address
reports this error message.
Note: GLBP members communicate between each other through hello messages sent every 3 seconds to the multicast address 224.0.0.102 and User
Datagram Protocol (UDP) port 3222 (source and destination). When configuring the multicast boundary command, permit the Multicast address by permit
224.0.0.0 15.255.255.255.

Reference: http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a00807d2520.shtml#dr

QUESTION 140
Refer to the exhibit.

When troubleshooting a network problem, a network analyzer is connected to Port f0/1 of a LAN switch. Which command can prevent BPDU transmission on
this port?

A. spanning-tree portfast bpduguard enable
B. spanning-tree bpduguard default
C. spanning-tree portfast bpdufilter default
D. no spanning-tree link-type shared

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 141
Which four LACP components are used to determine which hot-standby links become active after an interface failure within an EtherChannel bundle?
(Choose four.)

A. LACP system priority
B. LACP port priority
C. interface MAC address
D. system ID

traffic is not being replicated to the remote switch. B. D. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 143 After UDLD is implemented. UDLD timers are inconsistent. UDLD is enabled globally. B. however. port number F.E. UDLD port is configured in aggressive mode. . interface bandwidth Correct Answer: ABDE Section: (none) Explanation Explanation/Reference: QUESTION 142 RSPAN has been configured on a Cisco Catalyst switch. D. The local RSPAN switch is replicating only Rx traffic to the remote switch. Which type of misconfiguration is a cause? A. The local and remote RSPAN switches are configured using different session IDs. C. This port continues to reestablish until after eight failed retries. C. The port then transitions into the errdisable state. The RSPAN designated VLAN is missing the remote span command. a Network Administrator noticed that one port stops receiving UDLD packets. hot-standby link identification number G. The local switch is overloaded with the amount of sourced traffic that must be replicated to the remote switch. Which option describes what causes the port to go into the errdisable state? A. Normal UDLD operations that prevent traffic loops.

Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 144 To follow the Layer 2 switching guidelines. BPDUdisable Correct Answer: B Section: (none) . BPDUignore D. The engineer does not want this switch participating in Spanning Tree with the rest of the network. a network engineer decides to create a separate spanning tree for every group of 10 VLANs. however. STP Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 145 A network engineer is installing a switch for temporary workers to connect to. RPVST+ E. RSTP D. MST B. BPDUblock B. Which spanning-tree feature accomplishes this? A. PVST+ C. Which version of spanning tree is appropriate to meet the company policy? A. end user connectivity is still required. BPDUfilter C. BPDUguard E.

Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 147 When SDM templates are configured. D. reload B. What is the result of the SPAN configuration on a Cisco switch? A. Configure a SPAN session to monitor the received traffic on interface g0/4 only for VLAN 3. Configure a SPAN session to monitor the received traffic on interface g0/5 for all VLANs except VLAN 3. write memory D. backup config Correct Answer: A . which action must be performed for the configuration to take effect? A. shutdown C. Configure a SPAN session to monitor the received traffic on interface g0/4 for all VLANs except VLAN 3. C.Explanation Explanation/Reference: QUESTION 146 Refer to the exhibit. Configure a SPAN session to monitor the received traffic on interface g0/5 only for VLAN 3. B.

B. A sticky MAC address ages out of the MAC address table after 600 seconds.Section: (none) Explanation Explanation/Reference: QUESTION 148 Which statement about the MAC address sticky entries in the switch when the copy run start command is entered is true? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 149 Enablement of which feature puts the port into err-disabled state when the port has PortFast enabled and it receives BPDUs? A. D. BackboneFast C. BPDU filtering B. A sticky MAC address can be a unicast or multicast address. A sticky MAC address is lost when the switch reboots. A sticky MAC address is retained when the switch reboots. EtherChannel D. C. BPDU guard Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 150 .

Refer to the exhibit. Which configuration ensures that the Cisco Discovery Protocol packet update frequency sent from DSW1 to ALS1 is half of the default value? A. DSW1(config-if)#cdp holdtime 60 C. DSW1(config)#cdp timer 30 D. DSW1(config)#cdp timer 90 B. DSW1(config)#cdp holdtime 90 E. DSW1(config-if)#cdp holdtime 30 F. DSW1(config-if)#cdp timer 60 Correct Answer: C .

QoS D. PortFast C. They go down. but they are reassigned to the native VLAN. and then the VLAN is deleted.1Q trunking B. They go down until they are reassigned to a VLAN. 802. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 152 Which feature is automatically configured when an administrator enables a voice VLAN? A. They remain up. Which state are these interfaces in after the VLAN is deleted? A. private VLANs Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 153 . but they are reassigned to the default VLAN. B.Section: (none) Explanation Explanation/Reference: QUESTION 151 Interfaces are assigned to a VLAN. They remain up. D. but they are reassigned to the default VLAN. C.

active B.Which statement describes one major issue that VTP can cause in an enterprise network when a new switch is introduced in the network in VTP mode server? A. version 3 D. auto . Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 155 An engineer is configuring an EtherChannel between two switches using LACP. VTP does not recognize extended VLANs. Which version of VTP supports these extended VLANs? A. If the EtherChannel mode on switch 1 is configured to active. D. version 2 C. which two modes on switch 2 establish an operational EtherChannel? (Choose two. It can cause a network-wide VLAN configuration change if the revision number on the new switch is higher. B.) A. C. It can cause network access ports to go into err-disabled state. It can cause routing loops. version 1 B. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 154 A network administrator configures 10 extended VLANs ranging from VLANs 3051 to 3060 in an enterprise network. It can cause a network-wide VLAN configuration change if the revision number on the new switch is lower.

B. desirable D. which statement about placement of the IP address is true? A. source MAC address and source IP address B. D. source MAC address and destination IP address D. on E. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 157 Which option is valid for EtherChannel load balancing? A. The IP address is assigned via DHCP only. The IP address is placed on the lowest numbered member port. The IP address is placed on the port-channel logical interface. source MAC address and destination MAC address Correct Answer: D Section: (none) . destination MAC address and destination IP address C. The IP address is placed on the highest numbered member port.C. passive Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 156 When a Layer 2 EtherChannel is configured. C.

which option describes . An engineer is configuring EtherChannel between two switches and notices the console message on switch 2.Explanation Explanation/Reference: QUESTION 158 Refer to the exhibit. Based on the output.

D.the reason for this error? A. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 159 Refer to the exhibit. C. Switch 1 does not have enough member ports configured. The port channel interface numbers do not match. Switch 2 has too many member ports configured. The EtherChannel protocols do not match. B. .

B. D. Which statement is true? A. revision number. Configure DSW1 with the same region name. C. and VLAN-to-instance mapping as shown on DSW2. DSW1 automatically inherits MST configuration from DSW2 because they have the same domain name. Configure DSW1 with the same version number. therefore. DSW2 uses the VTP server mode to automatically propagate the MST configuration to DSW1. Correct Answer: D . DSW1 is in VTP client mode with a lower configuration revision number. it automatically inherits MST configuration from DW2. and VLAN-to-instance mapping as shown on DSW2.DSW1 should share the same MST region with switch DSW2. E.

The source port can be monitored in multiple SPAN sessions. D. 16 Gbps B. 64 Gbps D. The destination port does not participate in STP. The destination port can be destination in multiple SPAN sessions. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 161 In a switch stack environment. what is the total bidirectional traffic flow between two logical counter-rotating paths? A. C.Section: (none) Explanation Explanation/Reference: QUESTION 160 Which two statements about SPAN source and destination ports during an active session are true? (Choose two. The source port can be only an Ethernet physical port.) A. 32 Gbps C. E. B. You can mix individual source ports and source VLANs within a single session. 128 Gbps Correct Answer: B Section: (none) Explanation Explanation/Reference: .

RSPAN session 1 is incompletely configured for monitoring. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 163 . RSPAN session 1 monitors activity on VLAN 50 of a remote switch. SPAN session 2 only monitors egress traffic exiting port FastEthernet 0/14. B. SPAN session 2 monitors all traffic entering and exiting port FastEthernet 0/15.QUESTION 162 Refer to the exhibit. D. C. Which statement about the SPAN and RSPAN configuration on SW1 is true? A.

5000 bindings D. Layer 1 B. DHCP snooping database C. 1000 bindings B. spanning trees D. routing information Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 164 Which option is the minimum number of bindings that the DHCP snooping database can store? A.Which information does the subordinate switch in a switch stack keep for all the VLANs that are configured on it? A. 2000 bindings C. Layer 3 D. Layer 2 C. Layer 7 . 8000 bindings Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 165 On which layer does IP source guard provide filtering to prevent a malicious host from impersonating the IP address of a legitimate host? A. VLAN database B.

what is the state of port security on a switch? A. and VRRP are true? (Choose two. B. HSRP is the preferred protocol to be used on multivendor environments. D. one standby router. Correct Answer: CD Section: (none) Explanation Explanation/Reference: . learning Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 167 Which two statements about HSRP. VRRP has one master router. GLBP allows for a maximum of four MAC addresses per group. E. and many listening routers. C. off D. HSRP supports up to 255 groups on the same switch or router. GLBP.Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 166 By default.) A. on C. disabled B. VRRP is a Cisco proprietary protocol.

Which option is the most likely explanation of the duplicate address message logged? A. a hardware problem Correct Answer: B Section: (none) Explanation Explanation/Reference: . HSRP misconfiguration C. spanning-tree loop B.1.10. a PC with IP of 10.QUESTION 168 Refer to the exhibit.1 D.

such as CDP and VTP. The native VLAN is not present on the trunk. The standard configuration is used for each uplink. What is wrong with the configuration? A. A network engineer changes the default native VLAN to VLAN 999. The switchport mode trunk command should be first in the output. The interface is administratively down. The encapsulation type is incorrect.) A. is no longer working. After applying the settings on the uplinks to the core switches. . C. B. the switch control traffic.QUESTION 169 Refer to the exhibit. The control traffic must be manually enabled on the new native VLAN. Spanning tree determines the priority of the current root for VLAN 50 and reduces the priority of the local switch to a lower value. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 170 Which two options are two results of using the command spanning-tree vlan 50 root primary within a spanning-tree network under global configuration? (Choose two. D. E.

adjust STP priority to the maximum value B. The switchport that is configured for VLAN 50 is the primary connection to the spanning-tree root switch. Which action accomplishes this task? A. C. C. E. A network engineer notices that there are issues with the physical cabling of the current root port.B. D. Apply a BPDU filter on the primary interface of the remote switches. The engineer decides to force the secondary link to be the desired forwarding root port. Adjust the secondary link to have a lower priority than the primary link. The spanning-tree timers are reduced to improve the convergence time for VLAN 50. All ports that are configured on the current switch with VLAN 50 transition to designated ports. Change the link-type to point-to-point. D. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 171 An access switch at a remote location is connected to the spanning-tree root with redundant uplinks. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 172 A network engineer wants to make sure that an access switch will never become a Spanning Tree root for VLAN 5. disable STP globally C. The priority value for VLAN 50 is set to 4094 on the root while the local switch priority is set to 32768. B. apply root guard to all outgoing neighbor interfaces . Enable Rapid Spanning Tree to converge using the secondary link. What action will accomplish this task? A.

Standby HSRP router becomes active if it has higher priority than current active router E.D. Unless specifically configured. Correct Answer: BE Section: (none) Explanation . VRRP backup router becomes the master router if its priority is higher than the priority of the current master router. Another Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 174 Which two statements about default FHRP behavior are true? (Choose two) A. A back up GLBP active virtual gateway can become active only in the current active router fails C. Master switch C. All switches in stack B. the priority of an HSRP router is 200 D. Pre-emption is enabled by default B. Flash memory D. enable MSTP and use a different revision number than all other switches Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 173 In a switch stack where is the SDM template stored? A.

and VRRP is true? A. MAC address 0000.18 C.0. VRRP group communicate using multicast address 224.0.102 D.0.Explanation/Reference: QUESTION 175 Which statement about HSRP. B.0. It is an access port configured for a phone and PC B. GLBP uses UDP port 3222 (source an destination) for hello messages. HSRP group members communicate using multicast 224. GLBP. It is a trunk port and native VLAN is VLAN 700 D. It is an access port in VLAN 700 Correct Answer: B .ac0c indicates that default gateway redundancy is provided through GLBP Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 176 Which statement about the current configuration on port GigabitEthernet 2/0/1 is true? A.0c07. It is a trunk port and the native VLAN is VLAN 1 C.

Port security must be disabled on all access ports D. Which statement the status of the EtherChannel is true? . Port security sticky is disabled on the new network switch port C. A network administrator moves a PC from one office desk to another. Port security sticky is still enabled on the older network switch port Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 178 Refer to the exhibit. but the port keeps going back into err-disabled mode. Port security is still enable on the older network switch port E. Which two factors are possible causes of this issue? (Choose two) A. After the PC is moved the network administrator clears the port security on the network switch port connection to the PC. Port security sticky exists on the new network switch port B. An engineer has run the show etherchannel summary command the output is displayed.Section: (none) Explanation Explanation/Reference: QUESTION 177 An enterprise network has port security sticky enabled on all access ports.

The trunk ports is put in err-disable state. Untagged frames are forward via the native vlan Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 180 When a Cisco Catalyst switch that is configured in VTP server mode is first booted. The first 1005 VLANs in the startup-config file .A. The EtherChannel is operational and is using no etherchannel protocol Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 179 A switch has been configured with the VLAN dot1q tag native command. which two VLAN ranges are loaded on the switch? (Choose two) A. The EtherChannel is down because of a mismatched EtherChannel protocol C. Untagged frames are forwarded via the default VLAN B. All VLANs are in the VLAN database B. VLANs greater than 1005 in the startup config file C. It drops the untagged frames C. The EtherChannel is down and configured for LACP D. The EtherChannel is operational and configured for PAGP B. Which statement describes what the switch does with untagged frames when it receives on a trunked interface? A. The first 1005 VLANs in the VLAN database file D. D.

It stores the VTP domain password securely in as SHA-1 hash B. Redirect traffic D.E. (Choose two) A. It supports the use of AES to encrypt VTP messaging E. which two actions can be configured to occur. It adds an FCS field at the end of each VTP frame for consistency checking C. VLANs greater than 1005 in the VLAN database Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 181 Which two options are advantages of deploying VTPv3? (Choose two) A. Notify admin C. It supports the propagation of private VLANs D. It can be configured to allow only one VTP server to make changes to the VTP domain Correct Answer: CE Section: (none) Explanation Explanation/Reference: QUESTION 182 If storm control is enabled on a port and the traffic reaches the configure level. Shut down Correct Answer: AE Section: (none) . Log E. Trap B.

Version 1 B. Which version of VTP supports the use of private VLANs? A. a service provider configures various private VLANS in its backbone network infrastructure to prevent communicating to each other. Version 3 D. Interface Gi5/1 is using a Cisco proprietary trunking protocol B. VTP does not support private VLANs Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 184 Refer to the exhibit. Which two statements about SW1 are true? (Choose two) A. Version 2 C.Explanation Explanation/Reference: QUESTION 183 To provide security. On interface Gi5/1. all untagged traffic is tagged with VLAN 113 .

Spanning-tree mstp 1 priority 0 B. Spanning -tree mst vlan 10. Interface Gi5/1 is using an industry standard trunking protocol E. The device is configured is configured with the default MST region D. Interface Gi6/2 is the root port for VLAN 36 F.20 priority root . Which two commands ensure that DSW1 becomes root bridge for VLAN 10 and 20? (Choose two) A. Spanning-tree mst 1 root primary C.C. On interface Gi6/2 all untagged traffic is tagged with VLAN 600 Correct Answer: DF Section: (none) Explanation Explanation/Reference: QUESTION 185 Refer to the exhibit.

Spanning tree cost C.D. Trunk mode E. Trunk allow vlan (allowed VLANs on the trunk) Correct Answer: DE Section: (none) Explanation Explanation/Reference: QUESTION 187 Refer to exhibit. Spanning-tree mst 1 priority 1 F.20 root primary Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 186 What condition was matched during a EtherChannel configuration? (Choose two. which two statements correctly indicate when an SNMP trap is set to the switch? (Choose two) . Spanning tree mstp vlan 10. Spanning-tree mst 1 priority 4096 E.) (Which two conditions should match during EtherChannel configuration?) A. Interface description D. Spanning tree port priority B.

When the phone previously on Fa0/2 is now connect to Fa0/5 Correct Answer: CE Section: (none) Explanation Explanation/Reference: QUESTION 188 Refer to the exhibit.A. based on the output what is the problem? A. He notices the error message on the switch 2 (error message channel-misconfiguring error). When 61 percent of the address table capacity is used D. the EtherChannel interface of switch 2 is not configured Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 189 Which statement is true about RSTP topology changes? A. Any change in the state of the port generates a TC BDPU B. If either an edge port or a non-edge port move to a block state. When 61 MAC address are in the switch C. the EtherChannel on the switch 1 using incorrect member port B. the EtherChannel protocol on switch 1 is not correct D. then a TC BDPU is generated . an engineer is configuring an EtherChannel between two switches. the EtherChannel interface of switch 1 is not configured C. Only non-edge ports moving to the forwarding state generate a TC BDPU C. When a new workstation connects to port F0/1 B. When the switch loses power and reboots E.

B.D. which three statements about HSRP are true? (Choose three) . Enable VTP pruning on any client switch in the domain. D. Disable VTP pruning on a VTP server in the management domain. Enable VTP pruning on any switch in the management domain. Any loss of connectivity generates a TC BDPU Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 190 What action should a network administrator take to enable VTP pruning on an entire management domain? A. Only edge ports moving to the blocking state generate a TC BPDU E. Enable VTP pruning on a VTP server in the management domain. Based on the debug output. Enable VTP pruning on every switch in the domain. C. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 191 Refer to the exhibit. E.

11. B. The final active router is the router with IP address 172. Otherwise. The router with IP address 172.11. Routing may be performed at all layers but is most commonly done at the core and distribution layers.11.16.115 is the virtual HSRP IP address E. Routing should not be performed between VLANs located on separate switches. The router with IP address 172.A. Correct Answer: ABD Section: (none) Explanation Explanation/Reference: QUESTION 192 Which two statements are true about recommended practices that are to be used in a local VLAN solution design where Layer 2 traffic is to be kept to a minimum? (Choose two) A.111 has preempt configured C.11. Correct Answer: BD Section: (none) . routing should occur at the distribution layer.11.112 is using default HSRP priority.11. D.11.16. VLANs should be local to a switch E. Routing should occur at the access layer if voice VLANs is utilized.16.16.16. The IP address 172.111 B.111 D.112 is preferred over the router with IP address 172.112 has non-preempt configured F. The router with IP address 172.16.16. The priority of the router with IP address 172. C. VLANs should be localized to a single switch unless voice VLANs are being utilized.

Explanation Explanation/Reference: QUESTION 193 What is the effect of configuring the following command on a switch? Switch(config)# spanning-tree portfast bdpufilter default A. The command enables BPDU filtering on all ports regardless of whether they are configured for BPDU filtering at the interface level. then PortFast is disabled and the BPDUs are processed normally. If BPDUs are received by a port configured for PortFast. If BPDUs are received by a port configured for PortFast. C. client C. D. when a switch is configured to use VTP versions 1 or 2? A. they are ignored and none are sent. server D. If BPDUs are received by a port configured for PortFast. B. the port transitions to the forwarding state. transparent B. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 194 Which VTP mode is needed to configure an extended VLAN. Correct Answer: A Section: (none) Explanation Explanation/Reference: . Extended VLANs are only supported in version 3 and not in versions 1 or 2.

The time spent in the learning state will be 15 seconds. which two statements about the STP process for VLAN 200 are true? (Choose two. F. BPDUs will be sent out every two seconds. E. BPDUs will be sent out every 10 seconds. B. D. The maximum length of time that the BPDU information will be saved is 30 seconds. The time spent in the listening state will be 30 seconds. This switch is the root bridge for VLAN 200. Correct Answer: BF Section: (none) Explanation Explanation/Reference: .QUESTION 195 Based on the show spanning-tree vlan 200 output shown in the exhibit. C.) A.

The packet is encapsulated with a 26 byte header and a 4 byte FCS C.) A.1Q frame retains the original MAC destination address Correct Answer: ADF Section: (none) Explanation Explanation/Reference: QUESTION 197 Which of the following HSRP router states does an active router enter when it is pre-empted by a higher priority router? (Select the best answer. speak C. The protocol uses point-to-multipoint connectivity D. listen E. The IEEE 802.1Q frame uses multicast destination of 0x01-00-0c-00-00 F.1Q standard? (Choose three.QUESTION 196 Which three statements are correct with regard to the IEEE 802. active B. standby Correct Answer: B Section: (none) Explanation Explanation/Reference: First we should review all the HSRP States: .1Q frame format adds a 4 byte field to a Ethernet frame B. The IEEE 802. init F. The IEEE 802.) A. learn D. The protocol uses point-to-point connectivity E.

Now router A will fall back to the speak state to compete for active or standby state -> it becomes standby router because its priority is now lower than that of router A. it continues sending out periodic hello messages. After learning no one take the active or standby state.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a91. In this state. packet will go to default VLAN .0. But if at some time it receives a message from the active router that has a lower priority than its priority (because the administrator change the priority in either router).shtml QUESTION 198 What happens if you apply this command “vlan dot1q tag native” ? A. Now it starts sending hello messages containing its priority.0. Now router B is turned on. router B goes into speak state to announce its priority to all HSRP members and compete for the active state. it determines to take part in the election by moving to speak state. These messages are sent to the multicast address 224. Note: Suppose router A is in active state while router B is in standby state. It also goes through initial and listen state. Then it moves to listen state in which it tries to hear if there are already active or standby routers for this group. Reference: http://www. In listen state. Suppose there are 2 routers A and B in the network. router A is turned on first. If router B does not hear hello messages from router A within the holdtime.Now let’s take an example of a router passing through these states. Now to our main question! We want router B to become active router so we set a higher priority number than the priority of A and ask router B to take over the role of active router (with the preempt command). When it does not hear a hello message with a higher priority it assumes the role of active router and moves to active state. This is called a coup hello message. (Therefore answer B is correct). packet will be dropped B. it can take over the active role by sending out a hello packet with parameters indicating it wants to take over the active router. It enters the initial state. it learns that router A has been already the active router and no other router is taking standby role so it enters speak state to compete for the standby router -> it promotes itself as standby router.2 (which can be heard by all members in that group).cisco.

That interfaces Fa0/13 and Fa0/14 have a domain mismatch with another switch E.C. ??? Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 199 Refer to the exhibit. That interfaces Fa0/13 and Fa0/14 are down C. packet will go to native VLAN D. Based upon the output of show vlan on switch CAT2. what can we conclude about interfaces Fa0/13 and Fa0/14? A. That interfaces Fa0/13 and Fa0/14 are in VLAN 1 B. That interfaces Fa0/13 and Fa0/14 have a duplex mismatch with another switch . That interfaces Fa0/13 and Fa0/14 are trunk interfaces D.

0002. Which of the following actions are taken in a VLAN map that does not contain a match clause? A. The port will shut down. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 201 Given the configuration on a switch interface. The host will be refused access. Implicit forward feature at start of list. C. The host will be allowed to connect. . Implicit deny feature at start of list C. what happens when a host with the MAC address of 0003. Implicit deny feature at end of list B. B. The host can only connect through a hub/switch where 0002.0003. Implicit forward feature at end of list D.Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 200 VLAN maps have been configured on switch R1. D.0003 is directly connected to the switch port? A.0002 is already connected.

Switch 15 is configured as the root switch for VLAN 10 but not for VLAN 20. C.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 202 Refer to the exhibit. If the STP configuration is correct. All ports will be in forwarding mode. . All ports in VLAN 10 will be in forwarding mode and all ports in VLAN 20 will be in blocking mode. what will be true about Switch 15? A. All ports in VLAN 10 will be in forwarding mode. B.

All ports in VLAN 10 will be in forwarding mode and all ports in VLAN 20 will be in standby mode. F. B. They have been configured with the spanning-tree guard loop command. They have been configured with the spanning-tree bpduguard enable command. They have been configured with the spanning-tree guard root command. On the basis of the output of the show spanning-tree inconsistentports command. C. They have been configured with the spanning-tree bpdufilter disable command. They have been configured with the spanning-tree bpdufilter enable command.D. Correct Answer: F Section: (none) Explanation Explanation/Reference: . D. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 203 Refer to the exhibit. E. which statement about interfaces FastEthernet 0/1 and FastEthernet 0/2 is true? A. They have been configured with the spanning-tree bpduguard disable command.

switchport mode trunk B. switchport trunk native vlan 5 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 205 You administer a network that uses two routers. Router R1 is the active router and has been configured as follows: .QUESTION 204 You want to configure a switched intemetwork with multiple VLANs as shown above. R1 and R2. Which of the following commands should you issue on SwitchA for the port connected to SwitchB? (Select the best answer) A. switchport mode access vlan 5 D. configured as an HSRP group to provide redundancy for the gateway. switchport access vlan 5 C.

D. except the native VLAN. Correct Answer: E Section: (none) Explanation Explanation/Reference: . Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 206 Which statement is correct about 802. B.1Q trunking? A. In 802. The native VLAN on both ends of the trunk must be VLAN 1. The encapsulation type of both ends of the trunk does not have to match. all VLAN packets are tagged on the trunk link.Which of the following describes the effect the "standby preempt delay minimum 50" command will have on router R1? (Select the best answer.) A.1Q trunking can only be configured on a Layer 2 port. Router R1 will wait 50 seconds before attempting to preempt the active router.1Q trunking. C. B. 802. E. D. The HSRP priority for router R1 will decrease to 50 points when Fa0/2 goes down. C. Router R1 will become the standby router if the priority drops below 50. Both switches must be in the same VTP domain. The HSRP priority for router R1 will increase to 200.

The HSRP MAC address will be 0000. The HSRP MAC address will be 0000. Which statement is true about this command? A.ad01. Switch(config-if)#spanning-tree guard root B. E.QUESTION 207 Which of the following commands can be issued without interfering with the operation of loop guard? A. Switch(config-if)#switchport mode trunk D. Switch(config-if)#spanning-tree portfast C.0c07. This command will not work because the HSRP group information is missing.070c.0c07. The HSRP MAC address will be 0000. D. B. This command will not work because the active parameter is missing Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 209 .ac01. C.ac00. Switch(config-if)#switchport mode access Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 208 The following command was issued on a router that is being configured as the active HSRP router.

failure to set the command standby 35 preempt Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 210 .Routers R1 and R2 are configured for HSRP as shown below: You have configured the routers R1 & R2 with HSRP. physical layer issues B. What is the most likely cause of this? A. use of non-default HSRP timers D. no spanning tree loops C. While debugging router R2 you notice very frequent HSRP group state transitions.

B. The Standby priority is 100. The Standby delay is 3 seconds. The Standby hello time is 2 seconds. E. When two routers in an HSRP standby group are configured with identical priorities. the router with the highest configured IP address will become the active router. D. D. the standby group—number priority priority-value global configuration command must be used. E. Two HSRP groups are configured. The Standby hold time is 10 seconds.) A. C. The default priority of a router is zero (0). C. Correct Answer: CDE Section: (none) Explanation Explanation/Reference: The table below shows the default values of popular HSRP parameters: . The Standby track interface priority decrement is 10. the router with the lowest priority in an HSRP group would become the active router. The no standby priority command assigns a priority of 100 to the router. QUESTION 211 Which three statements are true of a default HSRP configuration? (Choose three.Which two statements about the HSRP priority are true? (Choose two) A. To assign the HSRP router priority in a standby group. Assuming that preempting has also been configured. B. F. Correct Answer: CE Section: (none) Explanation Explanation/Reference: The “no standby priority” command will reset the priority to the default value (100) -> C is correct.

the delay command causes router A to wait before it becomes active again. Standby track: For example.1_12c_ea1/configuration/guide/swhsrp. For example. Because no decrement value is specified in the standby track command. What is the result of setting GLBP weighting at 105 with lower threshold 90 and upper threshold 100 on this router? .cisco. the HSRP priority is decremented by the default value of 10 when the tracked interface goes down.Note: Standby delay: If router A is the HSRP active router and then loses a link. which causes it to become standby router. Reference: http://www.html QUESTION 212 Refer to the exhibit. consider this configuration: standby priority 150 standby track serial 0 An HSRP priority of 150 is configured with the standby priority command and HSRP is configured to track the state of interface Serial0. and then the link comes back.com/en/US/docs/switches/lan/catalyst3550/software/release/12. it waits for 30 seconds for the router to become active. with the “standby preempt delay minimum 30” command.

C. this router will be available as an AVF for group 1. If both tracked objects go down and then one comes up. This configuration is incorrect and will not have any effect on GLBP operation. but the other remains down. Only if the state of both tracked objects goes down will this router release its status as an AVF for group 1.A. B. D. E. Only if both tracked objects are up will this router will be available as an AVF for group 1. If the state of one tracked object goes down then this router will release its status as an AVF for group 1. Correct Answer: B Section: (none) Explanation .

Per session using a round-robin scheme C. Per GLBP group using a strict priority scheme E. BPDUGuard is enabled on both ports of SwitchA.Explanation/Reference: QUESTION 213 Which describes the default load balacing scheme used by the Gateway Load Balancing Protocol (GLBP)? A. Initially. Per host using a strict priority scheme B. Per session using a strict priority scheme D. A new LinkB is then attached between SwitchA and HubA. Per host basis using a round robin-scheme F.) . Which two statements about the possible result of attaching the second link are true? (Choose two. Per GLBP group using a round-robin scheme Correct Answer: E Section: (none) Explanation Explanation/Reference: QUESTION 214 Refer to the exhibit. LinkA is connected and forwarding traffic.

The switch port attached to LinkA immediately transitions to the blocking state. D. One or both of the two switch ports attached to the hub goes into the err-disabled state when a BPDU is received. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 215 Which protocol will enable a group of routers to form a single virtual router and will use the real IP address of a router as the gateway address? A. B. E. IRDP . The switch port attached to LinkB does not transition to up.A. Both switch ports attached to the hub transitions to the blocking state. C. A heavy traffic load could cause BPDU transmissions to be blocked and leave a switching loop. HSRP C. Proxy ARP B.

D. B. by disabling periodic VTP updates Correct Answer: B Section: (none) Explanation . The port becomes a normal STP switch port. by restricting unicast traffic across VTP domains B. The port immediately transitions to the forwarding state. GLBP Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 216 What two things occur when an RSTP edge port receives a BPDU? (Choose two. The port immediately transitions to the err-disable state.D. C. by reducing unnecessary flooding of traffic to inactive VLANs C.) A. The switch generates a Topology Change Notification BPDU. by limiting the spreading of VLAN information D. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 217 How does VTP pruning enhance network bandwidth? A. VRRP E.

stack master C. where are the templates stored? A.ac0a. vendor code B. what does 07. TFTP server D.0c07. HSRP router number D. ensuring that user traffic immediately and transparently recovers from . HSRP well-known virtual MAC address Correct Answer: E Section: (none) Explanation Explanation/Reference: QUESTION 219 If a switch stack is configured to use SDM templates.Explanation/Reference: QUESTION 218 In the hardware address 0000. HSRP well-known physical MAC address E.ac represent? A. flash memory Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 220 Which protocol specified by RFC 2281 provides network redundancy for IP networks. all stack members B. HSRP group number C.

STP Correct Answer: C Section: (none) Explanation Explanation/Reference: HSRP is a Cisco-proprietary protocol developed to allow several routers or multilayer switches to appear as a single gateway IP address. HSRP D. you notice via show commands that Switch2 is the HSRP active router.first-hop failures in network edge devices or access circuits? A. This protocol is described in RFC 2281. ICMP B. Which two items are most likely the cause of Switch1 not becoming the active router? (Choose two) . After the two switches have finished rebooting. QUESTION 221 HSRP was implemented and configured on two switches while scheduled network maintenance was performed. IRDP C.

premption is disabled E. IP redirect is disabled Correct Answer: AD Section: (none) Explanation Explanation/Reference: When two routers are turned on at the same time. IP addressing is incorrect D. Three switches are configured for HSRP. QUESTION 222 Refer to the exhibit. the router completes booting process first will take the active role. Switch1 remains in the HSRP listen state.A. incorrect standby timers F. booting delays B. Without the “preempt” configured. even a new router with a higher priority cannot take over the active role. What is the most likely cause of this status? .In the configuration of Switch1 we don’t see the “preempt” command configured. standby group number does not match VLAN number C.

IP addressing is incorrect D. this is normal operation B. incorrect standby timers Correct Answer: A Section: (none) Explanation . incorrect priority commands E. standby group number does not match VLAN number C.A.

Active D. Then it moves to listen state in which it tries to hear if there are already active or standby routers for this group. Suppose there are 2 routers A and B in the network. After learning no one take . which is smaller than that of Switch2 (110) and Switch3 (150).Explanation/Reference: Only Switch 1 is not configured with the priority so it will have the default priority of 100. Established C. QUESTION 223 What are three possible router states of HSRP routers on a LAN? (Choose three) A. Moreover. Standby B. router A is turned on first. both Switch2 and Switch3 have the “preempt” command so surely Switch3 becomes active router while Switch2 becomes standby router -> Switch1 will be in listen state (Please read the explanation of question 2 to understand more about this state). Init Correct Answer: ACF Section: (none) Explanation Explanation/Reference: First we should review all the HSRP States: Now let’s take an example of a router passing through these states. Backup F. It enters the initial state. Idle E.

These messages are sent to the multicast address 224.2 255. it can take over the active role by sending out a hello packet with parameters indicating it wants to take over the active router.0 Switch_B(config-if)#standby 1 priority 200 Switch_B(config-if)#standby 1 ip 10. Which configuration on the HSRP neighboring device ensures that it becomes the active HSRP device in the event that port fa1/1 on Switch_A goes down? A. Now router B is turned on. Reference: http://www.0 Switch_B(config-if)#standby 1 priority 200 Switch_B(config-if)#standby 1 preempt Switch_B(config-if)#standby 1 ip 10. Now router A will fall back to the speak state to compete for active or standby state -> it becomes standby router because its priority is now lower than that of router A.10.2 255.2 (which can be heard by all members in that group). In this state.0.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a91.255. Now to our main question! We want router B to become active router so we set a higher priority number than the priority of A and ask router B to take over the role of active router (with the preempt command). Note: Suppose router A is in active state while router B is in standby state. router B goes into speak state to announce its priority to all HSRP members and compete for the active state.10 Switch_B(config-if)#standby 1 track interface fa 1/1 B.10.shtml QUESTION 224 Refer to the exhibit.255.2 255. it learns that router A has been already the active router and no other router is taking standby role so it enters speak state to compete for the standby router -> it promotes itself as standby router.0.255.255.0 Switch_B(config-if)#standby 1 priority 195 . In listen state. Switch_B(config-if)#ip address 10.the active or standby state. Now it starts sending hello messages containing its priority.10.10. It also goes through initial and listen state.10.10. This is called a coup hello message. When it does not hear a hello message with a higher priority it assumes the role of active router and moves to active state. it determines to take part in the election by moving to speak state. Switch_B(config-if)#ip address 10.10. Switch_B(config-if)#ip address 10.cisco. it continues sending out periodic hello messages.10 C.10.10. If router B does not hear hello messages from router A within the holdtime.255. But if at some time it receives a message from the active router that has a lower priority than its priority (because the administrator change the priority in either router).10.255. (Therefore answer B is correct).

HSRP can only load-sharing by configuring some different HSRP groups. in SWITCH only GLBP has the load-balancing feature.0c07.10.10. HSRP provides redundancy and load balancing. Switch_B(config-if)#standby 1 preempt Switch_B(config-if)#standby 1 ip 10.10. but the Switch_B’s ip address on the HSRP interface is higher (10.10 D. Note: Answer A is not correct because Switch_B has the same priority value of Switch_A.10 Switch_B(config-if)#standby 1 track interface fa 1/1 Correct Answer: C Section: (none) Explanation Explanation/Reference: Switch_A is not configured standby track priority value so it will use the default track priority of 10 -> When Switch_A goes down. QUESTION 226 Regarding high availability.10. Switch_B(config-if)#ip address 10. what does the “03” represent? . Also Switch_B must have the “preempt” command configured to take over the active state -> C is correct.10. C. QUESTION 225 HSRP has been configured between two Company devices.ac03.1) so Switch_B will take over the active state of Switch_A even when Switch_A is still operational. B.0 Switch_B(config-if)#standby 1 priority 190 Switch_B(config-if)#standby 1 ip 10. Which of the following describe reasons for deploying HSRP? (Choose three) A.255.10. HSRP allows one router to automatically assume the function of the second router if the second router fails. But answer D is the only choice left in this question so we have to choose it.10. I just want to mention about answer D. In fact answer D is not totally correct.10. HSRP allows one router to automatically assume the function of the second router if the second router starts. with the MAC address 0000. D.2 255. its priority is 200 – 10 = 190 so Switch_B must be configured with a priority higher than 190. Correct Answer: ABD Section: (none) Explanation Explanation/Reference: Answer A and B are correct because they are the functions of HSRP.255.10. HSRP provides redundancy and fault tolerance.10.2 is higher than 10.

The VRRP group number E. passive C. The HSRP router number D. The type of encapsulation C. If the EtherChannel mode on switch 1 is configured using auto. which mode on switch 2 establishes an operational EtherChannel? A.A. QUESTION 227 An engineer is configuring EtherChannel between two switches using PAgP. active D. PAgP B. auto Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 228 When using EtherChannel misconfiguration guard which technology is used to prevent this type of misconfiguration from affecting the network? A. The active router number Correct Answer: E Section: (none) Explanation Explanation/Reference: The last two-digit hex value in the MAC address presents the HSRP group number. STP . The HSRP group number F. The GLBP group number B. desirable B.

Use a different RSPAN VLAN for each session if configuring RSPAN on multiple switches. Assign access ports to an RSPAN VLAN like any other campus VLAN. port security Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 229 A physical switch port is part of an EtherChannel group. Define an RSPAN VLAN before configuring an RSPAN source or destination session. C. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 230 Which option is a Cisco recommended RSPAN configuration practice? A. C. D. D.C. Use only one destination port for each RSPAN session. LACP D. The operation is not allowed as an EtherChannel member cannot be a SPAN source port. B. The port is put in the errdisabled state and can only be re-enabled manually. The port forwards traffic in the EtherChannel group and acts as a SPAN source simultaneously. The port is removed from the EtherChannel group. Correct Answer: A Section: (none) Explanation . B. What happens while the same port is configured as a SPAN destination? A.

logs D. shutdown B. error disable Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 232 Which three functions does Dynamic ARP Inspection perform with invalid IP-to MAC address bindings? (Choose three. discards C.Explanation/Reference: QUESTION 231 When port security is configured on a switch. intercepts B. which violation mode is the default? A. no change D.) A. logging C. accepts E. deletes Correct Answer: ABC Section: (none) Explanation Explanation/Reference: . bypasses F.

Switch(config)#spanning-tree root guard C. Switch(config-if)#spanning-tree root guard Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 234 A network engineer is considering implementing UDLD throughout the network. UDLD works at Layer 1 of the OSI model. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 235 In regards to Cisco Virtual Switching System which technology is needed between two switches for them to act as one network element and share control information and data traffic? A. UDLD is already enabled by default on all ports on Cisco switches. trunk . C. UDLD aggressively disables the port after eight failed retries to connect to neighbor. Which option must the network engineer consider? A. Switch(config-if)#spanning-tree guard-root D. D. UDLD is an IEEE standard that can be configured on non-Cisco devices. Switch(config-if)#spanning-tree guard root E.QUESTION 233 Which command enables root guard on a Cisco switch? A. Switch(config)#spanning-tree guard root B. B.

E. virtual port channel C. The port enters the err-disabled state. The port enters the shutdown state. The port immediately begins to drop all traffic. Which command can you enter to determine the reason? A. The port triggers an EEM script to notify support staff and continues to forward traffic normally. B. C. D.) A. F. show run interface g0/1 D. show log C. EtherChannel D. show ip interface brief .B. virtual switch link Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 236 In which two ways can a port respond to a port-security violation? (Choose two. Correct Answer: CF Section: (none) Explanation Explanation/Reference: QUESTION 237 After you connected a host to switch port G0/1. The SecurityViolation counter is incremented and the port sends an SNMP trap. show interfaces g0/1 status B. the port is error disabled. The SecurityViolation counter is incremented and the port sends a critical syslog message to the console.

VLAN 1 STP BPDUs are sent tagged on VLAN 99.Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 238 When EtherChannel guard is enabled and a misconfiguration is detected on a port. VLAN 1 STP BPDUs are sent untagged on VLAN 99. but the EtherChannel stays down. D. Correct Answer: AD Section: (none) Explanation . B. Correct Answer: E Section: (none) Explanation Explanation/Reference: QUESTION 239 In which two ways are IEEE STP BPDUs forwarded if VLAN 99 is configured as native? (Choose two. The port state remains unchanged. VLAN 1 and VLAN 99 BPDUs are sent tagged on VLAN 1. It enters the channel-error state. It enters the errdisable state. but it is unable to pass traffic. It enters the shutdown state. E. F. D. The port remains up. C. VLAN 1 and VLAN 99 BPDUs are sent untagged on VLAN 1. C. E. B.) A. VLAN 1 STP BPDUs are sent untagged on VLAN 1. how does the port respond? A. VLAN 1 STP BPDUs are sent tagged on VLAN 1.

B.3 is active because it has a higher IP address. Which two statements can be derived from the output of the show standby command? (Choose two. R2 becomes the active router after the hold time expires. the HSRP priority on R2 becomes 80.) A. R2 is using the default HSRP hello and hold timers. R2 Fa1/0 regains mastership when the link comes back up. D. Correct Answer: BD Section: (none) Explanation .Explanation/Reference: QUESTION 240 Refer to the exhibit.1. Router with IP 10.10. E. If Fa0/0 is shut down. C.

active. passive. B. What is the effect of the given configuration? . desirable. active. the switch with the lowest stack member priority value. D. desirable. C. the switch with the highest stack member ID. passive D. desirable Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 243 Refer to the exhibit.Explanation/Reference: QUESTION 241 Which switch is chosen as the stack master during a stack master election? A. the switch with the lowest stack member ID. passive B.) A. the switch with the highest stack member priority value. passive C. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 242 Which two combinations of EtherChannel modes support the formation of an EtherChannel? (Choose two. desirable E.

It increases the maximum size of an Ethernet frame to 1594 bytes. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 244 Which two statements about 802. It enables the switch to become the spanning-tree root bridge. E. It encapsulates the original Ethernet frame and adds a VLAN identifier. It enables extended VLANs. D.1q are true? (Choose two. C. D. C. B. F.) A. It adds a 32-bit field to the Ethernet frame between the source MAC address and length. It is a Cisco proprietaty protocol. it forces a recalculation of the frame-check sequence field.A. Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 245 Which command do you enter so that the default authentication group on a device falls back to the case-sensitive local user database when the initial . It enables spanning-tree to create dynamic system IDs. B. When it is enabled. It supports 8-byte VLAN identifiers. It enables the reduced MAC address feature.

Authentication commands must be entered under the interface. A SPAN source does not participate in any Layer 2 protocols. It is a Cisco proprietary protocol. It sends advertisements to multicast address 224. Neither a SPAN source nor SPAN destination participates in any Layer 2 protocols.0. F. aaa authentication login default group tacacs+ radius local B. Correct Answer: DE Section: (none) Explanation Explanation/Reference: QUESTION 247 Which statement about Layer 2 protocol participation of ports involved in a SPAN session is true? A. It supports MD5 and IP sec authentication. aaa authentication exec default group tacacs+ local if-authenticated C. It can use an interface IP address as the virtual IP address.18. aaa authentication login default group tacacs+ local-case if-authenticated D.9. B. D. E. C.0.0.authentication fails? A. It sends advertisements to multicast address 224.0. B.) A. . aaa authentication exec default group tacacs+ if-authenticated local Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 246 Which two statements about VRRP are true? (Choose two.

The command is unsupported on a trunk where VLANs have already been pruned manually. A SPAN destination does not participate in any Layer 2 protocols. D. C. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 248 Refer to the exhibit.C.3.4 command on FastEthernet0/2 is true? A. Both SPAN source and SPAN destination participate in any Layer 2 protocols. Which is not allowed on the trunk. . The two workstations continue to communicate without a default gateway configured. The running configuration displays switch port trunk allowed vlan 1-5 for Fa0/2. The two workstation stop communicating because they are on VLAN 5. B. Which description of the effect of entering the switch port trunk allowed vlan 2. D.

D. C.4.3. The other side of the interface is set as access. The interface needs no shutdown configured. B. Which statement about the interface is true? A.Correct Answer: D Section: (none) Explanation Explanation/Reference: This command will delete vlan 5 and configure trunk with allowed vlans 2. The interface is down. The switchport command is missing from the configuration. To add vlan command is switchport trunk allowed vlan ADD. . QUESTION 249 Refer to the exhibit.

UPDATE PASSWORD E. CHALLENGE C. ACCEPT D. BPDU Guard Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 251 Which three responses from a RADIUS server are valid? (Choose three. Which option can be campus-wide to satisfy this requirement? A. CONFIRM Correct Answer: ABC Section: (none) Explanation . switch port block C. Uplink fast D. REJECT B.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 250 A network engineer is trying to prevent users from connecting unauthorized equipment to a production network. private VLAs E. IP Source Guard B.) A.

This attribute cannot be changed on an individual port basis. Duplex D. . The compatibility check includes the following operational attributes: • Port mode • Access VLAN • Trunk native VLAN • Allowed VLAN list • Speed • 802. Cisco NX-OS checks certain interface attributes to ensure that the interface is compatible with the channel group. DTP E. VLAN Correct Answer: AE Section: (none) Explanation Explanation/Reference: Compatibility Requirements When you add an interface to a channel group.) A. Port cost C. Cisco NX-OS also checks a number of operational attributes for an interface before allowing that interface to participate in the port-channel aggregation. • Broadcast/Unicast/Multicast Storm Control setting • Priority-Flow-Control • Untagged CoS Use the show port-channel compatibility-parameters command to see the full list of compatibility checks that Cisco NX-OS uses.3x flow control setting • MTU The Cisco Nexus 5000 Series switch only supports system level MTU.Explanation/Reference: QUESTION 252 Which two operational attributes can be checked for EtherChannel ports that are in err-disabled state? (Choose two. Port mode B.

B. On Layer 3 boundaries in the distribution layer.cisco. A network engineer deployed an older switch with the same spanning-tree priority as the existing root. C.https://www. D.pdf QUESTION 253 Refer to the exhibit. In which two locations should the Spanning Tree protocol root guard feature be implemented? (Choose two. E.) A. which caused a network outage. On the access layers root facing ports. On the designated root switch downlinks to the access layer. Correct Answer: AB Section: (none) Explanation Explanation/Reference: . Globally on all network switches. On all of non-root switch facing ports of the access layer.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/layer2/421_n2_1/b_Cisco_n5k_layer2_config_gd_rel_421_N2_1/ Cisco_n5k_layer2_config_gd_rel_421_N2_1_chapter7.

interface GigabitEthernet0/0 switchport mode trunk switchport trunk encapsulation dot1q switchport trunk allowed vlan 915 C. DHCP snooping F.915 switchport mode access switchport access vlan 915 . trunk C.915 encapsulation dot1q 915 E.) A. interface GigabitEthernet0/0 switchport mode access switchport access vlan 915 B.QUESTION 254 Which three features can be optimized by using SDM templates? (Choose three. VLAN D.) A. port security B. access E. interface GigabitEthernet0/0. interface GigabitEthernet0/0 switchport mode access switchport voice vlan 915 switchport access vlan 915 D. routing Correct Answer: CDF Section: (none) Explanation Explanation/Reference: QUESTION 255 Which two configurations can you apply to a port so that it tags traffic with VLAN 915? (Choose two. interface GigabitEthernet0/0.

Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 256
An engineer is configuring an EtherChannel between two switches using PAgP. If the EtherChannel mode on switch 1 is configured to auto, which modes on
switch 2 establish an operational EtherChannel?

A. active
B. auto
C. desirable
D. on
E. passive

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 257
Which feature do you implement so that an interface enters the root inconsistent state if it receives a superior BPDU?

A. DPDU guard
B. root guard
C. BPDU guard
D. loop guard

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 258
A physical switch port is part of an EtherChannel group. What happens while the same port configured as a SPAN destination?

A. The port forwards traffic in the EtherChannel group and acts as a SPAN source simultaneously.
B. The port is removed from the EtherChannel group.
C. The port is put in the errdisabled state and can only be reenabled manually.
D. The operation is not allowed as an EtherChannel member cannot be a SPAN source port.

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 259
Which two statements about CDP are true? (Choose two.)

A. CDP uses a TLV to advertise the native VLAN
B. CDP is not supported with SNMP
C. CDP is supported on Frame Relay sub interfaces.
D. CDP runs on OSI Layer 2
E. CDP runs on OSI Layer 1

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 260
Which statements about RSPAN are true? (Choose two.)

A. It supports MAC address learning.

B. RSPAN VLANs can carry RSPAN traffic only.
C. Only one RSPAN VLAN can be configured per device.
D. RSPAN VLANs are exempt from VTP pruning.
E. MAC address learning is not supported.
F. RSPAN uses are GRE tunnel to transmit captured traffic.

Correct Answer: BE
Section: (none)
Explanation

Explanation/Reference:

QUESTION 261
When a private VLAN is configured, which mode must be configured as a router facing port?

A. isolated
B. promiscuous
C. community
D. host

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 262
When a switch is added to a stack, which switch automatically configures the new switch with the correct IOS?

A. master
B. peer
C. adjacent
D. slave

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 263
Which HSRP extension allows groups to share traffic loads?

A. GLBP
B. CHSRP
C. MHSRP
D. CGMP
E. FHRP

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 264
Which mechanism is specific for RSPAN and not for SPAN?

A. source port
B. monitor port
C. reflector port
D. redundant port
E. destination port

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 265
Which three pieces of information about the remote device are reported by Cisco Discovery Protocol? (Choose three.)

A. The routing protocols in use on the device
B. Its spanning-tree state
C. Its hostname
D. Its port number
E. Its configuration register value
F. Its hardware platform

Correct Answer: CDF
Section: (none)
Explanation

Explanation/Reference:

QUESTION 266
Where can NetFlow export data for long term storage and analysis?

A. another network device
B. flat file
C. syslog
D. collector

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 267
Which two types of threshold can you configure for tracking objects? (Choose two.)

A. weight
B. bandwidth
C. MTU
D. percentage
E. administrative distance 15
F. delay

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 268
Refer to the exhibit. Which statement describes the result if a switch that is running PVST+ is added to this network?

A. Spanning tree is disabled automatically on the network
B. Spanning tree continues to operate in Rapid PVST+ on DSW2 and the new switch operates in PVST+
C. Both switches operate in the PVST+ mode
D. Both switches operate in the Rapid PVST+ mode

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 269
A workstation technician moves a PC from one office desk to another. Before the move the PC has network connectivity. After the move as the PC plugged
into the new network port, it loses network connectivity and the network switch port becomes err-disabled. Which option can cause the issue?

A. wrong VLAN
B. wrong switch port mode

C. port security
D. speed issue

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 270
Your manager asked you to make every port on your switch bypass the normal spanning-tree timers which includes your uplink to other switches. What two
commands can you apply on the interfaces? (Choose two.)

A. spanning-tree portfast
B. spanning-tree portfast default
C. spanning-tree portfast access
D. spanning-tree portfast trunk

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 271
Which switchport feature will block the packet with unknown MAC address from sending it via port.

A. switchport protect
B. switchport block unicast
C. switchport portfast
D. packet with unknown MAC will be dropped

Correct Answer: B
Section: (none)

Explanation

Explanation/Reference:

QUESTION 272
Which IOS configuration command is required to configure a VLAN as a private VLAN?

A. switch(config-vlan)# private-vlan common
B. switch(config-vlan)# private-vlan private
C. switch(config-vlan)# private-vlan primary
D. switch(config-vlan)# private-vlan transparent

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 273
If all devices on an EtherChannel are sending traffic to a single MAC address, which two methods of load balancing on the EtherChannel are preferred?
(Choose two.)

A. destination-MAC
B. dest-source-MAC
C. destination-IP
D. source-MAC
E. source-IP

Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/54sg/configuration/guide/config/channel.html

QUESTION 274
What is the default mode for LACP EtherChannel when configured?

A. on
B. active
C. passive
D. desirable
E. off

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 275
Which layer private VLAN partition the broadcast domain?

A. Layer 1
B. Layer 2
C. Layer 3
D. Layer 4

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 276
What VSS technology allows you to share downstream resources?

A. LACP
B. PAgP

C. MEC
D. EOA

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 277
Which option is the maximum frame size for an 802.1Q frame?

A. 64 bytes
B. 68 bytes
C. 1518 bytes
D. 1522 bytes

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 278
Which option is the minimum frame size for an 802.1Q frame?

A. 64 bytes
B. 68 bytes
C. 1518 bytes
D. 1522 bytes

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 279
Which two statements about HSRP timers are true? (Choose two.)

A. the default hold timer is 15 seconds
B. the default hello timer is 3 seconds.
C. the default hello timer is 5 seconds.
D. the default hold timer is 10 seconds.
E. the default hello timer is 30 seconds.
F. the default hold timer is 30 seconds.

Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 280
During the implementation of a voice solution, which two required items are configured at an access layer switch that will be connected to an IP phone to
provide VoIP communication? (Choose two.)

A. allowed codecs
B. untagged VLAN
C. auxiliary VLAN
D. Cisco Unified Communications Manager IP address
E. RSTP

Correct Answer: BC
Section: (none)
Explanation

Explanation/Reference:

are described as follows: * Port 1 connects to the Catalyst series switch or other device that supports Voice-over-IP (VoIP). In the picture below the auxiliary VLAN is VLAN 30 while the native VLAN is VLAN 20. To enhance the quality of the VoIP traffic. port 2 and port 3 are often placed in two different VLANs. The ports. which are dedicated connections. To use the IP Phone these two VLANs will need to be configured on the switch.An IP phone contains an integrated three-port 10/100 switch. . The VLAN carries voice traffic to and from the IP Phone is often called auxiliary VLAN (Port 2 in this case) while the VLAN carries data traffic is often the native VLAN (Port 3 in this case). * Port 2 is an internal 10/100 interface that carries the phone traffic. * Port 3 connects to a PC or other device.

To learn how to configure voice and data VLAN please read: http://www.shtml.cisco.com/en/US/products/hw/switches/ps4324/ products_configuration_example09186a0080722cdb.html#wp1048863.1/configuration/guide/ vlans.com/en/US/docs/switches/lan/catalyst4000/8. .cisco.To learn how to configure auxiliary VLAN please read: http://www.

HSRP QUESTION 1 SIMLET . .Simlet .HSRP Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP. They have questions about how these two devices will perform in the event of a device failure.

.

R2-100% D. we see that R1 is the active standby router for the Ethernet 0/0 link. R1-100% Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Based on the following output. so all outgoing traffic will be forwarded to R1.10.0/24 subnet is being forwarded through R1? A. R1-50 %. R2-50% C. QUESTION 2 .What percentage of the outgoing traffic from the 172.16. R1-0% B.

HSRP Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP. . They have questions about how these two devices will perform in the event of a device failure.SIMLET .

.

the standby 1 track decrement command will lower the priority from 130 to 90. when it comes back up. If router R1 interface Etherne0/0 goes down and recovers. B. The interface will have its current priority incremented by 40 for HSRP group 1 D.Refer to the exhibit.HSRP . However. it will then increment it by 40 back to 130 for HSRP group 1. The interface will have its current priority incremented by 60 for HSRP group 1 E. The interface will have the priority decremented by 40 for HSRP group 1. when the Ethernet 0/0 interface goes down. which of the statement regarding HSRP priority is true? A. The interface will default to the a priority of 100 for HSRP group 1 Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Here is the HSRP configuration seen on R1: Here. The interface will have the priority decremented by 60 for HSRP group 1 C. QUESTION 3 SIMLET .

They have questions about how these two devices will perform in the event of a device failure. .Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP.

.

The HSRP Hello packets are blocked D. The HSRP group number mismatch B. The HSRP timers mismatch E.What issue is causing Router R1 and R2 to both be displayed as the HSRP active router for group 2? A. we see that authentication is configured on R2. but not on R1: . The HSRP group authentication is misconfigured C. The HSRP group priorities are different Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Based on the configuration output.

This can be further verified by issuing the “show standby” command on each router. .

. They have questions about how these two devices will perform in the event of a device failure.QUESTION 4 SIMLET .HSRP Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP.

.

4000. 0000.ac02 B. 4000. 0000.ac01 D. 0000.0c07.0c07.0010 Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Issuing the “show standby” command on either router shows us that the virtual MAC used by HSRP group 1 is 4000.0000.0000.0010 as shown below: .ac02 F.0000.What is the virtual mac-address of HSRP group 1? A. 4000.0c07.ac01 E.0000.0010 C.

.

.

.VTPv3 You have been asked to install and configure a new switch in a customer network. Use the console access to the existing and new switches to configure and verify correct device configuration.VTPv3 QUESTION 1 SIMLET .Simlet .

the switch has been partially configured and you need to complete the rest of configuration to .You are connecting the New_Switch to the LAN topology.

enable PC1 communication with PC2. vtp domain CCNP vtp password cisco vtp version 2 vtp mode transparent interface e0/0 switchport mode access switchport access vlan 200 . vtp domain CCNP_TEST vtp password cisco123 vtp version 3 vtp mode client interface e0/0 switchport mode access switchport access vlan 200 C. vtp domain CCNP vtp password cisco vtp version 3 vtp mode client interface e0/0 switchport mode access switchport access vlan 100 E. Which of the configuration is correct? A. vtp domain CCNP_TEST vtp password cisco123 vtp version 2 vtp mode client interface e0/0 switchport mode access switchport access vlan 100 D. vtp domain CCNP_TEST vtp password cisco123 vtp version 3 vtp mode server interface e0/0 switchport mode access switch port access vlan 100 B.

Note that the VTP versions supported in this network are 1. leaving only choice D as correct. Logging in to SW1 and using the “show vtp status” command we see this: So we know that the VTP domain must be CCNP. 2. 3 so either VTP version 2 or 3 can be configured on the new switch. . the VTP domain name must match. We also see from the topology diagram that eth 0/0 of the new switch connects to a PC in VLNA 100.Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Within any VTP. So. so we know that this port must be an access port in VLAN 100. step one is to find the correct VTP name on the other switches. This leaves only choice D and E.

Use the console access to the existing and new switches to configure and verify correct device configuration.VTPv3 You have been asked to install and configure a new switch in a customer network. .QUESTION 2 SIMLET .

For which configured VLAN are untagged frames sent over trunk between SW1 and SW2? .Refer to the configuration.

VLAN 40 E. VLAN 300 Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: The native VLAN is used for untagged frames sent along a trunk.A. . By issuing the “show interface trunk” command on SW1 and SW2 we see the native VLAN is 99. VLAN 999 D. VLAN 50 F. VLAN 99 C. VLAN 200 G. VLAN1 B.

QUESTION 3 SIMLET . . Use the console access to the existing and new switches to configure and verify correct device configuration.VTPv3 You have been asked to install and configure a new switch in a customer network.

You are adding new VLANs. VLAN500 and VLAN600 to the topology in such way that you need to configure SW1 as primary root for VLAN 500 and secondary for VLAN 600 and SW2 as primary root for VLAN 600 and secondary for VLAN 500. Which configuration step is valid? .

On SW2. SW2. but SW4 is a client. Configure VLAN 500 and VLAN 600 on SW1 only C. Configure VLAN 500 and VLAN 600 on SW2 only D. so we will need to add both VLANs to SW1 and SW2. configure vtp mode as off and configure VLAN 500 and VLAN 600.SW2 and SW4 E. Configure VLAN 500 and VLAN 600 on SW1 . . Configure VLAN 500 & VLAN 600 on both SW1 & SW2 B. and SW4 we see that both SW1 and SW2 are operating in VTP server mode. configure back to vtp server mode.A. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: By issuing the “show vtp status command on SW2.

.

.

.VTPv3 You have been asked to install and configure a new switch in a customer network. Use the console access to the existing and new switches to configure and verify correct device configuration.QUESTION 4 SIMLET .

You are required to configure private VLANs for a new server deployment connecting to the SW4 switch.Examine the VTP configuration. Which of the following configuration steps will allow creating private VLANs? .

. only SW4 will connect to servers in a private VLAN. you will need to only disable pruning on the switch that contains the private VLANs.VTPv3 You have been asked to install and configure a new switch in a customer network. Disable VTP pruning on SW2. Disable VTP pruning on SW4 only D. QUESTION 5 SIMLET . SW4 and New_Switch E. Disable VTP pruning on New_Switch and SW4 only.A. Disable VTP pruning on SW2 only C. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: To create private VLANs. Disable VTP pruning on SW1 only B. Use the console access to the existing and new switches to configure and verify correct device configuration. In this case.

Which configuration step is valid? .You are adding new VLANs. VLAN 500 and VLAN 600 to the topology in such way that you need to configure SW1 as primary root for VLAN 500 and secondary for VLAN 600 and SW2 as primary root for VLAN 600 and secondary for VLAN 500.

On SW2. This problem no longer exists in VTP version 3 because there is only one VTP Primary Server at a time. Configure VLAN 500 & VLAN 600 on both SW1 & SW2. E. it can overwrite a VTP Server if its Revision number is higher.HINT: VTP Operating Mode is set to Primary Server! A. They are: + “Primary ID”: The MAC address of the Primary Server + “Primary Description”: The hostname of the Primary Server The Primary Server is used on VTP version 3 to avoid the bad behavior in version 2. When it comes back. there are two additional fields under the output of “show vtp status” command. the VTP Primary Server will advertise its VLAN database to other VTP clients/servers so in fact answer A is not correct. Configure VLAN 500 and VLAN 600 on SW1. Only a VTP Primary Server can create new VLAN. Configure VLAN 500 and VLAN 600 on SW2 only. In this question you just need to check if Sw1 or Sw2 is the VTP Primary Server then we can create both VLAN 500 & 600 on it. . Then it will advertise these VLANs to other switches. B. C. After creating new VLAN. SW2 and SW4. D. configure vtp mode as off and configure VLAN 500 and VLAN 600. Correct Answer: B Section: (none) Explanation Explanation/Reference: In VTP version 3. In VTP version 2. a VTP client (or Server) can be taken out of the network. configure back to vtp server mode. Configure VLAN 500 and VLAN 600 on SW1 only.

For example: Source: https://www.certprepare. Note: If the above output shows the roles of Sw1 and Sw2 are “Server” only (not “Primary Server”) then we should choose: A. Configure VLAN 500 & VLAN 600 on both SW1 & SW2 Note: To make a switch a Primary Server.From the output we see Sw1 is the Primary Server so we should configure VLAN 500 & 600 only on this switch.com/vtpv3-sim . issue the “vtp primary vlan” under privilege exec mode.

Inc. Currently all interfaces are up. you have been asked to investigate and respond to the following question. unless GigabitEthernet1/0/1 on backup device has also failed. is a medium sized company. DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105 DSW2 – primary device for VLAN 103 and VLAN 104 A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device. Troubleshooting has identified several issues.Simlet . Using the running configurations and show commands. The distribution switches are configured to use HSRP to provide a high availability solution. distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. .HSRP Ferris Plastics QUESTION 1 Ferris Plastics. with an enterprise network (access.

During routine maintenance. Decrease the decrement value in the track command for the VLAN 101 HSRP group on U DSWTs to a values less than the value in the track command for the VLAN 101 HSRP group on DSW2. distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. What needs to be done to make the group for VLAN 101 function properly? A. C. The distribution switches are configured to use HSRP to provide a high availability solution. unless GigabitEthernet1/0/1 on backup device has also failed. Currently all interfaces are up. Using the running configurations and show commands. with an enterprise network (access. DSW1 did not become the active router for VLAN 101 as desired. after GigabitEthemet1/0/1 on DSW1 was reactivated. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: QUESTION 2 Ferris Plastics. Troubleshooting has identified several issues. DSW2 became the active HSRP device for VLAN 101 as desired. Enable preempt in the VLAN 101 HSRP group on DSW1. B. is a medium sized company. In the VLAN 101 HSRP group on DSW1. Inc. . DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105 DSW2 – primary device for VLAN 103 and VLAN 104 A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device. D. Disable preempt in the VLAN 101 HSRP group on DSW2’s. decrease the priority value to a value that is less ‘ than the priority value configured in the VLAN 101 HSRP group on DSW2. you have been asked to investigate and respond to the following question. However. All other interfaces were up. GigabitEthernet1/0/1 on DSW1 was shut down.

What needs to be done to make the group function properly? A. it became necessary to shut down the GigabitEthernet1/0/1 interface on DSW1. 0 B. D. The decrement value on DSWTs should be greater than 190 and less than 200. During this time. The decrement value on DSW1 should be greater than 11 and less than 19. E. Correct Answer: C . All other interfaces were up. The decrement value on DSW1 should be greater than 5 and less than 15.During routine maintenance. C. You have determined that there is an issue with the decrement value in the track command for the VLAN 102 HSRP group. The decrement value on DSWTs should be greater than 195 and less than 205. DSW1 remained the active device for the VLAN 102 HSRP group. The decrement value on DSW1 should be greater than 9 and less than 15.

with an enterprise network (access. unless GigabitEthernet1/0/1 on backup device has also failed. The distribution switches are configured to use HSRP to provide a high availability solution. Using the running configurations and show commands.Section: (none) Explanation Explanation/Reference: Explanation: Use “show run” command to show. Troubleshooting has identified several issues. . Currently all interfaces are up. Inc. Priority value is 200. you have been asked to investigate and respond to the following question. we should decrement value in the track command from 11 to 18. is a medium sized company. Because 200 – 11 = 189 < 190 (priority of Vlan102 on DS2). QUESTION 3 Ferris Plastics. distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. The left Vlan102 is console1 of DS1. DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105 DSW2 – primary device for VLAN 103 and VLAN 104 A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device.

what can be done to make the group function properly? A. increase the priority value to a value greater 200 and less than 250. decrease the priority value to a value less than 190 and greater than 150. On DSW2. increase the decrement value in the track command to a value greater than 10 and less than 50. C.All interfaces are active. Correct Answer: C Section: (none) Explanation . On DSW1. D. B. On DSW2. DSW2 has not become the active device for the VLAN 103 HSRP group. As related to the VLAN 103 HSRP group. disable preempt. On DSW1.

distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. is a medium sized company. . Inc. The distribution switches are configured to use HSRP to provide a high availability solution. so the correct answer is to increase the priority to more than 200. but less than 250. unless GigabitEthernet1/0/1 on backup device has also failed. DSW2 is configured to decrement the priority by 50 if this interface goes down. We need to increase the priority of DSW2 to greater than 200. with an enterprise network (access. but it should be less than 250 so that if the gig 1/0/1 interface goes down. QUESTION 4 Ferris Plastics. DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105 DSW2 – primary device for VLAN 103 and VLAN 104 A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device.Explanation/Reference: Explanation: From the output shown below of the HSRP status of DSW2. we see that the active router has a priority of 200. while the local priority is 190. DSW1 will become active.

On DSW2 decrease the priority value to a value less than 150. During this time. C. increase the decrement value in the track command to a value greater than 6. decrease the decrement value in the track command to a value less than 1. All other interfaces were up. Using the running configurations and show commands. On DSW1. disable preempt. Currently all interfaces are up. On DSW1. you have been asked to investigate and respond to the following question.Troubleshooting has identified several issues. During routine maintenance. . D. B. As related to the VLAN 104HSRP group. it became necessary to shut down the GigabitEthernet1/0/1 interface on DSW1 and DSW2. DSW1 became the active router for the VLAN 104HSRP group. On DSW1. what can to be done to make the group function properly? A.

DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105 DSW2 – primary device for VLAN 103 and VLAN 104 A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device. If increase the decrement in the track value to a value greater than 6 (> or = 6). Result is priority 144 < 145 (vlan104 on DS2 is active). Using the running configurations and show commands. is a medium sized company. Troubleshooting has identified several issues. distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. . In this question. QUESTION 5 Ferris Plastics. It can not become active device when G1/0/1 on DS2 fail. Currently all interfaces are up. with an enterprise network (access. Example: if we are disable preempt on DS1. unless GigabitEthernet1/0/1 on backup device has also failed. Vlan104 (left): 150 – 1 = 149. you have been asked to investigate and respond to the following question. Vlan104 (left): 150 – 6 = 144. G0/1/0 on DS1 & DS2 is shutdown. Vlan104 (right): 200 – 155 = 145. you will make Vlan104’s HSRP group fail function. By do that. The distribution switches are configured to use HSRP to provide a high availability solution. Inc.Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: We should NOT disable preempt on DS1. Result is priority 149 > 145 (Vlan104 on DS1 is active).

150 D. 50 B. 200 Correct Answer: B Section: (none) Explanation .What is the priority value of the VLAN 105 HSRP group on DSW2? A. 100 C.

Using the running configurations and show commands.Explanation/Reference: Explanation: Use "show standby brief" command on console2. Currently all interfaces are up. unless GigabitEthernet1/0/1 on backup device has also failed. Very easy to se“ priority of Vlan1”5 is 100. Troubleshooting has identified several issues.primary device for VLAN 103 and VLAN 104 A failure–of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device. DSW1 . distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. The distribution switches are configured to use HSRP to provide a high availability solution. .primary device for VLAN 101 VLAN 102 and VLAN 105 D–W2 . with an enterprise network (access. you have been asked to investigate and respond to the following question. Inc. is a medium sized company. QUESTION 6 Ferris Plastics.

what will be the resulting priority value of the VLAN 105 HSRP group on router DSW2? A. 90 B. 200 Correct Answer: A Section: (none) Explanation .If GigabitEthemet1/0/1 on DSW2 is shutdown. 150 D. 100 C.

and the tracking feature for Gig 1/0/0 is enabled which will decrement the priority by 10 if this interface goes down for a priority value of 90.Explanation/Reference: Explanation As seen below. . the current priority for VLAN 105 is 100.

.Simlet . 102.HSRP Hotspot Certprepare QUESTION 1 HSRP Hotspot . 105.Certprepare – DSW1 (Distribution Switch 1) is the primary device for VLAN 101.

The DSW1’s decrement value should be greater than 190 and less 200. D. Question: During routine maintenance. it became necessary to shutdown G1/0/1 on DSW1. The DSW1’s decrement value should be configured with a value from 200 to less than 205. You have determined that there is an issue with the decrement value in the track command in VLAN 102’s HSRP group. – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device.– DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104. The DSW1’s decrement value should be configured with a value from 195 to less than 205. B. The DSW1’s decrement value should be configured with a value from 9 to 15. The DSW1’s decrement value should be configured with a value from 11 to 18. During this time. Click on the PC Console1 and PC Console2 to access these switches then use the “show running-config” command on both switches DSW1>enable DSW1#show running-config DSW2>enable DSW2#show running-config . C. F. What need to be done to make the group function properly? A. Correct Answer: C Section: (none) Explanation Explanation/Reference: The question clearly stated that there was an issue with the decrement value in VLAN 102 so we should check VLAN 102 on both DSW1 and DSW2 switches first. The DSW1’s decrement value should be configured with a value from 5 to 15. DSW1 remained the active device for VLAN 102’s HSRP group. All other interface were up. unless GigabitEthernet 1/0/1 on backup device has also failed. E.

the DSW1’s priority is 200 and is higher than that of DSW2 so DSW1 becomes active switch for the group.As shown in the outputs.Certprepare . QUESTION 2 HSRP Hotspot . HSRP automatically reduces the router’s priority by a configurable amount. we have to configure DSW1’s decrement value with a value equal or greater than 11 so that its result is smaller than that of DSW2 (200 – 11 < 190). in this case 5. To make DSW2 takes over this role. Notice that the interface Gig1/0/1 on DSW1 is being tracked so when this interface goes down. Therefore the priority of DSW1 goes down from 200 to 195. But this value is still higher than that of DSW2 (190) so DSW1 remains the active switch for the group. Therefore C is the correct answer.

– DSW1 (Distribution Switch 1) is the primary device for VLAN 101. 105 – DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104 – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device. . 102. unless GigabitEthernet 1/0/1 on backup device has also failed.

Enable preempt on DSW1’s VLAN 101 HSRP group. after G1/0/1 on DSW1 was reactivated. Decrease the decrement in the track command for DSW1’s VLAN 101 HSRP group to a value less than the value in the track command for DSW2’s VLAN 101 HSRP group. All other interface were up. However. C. G1/0/1 on DSW1 was shutdown. Correct Answer: A Section: (none) Explanation Explanation/Reference: Continue to check VLAN 101 on both switches… . Disable preempt on DSW1’s VLAN 101 HSRP group. Decrease DSW1’s priority value for VLAN 101 HSRP group to a value that is less than priority value configured on DSW2’s HSRP group for VLAN 101. DSW2 became the active HSRP device for VLAN 101 as desired. What need to be done to make the group for VLAN 101 function properly? A. B. DSW1 did not become the active HSRP device as desired. D.Question: During routine maintenance.

QUESTION 3 HSRP Hotspot .Certprepare .We learned that DSW1 doesn’t have the “standby 1 preempt” command so it can’t take over the active role again even if its priority is the highest. So we need to enable this command on VLAN 101 of DSW1.

105 – DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104 – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device. unless GigabitEthernet 1/0/1 on backup device has also failed. . 102.– DSW1 (Distribution Switch 1) is the primary device for VLAN 101.

B. Correct Answer: C Section: (none) Explanation Explanation/Reference: . On DSW1. decrease the priority value to a value less than 190 and greater than 150. increase the decrement value in the track command to a value greater than 10 and less than 50. increase the priority value to a value greater 200 and less than 250. On DSW2.Question: DSW2 has not become the active device for VLAN 103’s HSRP group even though all interfaces are active. On DSW1. As related to VLAN 103’s HSRP group. What can be done to make the group function properly? A. C. D. disable preempt. On DSW2.

the priority of DSW2 will be 190 – 50 = 140 < 160 -> DSW1 will become new active switch (it is good. too). But there is another requirement from this question that “A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device. When Gi1/0/1 on DSW2 goes down. For example. the priority of DSW1 will be 160 – 10 = 150 and it is still greater than 140 of DSW2 -> DSW2 cannot retake the active role as the requirement of this . In order to make DSW2 become the active switch. This requirement makes answer B incorrect. we need to increase DSW2’s priority (to higher than 200) or decrease DSW1’s priority (to lower than 190) -> B and C are correct. But when Gi1/0/1 on DSW1 also goes down. unless GigabitEthernet 1/0/1 on backup device has also failed”. we choose to decrease the priority value on DSW1 to 160 (according to answer B) then DSW2 will become active switch (that is good).The reason DSW2 has not become the active switch for Vlan103 is because the priority value of DSW1 is higher than that of DSW2.

102.question. QUESTION 4 HSRP Hotspot .Certprepare – DSW1 (Distribution Switch 1) is the primary device for VLAN 101. 105 .

what will be the current priority value of the VLAN 105’s group on DSW1? A. its priority will decrease 55 so. unless GigabitEthernet 1/0/1 on backup device has also failed. QUESTION 5 . Question: If G1/0/1 on DSW1 is shutdown. its value will be 150 – 55 = 95. 95 B. 150 D.– DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104 – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device. 200 Correct Answer: A Section: (none) Explanation Explanation/Reference: Below is the output of VLAN 105: If G1/0/1 on DSW1 is shutdown. 100 C.

HSRP Hotspot . 102. . 105 – DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104 – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device. unless GigabitEthernet 1/0/1 on backup device has also failed.Certprepare – DSW1 (Distribution Switch 1) is the primary device for VLAN 101.

100 C. QUESTION 6 HSRP Hotspot . 50 B. 200 Correct Answer: B Section: (none) Explanation Explanation/Reference: Below is the output of VLAN 105 of DSW2: We don’t see the priority of DSW2 so it is using the default value (100). 150 D.Question: What is the configured priority value of the VLAN 105’s group on DSW2? A.Certprepare .

. 102. unless GigabitEthernet 1/0/1 on backup device has also failed.– DSW1 (Distribution Switch 1) is the primary device for VLAN 101. 105 – DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104 – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device.

disable track command. it became necessary to shutdown G1/0/1 on DSW1 and DSW2. D. C. As related to VLAN 104’s HSRP group. decrease the priority value to a value less than 150. disable preempt. On DSW2. All other interface were up. what can be done to make the group function properly? A. DSW1 became the active device for VLAN 104’s HSRP group. increase the decrement value in the track command to a value greater than 6. During this time. On DSW1. On DSW1. B.Question: During routine maintenance. On DSW1. Correct Answer: C Section: (none) Explanation Explanation/Reference: .

The question asks us how to keep the active role of DSW2. the priority of DSW1 will be 150 – 1 = 149 and that of DSW2 will be 200 – 55 = 145 -> DSW1 will become the active switch. . we learned that if both interfaces G1/0/1 of DSW1 and DSW2 are shutdown. From the outputs.

.The main point here is that we have to configure so in such a way that when both interfaces G1/0/1 of DSW1 and DSW2 are shutdown. or we have to configure the decrement value of DSW1 to a value greater than 6 ( 6 = 150 – 144) -> C is the correct answer. Therefore the priority value of DSW1 should be smaller than 145. Notice: To keep the active role of DSW2. the priority of DSW2 is still greater than that of DSW1. we can disable “preempt” on DSW1 (answer A) so that it will not take over the active role when DSW2 is downed but it also means that VLAN 104 will not have active switch -> VLAN 104 will fail.

For security reasons. it is necessary to restrict access to VLAN 20 in the following manner: Users connecting to VLAN 20 via port f0/1 on ASW1 must be authenticated before they are given access to the network. The topology diagram indicates their layer 2 mapping. VLAN 20 is a new VLAN that will be used to provide the shipping personnel access to the server. Corporate polices do not allow Layer 3 functionality to be enabled on the switches. Devices on VLAN 20 are restricted to the subnet of 172.40.120. Filtering should be implemented as close to the serverfarm as possible. You have been tasked with implementing the above access control as a pre- condition to installing the servers.40.120. DSW1 and ASW1.com is an IT company that has an existing enterprise network comprised of two layer 2 only switches. The RADIUS server and application servers will be installed at a future date.0/24.AAA dot1x (Mod 1 .Simulation Labs QUESTION 1 SIMULATION . Packets from devices in the subnet of 172.120. .46 RADIUS key: rad123 Authentication should be implemented as close to the host as possible.40.Named ACL) SWITCH. You must use the available IOS switch features.0/24 should be allowed on VLAN 20. Packets from devices in any other address range should be dropped on VLAN 20. Authentication is to be done via a RADIUS server: RADIUS server host: 172.

120.46 key rad123 ASW1(config)#aaa authentication dot1x default group radius ASW1(config)#dot1x system-auth-control .40.Correct Answer: Section: (none) Explanation Explanation/Reference: Console to ASW1 ASW1>enable ASW1#configure terminal ASW1(config)#aaa new-model ASW1(config)#radius-server host 172.

com is an IT company that has an existing enterprise network comprised of two layer 2 only switches.0 0.AAA dot1x (Mod 2 .40.Numbered ACL) SWITCH.255 DSW1(config-std-nacl)#exit DSW1(config)#vlan access-map CCNP 10 DSW1(config-access-map)#match ip address 10 DSW1(config-access-map)#action forward DSW1(config-access-map)#exit DSW1(config)#vlan access-map CCNP 20 DSW1(config-access-map)#action drop DSW1(config-access-map)#exit DSW1(config)#vlan filter CCNP vlan-list 20 DSW1(config)#end DSW1#copy run start QUESTION 2 SIMULATION .0.0.ASW1(config)#exit ASW1(config)#interface fa0/1 ASW1(config-if)#switchport mode access <<check if this is already pre-configured for you. Corporate polices do not allow Layer 3 functionality to be enabled on the switches. it is necessary to restrict access to VLAN 20 in the following manner: . For security reasons. ASW1(config-if)#dot1x port-control auto ASW1(config-if)#exit ASW1#copy run start Console to DSW1 DSW1>enable DSW1#configure terminal DSW1(config)#ip access-list standard 10 DSW1(config-std-nacl)#permit 172. DSW1 and ASW1. The topology diagram indicates their layer 2 mapping.120. ASW1(config-if)#switchport access vlan 20 <<check if this is already pre-configured for you. VLAN 20 is a new VLAN that will be used to provide the shipping personnel access to the server.

40. Packets from devices in the subnet of 172. Authentication is to be done via a RADIUS server: RADIUS server host: 172. Devices on VLAN 20 are restricted to the subnet of 172.120.120. NAMED ACL IS NOT ALLOWED TO BE USED. Users connecting to VLAN 20 via port f0/1 on ASW1 must be authenticated before they are given access to the network.40. Filtering should be implemented as close to the serverfarm as possible.0/24 should be allowed on VLAN 20.40.0/24. You must use the available IOS switch features. The RADIUS server and application servers will be installed at a future date. Packets from devices in any other address range should be dropped on VLAN 20. . You have been tasked with implementing the above access control as a pre- condition to installing the servers.46 RADIUS key: rad123 Authentication should be implemented as close to the host as possible.120.

40. ASW1(config-if)#switchport access vlan 20 <<check if this is already pre-configured for you.40.Correct Answer: Section: (none) Explanation Explanation/Reference: Console to ASW1 ASW1>enable ASW1#configure terminal ASW1(config)#aaa new-model ASW1(config)#radius-server host 172.0 0.120.0.0.120. ASW1(config-if)#dot1x port-control auto ASW1(config-if)#exit ASW1#copy run start Console to DSW1 DSW1>enable DSW1#configure terminal DSW1(config)#access-list 10 permit 172.255 DSW1(config)#vlan access-map CCNP 10 DSW1(config-access-map)#match ip address 10 DSW1(config-access-map)#action forward DSW1(config-access-map)#exit DSW1(config)#vlan access-map CCNP 20 DSW1(config-access-map)#action drop DSW1(config-access-map)#exit .46 key rad123 ASW1(config)#aaa authentication dot1x default group radius ASW1(config)#dot1x system-auth-control ASW1(config)#exit ASW1(config)#interface fa0/1 ASW1(config-if)#switchport mode access <<check if this is already pre-configured for you.

RouterA is currently configured correctly and is providing the routing function for devices on SwitchA and SwitchB. SwitchB has a minimal configuration.LACP with STP (Modification 1) (FROM CERTPREPARE) You work for SWITCH. with SwitchA controlling activation. 13. but will need to be modified to support the addition of SwitchB. 22 and 23. • The two trunks between SwitchA and SwitchB need to be configured in a mode that allows for the maximum use of their bandwidth for all vlans. This mode should be done with a non-proprietary protocol. Configuration Requirements for SwitchA The VTP and STP configuration modes on SwitchA should not be modified. • Propagation of unnecessary broadcasts should be limited using manual pruning on this trunk link.DSW1(config)#vlan filter CCNP vlan-list 20 DSW1(config)#end DSW1#copy run start QUESTION 3 SIMULATION . 22 and 23 should tagged when traversing the trunk link.11/24 Inter-switch Connectivity Configuration Requirements • For operational and security reasons trunking should be unconditional and Vlans 1.com. SwitchA is currently configured correctly. All other vlans should be left are their default values. Configuration Requirements for SwitchB • Vlan 21 Name: Marketing will support two servers attached to fa0/9 and fa0/10 • Vlan 22 Name: Sales will support two servers attached to fa0/13 and fa0/14 • Vlan 23 o Name: Engineering will support two servers attached to fa0/15 and fa0/16 • Access ports that connect to server should transition immediately to forwarding state upon detecting the connection of a device. .1. • SwitchA needs to be the root switch for vlans 11. • SwitchB must operate in the same spanning tree mode as SwitchA • No routing is to be configured on SwitchB • Only the SVI vlan 1 is to be configured and it is to use address 192. 21. 12. 21. • SwitchB VTP mode needs to be the same as SwitchA. You have been tasked with competing the needed configuring of SwitchA and SwitchB. They have just added a new switch (SwitchB) to the existing network as shown in the topology diagram. SwitchA and SwitchB use Cisco as the enable password.168.

Correct Answer: Section: (none) Explanation Explanation/Reference: Switch A SWA(config)#vlan 21 SWA(config-vlan)#name Marketing SWA(config)#vlan 22 SWA(config-vlan)#name Sales .

SWA(config)#vlan 23 SWA(config-vlan)#name Engineering SWA(config-vlan)#exit SWA(config)#spanning-tree vlan 11-13.21-23 root primary SWA(config)#interface range fa0/3 – 4 SWA(config-if)#shutdown SWA(config-if)#no switchport mode access SWA(config-if)#no switchport access vlan 98 SWA(config-if)#channel-group 1 mode active SWA(config-if)#channel-protocol lacp SWA(config-if)#exit SWA(config)#interface port-channel 1 SWA(config-if)#switchport mode trunk SWA(config-if)#switchport trunk native vlan 99 SWA(config-if)#switchport trunk allowed vlan 1. SWB(config)#vlan 11 SWB(config-vlan)#name ADM SWB(config)#vlan 12 SWB(config-vlan)#name BDM SWB(config)#vlan 13 SWB(config-vlan)#name CDM SWB(config)#vlan 21 SWB(config-vlan)#name Marketing SWB(config)#vlan 22 SWB(config-vlan)#name Sales SWB(config)#vlan 23 SWB(config-vlan)#name Engineering SWB(config)#vlan 98 SWB(config-vlan)#name Parking SWB(config)#vlan 99 SWB(config-vlan)#name TrunkNative SWB(config-vlan)#exit .12 & 13 should match with SwitchA.21-23 SWA(config-if)#no shutdown Switch B ***VLAN 11.

SWB(config)#interface range fa0/9 – 10 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 21 SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#interface range fa0/13 – 14 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 22 SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#interface range fa0/15 – 16 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 23 SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#vtp mode transparent SWB(config)#spanning-tree mode rapid-pvst SWB(config)#interface vlan 1 SWB(config-if)#ip address 192.255.168.0 SWB(config-if)#no shut SWB(config)#ip default-gateway 192.255.21-23 SWB(config-if)#no shutdown .1.168.1.11 255.1 SWB(config)#interface range fa0/3 – 4 SWB(config-if)#shutdown SWB(config-if)#channel-group 1 mode passive SWB(config-if)#channel-protocol lacp SWB(config-if)#exit SWB(config)#interface port-channel 1 SWB(config-if)#switchport trunk encapsulation dot1q SWB(config-if)#switchport mode trunk SWB(config-if)#switchport trunk native vlan 99 SWB(config-if)#switchport trunk allowed vlan 1.

If ping is successful. Configuration Requirements for SwitchA The VTP and STP configuration modes on SwitchA should not be modified.***** Switch A ***** SWA(config)#interface range fa0/3 – 4 SWA(config-if)#no shutdown SWA(config-if)#exit ***** Switch B ***** SWB(config)#interface range fa0/3 – 4 SWB(config-if)#no shutdown SWB(config-if)#exit #show ip interface brief *** Run on both SWA and SWB to see port channel. #ping the router IP from SWB by typing in ping 192. 22 and 23.1. • SwitchA needs to be the root switch for vlans 11. You have been tasked with competing the needed configuring of SwitchA and SwitchB. SwitchB has a minimal configuration. #show etherchannel summary *** Run on both SWA and SWB Port channel should be up. They have just added a new switch (SwitchB) to the existing network as shown in the topology diagram. but will need to be modified to support the addition of SwitchB.168.LACP with STP (Modification 2) (ETHERCHANNEL MUST BE CONFIGURED ONLY ON THE PHYSICAL INTERFACES) You work for SWITCH.1. Configuration Requirements for SwitchB • Vlan 21 Name: Marketing will support two servers attached to fa0/9 and fa0/10 • Vlan 22 Name: Sales will support two servers attached to fa0/13 and fa0/14 • Vlan 23 o Name: Engineering . 13.com. fa0/3. All other vlans should be left are their default values. RouterA is currently configured correctly and is providing the routing function for devices on SwitchA and SwitchB. 12. 21. SwitchA is currently configured correctly. copy run start on both SWA and SWB. SwitchA and SwitchB use Cisco as the enable password. QUESTION 4 SIMULATION . fa0/4 and VLAN 1 should be up/up.

21. • SwitchB must operate in the same spanning tree mode as SwitchA • No routing is to be configured on SwitchB • Only the SVI vlan 1 is to be configured and it is to use address 192. This mode should be done with a non-proprietary protocol. • The two trunks between SwitchA and SwitchB need to be configured in a mode that allows for the maximum use of their bandwidth for all vlans. 22 and 23 should tagged when traversing the trunk link.1. . • Propagation of unnecessary broadcasts should be limited using manual pruning on this trunk link.will support two servers attached to fa0/15 and fa0/16 • Access ports that connect to server should transition immediately to forwarding state upon detecting the connection of a device.168. with SwitchA controlling activation. • SwitchB VTP mode needs to be the same as SwitchA.11/24 Inter-switch Connectivity Configuration Requirements • For operational and security reasons trunking should be unconditional and Vlans 1.

Correct Answer: Section: (none) Explanation Explanation/Reference: Switch A SWA(config)#vlan 21 SWA(config-vlan)#name Marketing SWA(config)#vlan 22 SWA(config-vlan)#name Sales SWA(config)#vlan 23 .

SWA(config-vlan)#name Engineering SWA(config-vlan)#exit SWA(config)#spanning-tree vlan 11-13.21-23 SWA(config-if)#switchport mode trunk SWA(config-if)#channel-group 1 mode active SWA(config-if)#channel-protocol lacp SWA(config-if)#exit Switch B ***VLAN 11.12 & 13 should match with SwitchA.21-23 root primary SWA(config)#interface range fa0/3 – 4 SWA(config-if)#shutdown SWA(config-if)#no switchport mode access SWA(config-if)#no switchport access vlan 98 SWA(config-if)#switchport trunk native vlan 99 SWA(config-if)#switchport trunk allowed vlan 1. SWB(config)#vlan 11 SWB(config-vlan)#name ADM SWB(config)#vlan 12 SWB(config-vlan)#name BDM SWB(config)#vlan 13 SWB(config-vlan)#name CDM SWB(config)#vlan 21 SWB(config-vlan)#name Marketing SWB(config)#vlan 22 SWB(config-vlan)#name Sales SWB(config)#vlan 23 SWB(config-vlan)#name Engineering SWB(config)#vlan 98 SWB(config-vlan)#name Parking SWB(config)#vlan 99 SWB(config-vlan)#name TrunkNative SWB(config-vlan)#exit SWB(config)#interface range fa0/9 – 10 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 21 .

1 SWB(config)#interface range fa0/3 – 4 SWB(config-if)#shutdown SWB(config-if)#switchport trunk encapsulation dot1q SWB(config-if)#switchport trunk native vlan 99 SWB(config-if)#switchport trunk allowed vlan 1.168.1.168.21-23 SWB(config-if)#switchport mode trunk SWB(config-if)#channel-group 1 mode passive SWB(config-if)#channel-protocol lacp SWB(config-if)#exit ***** Switch A ***** SWA(config)#interface range fa0/3 – 4 SWA(config-if)#no shutdown SWA(config-if)#exit ***** Switch B ***** .255.11 255.1.0 SWB(config-if)#no shut SWB(config)#ip default-gateway 192.255.SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#interface range fa0/13 – 14 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 22 SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#interface range fa0/15 – 16 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 23 SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#vtp mode transparent SWB(config)#spanning-tree mode rapid-pvst SWB(config)#interface vlan 1 SWB(config-if)#ip address 192.

You need to configure SwitchC so that Hosts H1 and H2 can successfully ping the server S1. SwitchC uses Cisco as the enable password. No trunking has been configured on RouterC.200.168. which has a partial configuration and has been attached to RouterC as shown in the topology diagram. The following subnets are available to implement this solution: – 10.200. Note: Due to administrative restrictions and requirements you should not add or delete VLANs. Routing must only be enabled for the specific subnets shown in the diagram. #ping the router IP from SWB by typing in ping 192. Company policies forbid the use of static or default routing.32/27 – 190. Due to administrative restrictions and requirements you should not add/delete vlans or create trunk links.1.250. Routed interfaces should use the lowest host on a subnet when possible. Also SwitchC needs to be able to ping server S1.250. . fa0/4 & VLAN 1 should be up/up. since it was required to apply commands only on physical interface. If ping is successful. You do not have access to RouteC.64/27 Hosts H1 and H2 are configured with the correct IP address and default gateway.MLS EIGRP You have been tasked with configuring multilayer SwitchC.10. Company policies forbid the use of static or default routing. changes VLAN port assignments or create trunks. #show etherchannel summary *** Run on both SWA and SWB Port channel should be up.1. copy run start on both SWA and SWB. #show ip interface brief *** Run on both SWA and SWB to see port channel.SWB(config)#interface range fa0/3 – 4 SWB(config-if)#no shutdown SWB(config-if)#exit Note: No need to apply commands on Port Channel (interface port-channel 1). RouterC is correctly configured. All routes must be learned via the EIGRP routing protocol.10.0/24 – 190. QUESTION 5 SIMULATION . All routes must be learned via EIGRP 65010 routing protocol. fa0/3.

Correct Answer: Section: (none) Explanation Explanation/Reference: + Use RouterC as a “router on a stick” and SwitchC as a pure Layer2 switch. The question clearly states “No trunking has been configured on RouterC” so RouterC does not contribute to interVLAN routing of hosts H1 & H2 -> SwitchC must be configured as a Layer 3 switch with SVIs for interVLAN routing. SwitchC should be configured as a Layer 3 switch (which supports ip routing function as a router). We should check the default gateways on H1 & H2. No trunking requires. C:\>ipconfig We will get the default gateways as follows: Host1: . + Only use SwitchC for interVLAN routing without using RouterC. Trunking must be established between RouterC and SwitchC. Click on H1 and H2 and type the “ipconfig” command to get their default gateways.

200.200.2 255.0.255.0.0.31 NOTE: THE ROUTER IS CORRECTLY CONFIGURED.1 so this is the lowest usable IP address.255.0.0.0 ->RouterC has used IP 10.224 SwitchC(config-if)# no shutdown SwitchC(config-if)#exit SwitchC(config)# ip routing (Notice: MLS will not work without this command) SwitchC(config)# router eigrp 65010 SwitchC(config-router)# network 10. In order to complete the lab. Also make sure you use the correct EIGRP AS number (in the configuration above it is 650 but it will change when you take the exam) but we are not allowed to access RouterC so the only way to find out the EIGRP AS is to look at the exhibit above.255.33 255. SwitchC(config-if)# ip address 10. Also some reports said the “no auto-summary” command can’t be used in the simulator. also don’t modify/delete any port just do the above configuration.10.255.31 SwitchC(config-router)# network 190.10. and from the PCs as well. SwitchC(config-if)# no shutdown SwitchC(config-if)# exit SwitchC(config)# int vlan 2 SwitchC(config-if)# ip address 190.32 0.10.250.33 Host2: + Default gateway: 190.0.65 Now we have enough information to configure SwitchC (notice the EIGRP AS in this case is 650) Note: VLAN2 and VLAN3 were created and gi0/10.65 255.10.200.255.200.255 SwitchC(config-router)# network 190. If you use wrong AS number.200.+ Default gateway: 190.224 SwitchC(config-if)# no shutdown SwitchC(config-if)# int vlan 3 SwitchC(config-if)# ip address 190.250. no neighbor relationship is formed between RouterC and SwitchC.200.10.64 0. in fact it is not necessary because the network 190.0 0.255.0/16 is not used anywhere else in this topology.200.0. gi0/11 interfaces were configured as access ports so we don’t need to configure them in this sim. SwitchC# configure terminal SwitchC(config)# int gi0/1 SwitchC(config-if)#no switchport -> without using this command. you should expect the ping to SERVER to succeed from the MLS. so you will not miss within it in the exam. .250.250. the simulator does not let you assign IP address on Gi0/1 interface.10.250.250.

0.0. 4. But in the exam the sim is just a flash based simulator so we should use two above commands.Old CCNP SWITCH Labs The headquarter office for a cement manufacturer is installing a temporary Catalyst 3550 in an IDF to connect 24 additional users. Also configure the user ports (all FastEthernet ports) so that the ports are permanently non-trunking. Requirements: You will configure FastEthernet ports 0/12 through 0/24 for users who belong to VLAN 20.31″ we can use one simple command “network 190.64 0. all non-trunking interfaces should transition immediately to the forwarding state of Spanning tree.0. Ensure all non-trunking interfaces (Fa0/1 to Fa0/24) transition immediately to the forwarding state of Spanning-Tree.200.200.In fact.0. we can use “show run” command to verify.0. Ensure the switch does not participate in VTP but forwards VTP advertisements received on trunk ports. QUESTION 6 SIMULATION . only the summarized network 190. Also all VLAN and VTP configurations are to be completed in global configuration mode as VLAN database mode is being deprecated by Cisco. But after finishing the configuration. You are required to accomplish the following tasks: 1.0. 2.32 0. it is important to have the correct configuration prior to connecting to the production network.250.0″ because it is the nature of distance vector routing protocol like EIGRP: only major networks need to be advertised.Spanning-Tree Lab Sim (Certprepare) . Ensure all FastEthernet interfaces are in a permanent non-trunking mode. It will be necessary to ensure that the switch does not participate in VTP but forwards VTP advertisements that are received on trunk ports.0 is shown. Place FastEthernet interfaces 0/12 through 0/24 in VLAN 20. To prevent network corruption.200.31″ and “network 190. Because of errors that have been experienced on office computers. 3.250. Correct Answer: Section: (none) Explanation Explanation/Reference: Console into the Switch . just for sure.200. we are pretty sure instead of using two commands “network 190. even without “no auto-summary” command the network still works correctly.

To change the VLAN associated with a port. it is not necessary for you to make the specific VLAN port assignments on the access-layer switches.VTP Lab 1 Sim (Certprepare) . switch doesn’t participate in the VTP domain. Your task is to configure VTP to share VLAN information from the distribution-layer switch to the access-layer devices. Also. Please reference the following table for the VTP and VLAN information to be configured: . Switch(config-if-range)#interface range fa0/12 – 24 Switch(config-if-range)#switchport access vlan 20 <<Make these ports members of vlan 20 Switch(config-if-range)#exit Next we need to make this switch in transparent mode. all ports on the switch are in VLAN 1.certprepare. Switch(config-if-range)#spanning-tree portfast <<Enables the PortFast on interface. Switch(config)#vtp mode transparent Switch(config)#exit Switch#copy running-config startup-config Source: http://www. you need to go to each interface (or a range of interfaces) and tell it which VLAN to be a part of. because VLAN database mode is being deprecated by Cisco. we need to assign FastEthernet ports 0/12 through 0/24 to VLAN 20. Switch>enable Switch#configure terminal Switch(config)#interface range fa0/1 – 24 Switch(config-if-range)#switchport mode access <<Make all FastEthernet interfaces into access mode.Old CCNP SWITCH Labs The headquarter offices for a book retailer are enhancing their wiring closets with Layer3 switches. Then. In this mode.com/spanning-tree-lab-sim QUESTION 7 SIMULATION . but it still forwards VTP advertisements through any configured trunk links. however. all VLAN and VTP configurations are to be completed in the global configuration mode. By default. Next. The new distribution-layer switch has been installed and a new access-layer switch cabled to it. it is necessary to configure interVLAN routing on the distribution layer switch to route traffic between the different VLANs that are configured on the access-layer switches.

5. Configure the VTP information with the distribution layer switch as the VTP server. 4. 2. Configure VLANs on the distribution layer switch. Configure inter-VLAN routing on the distribution layer switch. click on the host icon that is connected to the switch be way of a serial console cable. Specific VLAN port assignments will be made as users are added to the access layer switches in the future. Configure the VTP information with the access layer switch as a VTP client. To configure the switch. All VLANs and VTP configurations are to completed in the global configuration. Correct Answer: . 6.Requirements: These are your specific tasks: 1. 3.

use the vlan vlanID# command: DLSwitch(config)#vlan 20 DLSwitch(config)#vlan 21 Configure IP addresses for VLANs: DLSwitch(config)#interface vlan 20 DLSwitch(config-if)#ip address 172.132.255. (Console into DLSwitch) . (Console into ALSwitch) ALSwitch#configure terminal ALSwitch(config)#vtp mode client ALSwitch(config)#vtp domain cisco ALSwitch(config)#exit ALSwitch#copy running-config startup-config 3) Configure VLANs on the distribution layer switch.16.255. not CISCO because it is case sensitive. (Console into DLSwitch) To create VLANs on a switch.71.1 255.Section: (none) Explanation Explanation/Reference: 1) Configure the VTP information with the distribution layer switch as the VTP server.0 DLSwitch(if-config)#no shutdown DLSwitch(if-config)#exit 4) Configure inter-VLAN routing on the distribution layer switch. 2) Configure the VTP information with the access layer switch as a VTP client.16. (Console into DLSwitch) DLSwitch#configure terminal DLSwitch(config)#vtp mode server DLSwitch(config)#vtp domain cisco <<use cisco.255.0 DLSwitch(config-if)#no shutdown DLSwitch(config-if)#exit DLSwitch(if-config)#interface vlan 21 DLSwitch(if-config)#ip address 172.1 255.255.

CORE. No access is provided to ASW1 or ASW2.Old CCNP SWITCH Labs Acme is a small export company that has an existing enterprise network comprised of 5 switches. with isolating the cause of these issues and implementing the appropriate solutions. however. No configuration changes will be possible on these routers. – Traffic for VLAN 30 should be forwarding over the gig 1/0/6 trunk port between DSW1 and DSW2. Previous configuration attempts have resulted in the following issues: – CORE should be the root bridge for VLAN 20.VTP Lab 2 Sim (Certprepare) . VLAN 40 is currently using gig 1/0/6. DLSwitch(config)#ip routing DLSwitch(config)#exit DLSwitch#copy running-config startup-config Source: http://www. DSW1. ASW1 and ASW2. You task is complicated by the fact that you only have full access to DSW1. You have been tasked with isolating the cause of these issuer and implementing the appropriate solutions. DSW2. The topology diagram indicates their desired pre-VLAN spanning tree mapping. . and DSW2 using the enable 2 level with a password of acme. VLAN 30 is currently using gig 1/0/5. However. . Your task is complicated by the fact that you only have full access to DSW1. DSW1 is currently the root bridge for VLAN 20. Only limited show command access is provided on CORE.com/vtp-lab QUESTION 8 SIMULATION . However. – Traffic for VLAN 40 should be forwarding over the gig 1/0/5 trunk port between DSW1 and DSW2. with the enable secret password cisco.certprepare.

however. We need to make CORE switch the root bridge for VLAN 20.Correct Answer: Section: (none) Explanation Explanation/Reference: Console into DSW1 1) CORE should be the root bridge for VLAN 20. DSW1 is currently the root bridge for VLAN 20. DSW1>enable DSW1#show spanning-tree <<check status "This bridge is the root" via Root ID DSW1#configure terminal DSW(config)#spanning-tree vlan 20 priority 61440 .

all VLAN and VTP configurations are to be completed in the global configuration mode. The new distribution-layer switch has been installed and a new access-layer switch cabled to it. Your task is to configure VTP to share VLAN information from the distribution-layer switch to the access-layer devices. Please reference the following table for the VTP and VLAN information to be configured: . VLAN 40 is currently using gig 1/0/6. Also. DSW1(config)#interface g1/0/5 DSW1(config-if)#spanning-tree vlan 40 cost 1 DSW1(config-if)#end You should re-check to see if everything was configured correctly: DSW1#show spanning-tree Save the configuration: DSW1#copy running-config startup-config Source: http://www. it is neccessary to configure interVLAN routing on the distribution-layer switch to route traffic between the different VLANs that are configured on the access-layer switches. However VLAN 30 is currently using gig 1/0/5. However. Then.certprepare. because VLAN database mode is being depricated by Cisco.2) Traffic for VLAN 30 should be forwarding over the gig 1/0/6 trunk port between DSW1 and DSW2. however.com/vtp-lab-2 QUESTION 9 SIMULATION .VTP Lab: Central Offices (Footwear Distributor) The central offices for a footwear distributor are enhancing their wiring closets with Layer 3 switches. it is not neccessary for you to make the specific VLAN port assignments on the access-layer switches. DSW1(config)#interface g1/0/6 DSW1(config-if)#spanning-tree vlan 30 port-priority 64 DSW1(config-if)#exit 3) Traffic for VLAN 40 should be forwarding over the gig 1/0/5 trunk port between DSW1 and DSW2.

Configure the VTP information with the distribution layer switch as the VTP server 2. Configure inter-VLAN routing in the distribution layer switch 5.71. Configure VLANs in the distribution layer switch 4.1/24 These are your specifc tasks: 1.132.16. click on the host icon that is connected to the switch using a serial console cable. Correct Answer: Section: (none) Explanation Explanation/Reference: VTP Server Configuration switch#configure terminal switch(config)#vtp mode server . All VLANs and VTP configurations are to be completed in the global configuration To configure the switch.16. 6.VTP Domain Name: cisco VLAN IDs: 20. Specifc VLAN port assignments will be made as users are added to the access layer switches in the future.1/24 172. Configure the VTP information with the access layer switch as a VTP client 3.31 IP Addresses 172.

it is neccessary to configure interVLAN routing on the distribution-layer switch to route traffic between the different VLANs that are configured on the .64.20.1 255.162.1 255.0 switch(config-if)#no shutdown switch(config-if)#exit switch(config)#ip routing switch(config)#end switch#copy run start VTP Client Configuration switch#configure terminal switch(config)#vtp mode client switch(config)#vtp domain CISCO switch#copy run start QUESTION 10 SIMULATION .255.31. The new distribution-layer switch has been installed and a new access-layer switch cabled to it.255.0 switch(config-if)#no shutdown switch(config-if)#interface vlan 31 switch(config-if)#ip address 192. Then.255. switch(config)#vtp domain CISCO switch(config)#vlan 20 switch(config)#vlan 31 switch(config)#interface vlan 20 switch(config-if)#ip address 172.255. Your task is to configure VTP to share VLAN information from the distribution-layer switch to the access-layer devices.VTP Lab: Headquarter Offices (Book Retailer) The headquarter offices for a book retailer are enhancing their wiring closets with Layer 3 switches.

Configure inter-VLAN routing in the distribution layer switch 5. all VLAN and VTP configurations are to be completed in the global configuration mode. All VLANs and VTP configurations are to be completed in the global configuration To configure the switch.access-layer switches. Please reference the following table for the VTP and VLAN information to be configured: VTP Domain Name: cisco VLAN IDs: 20. because VLAN database mode is being depricated by Cisco. however.71. Configure the VTP information with the access layer switch as a VTP client 3. Also.31 IP Addresses 172. Configure VLANs in the distribution layer switch 4. Configure the VTP information with the access layer switch TestKing2 as a VTP client . Correct Answer: Section: (none) Explanation Explanation/Reference: These are yiur specifc tasks: 1. Configure the VTP information with the distribution layer switch TestKing1 as the VTP server 2. Specifc VLAN port assignments will be made as users are added to the access layer switches in the future.132.1/24 172. Configure the VTP information with the distribution layer switch as the VTP server 2. click on the host icon that is connected to the switch using a serial console cable.16.16. it is not neccessary for you to make the specific VLAN port assignments on the access-layer switches. 6.1/24 These are your specifc tasks: 1.

VTP Server Configuration switch#configure terminal switch(config)#vtp mode server switch(config)#vtp domain CISCO switch(config)#vlan 20 switch(config)#vlan 31 switch(config)#interface vlan 20 switch(config-if)#ip address 172.3.31.255.255.0 switch(config-if)#no shutdown switch(config-if)#interface vlan 31 switch(config-if)#ip address 192.255. click on the host icon that is connected to the switch using a serial console cable.1 255.1 255.0 switch(config-if)#no shutdown switch(config-if)#exit switch(config)#ip routing switch(config)#end switch#copy run start VTP Client Configuration switch#configure terminal switch(config)#vtp mode client switch(config)#vtp domain CISCO switch#copy run start . Configure VLANs on the distribution layer switch TestKing 4.162.20.64. Configure inter-VLAN routing on the distribution layer switch TestKing1 5. 6.255. Specifc VLAN port assigoments will be made as users are added to the access layer switches in the future. All VLANs and VTP configurations are to be completed in the global configuration To configure the switch.

Official QUESTION 1 Drag and Drop .Drag and Drop . Select and Place: Correct Answer: .CDP / LLDP (Official) Drag and drop the characteristic from the left to the matching Layer 2 protocol on the right.

Select and Place: .PortFast / BPDU Guard / BPDU Filter (Official) Drag and drop the characteristic from the left to the matching STP feature on the right.Section: (none) Explanation Explanation/Reference: QUESTION 2 Drag and Drop .

Correct Answer: .

Section: (none) Explanation .

Explanation/Reference: QUESTION 3 Drag and Drop .PVST+ / Rapid PVST+ / MSTP (Official) Drag and drop the characteristic from the left to the matching STP mode on the right. Select and Place: .

Correct Answer: .

STP Components (Official) .Section: (none) Explanation Explanation/Reference: QUESTION 4 Drag and Drop .

Select and Place: .Drop the STP components from the left onto the correct descriptions on the right.

Correct Answer: Section: (none) Explanation .

Select and Place: .LLDP-MED TLVs (Official) Drag and drop the LLDP-MED TLVs from the left onto the correct statements on the right.Explanation/Reference: QUESTION 5 Drag and Drop .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

Select and Place: .STP Characteristics (Official) Drag and drop the characteristic from the left to the matching STP category on the right.QUESTION 6 Drag and Drop .

Correct Answer: Section: (none) Explanation Explanation/Reference: STP: Switch Priority .

Select and Place: .increment of 4096 .increments of 16 STP: Path Cost . STP: Port Priority .SPAN Source and Destination Ports (Official) Drag and drop the statements about SPAN source and destination ports from the left onto the correct port types on the right.200000000 QUESTION 7 Drag and Drop . .The lowest value is preferred.Default value is based on interface speed..value range from 1 .default value of 128 .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

It can be monitored as a bundled logical port or as individual physical ports .Its original configuration is overwritten by the SPAN configuration QUESTION 8 Drag and Drop .It can be trunk or an access port .It is not supported as part of a VLAN . Not all options are used.HSRP Correct Statements (Official) Drag and drop the correct statements about HSRP from the left into the True column on the right.Multiple VLANs can be included in a single session Destination Port . Select and Place: .It acts as the monitoring port .Source Port .

Correct Answer: .

HSRPv1 and HSRPv2 use different multicast addresses for hello packets. .Section: (none) Explanation Explanation/Reference: True .

QUESTION 9 Drag and Drop . . .It is a Cisco-proprietary implementation of FHRP.It supports authentication. Select and Place: .VRRP Version 2 and VRRP Version 3 / VRRP Version 3 (Official) Drag and drop the description of VRRP from the left onto the correct versions of VRRP on the right.It can share a virtual MAC or IP address among a group of routers..

STP Timers .Correct Answer: Section: (none) Explanation Explanation/Reference: QUESTION 10 Drag and Drop .

Select and Place: Correct Answer: .

Section: (none) Explanation .

Guard Root / Guard Loop Select and Place: Correct Answer: .Explanation/Reference: QUESTION 11 Drag and Drop .

Section: (none) Explanation Explanation/Reference: QUESTION 12 Drag and Drop .Switch Stack Process Select and Place: .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

QUESTION 13 Drag and Drop .LACP vs PAGP Select and Place: Correct Answer: .

Section: (none) Explanation Explanation/Reference: QUESTION 14 Drag and Drop .VSS vs STACK Select and Place: .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

RSPAN True and False (5th March 2018) Select and Place: Correct Answer: .QUESTION 15 Drag and Drop .

Supports only VTP .MAC address learning is disabled .Section: (none) Explanation Explanation/Reference: True .Supports only STP .

Uses VLAN ID 2-1024 .Uses VLAN ID 2-1001 .False .

Drag and Drop .LLDP-TLV (Concepts Only) LLDP-MED Capabilities TLV Network Policy TLV Select and Place: .Concepts QUESTION 1 Drag and Drop .

.

Correct Answer: .

.

Section: (none) Explanation Explanation/Reference: QUESTION 2 Drag and Drop .LLDP-TLV (Concepts Only) Power Management TLV Inventory Management TLV Location TLV Select and Place: .

.

Correct Answer: .

.

STP Timer Delay (Concepts Only) Diameter of the STP Domain (dia) Bridge Transit Delay (transit delay) BPDU Transmission Delay (bpdu_delay) Select and Place: .Section: (none) Explanation Explanation/Reference: QUESTION 3 Drag and Drop .

.

Correct Answer: .

.

Section: (none) Explanation Explanation/Reference: QUESTION 4 Drag and Drop .STP Timer Delay (Concepts Only) Message Age Increment Overestimate (msg_overestimate) Lost Message (lost_msg) Transmit Halt Delay (Tx_halt_delay) Select and Place: .

Correct Answer: .

Section: (none) Explanation .

Explanation/Reference: QUESTION 5 Drag and Drop .STP Timer Delay (Concepts Only) Medium Access Delay (med_access_delay) End-to-end BPDU Propagation Delay Maximum Transmission Halt Delay Select and Place: .

.

Correct Answer: .

.

Section: (none) Explanation Explanation/Reference: QUESTION 6 Drag and Drop .CONCEPT ONLY (UNOFFICIAL) Select and Place: .RSPAN Steps (Concept 1) .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

CONCEPT ONLY (UNOFFICIAL) Select and Place: .RSPAN Steps (Concept 2) .QUESTION 7 Drag and Drop .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

https://www.CONCEPT ONLY (UNOFFICIAL) Select and Place: .– Step 1: Configure a VLAN as an RSPAN VLAN. – Step 3: Associate an RSPAN destination session number with the RSPAN VLAN. – Step 5: Associate an RSPAN destination session number with the destination port.cisco.pdf QUESTION 8 Drag and Drop . – Step 4: Associate an RSPAN source session number with the RSPAN VLAN.VRRPv2 vs VRRPv3 (Concept 1) . – Step 2: Associate an RSPAN source session number with source ports or VLANs.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_40_se/configuration/guide/scg/swspan.

.

Correct Answer: .

.

CONCEPT ONLY (UNOFFICIAL) Select and Place: .HSRPv1 vs HSRPv2 (Concept 1) .Section: (none) Explanation Explanation/Reference: QUESTION 9 Drag and Drop .

.

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 10
Drag and Drop - RSPAN (True & False) - CONCEPT ONLY

Select and Place:

Correct Answer:

Section: (none)

Explanation

Explanation/Reference:

QUESTION 11
Drag and Drop - Stack Master Election Process (CONCEPT ONLY)

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Stack Master Election

1. The switch that is currently the stack master.
2. The switch with the highest stack member priority value.
3. The switch that uses the non-default interface-level configuration.
4. The switch with the higher Hardware/Software priority.
5. The switch with the longest system up-time.
6. The switch with the lowest MAC address.

Reference: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/71925-cat3750-create-switch-stks.html#anc10

QUESTION 12
Drag and Drop - DHCP Snooping Process (Concept 1) - CONCEPT ONLY (UNOFFICIAL)

Select and Place:

Correct Answer:

Enable DHCP snooping on selected VLANs Step 3 .Enable Dynamic ARP Inspection (DAI) Step 4 .Enable DHCP snooping globally Step 2 .Section: (none) Explanation Explanation/Reference: Step 1 .Enable ARP inspection on selected VLANs QUESTION 13 .

RADIUS vs TACACS+ (Concept 1) .Drag and Drop .CONCEPT ONLY (UNOFFICIAL) Select and Place: .

.

Correct Answer: .

.

Encrypts only the password in access-request packet from client to server .Uses TCP port 49 Reference: https://www.html QUESTION 14 Drag and Drop .com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.Does offer Multiprotocol support .Encrypts the entire body of the packet .Combines authentication and authorization .Does not offer Multiprotocol support .Is a client-server model .Section: (none) Explanation Explanation/Reference: RADIUS .Uses UDP port 1812 TACACS+ .RADIUS vs TACACS+ (Concept 2) .Separates AAA and performs three-way challenge .cisco.CONCEPT ONLY (UNOFFICIAL) Select and Place: .Cisco proprietary .

Correct Answer: .

Section: (none) .

CHAP.Assign privilege levels to commands .Provides two methods to control authorization of router commands on a per-user or per-group basis Reference: https://www.Is not as useful for router management or as flexible for terminal services .Explanation Explanation/Reference: RADIUS . PAP.Explicitly specify on a per-user or per-group basis of which commands are allowed .Does not allow users to control which commands can be executed on a router .Authenticated through the use of a shared secret .Port Priorities (CONCEPT ONLY) Port Cost / Switch Port Priority / Port Priority Select and Place: .cisco.html QUESTION 15 Drag and Drop . UNIX login and other authentication mechanisms TACACS+ .Allow router verify whether if the user is authorized at specified privilege level .com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.Supports PPP.

Correct Answer: .

Section: (none) Explanation .

Explanation/Reference: QUESTION 16 Drag and Drop .Switch Port Priorities (CONCEPT ONLY) Port Priority / Switch Priority / Path Cost Select and Place: .

Correct Answer: .

Section: (none) .

VRRPv2 & VRRPv3 vs VRRPv3 Comparison (8th March 2018) .Explanation Explanation/Reference: QUESTION 17 Drag and Drop .CONCEPT ONLY Select and Place: Correct Answer: .

Section: (none) Explanation Explanation/Reference: VRRP v2 and VRRP v3 – Assign IP address in the Layer 3 Ethernet – Send hello messages to multicast address 224.18 – Something about IGMP – Supports VTP .0.0.

VRRP v3 – Supports IPv6 – Timers in millisecond .

The switch that is currently the stack master .Contribute QUESTION 1 What happens if an interface within channel group is configured as SPAN destination? A. STP D. will not be operational C. LACP B. the link will be in error-disable D. which technology supports that? A. Port Security Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 3 Which will identify the master switch in stackwise? A. PagP C. will operate normal Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 2 EtherChannel guard misconfig is configured on a switch.MCQs April 2017 . Portchannel will forward traffic to source span B.

B. The switch with the highest stack member priority value C. The switch that uses the non-default interface-level configuration D. The switch with the lower priority stack member priority value Correct Answer: B Section: (none) Explanation Explanation/Reference: .

64 B. 1518 D.MCQs May 2017 . 1522 Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 2 How will the traffic reach the core switch from AS switch to DS core switch? . 128 C.1Q? A.Contribute QUESTION 1 What is the Ethernet frame size for 802.

ASW1 to DWS1 to core B.) A. ASW1 to DSW1 to DSW2 to core D. two distribution and two access switches on each distribution switch. with redundant links and bandwidth mentioned. ASW1 to DSW2 to DSW1 to core Correct Answer: B Section: (none) Explanation Explanation/Reference: . ASW1 to DWS2 to core C.(Based on a topology shown with one core.

00-00-0C-07-AC-2D B.QUESTION 3 If HSRP group number is 45 what would be the MAC address? (Basically conversion of digit to hexadecimal with group of 16. 0000-070C-AC2D D. 0000-0C07-AC45 C. 0000-C004-ACD2 Correct Answer: A Section: (none) Explanation Explanation/Reference: HSRP vMAC: 0000-0C07-AC?? -> 0000-0C07-AC2D .) A.

vrrp [group-number] priority [priority] C. vrrp [group-number] preempt D. vrrp [group-number] ip [ip-address] B. (Choose three. not VRRP. Enable this feature by using the (config)# spanning-tree etherchannel guard misconfig global configuration command.html QUESTION 5 Select a valid VRRP configuration from a list of possible configurations. just take a good look a t a few valid VRRP configuration examples so that you will be able to recognize invalid ones.x are wrong. B. . as that would be HSRP..com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/ configuration/guide/3750xscg/swstpopt.) A. Anyway.... This command is not available in Cisco Switches D.cisco. Enable this feature by using the (config-if)# spanning-tree etherchannel guard misconfig command Correct Answer: A Section: (none) Explanation Explanation/Reference: Enabling EtherChannel Misconfiguring Guard – http://www.x. The number 1 is the group number. A.x. standby [group number] priority [priority] E. Also. You don’t need the word ‘group’ in the configuration line. I think the options that put things like vrrp group 1 ip x.CISCO_ID : HSRP_ID : GROUP_ID 2D=45 QUESTION 4 A question on EtherChannel misconfiguration. standby [group number] preempt Correct Answer: ABC Section: (none) Explanation Explanation/Reference: You can eliminate configurations with the word ‘standby’.. Spanning Tree portfast feature must be disabled per interface basis C..

what is the process to configure EtherChannel. Shutdown is necessary if the ports are in err-disable D. 129 . Don't need to shutdown the ports Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 8 A question about spanning-tree port-priority. A. isolated C. A. A.QUESTION 6 Private VLANs (PVLANs) have two secondary VLAN types. host Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 7 EtherChannel . shutdown both interface ports B. 127 B. community B. promiscuous D. shutdown the interface on one side only C.

(config)# spanning-tree etherchannel guard misconfig B. (config-if)# spanning-tree etherchannel guard misconfig C. 4096 Correct Answer: A Section: (none) Explanation Explanation/Reference: If all priorities are default the value is 128. 00-00-0C07-AC25 B. (config)# spanning-tree etherchannel misconfig guard D. (config-if)# spanning-tree etherchannel misconfig guard Correct Answer: A Section: (none) Explanation Explanation/Reference: Enabling EtherChannel Guard – http://www.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/ guide/3750xscg/swstpopt.. 0000-C007-AC25 D. QUESTION 9 Question about EtherChannel based on STP EtherChannel misconfig... Lesser is better in this case.. what would be the vMAC (virtual MAC) address? A. 0000-0C07-AC37 C.C. 128 D.cisco..html QUESTION 10 If HSRP group number is 37. A. 0000-C007-AC37 Correct Answer: A . the only one answer who has the less value in this case is 127.

host D.Section: (none) Explanation Explanation/Reference: HSRP vMAC: 0000-0C07-ACXX Converting 37 Decimal to hexadecimal = 25 HSRP vMAC = 0000-0C07-AC25 QUESTION 11 What is the default value for spanning-tree port-priority? A. 128 B. 1024 Correct Answer: A Section: (none) Explanation Explanation/Reference: https://www...com/c/m/en_us/techdoc/dc/reference/cli/n5k/commands/spanning-tree-port-priority.. promiscuous C. 64 C. isolated B. 32 D..html QUESTION 12 When you configure PVLAN to the portal facing to the router what kind of . should be? A. community Correct Answer: B Section: (none) Explanation .cisco.

0x0800 D. 0x0806 B. unicast D.Explanation/Reference: QUESTION 13 Which option TPI 802. if write command “switchport mode trunk portfast”? (I don’t remember properly) A.1Q tag? A. 0x888E C. router C. 0x8100 Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 14 MAC address filter? A. CPU-destined B. trunk port will be immediately . multicast Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 15 Question about what would be.

All ports of the new switch are changed to listening state Correct Answer: B Section: (none) Explanation Explanation/Reference: https://www.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10588-74. Allow two root bridges in a network D.B. (config)#spanning-tree loop-guard default D. (config-if)#spanning-tree guard loop E. (config-if)#spanning-tree guard Correct Answer: D .cisco. BDPU turn this port to shutdown Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 16 What statement is true if a new switch with a lower bridge ID is introduced in a network with root guard enhancement? A. Root Guard puts the port into root-inconsistent C. BDPU turn this port to err-disabled D. (config-if)#spanning-tree loop C. trunk port can be portfast mode C. (config)#spanning-tree loop guard default B. Prevent unknown switch be a root port B.html QUESTION 17 How to configure loop guard in a Cisco switch IOS? A.

Correct Answer: B Section: (none) Explanation Explanation/Reference: . VLAN 1 is the default VLAN. D. C. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 19 Question about the behavior of an access port when a tagged packet is received. B. tag is removed and packet is forwarded on the VLAN of the trunk port. A. None until the port VLAN is determined. tag is removed and packet is forwarded to the VLAN mentioned in the tag.Section: (none) Explanation Explanation/Reference: spanning-tree guard loop Router(config)#interface gigabitEthernet 1/1 Router(config-if)# spanning-tree guard loop QUESTION 18 Which statement is true about dynamic access port? A. All VLANs are permitted in a dynamic access port link. B. Per default the port has to participate in a VLAN election to determine which VLAN a port is assigned. D. tag is removed and packet is forwarded on the VLAN of the access port. packet is dropped. C.

A. (config-if)# spanning-tree port-priority 129 Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 22 A question on EtherChannel misconfiguration. vlan 510 remote span C. vlan 4029 remote span B. PortFast B. A. PAGP . (config)# spanning-tree port-priority 127 B. vlan 510 span D. (config)# spanning-tree port-priority 129 D. A. (config-if)# spanning-tree port-priority 127 C. vlan 4029 span Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 21 A question about configuring spanning-tree port-priority based on a diagram where all port-priorities are default.QUESTION 20 A question about RSPAN configuration in VTPv2.

LACP D. Console is the only backup authentication method C.C. You can set user privileged levels D. Console is a backup authentication method B. STP Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 23 A question on local database for consoling to network devices. VSS Correct Answer: ABD . BPDUguard E. VRRP F. configuration ports into EtherChannel D.) A. security violation C. (Choose three) A. (Choose two. Consoling to network devices is not possible Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 24 Three reasons for err-disable. storm control B.

CDP or LLDP must be enable on switch D. Traffic in network is doubled C.Late-collision detection .Duplex mismatch . The traffic is cached in NVRAM Correct Answer: A Section: (none) Explanation Explanation/Reference: .A cable that is out of specification (either too long.UniDirectional Link Detection (UDLD) condition .Layer 2 Tunneling Protocol (L2TP) guard .Incorrect GBIC / Small Form-Factor Pluggable (SFP) module or cable .BPDU guard violation . or defective) . Destination port is unusable for normal use B.Link-flap detection .Port channel misconfiguration .Port Aggregation Protocol (PAgP) flap .Address Resolution Protocol (ARP) inspection .Storm Control QUESTION 25 What can happen after a RSPAN configuration in a Cisco switch? A. The reason can be: .DHCP snooping rate-limit .Section: (none) Explanation Explanation/Reference: There are various reasons for the interface to go into errdisable.Port duplex misconfiguration .Inline power . the wrong type.Security violation .Bad network interface card (NIC) card (with physical problems or driver problems) .

Local user dbs is the only backup authentication method C.) A. (config)# spanning-tree loopguard enable D. (config)# spanning-tree guard loop Correct Answer: AB Section: (none) Explanation Explanation/Reference: https://www. (Choose two.cisco. Local user dbs can be main and also backup authentication method B.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10596-84. You can set user privileged levels D. (config-if)# spanning-tree guard loop C. Local user dbs is used after 3 unsuccessful logins via RADIUS server E.html#loop_guard QUESTION 28 What happens if a switch with dhcp snooping and ip source guard enabled globally.QUESTION 26 A question on local user database for login to network devices. AAA authentication must be implemented on switch Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 27 What are the two ways to configure loop guard? A. (config-if)# spanning-tree loopguard default E. (config)# spanning-tree loopguard default B. what does the switch do when it receives a packet with option 82? .

” (see “Enabling or Disabling Option 82 User Defined Data Insertion and Removal”) <<ingress (in) Layer 3 egress – this sounds right "Enters interface configuration mode. Proxy ARP D. Nothing Correct Answer: B Section: (none) Explanation Explanation/Reference: The switch removes the option-82 field and forwards the packet to the switch port that connects to the DHCP client that sent the DHCP request. http://www.A. Remove 82 and forward C.cisco. Layer 4 ingress Correct Answer: AB Section: (none) Explanation Explanation/Reference: Layer 2 ingress – “Enters interface configuration mode. Layer 3 ingress D. Layer 2 egress E.html QUESTION 29 Which two statements are true about Option 82? (Choose two. Layer 3 egress C. where slot/port is the interface for which you want to enable or disable subnet broadcast support for the DHCP relay agent.) A. Drop B. Layer 2 ingress B. (see "Enabling or Disabling Subnet Broadcast Support for the DHCP Relay Agent on a Layer 3 Interface") <<egress (out) .com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/security/configuration_guide/b_sec_3se_3850_cg/ b_sec_3se_3850_cg_chapter_01100. where slot/port is the Layer 2 Ethernet ingress interface where you want to configure the option 82 string. Layer 4 egress F.

show access ports B. (Choose two.com/c/en/us/td/docs/switches/datacenter/nexus3548/sw/security/6-x/b_N3548_Security_Config_602_A11/ b_N3548_Security_Config_602_A11_chapter_01011. .http://www. Disabled by default B.html QUESTION 30 Which command is used to verify trunk native VLANs? A.) A.cisco. show interfaces trunk C. Enters on untrusted port C. show vlan native trunk Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 31 Question about voice VLAN. show trunk D. Default CoS value of 5 for untagged.

(Choose two. B. D. . UDLD messages are sent every 15 seconds. UDLD tries to reestablish link once before declaring the link down.) A. DSW1: change port priority but in global configuration mode. 2 ALSW. Question is how to make DSW1 the primary root for VLAN 10. port is turned to errdisable. E. 2 PCs per ALSW. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 33 Diagram is: with 1 core. When unidirectional fail is detected. DSW1: change bridge priority to 4096 (lowest). DSW1: change bridge priority but value is 0. Needs manual enable of PortFast.D. 2 DSW connected with EtherChannel. UDLD automatically sends message interval based on configured timers. DSW1: change bridge priority but command is priority root. C.) A. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 32 Question about UDLD aggressive. port state is determined by spanning tree. C. F. Per diagram current root for VLAN 10 is DSW2. DSW2: change bridge priority to 61440 (highest). E. (Choose two. When unidirectional fail is detected. B. D. UDLD sends messages four times the message interval by default.

Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 34 How to configure dynamic ARP inspection on a VLAN? A. (config-if)# ip arp inspection vlan C. root primary B.cisco. reflector D. diameter C. (config)# ip arp inspection vlan B.html QUESTION 35 What keyword in macro command is used to configure a root bridge and automatically adjust STP timers? A. STP bridge root Correct Answer: B Section: (none) Explanation Explanation/Reference: Source: https://www. (config)# arp inspection default D. (config-if)# inspection arp vlan Correct Answer: A Section: (none) Explanation Explanation/Reference: Source: https://www.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/19120-122.html .com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/dynarp.cisco.

QUESTION 36 Question about interoperability between MST and RSTP. disable RSTP and uses bpdu type 4 B. Trunk port will be immediately B.cisco. enable RSTP and uses bpdu type 4 C. Protocol ID: 2 bytes (0x0000 IEEE 802. if write command “spanning-tree portfast trunk”? A. disable RSTP and uses bpdu type 2 D.1aq BPDUs have the following format: 1. http://www. A. BPDU Type: 1 byte (0x00 Config BPDU. MST interoperates with Rapid PVST+ with no need for user configuration. Flags: 1 byte QUESTION 37 Question about what would be.1w BPDU (Version 2). 0x80 TCN BPDU.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli_rel_4_0_1a/CLIConfigurationGuide/MST.1D) 2. Trunk port can be portfast mode C.html#40909 Bridge Protocol Data Unit fields[edit] IEEE 802. 0x02 RST BPDU) 4. The port is removed from trunk Correct Answer: B Section: (none) Explanation . enable RSTP and uses bpdu type 2 Correct Answer: D Section: (none) Explanation Explanation/Reference: 802. Version ID: 1 byte (0x00 Config & TCN / 0x02 RST / 0x03 MSTP / 0x04 SPT BPDU) 3.1D and IEEE 802. BDPU turn this port to err-disabled D.

wordpress. Static bindings can't be removed from MAC address table. Every entry in MAC address table has VLAN assigned. flash Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 39 What statement about MAC address table is true? A. slave C. C. Extended VLANs doesn’t have VLAN assigned in MAC address table. D. B.) A.Explanation/Reference: Source: https://cciepursuit. Private VLANs doesn't have to be assigned in MAC address table. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 40 What statements about STP path cost are true? (Choose two. master B.com/2009/01/20/enabling-portfast-on-trunks/ QUESTION 38 Where is SDM template stored in a Stackwise configuration? A. Long path cost is 64 bits . NVRAM D.

DSW1 and DSW2 need to communicate with each other to determine the role.cisco. Which technology is it using? A.) A. Default path cost is short E. STP B. Frame has CRC C. LLDP multicast address is 0100-0CCC-CCCC E. LLDP frame is compatible with CDP v2 D. Frame has destination multicast address B.com/c/en/us/products/collateral/switches/catalyst-6500-virtual-switching-system1440/prod_qas0900aecd806ed74b.html QUESTION 42 Which two statements about frame LLDP is true? (Choose two. Can't be used for POE negotiation . They have equal path cost by default Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 41 In a Virtual Switching System.B. RSPAN C. MST uses long path cost D. Short path cost is 32 bits C. LACP Correct Answer: C Section: (none) Explanation Explanation/Reference: Source: https://www. VSL Protocol (Virtual Switch Link) D.

) A. Destination ports SPAN work on L2 (Layer 2). switchport trunk allowed vlan except 55 D. Destination and source port SPAN don't work on L2 (Layer 2). Source ports SPAN work on L2 (Layer 2).wireshark. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 44 Which two commands is used to remove VLAN 55 from the trunk port? (Choose two. remove 55 B. Destination and source port SPAN works on L2 (Layer 2).org/LinkLayerDiscoveryProtocol QUESTION 43 Which statement about frame SPAN is true? A. C. switchport remove vlan 55 E. B.Correct Answer: AB Section: (none) Explanation Explanation/Reference: Source: https://wiki. D. switchport trunk remove vlan 55 Correct Answer: BC Section: (none) Explanation Explanation/Reference: . switchport trunk allowed vlan remove 55 C. switchport trunk allowed vlan add 3.

LACP priority is used to determine which port is put in standby mode. C. On a switch there can be only one RSPAN VLAN . D. aaa authentication exec default group radius Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 46 Question about LACP priority. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 47 Which information is true about RSPAN? A. aaa authorization group default radius D. RSPAN VLAN carries only RSPAN traffic B. aaa authorization exec default group radius B. B. LACP priority is used to determine which port is used to form the EtherChannel. Which statement is true? A. There was a command about LACP priority. LACP priority is removed from EtherChannel. aaa authentication default group login C.QUESTION 45 AAA question about the command used to login a user and set immediate access to privilege mode. A.

0x8100 B. RSPAN VLAN carries RSPAN traffic along multiple switches D. RSPAN can be enable only in a Layer 3 switch Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 48 What statement is true about PVST? A.C. STP is the default mode on Cisco switches Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 49 What is the value of the TPID/tag protocol identifier in dot1q? A. PVST+ is the default STP mode on Cisco switches B. 0x8200 Correct Answer: A Section: (none) Explanation . Is the default mode on Cisco switches D. Rapid PVST+ is the default STP mode on Cisco switches C. 0x8b45 D. 0x8a88 C.

DSW1: interface g1/0 C. Change in port priority so traffic goes through DSW1 to DSW2. 0x8b45 D. its name is S-TAG (Service tag. (Choose two. DSW2: interface g1/0 E. 0x8a88 (or 0x88a8 ???) B. 0x8100 C. 0x8200 Correct Answer: A Section: (none) Explanation Explanation/Reference: The outer tag is the one closer/closest to the Ethernet header. Default port priority is configured. Link connected from PC1 to DSW2 is 4Gbps and DSW1 is 10gbps.Explanation/Reference: C-TAG (Customer tag. PC1 is connected to DSW1 and DSW2 root bridge. There is an EtherChannel trunk between DSW1 and DSW2. DSW1: spanning-tree port priority 0 Correct Answer: AB Section: (none) Explanation Explanation/Reference: . DSW2: spanning-tree port priority 16 D. Core switch is connected to 2 distribution switches which are connected to 2 access switches. with ethertype 0x8100) QUESTION 50 What is the value of the TPID/tag protocol identifier of QinQ? A.) A. ethertype 0x88a8) QUESTION 51 EXHIBIT INCLUDED. DSW1: spanning-tree port priority 16 B. About port priority.

) A. How can the port be brought back to operational status? A. trunk allowed vlan 116 C. Now admin has entered “no bpdu guard enable” command. Rebooting the switch Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 53 Which two configurations cause the frames to be tagged? (Choose two. interface with access and voice VLAN configured to 116 D. switchport mode on Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 54 EtherChannel load balancing with an exhibit. With the command: UDLD reset D. With the command: disable autorecovery BPDU guard C.QUESTION 52 Exhibit included which it had BPDU guard configured and received BPDU. With the command: shutdown + no shutdown B.116 encapsulation dot1q B. interface gi 0/1. . interface encapsulation native vlan E.

Which EtherChannel load balancing algorithm should be used to optimize the EtherChannel links between switches? A. Destination MAC Correct Answer: A Section: (none) Explanation Explanation/Reference: . Source MAC B. Destination IP D. Source-dest MAC C.

VLAN Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 57 Which statement is true about GLBP? . SVI C. switchport trunk allowed vlan remove vlan 100 B.99-250 A. DCSP D. switchport trunk allowed vlan except vlan 100 D. switchport trunk remove vlan 100 Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 56 What is the link called between a VSS? (CONCEPT ONLY) A.101-250 C.) EXHIBIT . VSL (Virtual Switch Link) B.99.switchport trunk allowed vlan 1.80.QUESTION 55 Which two commands will remove VLAN 100 from the allowed VLAN list? (Choose two. switchport trunk allowed vlan 1-80.

VRRP uses multicast address 224.0.cisco. Two AVG could be elected on a switch C.0. VRRP uses multicast address 224.0. VRRP uses multicast address 224.0.0.cisco. B.0. GLBP uses multicast address 224. D.0.18 and uses IP Protocol 112 B.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp. Only one AVG can be elected on a switch B.A. VRRP uses multicast address 224.2 and uses IP Protocol port 3222 D.0.102 with TCP port 3222.0. GLBP supports 8 AVGs per group Correct Answer: A Section: (none) Explanation Explanation/Reference: Source: https://www. GLBP uses multicast address 224. GLBP uses multicast address 224. VRRP uses multicast address 224.2 with TCP port 3222.0.0.0.18 with UDP port 3222 Correct Answer: A Section: (none) Explanation Explanation/Reference: Source: https://www.0.html QUESTION 59 Which statement is true about VRRP? A.9 and uses UCP port 112 .0.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.0.html QUESTION 58 How many Active Virtual Gateways (AVG) can be used in a GLBP protocol? A. Two AVG just could be elected in GLBP v2 D.0. C.28 and uses UDP port 112 C.18 and uses TCP port 112 E.0.102 with UDP port 3222.0. GLBP uses multicast address 224.

(CONCEPT ONLY) A.0.0.com/c/en/us/support/docs/ip/hot-standby-router-protocol-hsrp/9234-hsrpguidetoc. B.html QUESTION 61 A question about the priority of a Stackwise switch. HSRP uses multicast address 224.cisco.0.0. Master member does not completely exist. HSRP uses broadcast address 224. C.0. HSRP uses multicast address 224. HSRP uses broadcast address 224. B. D.0.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 60 Which statement is true about HSRP? A. Master member is based on user aggression.0.22 with UDP port 32229 Correct Answer: A Section: (none) Explanation Explanation/Reference: Source: https://www.2 and uses UDP port 1985.2 with UDP port 1985 D.0. Correct Answer: A Section: (none) Explanation Explanation/Reference: . Master member is selected based on member’s priority. Master member will never be selected based on member’s priority.22 with TCP port 1122 C.

B. removes loops D. Network administrator must disable spanning-tree protocol Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 64 An exhibit with spanning-tree. B. UDLD reset D. . We have to configure shutdown and no shutdown. The command spanning-tree mode IEEE was implemented. The spanning-tree mode is IEEE.QUESTION 62 What is the benefit of UDLD? A. help in preventing loops C. C. Protocol used was IEEE. which is true? (There's an exhibit that shows f0/7 receive BPDU. provides backup for fiber B. (Choose two) A. Have to use errdisable recovery. determines switch path Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 63 When no spanning-tree bpdu guard enable is configured in f0/7.) A.

D. Other interface will recover . 224.2 D.0. The protocol does not supported by switches that utilizes EtherChannel.1. udld setting udld setting int f0/5 udld setting aggressive What happens if interface f0/5 has been damaged? A.0.1. 224.1 C.1.102 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 66 A question about UDLD.0.102 B.C. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 65 What is the multicast address for HSRP? A.1.0. 127. 224. E. The protocol is Cisco proprietary. The protocol is supported per MEC basis.

B. Packet is dropped. D. Destination Port Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 68 What will be the behavior of an access port when a tagged packet is received. Link stays up D. All links go down C. C. Monitor Port B. with a VLAN ID of an access port? A. The tag is removed and packet is forwarded to a VLAN of access port. The tag is not removed and packet is forwarded of the VLAN mentioned in the tag. Access Port C. Correct Answer: A Section: (none) . Forwarding Port D. B. The tag is removed and packet is forwarded of the VLAN mentioned in the tag. Reset interface Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 67 Question about the difference between RSPAN and SPAN. A.

DSW1 connected to DSW2 with 10G link and to ASW1 with 10G link also DSW2 connected to ASW1 with 1G link What is the path for traffic sourced from a PC connected to ASW1 to reach DSW1? A. ASW1 were connected to DSW2 B.Explanation Explanation/Reference: QUESTION 69 STP Topology Exhibit Included. LACP . which technology is used to PREVENT this type of misconfiguration from affecting the network? A. DSW1 were connected to ASW1 C. ASW1 were connected to ASW2 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 70 When using EtherChannel misconfiguration guard. DSW1 were connected to loopback interface D.

PAgP Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 71 When using EtherChannel misconfiguration guard. STP D. PAgP Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 72 An engineer needs to add a customer private VLAN to the network. which technology is used to SUPPORT this type of misconfiguration from affecting the network? A. Configure VTP in server mode D. What configuration is required to isolate the customer's traffic on the network? A. STP D. Disable VTP and manually configure the customer VLAN Correct Answer: A Section: (none) . Enable VTP v3 C.B. Configure transparent mode B. Port security C. LACP B. Port security C.

LLDP must be enable in an interface. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 74 EXHIBIT INCLUDED. B. Source IP B. Source MAC C.Explanation Explanation/Reference: QUESTION 73 What SPAN configuration is required to enable on a switch? A. A monitor VLAN is created for the SPAN traffic. Source Port Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 75 What is the behavior of an access port when a tagged packet is received other than the access VLAN value? . Destination MAC-Source D. Disable VTP pruning on trunk links. Question about the best load balancing method with an exhibit. D. C. Configure a source and destination port. A.

A. It will work. Packet is dropped Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 76 Refer to the exhibit. It will work. the new switch will communicate exist switch with PVST+ C. Not available D. which statement is true? A. It will not working between two switches. Tag is removed and packet is forwarded on the VLAN of the access port. B. the new switch will communicate exist switch with Rapid-PVST D. C.(Picture was showing from CLI “show spanning-tree vlan xx” that running on mode rapid-pvst). Which statement is true? . . Tag is removed and packet is forwarded of the VLAN mentioned in the tag. the new switch will communicate exist switch with MSTP Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 77 About VRRP configuration. If you have a new switch (that runs spanning-tree mode pvst+) connect to the exist switch. It will work. B.

What method / feature / functions you need to enable to prevent initial / potential broadcast of internal information / topology? (forgot the correct wording) A.168.168. Switch-A(config)# interface vlan 2 Switch-A(config-if)# ip address 192. Switch-A(config)# interface vlan 1 Switch-A(config-if)# ip address 192.[Question just short like this because in each option will have CLI for config 1 group of VRRP] A.1 Switch-A(config-if)# vrrp 2 priority 100 C.168.0 Switch-A(config-if)# vrrp 2 ip 192. Switch-A(config)# interface vlan 1 Switch-A(config-if)# ip address 192.255.1. Switch-A(config)# interface vlan 2 Switch-A(config-if)# ip address 192.1.1.168.1 Switch-A(config-if)# vrrp 1 priority 200 B.0 Switch-A(config-if)# vrrp 1 ip 192.10 Switch-A(config-if)# vrrp 1 priority 100 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 78 Your company wants to connect an internal switch to the uplink provider switch.255.255.0 Switch-A(config-if)# vrrp 1 ip 192. BPDU Filter .0 Switch-A(config-if)# vrrp 1 ip 192.255.10 255.1.255.11 255.168.1.1.10 255.10 Switch-A(config-if)# vrrp 1 priority 200 D.255.168.168.1.10 255.1.255.168.255.

BPDU Bridge Correct Answer: A Section: (none) Explanation Explanation/Reference: .B. BPDU Guard C. BPDU Loop D.

The EtherChannel will not be operational because the port cannot be used as SPAN destination. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 2 What do subordinate switches in a switch stack keep? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 3 Which two statements apply to topology-based switching? (Choose two.Contribute QUESTION 1 There was an EtherChannel configured and one of the port was used as SPAN destination. EtherChannel will operate as normal. The EtherChannel will no longer exist. Subordinate switches does not keep their own spanning trees. EtherChannel will discard the port used. C. C. E. B. B. What will be the result? A. Store running configuration on all the switches.) . D. Subordinate switches keep entire VLAN database. The EtherChannel will shutdown. D. Subordinate switches keep their own spanning trees for each VLAN that they support.MCQs June 2017 .

A.) A.) A. It is functionally equivalent to Cisco Express Forwarding. It is not enabled by default on Cisco devices. It is the preferred switching mode in Cisco multilayer switches. C. E. It runs on the network layer. Multi-vendor Protocol Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 4 Which two statements apply to LLDP? (Choose two. SDM templates are defined by the switch model and can't be changed . D. It runs on the data link layer. C. B. You can verify the SDM template that is in use with the show sdm prefer command. Changing the SDM template will not disturb switch operation. D. They are used to allocate system resources. B. Disabled by default. It uses loop free protocol for switching. C. Hold-time is 100 seconds on Cisco devices Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 5 Which two statements about SDM templates are true? (Choose two. D. E. B. Enabled on Cisco devices by default.

) A. Normal STP VLAN 1 BPDU travel across VLAN 1 untagged D. enabled Correct Answer: B Section: (none) Explanation Explanation/Reference: . PVST+ VLAN 99 BPDU travel across VLAN 99 tagged Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 7 What is the default violation status of port security? A. shutdown C.E. PVST+ VLAN 1 BPDU travel across VLAN 99 tagged C. trap D. SDM templates changes don't require switch to be rebooted Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 6 Question about the behavior of VLAN 1 BPDUs in a situation where the native VLAN configured as VLAN 99 and the native VLAN is tagged. none B. Normal STP VLAN 1 BPDU travel across VLAN 99 untagged B. (Choose two.

Enabled C. Nothing D. Enabled by broadcast only D.QUESTION 8 What is the storm control violation defined by default on a Cisco switch? A. Enabled by multicast only Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 9 What happens when a destination SPAN port that is configured as EtherChannel receives traffic? A. Disabled B. Err-disable C. VRRP uses TCP IP protocol 20 . A. VRRP uses UDP port number something (or IP protocol 112) B. Shutdown B. Broadcast threshold is doubled in an interface Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 10 A question regarding to redundancy protocol (or VRRP).

An IP protocol does not exist Correct Answer: A Section: (none) Explanation Explanation/Reference: . VRRP uses UDP protocol 200 D.C.

Correct Answer: AC Section: (none) Explanation Explanation/Reference: Answer A is correct because skew time-> (256-configured priority)/256-configured. E. . The Skew time is .MCQs August 2017 .351 seconds. B. D. C.Contribute QUESTION 1 Refer to the exhibit. The device on which the interface resides is acting as a standby router. it becomes the master router after 3. Answer C is correct because there was priority 105 in exhibit but there was also line: Track object 1 state “down” decrement 15 -> so the configured priority is 120. The configured VRRP priority of the interface is 120. Which two statements about the network environment of the interface that generated this output are true? (Choose two.) A.531 seconds. The configured VRRP priority of the interface is 105. If the priority of another router is higher than the priority of the master router.

Cisco Express Forwarding must be disabled globally. channel-protocol lacp channel-group 1 mode active Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 3 Which two prerequisites for HSRP to become active on an interface are true? (Choose two.351)) but notice that there was hold down timer 3.. An IP address must be configured on the interface.) A. channel-protocol lacp channel-group 1 mode auto B. channel-protocol pagp channel-group 1 mode on D. QUESTION 2 Which two commands sequences must you enter on a pair switches so that they negotiate an EtherChannel using an IEEE-standard. channel-protocol lacp channel-group 1 mode passive C.531. PIM routing must be disabled on the interface. A Virtual-MAC address must be configured on the interface..351 instead of 3. B.? (Choose two.Answer E is NOT correct because even though the hello interval in the exhibit is 1s (hold interval is 3x hello + skew time (0.) A. channel-protocol pagp channel-group 1 mode auto E. Correct Answer: BD Section: (none) Explanation . C. D. E. The VIP must be in the same subnet as the primary IP address.

B.” . PAP D. Correct Answer: AB Section: (none) Explanation Explanation/Reference: A.Explanation/Reference: QUESTION 4 Which two authentication types does VRRP support? (Choose two. The source and destination ports must reside in the same switch or switch stack. D. It can monitor only traffic that ingresses or egresses on the source interface or VLAN.1x E. Plain-text B. C. Correct It’s obvious. A SPAN session can support multiple destination ports only if they are on the same VLAN. A switch can support only one local SPAN session at a time. E. you can’t destinate a port or vlan that’s doens’t exist on the local switch or stack.) A.) A. CHAP C. MD5 Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 5 Which two limitations of local SPAN are true? (Choose two. Each SPAN session supports only one source VLAN or interface. “The destination port used in one SPAN session cannot also be used as the destination port for another SPAN session. 802.

B. Incorrect “You can also create a SPAN session to monitor multiple VLAN sources and choose only VLANs of interest to transmit on multiple destination ports. A. Incorrect “You can create up to 64 total SPAN sessions (Local SPAN plus ERSPAN) on your local device. For example. Their port is error-disabled. Correct C.” Source: https://www. you can configure SPAN on a trunk port and monitor traffic from different VLANs on different destination ports.” E. D. The port is moved into the spanning-tree blocking state. C. For example. Template maximises system resources for unicast routing. Template maximises system resources for access control lists. C.html#pgfId-1054894 QUESTION 6 Which statement about the default switch database management template is true? A. .” D.cisco. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 7 Which results happens when a nontrunking port that is configured with BPDU guard is connected to a device that is transmitting…. Template gives balance to all functions. B. Incorrect “You can also create a SPAN session to monitor multiple VLAN sources and choose only VLANs of interest to transmit on multiple destination ports. B. you can configure SPAN on a trunk port and monitor traffic from different VLANs on different destination ports.com/c/en/us/td/docs/switches/datacenter/nexus1000/sw/4_0_4_s_v_1_3/system_management/configuration/guide/ n1000v_system/n1000v_system_9span. Template disables routing and supports the maximum number of unicast MAC addresses. A routing loop can occur on the network.

The AVF assigns virtual MAC addresses to GLBP group members. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 8 Which two settings are part of a default LLDP configuration? (Choose two. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 9 Which two statements about GLBP are true? (Choose two. The LLDP timer is 60 seconds. The AVF responds to ARP request for the virtual IP address. The LLDP hold time is 60 seconds. C.D. The LLDP global state is disabled. D. The LAN client traffic is handled by the active AVF only. The LLDP interface state is enabled. The port transitions to the connected state. E. Correct Answer: CE Section: (none) . The LLDP reinitialisation delay is 5 seconds. E. The AVG assigns virtual MAC addresses to GLBP group members.) A.) A. B. C. D. The AVG responds to ARP requests for the virtual IP address. B.

If switch SW6 is operating VTP server and the other devices have the same configuration as SW4.Explanation Explanation/Reference: QUESTION 10 Refer to the exhibit. which statement about the VLANs network is true? A. . Traffic on VLANs 1 through 9 is flooded to all switches in the network.

Which two effects of this configuration are true? (Choose two.) . VLANs 1 through 101 are operational on all switch trunks. Routing Protocol D. Spanning-Tree Mode F. C. VLANs 1 through 101 are pruned on the link between SW1 and SW2. Native VLAN-ID Correct Answer: BF Section: (none) Explanation Explanation/Reference: QUESTION 12 Refer to the exhibit. Processor Type B. VLANs 1 through 9 are pruned on the link between SW1 and SW4. VTP Domain Name C. D. You have configured routers R1 and R2 with VRRP for load sharing as shown. Memory Usage E. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 11 Which two pieces of information are carried in a Cisco Discovery Protocol advertisement? (Choose two.B.) A.

0.10.1.1 and router R2 is the primary gateway for 10.0. PC1 and PC3 use router R1 as the primary gateway. D.A. PC2 and PC4 use router R1 as the primary gateway.1.1.0.gl/5tZwUm) is not correct. Router R1 is the primary gateway for 10. The four PCs send all request to router R1. F. . E. B. The four PCs send packets round-robin between routers R1 and R2. which forward traffic to router R2 as necessary.1. C.1 and Router R1 is the primary gateway for 10.10. Router R2 is the primary gateway for 10. Correct Answer: DE Section: (none) Explanation Explanation/Reference: The exhibit (goo.0.

Dynamic Desirable and Access C.3. Which two statements about the network environment of the device that generated this output are true? (Choose two. The PC1 and PC3 uses R1 as primary gateway.The client 1 and 3 have default gateway 10.1.0.2 and R2 has 10.0. Nonegotiate and Trunk E. Dynamic Auto and Trunk Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 14 Refer to the exhibit. This mean that R1 is primary for group 1 and R2 is primary for group 2.) . The interfaces on the routers have IP as per question-> R1 as 10.1.0.1 and client 2 and 4 has default gateway 10.1.) A. Dynamic Desirable and Dynamic Auto B.1. Dynamic Auto and Dynamic Auto D. QUESTION 13 Which two DTP negotiated interface mode combinations negotiate to form an access port? (Choose two.0.10.

Answer C is NOT correct because the priority value wasn’t 1.There were timers: 3s hello and 10s hold. Correct Answer: AE Section: (none) Explanation Explanation/Reference: There was a show standby brief exhibit. The standby router can take the active HSRP if it fails to receive a hello packet from the active router within 1. The priority value of the HSRP group is 1. . Answer B is NOT correct because 1. Answer A is correct . B. C. E.616 is time when the router will send the next hello message. Answer D is NOT correct because there was nothing line HSRP version 2. D.616 seconds. The exhibit hello and hold timer values are in use. HSRP version 2 is in use. The standby router can take the active HSRP role if it fails to receive a hello packet from the active router within 10 seconds.A.

VTP version 1 and version 2 support only normal-range VLANs (VLAN IDs 1 to 1005). C. D. It can be enabled on a per-port basis.cisco. It can be enabled on a per-interface basis.cisco.html#wp1316856 In addition to propagating VTP information. you cannot convert from VTP version 3 to version 1 or 2. It performs consistency checks only when a new VLAN is manually added. Consistency checks are not performed when new information is obtained from a VTP message or when information is read from NVRAM. VLAN consistency checks (such as VLAN names and values) are performed only when you enter new information through the CLI or SNMP. Only VTPv3 allows to turn on/off per-port basis -> Answers C.html QUESTION 16 Which three options of VLAN IDs are in extended range? (Choose three. VTP version 3 supports the entire VLAN range (VLANs 1 to 4094). QUESTION 15 Which statement about the VTPv2 is true? A. If extended VLANs are configured. Correct Answer: B Section: (none) Explanation Explanation/Reference: VTPv3 offers support for extended range VLAN (VLANs 1006 to 4094) database propagation. Reference: https://www. A separate instance of the VTP protocol runs for each application that uses VTP -> Only VTPv3 supports multiple VTP instances -> Answer A is not correct. Consistency Checks: In VTP version 2. Therefore Answer D is not correct.This also mean that after 10 second the standby router will take the active role because is there as 3 missing hello messages. B. E. It supports the use of multiple instances. It propagates VLANs 1 – 1005 only. version 3 can propagate Multiple Spanning Tree (MST) protocol database information.) . Reference: https://www. You cannot convert from VTP version 3 to VTP version 2 if extended VLANs are configured in the domain. VTP versions 1 and 2 propagate only VLANs 1 to 1005. Extended range VLANs (VLANs 1006 to 4094) are supported only in VTP version 3.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/ swvtp. E are not correct.Answer E is correct .com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.

com/t5/network-infrastructure-documents/importance-of-bpdu-guardand-bpdu-filter/ta-p/3120465 QUESTION 18 Which STP feature used to monitor BPDU traffic and enable STP to transition between states? A.com/c/en/us/td/docs/ios/12_4t/12_4t15/ht_xvlan. Root Guard B.A. 999 C. BPDU Guard C. 3003 F. 99 B. 1006 E. 4021 Correct Answer: DEF Section: (none) Explanation Explanation/Reference: Source: https://www. (Which of these options supports to maintain the network architechture and stability of the root bridge in a spanning-tree service?) A. Loop Guard Correct Answer: C Section: (none) Explanation Explanation/Reference: Source: https://supportforums. 1001 D. Root Guard D. BPDU Filter B..cisco..html QUESTION 17 A question about security and the choices were.cisco. Loop Guard .

An STP loop is created when an STP blocking port in a redundant topology erroneously transitions to the forwarding state. The loop guard feature makes additional checks. The first one says it prevents an interface from receiving BPDUs while the second one says when it receives BPDUs. Eventually. root guard moves this port to a root-inconsistent STP state (which is equal to STP listening state). the blocking port from the alternate or backup port becomes designated and moves to a forwarding state. How about BPDU Filter? At the global level. and BPDU filtering is disabled. the root guard enforces the position of the root bridge. instead of the listening/learning/forwarding state. Root Guard ensures that the port on which root guard is enabled is the designated port. and the non-designated port receives BPDUs. But if it receives BPDUs. BPDU Guard Correct Answer: C Section: (none) Explanation Explanation/Reference: BPDU Guard feature allows STP to shut an access port in the event of receiving a BPDU. So all three features above do not support STP to transition between states. and loop guard is enabled. the port assumes the designated port role. When one of the ports in a physically redundant topology no longer receives BPDUs. Reference: http://www. In its operation. you can enable BPDU filtering on Port Fast-enabled interfaces by using the spanning-tree portfast bpdufilter default global configuration command. The port moves to the STP forwarding state and creates a loop.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_55_se/configuration/guide/3560_scg/swstpopt. You should globally enable BPDU filtering on a switch so that hosts connected to these interfaces do not receive BPDUs. In this way. the interface loses its Port Fast-operational status. The interfaces still send a few BPDUs at link-up before the switch begins to filter outbound BPDUs. STP relies on continuous reception or transmission of BPDUs based on the port role. No traffic is forwarded across this port. Without the loop guard feature.cisco. This situation creates a loop. This command prevents interfaces that are in a Port Fast-operational state from sending or receiving BPDUs. Loop Guard feature provides additional protection against STP loops. one in global configuration mode and one under a specific interface: Configuring BPDU filter globally: .html The first and second underlined sentences are very contradictory. the STP conceives that the topology is loop free. If BPDUs are not received on a non-designated port. BPDU Filter D. that port is moved into the STP loop-inconsistent blocking state.C. The designated port transmits BPDUs. There are two ways to configure BPDU filtering feature. If the bridge receives superior BPDUs on a root guard-enabled port. This usually happens because one of the ports of a physically redundant topology (not necessarily the STP blocking port) no longer receives STP BPDUs. BPDU filtering is disabled! The fact is this command will prevent an interface from sending BPDUs only. If a BPDU is received on a Port Fast-enabled interface. it will lose its PortFast feature and return to a normal switching port (with STP enabled).

) A. the port returns to normal state + When BPDU filtering is enabled on a specific port. Utilizes UDP port F.) A. MAC Destination . Encrypts the whole payload D. MAC Source B. and if BPDUs are seen. Encrypts the header C. the port loses its PortFast status. Supports backwards compatible with TACACS+ B. Utilizes TCP port E. they will be dropped) Therefore in this question we can only think about the BPDU Filter under global configuration mode. MAC Source-destination C. Separates authentication and authorization Correct Answer: CDF Section: (none) Explanation Explanation/Reference: QUESTION 20 Which two possible EtherChannel load balancing mechanisms are based on Layer 3? (Choose two. IP Source D. BPDU filtering is disabled. In this mode the port can transit between STP states. (Choose three.Switch(config)#spanning-tree portfast bpdufilter default Configure BPDU Filter on the interface: Switch(config-if)#spanning-tree bpdufilter enable (this overrides the global bpdufilter command above) But the effect of these two commands are different and you should remember: + When BPDU filtering is enabled globally. it prevents this port from sending or receiving BPDUs (so if BPDUs are seen. QUESTION 19 A question about TACACS+ with three choices. IP Source-destination E.

Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 21 A question about what carries voice VLAN to a Cisco phone? A. WAP E. SHA-124 B. (Choose three. RSPAN Correct Answer: C Section: (none) Explanation Explanation/Reference: You must enable CDP on the switch port connected to the Cisco IP Phone to send the configuration to the phone (which includes the Voice VLAN to be used). MD5 Correct Answer: CEF Section: (none) . CDP D. SHA-254 C.) A. SIP B. Plain text authentication F. LLDP C. No authentication D. SKINNY E. QUESTION 22 VRRP authentication.

D. (Choose two. It is vendor neutral. dynamic auto or dynamic desirable + trunk = trunk E.Explanation Explanation/Reference: QUESTION 23 DTP question was about how to form an access port. dynamic desirable + dynamic desirable = trunk D. Correct Answer: CE Section: (none) Explanation . dynamic auto + dynamic desirable = trunk C. It supports one STP instance per VLAN.) (CONCEPT ONLY) A. All VLANs must reside in a single MST region. C. It can map multiple VLANs to a single STP instance. It can operate without a root bridge. E. dynamic auto + dynamic auto = access B. B. dynamic auto or dynamic desirable + access = access Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 24 Which two statements about MST are true? (Choose two.) A.

This feature filters outgoing ICMP redirect messages through HSRP. it does not depend on the number of router/switch. HSRP can be configured on a maximum of 32 VLAN or routing interfaces.Explanation/Reference: QUESTION 25 Which two statements about HSRP are true? (Choose two. Reference: https://www. Correct Answer: BD Section: (none) Explanation Explanation/Reference: ICMP (Internet Control Message Protocol) redirect messages are automatically enabled on interfaces configured with HSRP (therefore answer A is not correct). When the switch is running HSRP. ICMP provides diagnostic functions. It is supported on switch virtual interfaces and routed ports. ICMP is a network layer Internet protocol that provides message packets to report errors and other information relevant to IP processing. So its support depends on VLAN or interface only. The interfaces in a HSRP group share a virtual MAC address. HSRP allows two or more HSRP-configured routers to use the MAC address and IP network address of a virtual router -> Answer D is correct. in which the next hop IP address might be changed to an HSRP virtual IP address. Primary and secondary HSRP switches forward traffic in a round-robin style. When HSRP is configured on a network or segment.) A. C. the standby router is the router that takes over the routing duties when an active router fails or when preset conditions are met -> Answer C is not correct. D. such as sending and directing error packets to the host. E. You must manually configure ICMP redirect messages on HSRP interfaces. it provides a virtual MAC address and an IP address that is shared among a group of configured routers. If a host is redirected by ICMP to the real MAC address of a router and that router later fails. packets from the host are lost. make sure hosts do not discover the interface (or real) MAC addresses of routers in the HSRP group. the active router is the router of choice for routing packets. Routers in an HSRP group can be any router interface that supports HSRP. including routed ports and switch virtual interfaces (SVIs) on the switch -> Answer B is correct. An HSRP group can support a maximum of eight switches.cisco.pdf .com/c/en/us/td/docs/switches/metro/me3600x_3800x/software/release/12-2_52_ey/configuration/guide/3800x3600xscg/ swhsrp. B. In a group of router interfaces.

server C. client B.QUESTION 26 Which VTPv2 mode does the switch operate without participating in VTP? A. This feature instructs the port to skip listening and learning state and move to forwarding state immediately. QinQ B. transparent D. Voice VLAN D.1q Correct Answer: BC Section: (none) Explanation Explanation/Reference: The Portfast feature can be configured on both access or trunk port. 802. The voice VLAN feature enables access ports to carry IP voice traffic from an IP phone. The simple example below shows how to configure voice VLAN on an interface: . STP Mode E. off Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 27 Which two features can you configure on a access port? (Choose two. PortFast C.) A.

) A. shutdown C. trap D. no cdp enable on interface E. let admin know Correct Answer: BC Section: (none) Explanation . cdp disable on interface D. (Choose two. no cdp run on interface B.) A. QUESTION 28 How to disable CDP? (Choose two. Cisco calls this a Multi-VLAN access port. no cdp enable in global configuration Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 29 Storm control options apart from the default one.Note: This is not a trunk port (although two VLANs are configured on an interface). log B. err-disable E. no cdp run in global configuration C.

) . Correct Answer: BE Section: (none) Explanation Explanation/Reference: Source: https://www. Is compatible with TACACS+ Correct Answer: BC Section: (none) Explanation Explanation/Reference: https://www.cisco.) A. Maximum 4 AVFs allowed in a group C. Uses client server model C. GLBP supports up to 1024 virtual routers per group. Uses UDP to exchange traffic D.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.cisco. Support for multiple protocols E.Explanation/Reference: QUESTION 30 Which two statements about GLBP is true? (Choose two.pdf (page 2) QUESTION 32 A question on TACACS+.html QUESTION 31 Which of these two options are true about RADIUS? (Choose two. (Choose two. Can have 6 AVFs in a group E.) A.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10. Uses TCP port 49 B. Can have 128 AVFs on an interface B. Can work with dual active AVGs D.

but this is just a concept only based on exhibit. .com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.) (NOTE: Original question similar to this asks for two (2) answers. Encrypts just the header. Correct Answer: CD Section: (none) Explanation Explanation/Reference: https://www. E. Separates authentication and authorization. Has support for multiple protocols other than IP. The configured VRRP priority of the interface is 120. D. C.pdf (pages 3 and 4) QUESTION 33 Refer to the exhibit. Backward compatible with TACACS.) A.cisco. More secure then RADIUS as it uses UDP. Which three statements about the network environment of the interface that generated the exhibit is true? (Choose three.A. B.

correlate IP to domain name D. The configured VRRP priority of the interface is 105. The Down Interval is 3 seconds + Skew Time. The Skew time 0. (Choose two. drops all traffic outside the domain E. We can also confirm the configured priority by manually calculating the Skew Time. limit traffic from untrusted C. C.531 seconds. E. we saw Master Down interval is 3. it becomes the master router.B.15 = 105). The formula for the Skew Time is (256 .com/vrrp-skew-time-and-always-be-learning/ We can determine that the configured priority was 120.531 sec.531 (this is the Skew Time) In the exhibit. The device on which the interface resides is acting as a standby router. If the priority of another router is higher than the priority of the master router. 256 — 120 = 136. limit / intercept messages from untrusted B. (120 . Explanation about the Skew Time can be found here: https://|khill. QUESTION 34 A question about DHCP snooping feature. because the Tracked Object is down in the exhibit and decrement value was 15 and the current priority is 105.configured priority) / 256. 136/256 = 0. D.2 IOS Correct Answer: AB Section: (none) Explanation . resource not available in 12. Correct Answer: ACE Section: (none) Explanation Explanation/Reference: Original question was to choose only two (2) answers.) A.

UDLD reset B. (Choose two. disabled when native VLAN mismatched B.) A. send periodic multicast Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 37 A question about how to tag native VLAN X. Shut and restart D.) A.) A.Explanation/Reference: QUESTION 35 A question about how to recover err-disable. send periodic broadcast D. (Choose two. Err-disable auto recovery C. switchport trunk native vlan x . UDLD recovery Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 36 A question about which is true about CDP? (Choose two. can be disable on interface only C.

uses extended. ??? Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 39 A question about AAA with TACACS+ (Choose three. (Choose two..) A.. ??? D. uses standard.B. uses TCP 49 B.. Config#….. Err-disabled when max allowed mac B. uses UDP 49 C. D.. ??? C...) A. ??? E. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 38 A question about port security (mac). Cisco proprietary D. . Config#…. encapsulation dot1q native vlan x C. E.

no cdp run on sub-interface D. no cdp run on enable mode Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 41 Refer to the exhibit.) A. no cdp enable to disable per interface C. no cdp run on global configuration B. You can change the SDM template to maximize the number of supported MAC addresses. no cdp enable to shutdown per interface E. (Choose two. Which action do you take to correct the problem? . You noticed that the switch routing performance has been significantly degraded.Correct Answer: ACD Section: (none) Explanation Explanation/Reference: QUESTION 40 A question about how to disable CDP.

It runs on TCP port 49. D. Configure sdm prefer vlan B. Execute clear ip route command to reset the routing table. Configure sdm prefer default Correct Answer: D Section: (none) Explanation Explanation/Reference: Answer D is correct cause the question asks to maximize supported MAC address. QUESTION 42 Which three characteristics of AAA with RADIUS are true? (Choose three. It is a Cisco proprietary implementation. C. . It uses standards-based implemented.) A. Configure sdm prefer routing C.A. It uses a client-server architecture. It runs on UDP port 1812. B. D. E.

To use space in MAC address table. Correct Answer: A Section: (none) Explanation . It uses a client-private cloud architecture. They support a single VLAN for data traffic.) A. D. Correct Answer: ABC Section: (none) Explanation Explanation/Reference: QUESTION 43 Which two statements about an access port with voice VLAN are true? (Choose two. To wipe space in MAC address table. C.F. They require VTP. B. E. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 44 Why the network administration can want to to disable MAC address learning on the router? A. C. D. There was a security violation. They can be configured on VLANs 1 through 1001. B. To free up space in MAC address table. They can be configured on trunk ports and access ports. Frame on the voice VLAN are tagged with a Layer 2 CoS value.

Per switch port. C. It encrypted the whole transition F. It encrypted the passwords E. With the global command mac-address disable. B.cisco. It integrates authentication and authorization B.) A. It separates authentication and authorization Correct Answer: BEF Section: (none) Explanation Explanation/Reference: RADIUS encrypts only the password in the access-request packet. On the VLAN interface. from the client to the server. It controls access to network devices C. It controls access to endpoint devices D.pdf QUESTION 46 Which three advantages of TACACS+ are true? (Choose three. The remainder of the packet is unencrypted. D.Explanation/Reference: QUESTION 45 Where can you disable MAC address learning on the switch? A.com/c/en/us/td/docs/wireless/mwr_2941_dc/software_config/guide/3_3/2941_33_Config_Guide/mac_lrn. Other . https://www. A VLAN filter template is necessary. use the default mac address-table learning global configuration command. Correct Answer: A Section: (none) Explanation Explanation/Reference: To re-enable MAC address learning on an interface or VLAN.

and accounting. However. such as username. can be captured by a third party.) A. during normal operation. For debugging purposes. TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. private VLANs Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 48 How to tag native VLAN 99? A. Within the header is a field that indicates whether the body is encrypted or not. EtherChannel E. QUESTION 47 Which two restrictions of the port security feature are true? (Choose two. encapsulation dot1q native vlan 99 C. the body of the packet is fully encrypted for more secure communications. authorized services. it is useful to have the body of the packets unencrypted. trunk ports B. tunnel ports D.information. SPAN ports C. switchport trunk native vlan 99 B. switchport vlan native 99 Correct Answer: A Section: (none) Explanation Explanation/Reference: . switchport mode trunk native vlan 99 D.

B. D. Not available Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 50 What happens if we add "line" on AAA command? A. C. Need to disable CDP. Need to enable LLDP. Can be configured on the same port and keep CoS. Is the prefer logging method in Cisco switches Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 51 Which one is related to Stackwise technology? A. Disable RADIUS authentication C. . (Choose two. E. Multiple switch can be stack. Switches can be stack with port-channel. Need to be configured on a separated VLAN.QUESTION 49 A question about voice VLAN. Disable TACACS+ authentication B.) A. It's a last resource (or resort) login D. B.

Due to port security configuration. Due to UDLD aggressive mode. C. After initial boot (I think another switch). ProStack with mix switch. port security B. Due to UDLD normal mode. D. multicast and unicast problem? A. the other switch didn't get the BPDU message. Due to STP.C. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 52 A switch which was connected with 2 fiber cable attached to another switch. one of the link get error-disable or shutdown. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 53 Which technique will control broadcast. STP C. SPAN Correct Answer: C Section: (none) . B. Master switch and backup switch is listed in line. the other switch didn't get the BPDU message. What was the reason for that? A. storm control D. D.

UDLD reset B. (config-if)# no cdp run E. UDLD recovery Correct Answer: AB Section: (none) Explanation Explanation/Reference: . Err-disable auto recovery C. (config)# no cdp enable Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 55 How to recover err-disable after an UDLD failure? (CONCEPT) A.) . Reboot the switch E. (config)# no cdp run B. (config-if)# cdp disable F. (config)# cdp disable C.CONCEPT A.Explanation Explanation/Reference: QUESTION 54 A question about how to disable CDP? (Choose two. Shut and no shutdown (restart) D. (config-if)# no cdp enable D.

Prevent DHCP server from connecting to a trusted interface Correct Answer: ABCDE Section: (none) Explanation Explanation/Reference: Concepts: – Define and configure a DHCP server . Ensure that DHCP server is connected in a trusted interface D. sticky B.QUESTION 56 Which configuration do you apply to an interface so that it port security to learn and commit the first MAC address? (CONCEPT) A. Configure DHCP snooping DB agent E. Enable DHCP snooping globally F. Define and configure a DHCP server B. Disable DHCP snooping on at least one VLAN H. protect Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 57 How to configure DHCP snooping and DAI (Dynamic ARP Inspection) in VLAN? (Choose all that apply.CONCEPT ONLY A. Enable DHCP snooping on at least one VLAN C. shutdown D. restrict C. Redirect DHCP snooping locally G.) .

com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp. These reports are integral for meeting compliance needs. LAN Base B. performance will be degraded. accurate information on unused switch ports helps the administrator keep these ports closed. a broadcast storm would occur. When building a switch stack. you can mix software feature sets. As a best practice for safeguarding your network from security risks. IP Base C.CONCEPT ONLY A. When building a Switch stack. B.– Enable DHCP snooping on at least one VLAN – Ensure that DHCP server is connected in a trusted interface – Configure DHCP snooping DB agent – Enable DHCP snooping globally https://www. etc. You can even drill down into specific port data to obtain active and historical port utilization information. memory used. QUESTION 59 Which statement is true about Stackwise? .) .CONCEPT ONLY A. D. When building a switch stack. IP Services E.html#wp1114907 QUESTION 58 Which three feature sets are used in Stackwise technology? (Choose three. C.cisco. LAN Agent Correct Answer: ABD Section: (none) Explanation Explanation/Reference: The switch port monitor provides data on network switches by port in use. ARP Base F. Correct Answer: A Section: (none) Explanation . CPU load. WAN Services D. When building a Switch stack. you cannot mix software feature sets.

Explanation/Reference: There are three main software feature sets: LAN Base. IP Base. accurate information on unused switch ports helps the administrator keep these ports closed. B. Which two statements about the flag of the EtherChannel is true? (Choose two.) . When building a Switch stack. etc.) . E. These reports are integral for meeting compliance needs. Accurate information on unused switch ports is not neccessary. you cannot have some switches with LAN Base and some with IP Services. The switch port monitor provides data on network switches by port in use. QUESTION 60 Which three statements about SPAN and RSPAN are true? (Choose three. Correct Answer: ABC Section: (none) Explanation Explanation/Reference: The switch port monitor provides data on network switches by port in use.CONCEPT ONLY A. Accurate information on unused switch ports helps the administrator keep these ports closed for security risk best practices. C. As a best practice for safeguarding your network from security risks. you cannot mix software feature sets. IP Services. You can even drill down into specific port data to obtain active and historical port utilization information. Does not provide specific port data to obtain active and historical port utilization information. It provides specific port data to obtain active and historical port utilization information. For example. CPU load and memory used. memory used. QUESTION 61 Refer to the exhibit. CPU load. D.

Correct Answer: AB Section: (none) Explanation Explanation/Reference: . Flag U indicates EtherChannel is operational.A. Flag S indicates Layer 2 is operational. Flag H indicates EtherChannel is operational. C. E. Flag R indicates Layer 2 is operational. D. B. Flag U indicates Layer 2 is operational.

QUESTION 62 Refer to the exhibit. DSW2(config-if)# spanning-tree port priority 0 Correct Answer: ABC Section: (none) Explanation .) . DSW1(config)# interface g1/0 C.CONCEPT ONLY A. Which three actions you need to perform to make the traffic goes through DSW1 to DSW2? (Choose three. DSW2(config)# interface g1/0 E. DSW1(config-if)# spanning-tree port priority 16 B. DSW2(config-if)# spanning-tree port priority 16 D.

C.Explanation/Reference: QUESTION 63 Refer to the exhibit.CONCEPT ONLY (BASED ON THE ORIGINAL WITH 2 ANSWERS) A. Which three statements about the flag of the EtherChannel is true? (Choose three.) . B. Port-Channel protocol is Cisco proprietary. D. Port-Channel is bundled in Group 10. Flag S indicates Layer 2 is operational. Flag U indicates EtherChannel is operational. .

CONCEPT ONLY . Correct Answer: ABC Section: (none) Explanation Explanation/Reference: QUESTION 64 Refer to exhibit: How to make DSW1 the primary root for VLAN 10. (Choose two. Flag SU indicates the EtherChannel is suspended.E.) .

Change DSW2 bridge priority to VLAN 20 to 61440 B.A. Change DSW1 bridge priority to VLAN 10 to 4096 .

Change DSW1 bridge priority to VLAN 10 for 1 E. Spanning trees information D. Routing information Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 66 Which three settings are part of a default LLDP configuration? (Choose three.C. VLAN database B. B. The LLDP reinitialisation delay is 5 seconds. Correct Answer: ABD . C. Change DSW1 bridge priority to VLAN 10 with the command priority root Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 65 Which information does the subordinate switch in a switch stack keep for all the VLANs that are configured on it? (CONCEPT ONLY) A. E. D. The LLDP hold time is 120 seconds.) A. The LLDP global state is disabled. The LLDP interface state is enabled. The LLDP timer is 60 seconds. Change DSW1 bridge priority to VLAN 20 for 4096 D. DHCP snooping database C.

Section: (none) Explanation Explanation/Reference: QUESTION 67 Which two TLVs are included in Cisco Discovery Protocol advertisements? (Choose two. Native VLAN TLV Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 68 Which fallback method can you configure to allow all AAA authorization requests to be granted if the other methods do not respond or return an error? A. Network Policy TLV B. RADIUS C.) A. TACACS+ Correct Answer: C Section: (none) Explanation Explanation/Reference: . System Name TLV D. VTP Management Domain TLV C. enable B. none D. Inventory Management TLV E.

VTPs can now be configured in off mode. They are sent only from the master router.wordpress. B.html Supports extended VLANs (1006 . B.QUESTION 69 Which two new features are included in VTPv3? (Choose two. They are sent every three seconds by default. Correct Answer: AD Section: (none) Explanation Explanation/Reference: https://yurmagccie. they are sent from the master router and standby routers . They include priority information. It can be configured to prevent the override of the VLAN database. E.4094) VTP can now be turned off completely. Correct Answer: AE Section: (none) Explanation Explanation/Reference: http://brbccie.) A. C. VTP now supports MD5 passwords. the accidental-high-configuration-revision-wipes-out-your-network issue. as opposed to just transparent mode Fixes the bane of VTP v1/2.) A. E. C. VLANs configured for token ring are now eligible to participate in VTP.com/2015/08/07/virtual-router-redundancy-protocol/#_jmp0_ a. VLANs in the extended range are now eligible to participate in VTP. D.blogspot. by design it does this no configuration is necessary. They include VRRP timer information.I believe true .com/2014/07/vtp-v3. They are sent from the master router and standby routers. QUESTION 70 Which two statements about VRRP advertisements are true? (Choose two. D.

b. port-security settings D. then Local router changes its state to Master. and SNMP settings—that apply to all stack members • Stack member interface-specific configuration settings. STP. SNMP settings Correct Answer: DE Section: (none) Explanation Explanation/Reference: https://www. then Local router stays in Backup state.pdf Switch Stack Configuration Files The configuration files record these settings: • System-level (global) configuration settings—such as IP. QUESTION 71 Which two StackWise configuration setting types are applied at the system level? (Choose two. they include VRRP timer information .is true because of the above e.) A.False because: There are three possible states of VRRP router: Init.6 sec. Backup. If Local router receives VRRP Advertisement message with higher priority value or with same priority value but higher IP address. which are specific for each stack member QUESTION 72 A question about the effective way to handle unknown traffic? . In Backup state Local router sends and listens to VRRP Advertisement messages from other routers.False because: Defaults: Hello time 1 sec. speed/duplex settings C. Master. 802. If there are no VRRP Advertisement messages with higher priority value or with same priority value and higher IP address.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_40_se/configuration/guide/scg1/swstack. When you enable VRRP on interface router goes from Init to Backup state. they include priority information . VLAN settings E. VLAN. they are sent only from the master router .1x settings B. d. The router in VRRP group will ignore VRRP advertisement messages with timer values that do not match to local timer values c. they are sent very three seconds by default .cisco.False because: All routers in a VRRP group must use the same timer values. hold time 3.

VLAN ID E. broadcast storm B. spanning-tree mst mst forward-time 5 C. DSCP Correct Answer: ABC Section: (none) Explanation Explanation/Reference: QUESTION 74 Which command can you enter to set the time between BPDUs in an MST environment by route bridge? A. spanning-tree mst hello-time 2 D. port number C.A. IP address D. unicast storm C. ARP Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 73 Which three values can Cisco IOS device use as the basis for EtherChannel load-balancing? (Choose three.) A. IP precedence F. spanning-tree mst 1 cost 5 B. MAC address B. spanning-tree mst max-age 20 . multicast storm D.

Port must be in encapsulation mode Correct Answer: AB Section: (none) Explanation . Port security must be disabled on the port level E.Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 75 Which two tasks must you perform on a device to ensure that an Etherchannel operate at Layer 3? (Choose two.) A.) A. Port security must be enabled on the port level C. configure EtherChannel directly on the interface C. configure no switchport on physical interface B. switchport mode trunk D. Port must be in access mode B. configure switchport mode access Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 76 Which two configuration requirements for port security are true? (Choose two. configure switchport on E. Port must be in interface VLAN mode D.

E. Only ISP edge devices C.com/c/en/us/td/docs/switches/lan/catalyst4000/8-2glx/configuration/guide/stp_enha. PortFast just can be connected to a workstation or server. B.html QUESTION 78 Which two ISP devices should have trust Port-Statement with DHCP Snooping feature? (Choose two.) A.Explanation/Reference: QUESTION 77 A question about how PortFast works in access and trunk ports. https://www. State immediately bypassing the listening and learning states. Nobody is responsible to control ISP edge devices Correct Answer: AB Section: (none) Explanation . The port is put in err-disable if connected in a trunk port. D. Network devices E. (Choose two.1D) timers. Skip STP (802. C. Edge devices D. State does not immediately bypassing the listening and learning states. Local only devices F.) A. Correct Answer: AB Section: (none) Explanation Explanation/Reference: This article is very helpful. User responsible to control ISP edge devices B.cisco.

E. Stack works with multicast only addresses. Dynamic MAC address learning is not possible on a Ethernet switch. B. D. It is not possible to enable and disable dynamic MAC address learning only on VLAN. Dynamic MAC address learning is not a standard function in Ethernet networks.Explanation/Reference: QUESTION 79 A question about dymanic MAC address learning. Stack works with single management IP. Stack works like a single device. (Choose two. C. Stack works with single management console to monitor. (Choose two. A. C. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 81 A question about using CDP and LLDP at the same time on one switch. Stack does not work with single management IP.) . B. D. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 80 A question about StackWise. E.) A. You can enable and disable dynamic MAC address learning only on VLAN. Dynamic MAC address learning is standard function in Ethernet networks.

) A. QoS works with QoS queue if the port state is set to trust E. Port must be trust Correct Answer: ABD Section: (none) Explanation Explanation/Reference: QUESTION 83 A question about port security violation. Can not use at the same time C. Interface should be trunk or access D.A. A. Port must be untrust F. (Choose three. Always shutdown by violations . Traffic tagged or untagged C. Only CDP D. Only LLDP E. LLDP use multicast advertisement F. Can use CDP and LLDP at the same time B. LLDP use unicast advertisement Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 82 A question about voice LAN port. Voice needs their own VLAN B.

The ports can be source of a SPAN session but not destination. All ports should be a part of SPAN source and destination session. QUESTION 85 Which two port err-disabled recovery options are used to detect the reason? (Choose two.) . Always trap by violations E. Correct Answer: CD Section: (none) Explanation Explanation/Reference: Same trunking protocol (dot1q or ISL) should be used on all ports. C. D.) A. Same trunking protocol should be used on all ports. D.CONCEPT ONLY A. error-disable notifications/traps are disabled by default. . Ports should be contiguous. Ports should be in same module of switch stack. Always disable by violations Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 84 Which two requirements are required to form a Layer 2 EtherChannel? (Choose two. B. E. Always log by violations D. show errdisable detect B. No port should be a part of SPAN destination session. show errdisable recovery C. error-disable notifications/traps are active by default. Always error-disable by violations C.B.

E. error-disable notifications/traps is never possible. Correct Answer: AB Section: (none) Explanation Explanation/Reference: .

the switch with the lowest stack member priority value C. show sdm prefer routing (config)# sdm prefer routing C. the switch with the lowest stack member ID Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 3 . show sdm prefer (config)# sdm prefer routing D. show sdm prefer vlan (config)# sdm prefer vlan B. show sdm prefer (config)# sdm prefer default Correct Answer: D Section: (none) Explanation Explanation/Reference: Default SDM gives balance to all functions. the switch with the highest stack member priority value B.MCQs Sept-Oct-Nov 2017 . A. QUESTION 2 Which switch is chosen as the stack master during a stack master election or re-election? A.Contribute QUESTION 1 A question about a Layer 2 switch has been moved over to a Layer 2 and Layer 3 environment but high CPU spike during work hours. the switch with the highest stack member ID D.

. (config)# ip arp inspection vlan 10 E. A. (config)# ip dhcp snooping C. (config)# interface ethernet 0/0 (config-if)# ip dhcp snooping trust (config-if)# ip arp inspection trust F. storm-control broadcast enable Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 5 A question related to security violation mode which drop unknown packets and then sends trap. storm-control broadcast level 10 20 D. storm-control broadcast level 10bps B. (config)# ip dhcp snooping vlan 10 D.CONCEPT ONLY A. (config)# interface ethernet 0/0 (config-if)# ip dhcp arp inspect-snoop trust Correct Answer: BCDE Section: (none) Explanation Explanation/Reference: QUESTION 4 A question about storm control based on optimal storm-control configuring.Which of the following commands are valid to configure DHCP snooping with Dynamic ARP Inspection for a VLAN? (Choose all that apply.) . (config)# ip dhcp snooping vlan arp trust B. storm-control broadcast level 10pps C.

E. Created in VTP server mode in VTP version 3. B. 2 C. VTP version 3 stores extended-range VLAN in VLAN database. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 7 How many VLANs can be assigned to a user access port configured for VoIP? A. restrict D. Created when switch is in VTP server mode. drop C.) A. D. C. They support pruning. inhibit B. protect Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 6 Which two statements about extended-range VLANs are true? (Choose two.A. VTP version 1 and 2 stores extended-range VLAN in VLAN database. 3 . shutdown E. 1 B.

When the CAM table overflows with dynamically learned MAC address. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 9 Which three authentication methods does VRRP use? (Choose three. 802.1x authentication B. D. E. C. When sticky MAC address learning is enabled and the port has a link down condition. When a port with secure MAC address attempt to use a different port in same VLAN. When the same MAC addresses enters a port more than once. Plain text authentication F. No authentication E.) A.) A. Cipher authentication C. B. SHA-256 authentication D.D. When the port has received more MAC address than allowed. MD5 authentication Correct Answer: DEF . unlimited Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 8 A question about port security violation occur in which two circumstances? (Choose two.

cisco.Section: (none) Explanation Explanation/Reference: VRRP has three authentication schemes: No authentication Plain text authentication MD5 authentication Reference: https://www.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-glbp. No authentication D. Single Sign On authentication B.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-vrrp. 6-to-4 authentication Correct Answer: BCD Section: (none) Explanation Explanation/Reference: GLBP has three authentication schemes: No authentication Plain text authentication MD5 authentication Reference: https://www.) .html QUESTION 11 Which two authentication methods does HSRP use? (Choose two. DCSP authentication F.cisco.) A.html#GUID-B1CB24C0-2526-4790- A701-0105FDA69FC8 QUESTION 10 Which three authentication methods does GLBP use? (Choose three. Plain text authentication E. MD5 authentication C.

html QUESTION 12 Which three HSRP exchange states are used in multicast messages? (Choose three. WPA2 authentication B.A.cisco. resign Correct Answer: BEF Section: (none) Explanation Explanation/Reference: Coup .) A. Hello .When a standby router wants to assume the function of the active router. Teredo F. coup C. it sends a coup message. SHA-128 authentication C. hold E. err-disabled B. MD5 authentication D. hello F. inherit D. No authentication methods do exist Correct Answer: CD Section: (none) Explanation Explanation/Reference: HSRP has two authentication schemes: Plain text authentication MD5 authentication Reference: https://www. Plain text authentication E.A router that is the active router sends this message when it is about to shut down or when a router that has a higher priority sends a hello or coup . Resign .The hello message conveys to other HSRP routers the HSRP priority and state information of the router.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-hsrp.

Correct Answer: BD Section: (none) Explanation Explanation/Reference: Perform this task to configure multiple HSRP client groups. random delay so that all client groups do not change at the same time. The standby follow command configures an HSRP group to become a slave of another HSRP group. Use the standby priority command to configure an HSRP group to become a backup of another HSRP group. .html#GUID-0C469257-64CB-4779- B9FC-964A2E051789 QUESTION 13 Which two tasks can be accomplished to configure multiple HSRP client groups? (Choose two.) A.cisco. Use the standby follow command to configure an HSRP group to become a slave of another HSRP group. The default interval is 10 seconds and can be configured to as much as 255 seconds. Use the standby mac-refresh seconds command to directly change the HSRP client group refresh interval.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-hsrp. D. E. Use the standby track command to configure an HSRP group to become a primary HSRP group. B. HSRP client groups follow the master HSRP with a slight. Use the standby mac-resurrect <seconds> command to change the refresh interval of the HSRP client group. C.message. Use the standby mac-refresh <seconds> command to change the refresh interval of the HSRP client group. Reference: https://www.

E. RSPAN VLAN can not be a private primary VLAN or secondary VLAN. RSPAN VLAN prevents from carrying traffic. Correct Answer: ACD Section: (none) Explanation . RSPAN VLAN traffic only flows on trunk ports.cisco. D. B. F. All RSPAN VLAN traffic is flooded.) A.Reference: https://www. C. RSPAN VLAN traffic only flows on access ports. RSPAN VLAN does not support Spanning-Tree Protocol.html#GUID-EBDA2930-B8E5-4E54- 9ECC-F9F232EC2955 QUESTION 14 Which three statements about RSPAN VLAN are true? (Choose three.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-hsrp.

STP can run on RSPAN VLAN trunks but not on SPAN destination ports.Explanation/Reference: The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN. If you assign an RSPAN VLAN ID in the extended VLAN range (1006 to 4094). RSPAN VLAN traffic only flows on trunk ports.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/ swspan. For VLANs 1 to 1005 that are visible to VLAN Trunking Protocol (VTP). RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command.) A. RSPAN VLAN traffic does not get flooded. . RSPAN VLAN must be configured in VLAN configuration mode using the remote-span command. C. D. The RSPAN VLAN ID separates the sessions. It has these special characteristics: All traffic in the RSPAN VLAN is always flooded. multiple RSPAN source sessions anywhere in the network can contribute packets to the RSPAN session. Reference: https://www.html QUESTION 15 Which two statements about RSPAN VLAN are true? (Choose two.cisco. except for SPAN destination ports. E. That is. It is normal to have multiple RSPAN VLANs in a network at the same time with each RSPAN VLAN defining a network-wide RSPAN session. It is also possible to have multiple RSPAN destination sessions throughout the network. you must manually configure all intermediate switches. No MAC address learning occurs on the RSPAN VLAN. Correct Answer: AB Section: (none) Explanation Explanation/Reference: The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. No MAC address learning occurs on the RSPAN VLAN. It has these special characteristics: All traffic in the RSPAN VLAN is always flooded. RSPAN VLAN does not support any protocols. the VLAN ID and its associated RSPAN characteristic are propagated by VTP. RSPAN VLAN trunks can handle Spanning-Tree protocol. RSPAN VLAN access ports can handle Spanning-Tree protocol in conjunction with SPAN destination ports. B. monitoring the same RSPAN VLAN and presenting traffic to the user.

Reference: https://www. E. Other security features. That is.html QUESTION 16 Which two functions of DHCP snooping are true? (Choose two. which contains information about untrusted hosts with leased IP addresses. Rate-limits DHCP traffic from trusted and untrusted sources. For VLANs 1 to 1005 that are visible to VLAN Trunking Protocol (VTP). multiple RSPAN source sessions anywhere in the network can contribute packets to the RSPAN session.cisco. Builds and maintains the DHCP snooping binding database. Utilizes the DHCP snooping binding database to validate subsequent requests from untrusted hosts. D.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/ swspan. C. monitoring the same RSPAN VLAN and presenting traffic to the user. RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command. It is also possible to have multiple RSPAN destination sessions throughout the network. the VLAN ID and its associated RSPAN characteristic are propagated by VTP. It is normal to have multiple RSPAN VLANs in a network at the same time with each RSPAN VLAN defining a network-wide RSPAN session. It rate-limits DHCP traffic from trusted and untrusted sources. An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN. such as dynamic ARP inspection (DAI). . STP can run on RSPAN VLAN trunks but not on SPAN destination ports. you must manually configure all intermediate switches. The RSPAN VLAN ID separates the sessions. B. It helps build the route table. Correct Answer: AD Section: (none) Explanation Explanation/Reference: DHCP snooping is a security feature that acts like a firewall between untrusted hosts and trusted DHCP servers. If you assign an RSPAN VLAN ID in the extended VLAN range (1006 to 4094). The DHCP snooping feature performs the following activities: Validates DHCP messages received from untrusted sources and filters out invalid messages. RSPAN VLAN traffic only flows on trunk ports. also use information stored in the DHCP snooping binding database.) A. It correlates IP address to hostnames. It listens to multicast messages between senders and receiver. It filters invalid messages from untrusted sources.

A secure port cannot belong to an EtherChannel port-channel interface.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp. E. all DHCP messages for enabled VLANs are intercepted in the PFC and directed to the RP for processing.DHCP snooping is enabled on a per-VLAN basis. It is not supported on EtherChannel port-channel interfaces. It is not supported on PVLAN ports. A secure port and static MAC address configuration are mutually exclusive. the feature is inactive on all VLANs.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html QUESTION 17 Which two restrictions of the port security feature are true? (Choose two.) A.cisco. Configure the switchport switch-port security violation restrict 1 command. Therefore. A secure port cannot be a destination port for Switch Port Analyzer (SPAN). It is supported on destination SPAN ports. Correct Answer: AC Section: (none) Explanation Explanation/Reference: Port Security Guidelines and Restrictions Follow these guidelines when configuring port security: A secure port cannot be a trunk port.cisco. Reference: https://www. By default. Static port MAC address assignments are not supported. The DHCP snooping feature is implemented in software on the route processor (RP). Reference: https://www. B. A single device can learn a maximum of three sticky MAC addresses. D. C. You can enable the feature on a single VLAN or a range of VLANs. .pdf (see page 32-3) QUESTION 18 Which configuration do you apply to an interface so that it uses port security to learn and commit the first MAC address? A.

port-channel load-balance dst-ip B.) A. F.pdf (see page 62-9) QUESTION 19 Which two commands can you enter to configure load-balancing at Layer 2? (Choose two. port-channel load-balance src-ip Correct Answer: CD Section: (none) Explanation .cisco. Disable the sticky MAC addresses feature. C.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/port_sec. Configure the switch for port-security aging type inactivity command. Correct Answer: E Section: (none) Explanation Explanation/Reference: Here is a concept example on how to learn and commit MAC addresses. port-channel load-balance src-dest-mac E. port-channel load-balance src-mac D. Configure the switchport port-security maximum 1 command. port-channel load-balance src-dst-ip C. Reference: https://www. E. D.B. Enable the static secure MAC addresses feature. Enable the sticky MAC addresses feature.

E.Explanation/Reference: QUESTION 20 Which two statements about CDP are true? (Choose two. It can be disabled only at the interface level. Devices with Cisco Discovery Protocol configured send advertisement messages to a broadcast address on a periodic basis. VTP relies on Cisco Discovery Protocol to carry VTP domain information. It is disabled when switches have mismatched native VLANs. channel-protocol pagp channel-group 1 mode desirable E.) A. Devices with Cisco Discovery Protocol configured send advertisement messages to a multicast address on a periodic basis. Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 21 Which two command sequences must you enter on a pair of switches so that they negotiate an EtherChannel using the Cisco proprietary port-aggregation protocol? (Choose two. channel-protocol pagp channel-group 1 mode auto C. channel-protocol pagp channel-group 1 mode on Correct Answer: BD Section: (none) . D. channel-protocol lacp channel-group 1 mode active D. B. C. channel-protocol lacp channel-group 1 mode on B.) A.

Enter the cdp disable command to disable it on an individual interface. E. You can use the show errdisable detect command to view the reason a port was error-disabled. Enter the no cdp run command to disable it in the global configuration. You can use the show errdisable recovery command to view the reason a port was error-disabled. Correct Answer: AB Section: (none) Explanation Explanation/Reference: . B. Enter the no cdp enable command to disable it on an individual interface. D. Errdisable detection is enabled by default on ports with port security enabled. D. E.) A.) A. C. Enter the no cdp run command to disable it on an individual interface. Enter the no cdp enable command to disable it on a device. B. Errdisabled detection is disabled by default on ports with port security enabled.Explanation Explanation/Reference: QUESTION 22 Which two ways can you use to disable Cisco Discovery Protocol? (Choose two. C. Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 23 Which two statements about errdisable recovery are true? (Choose two. Errdisabled autorecovery is enabled by default.

VIP on same subnet. C. (Choose two. Physical IP address must be set. D.) A. B.CONCEPT ONLY A.QUESTION 24 What are the prerequisite for HSRP interface to come up? (Choose two. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 25 Which two prerequisites are required for an HSRP interface to come up? (Choose two. Configure an physical IP address for the interface and enable that interface before HSRP becomes active. E. It requires to configure more than one first-hop redundancy protocol on the same interface. B. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 26 A question based on MAC address table.) . Configure HSRP version 2 to interoperate with HSRP version 1. There are no prerequisites required to configure HSRP. Virtual MAC address need to be configured.) . C. E. D. The virtual IP address must be in the same subnet as the interface IP address. VIP on a separate subnet. The virtual IP address is prohibited to be in the same subnet as the interface IP address under IPv4.

aaa. Two MAC address aaa. Fa0/3 can communicate Layer 2 switch.x in routing table. D. Fa0/2 cannot communicate in Layer 2 switch. C.aaa. Two MAC address aaa. B.A.aaa must be in different VLAN. Fa0/1. Fa0/1. R1 have x. A.x. ??? D. ??? Correct Answer: A . ??? C.x.aaa.aaa. E. Fa0/3 cannot communicate in Layer 2 switch.aaa must be in same VLAN. B. Fa0/2. Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 27 A question about HSRP that have these options.

x then either R1 or R2 will take mastership because it will be decrement of 10 the priority of R1 is 110.x.x. B.) A.x. The two aaaa.x.aaaa MAC address entries must be from different VLANs.Section: (none) Explanation Explanation/Reference: QUESTION 28 Refer to the exhibit. When R2 lose route to 10.x then R1 will take mastership because it will be increment of 20 the priority of R2 is 120. E.x. The two aaaa. C.x then R1 will take mastership because it will be increment of 20 the priority of R1 is 130 – minus 20 = 110 and the R1 is on .x. D. Interface fa0/1 and fa0/2 cannot communicate via Layer 2 switching.x then R2 will take mastership because it will be decrement of 20 the priority of R1 is 110 – minus 20 = 90 and the R2 is on default priority (100).x. Interface fa0/1 and fa0/3 cannot communicate via Layer 2 switching.aaaa. When R1 lose route to 10. Which two statements about the network environment are true? (Choose two. A.x. C. When R2 lose route to 10. When both R1 and R2 lose route to 10. D. Interface fa0/2 and fa0/3 can communicate via Layer 2 switching.aaaa. Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 29 A question with two VRRP routers and there is an IP reachability.aaaa MAC address entries must be from the same VLANs. B.

switchport trunk vlan 99 native C. switchport vlan 99 native F.contributed in Certprepare) A. DHCP Snooping B. DHCP Request D. switchport native trunk vlan 99 E. DHCP Relay C. switchport native vlan 99 trunk D. switchport vlan native trunk 99 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 31 Which type of packet does DHCP snooping continuously check in a production network? (What kind of packets is DHCP snooping continuously check in a production network? . DHCP Reply . Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 30 How can you set VLAN 99 on a trunk to become a native VLAN? A. default priority (90). DHCP Acknowledge E. switchport trunk native vlan 99 B.

aaaa. how to untagged trunk VLAN 99? .aaaa.contributed in Certprepare) A. It shows a show mac-address output.aaaa. DHCP Allow Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 32 If VLAN 99 is set to trunk. how can you set it to untagged from trunk VLAN 99? (If VLAN 99 trunk is set.aaaa with a show mac-address output based on Layer 3. switchport allow access vlan 99 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 33 A question with the MAC address aaaa. switchport vlan 99 allow access D.contributed in Certprepare) . switchport access vlan 99 B. switchport vlan 99 access C.F.) (New question with the MAC aaaa. . (Choose two.

Fa0/1 and Fa0/3 cannot communicate without a Layer 3 switch. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 34 A question related to a MAC address output. Device with MAC address of aaaa. B.aaaa. Device with MAC address of aaaa.aaaa is connected to the same VLAN. Fa0/1 and Fa0/2 are in the same VLAN. . Fa0/1 and Fa0/2 are not in the same VLAN. B. Fa0/1 and Fa0/2 cannot communicate via Layer 3 switch.) (ANOTHER CONTRIBUTED VARIATION FROM CERTPREPARE) A.aaaa is connected to different VLAN. (Choose two. D. Fa0/1 and Fa0/3 can communicate without a Layer 3 switch. E. C.aaaa.A.

R2 does not have a route to 10.C. A.10. IGMP Snooping C. DHCP Inspection Correct Answer: D .1/32 in routing table.1.1/32 in routing table. Communication between VRRP members is encrypted using MD5. R2 becomes master if R1 reboots or track in R1 does not fail. D.10. which statement is true about R1 and R2? A. B. Fa0/1 and Fa0/3 can not communicate on the Layer 2 switch. DHCP Snooping E. Fa0/3 and Fa0/2 can communicate on the Layer 2 switch. D. C. Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 35 EXHIBIT INCLUDED . R1 has a route to 10. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 36 A question related to constant checking of DHCP messages and filtering. IGMP ??? B.1.R1 is the VRRP master virtual router. ARP Inspection D. E. Fa0/1 and Fa0/2 can not communicate on the Layer 2 switch.

E. StackWise manages like a hybrid device. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 38 Which feature rate-limits DHCP traffic? A. DHCP Acknowledge C.) A. It can use one IP address. C. DHCP Snooping B.Section: (none) Explanation Explanation/Reference: QUESTION 37 Which two statements are true about StackWise? (Choose two. DHCP Request D. DHCP Spoofing Correct Answer: A Section: (none) Explanation Explanation/Reference: . It looks like a multiple device. B. It looks like one device. It can use multiple IP address. D.

D. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 41 Which command configures VLAN 99 as an untagged VLAN on a trunk? A. All ports in the EtherChannel must be on the same module. It monitors multiple switches from a central console. The trunking protocol must be the same for all links in the EtherChannel.) A. C.html QUESTION 40 Which two conditions must be met to establish a Layer 2 EtherChannel? (Choose two.QUESTION 39 Which two statements are true about StackWise? (Choose two. switchport access vlan 99 . B. C. It allows multiple switches to operate as a single switch.) A. It can use one IP address to communicate with n/w (network). E. Correct Answer: BE Section: (none) Explanation Explanation/Reference: https://www. It enables multiple switch ports to share a single master configuration.com/c/en/us/products/collateral/switches/catalyst-3750-series-switches/prod_white_paper09186a00801b096a. All ports in the EtherChannel must operate in half duplex. LAN ports in the EtherChannel must be contiguous. B.cisco. SPAN must be disabled on the ports. D. It groups multiple switch ports as a single EtherChannel. E.

switchport trunk pruning vlan except 99 C. switchport trunk native vlan 99 Correct Answer: D Section: (none) Explanation Explanation/Reference: . switchport trunk allowed vlan 99 D.B.

asp?p=2181837&seqNum=7 QUESTION 42 Refer to the exhibit.) .Reference: http://www. Which two statements about the network environment of the device that generated this output are true? (Choose two.com/articles/article.ciscopress.

B. E. The virtual IP address of the HSRP group is 10. D.1.1.1. it can become the active router. C. Which statement about the VRRP configuration on R1 and R2 is true? . The hello and hold timers are set to custom values. Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 43 Refer to the exhibit. The local device has higher priority setting that the active router. R1 is the VRRP master virtual router. If the router with a higher IP address and same HSRP priority as the active router becomes available. Currently.A. If the local device fails to receive a hello from the active router for more than 5 seconds. that router becomes the new active router 5 seconds later.

Communication between VRRP members is encrypted using MD5. C.A.1. R2 does not have a route to 10.10. R2 becomes master if R1 reboots or track in R1 does not fail. R1 has a route to 10. D.10. .1.11/32 in its routing table. B.1/32 in its routing table.

DHCP host tracking C. Dynamic ARP inspection Correct Answer: D Section: (none) Explanation Explanation/Reference: . DHCP inspection F. DHCP snooping E. CGMP binding D.Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 44 Which feature actively validates DHCP messages and drops invalid messages? A. IGMP snooping B.

. If an AVF has failed. reply Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 3 Which statement is true when one of its virtual gateway redundancy with an AVF has failed? A.Contribute QUESTION 1 Which statement about GLBP is true? A. They become active if any of the existing forwarding switches fail. Unused bandwidth is never utilized. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 2 In which state does the standby virtual gateway take election? A. They communicate under TCP port 3222 for both source and destination. listen C. learn B. C.MCQs Dec 2017_Feb-March 2018 . one of the primary virtual forwarders in the listen state assumes responsibility for the virtual MAC address. init D. They become restricted if any of the existing forwarding switches fail. B. D.

Token Ring F. Multicast C. If an AVF has failed. 5. one of the secondary virtual forwarders in the listen state assumes responsibility for the virtual MAC address. If an AVF has failed. Unicast E. Broadcast D. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 4 Which three design types of capable Ethernet LANs does HSRP support? (Choose three. 2 and 4 . 3. FDDI Correct Answer: ABC Section: (none) Explanation Explanation/Reference: QUESTION 5 Which hot standby groups numbers are used in a HSRP token ring? A. 0 and 1 D. 1 and 2 B. D. C. 0.) A. one of the secondary virtual forwarders in the listen state will also fail. If an AVF has failed.B. Multicaccess B. and 7 C. one of the primary virtual forwarders in the listen state will also fail.

Token ring E. IP address B. (config-if)# spanning-tree root guard D. (config if)# spanning-tree guard root B. (config)# spanning-tree root guard Correct Answer: A Section: (none) Explanation . MAC address C.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 6 Which component does the GLBP client cache stores for each host of a particular GLBP group? A. VLAN D. (config)# spanning-tree guard root C. DCSP Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 7 Which command is required for root guard for Cisco device to place ID:2071948x? (Where x is the last digit ID) A.

??? D. Access Switch D. Core Switch Correct Answer: B Section: (none) Explanation Explanation/Reference: A Catalyst switch can detect an IP phone via CDP and can instruct the phone to extend a trust boundary to its auxiliary data port. Distribution Switch.) A. IP Phone. Distribution Switch E. Port ID C.Explanation/Reference: QUESTION 8 What will extend a trust boundary (There is a switch interface configuration with separate voice VLAN and data VLAN to. Core Switch and Data Centre Aggregation switch)? A. Chassis ID B. ??? F. IP Phone C. ??? Correct Answer: AB Section: (none) Explanation . Multiple Layers PC B. Reference: CCNP BCMSN Exam Certification Guide: CCNP Self-study QUESTION 9 Which two TLVs are mandatory? (Choose two. Access Switch. also showing endpoint (host). The voice traffic from the phone should be implicitly trusted because the phone is both a Cisco device and a small switch that can be configured and controlled. ??? E.

1 organizationally specific TLVs) B.CONCEPT ONLY A. Source and destination capabilities TLV Correct Answer: ABCDE Section: (none) Explanation Explanation/Reference: The switch supports these basic management TLVs.com/c/en/us/td/docs/switches/metro/me3400/software/release/12-2_58_se/configuration/guide/ME3400_scg/swlldp.3 organizationally specific TLVs) C. Port description TLV B. MAC/PHY configuration/status TLV (IEEE 802.cisco. Management address TLV F. These are mandatory LLDP TLVs.CONCEPT ONLY A. Port VLAN ID TLV (IEEE 802. • Port description TLV • System name TLV • System description • System capabilities TLV • Management address TLV Source: https://www.pdf (page 24- 2) QUESTION 11 Which two of the following organizationally specific LLDP TLVs are also advertised to support LLDP-MED? (Choose two.) . IP Address TLV (IEEE 802. System description D. System capabilities TLV E. System name TLV C.) .9 organizationally specific TLVs) . Isolated address TLV G.Explanation/Reference: QUESTION 10 Which of the following mandatory TLVs are valid for basic management? (Choose five.

??? Correct Answer: AB Section: (none) Explanation Explanation/Reference: The switch supports these basic management TLVs.com/c/en/us/td/docs/switches/metro/me3400/software/release/12-2_58_se/configuration/guide/ME3400_scg/swlldp.cisco. ??? D.D. (Choose two. Descriptive TLV (IEEE 802.5 organizationally specific TLVs) Correct Answer: AB Section: (none) Explanation Explanation/Reference: These organizationally specific LLDP TLVs are also advertised to support LLDP-MED.1 organizationally specific TLVs) • MAC/PHY configuration/status TLV(IEEE 802. • Port VLAN ID TLV ((IEEE 802.) A. • Port description TLV • System name TLV • System description • System capabilities TLV • Management address TLV . These are mandatory LLDP TLVs.3 organizationally specific TLVs) E. System name C.pdf (page 24- 2) QUESTION 12 A question about LLDP TLVs with two choices.3 organizationally specific TLVs) Source: https://www. DSCP TLV (IEEE 802. System description B. ??? E.

com/c/en/us/td/docs/switches/metro/me3400/software/release/12-2_58_se/configuration/guide/ME3400_scg/swlldp. Time To Live E. Platform TLV C. Description ID Correct Answer: ABCD Section: (none) Explanation . Network TLV D. Chassis ID C.pdf (page 24- 2) QUESTION 13 Which two mandatory TLV types does LLDP advertise? (Choose two. VLAN ID F. System name ID G. Native VLAN TLV B.CONCEPT ONLY A.Source: https://www. End of LLDPDU B.) A. Chassis ID TLV Correct Answer: EF Section: (none) Explanation Explanation/Reference: QUESTION 14 Which four mandatory TLVs are valid? (Choose four.) . Hostname TLV E. Port ID D.cisco. Port ID TLV F.

maximum 16 instances to be used. Enables RSTP and use BPDU type 2. B. Source ID TLV H. System capabilities TLV E. what happens? A. Disables RSTP and use BPDU type 4. D. System name TLV C. System description TLV D. Disables RSTP and use BPDU type 2. Management address TLV F. maximum 16 instances to be used.Explanation/Reference: QUESTION 15 Which six optional TLVs are valid? (Choose six. Enables RSTP and use BPDU type 4. maximum 16 instances to be used. Correct Answer: A Section: (none) Explanation Explanation/Reference: . Port description TLV B. Native hostname TLV Correct Answer: ABCDEF Section: (none) Explanation Explanation/Reference: QUESTION 16 When you enable MST on the switch. Specific TLVs G. maximum 16 instances to be used.CONCEPT ONLY A. C.) .

(config)# ip dhcp untrusted-allow information D.CONCEPT ONLY A. (config)# interface FastEthernet 0/1 (config-if)# ip dhcp snooping trust (config-if)# do show ip dhcp snooping | begin pps B. (config-if)# ip dhcp snooping information option allow-untrusted C.QUESTION 17 Which two methods are used to configure a trusted option 82? (Choose two. (config)# ip dhcp snooping information option (config)# do show ip dhcp snooping | include 82 (config)# ip dhcp snooping information option allow-untrusted B. (config)# dhcp allow-untrusted option information Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 18 Which of the following commands to configure a DHCP trust is valid? . (config)# interface FastEthernet 0/1 (config-if)# ip dhcp snooping enable (config-if)# ip dhcp show snoop | begin pps Correct Answer: A Section: (none) . (config-if)# ip dhcp snooping trust-allow information E. (config)# interface FastEthernet 0/1 (config-if) ip dhcp snooping granted (config-if)# do show ip dhcp snooping | enable pps C. (config)# interface FastEthernet 0/1 (config-if) ip dhcp snooping allowed-enable (config-if)# do show ip dhcp snooping | start pps D.CONCEPT ONLY A.) .

D. R2 will become active when reboot. Both R1 and R2 will still become active and does not require a reboot. SW1(config-if)#spanning-tree port-priority 129 D. R1 will become active when reboot. B. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 20 If switch SW1 is connected in a mesh with four other switches and all switches retain the default configuration. SW1(config-if)#spanning-tree port-priority 127 Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 21 . It is not possible for either R1 or R2 to take the priority when both rebooted. A.Explanation Explanation/Reference: QUESTION 19 What will happen if R1 or R2 reboot which will take the priority. which command do you enter on SW1 interface to make it the root bridge for all VLANs? A. SW1(config)#spanning-tree port-priority 127 C. C. SW1(config)#spanning-tree port-priority 129 B.

when a Layer 2 EtherChannel is configured? (Choose two. switchport mode B. E. It is assigned multicast address 224. VLAN membership Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 23 Which tool can error-disable an interface if the storm control threshold is exceeded? A. C.9. D. storm control action default .0.8. spanning-tree cost C. Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 22 Which two attributes must match across the member ports. Its IP address number is 115.0. storm control action shutdown B.0. It is assigned multicast address 224.0. It supports both MD5 and SHA1 authentication. The TTL for VRRP packets must be 255.) A.Which two statements about VRRP are true? (Choose two. spanning-tree priority D. F. Three versions of the VRRP protocol have been defined.) A. B.

The port would try to actively repair the damaged fiber after 15 seconds.. . It would be in shutdown mode until fiber is replaced.. B. storm control enable D. Hence source traffic. storm control action trap Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 24 A switch has a pair of fiber and it has been damaged. Which two statements is true about the configuration below? (Choose two.. It would be up for 15 minutes after fiber is fixed. D.. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 25 Which statement is true about SPAN on a switch? A.) A. On every source port configured.. (???). It would prevent loops. It would double the source traffic. C. B. C.C. there would be another port that can not be used normally.

254? A. B. It is mostly used when connecting to workstations and servers.1.168. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 27 Which two statements about PortFast is true? (Choose two.) A. D. D. Forward it C.168. F. Only when the port is active when it moves to the forwarding state. C. and forward it (with its own source MAC address). Stop the Option 82 and make an proxy ARP request for the IP address 192.1. Correct Answer: CD Section: (none) . ??? Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 26 What would happen if a switch gets a packet with Option 82 with the IP address of 192. Stop the Option 82 and replace the source IP address to the switch management IP address and forward it.D. Drop it B. E. It skips the learning state. It will skip all spanning-tree states. Stop the Option 82 and forward it. Stop the Option 82 and replace the source MAC address.254.

) A. It can be configured in VTP transparent. B. B. E. Information about VLANs are stored in the configuration. It must have an IP address that is active. It required all the groups to have the same routing protocols. C. It supports VLANs 1-1001.) A. but must have the same name. It supports extended VLAN. It can have different VLANs with the same VLAN ID. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 29 Which two statements about VLAN database is true? (Choose two. but must be in the VLAN database mode.Explanation Explanation/Reference: QUESTION 28 Which two statements about HSRP is true? (Choose two. Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 30 . It must have the same virtual MAC address for all groups. D. C. It must have the same VIP address in all groups. D.

??? D.) A.Which two statements about err-disable is true? (Choose two. It is using one IP address to manage all switches. B. VLAN 1 untagged as 99 C. C. C. VLAN 99 tagged as 1 D. It is on auto when port-security is on.) A. ??? D. B. VLAN 1 tagged as 99 B. ??? Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 31 Which two statements about stack is true? (Choose two. but they all work independently. VLAN 99 untagged as 1 . When the port goes to err-disabled. It uses proprietary modules. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 32 What would happen if IEEE was VLAN 99 as native? (Choose two. the link of the switch light goes to solid orange. It shares one IP address in all switches.) A.

On the global configuration mode. (config-if)# ip dhcp snooping trust B. dhcp snooping trust B. On the global configuration mode. On the interface configuration mode.CONCEPT ONLY A. (config)# ip dhcp snooping information option enable-untrusted . ip dhcp snooping option replace D. On the interface configuration mode. (config)# ip dhcp snooping information option allow-untrusted C. On the interface configuration mode. (config-if)# ip dhcp snooping information option allow-untrusted D.Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 33 Which command is used to configure DHCP snooping for Option 82? A. (config-if)# ip dhcp snooping granted E. dhcp snooping information option untrust C.) . ip dhcp snooping information option allow-untrusted Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 34 Which three commands are valid to configure DHCP snooping for Option 82? (Choose three.

(config-if)# ip dhcp snooping information option enable-untrusted Correct Answer: ABC Section: (none) Explanation Explanation/Reference: QUESTION 35 Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC address binding? A.F. It supports checksum. Dynamic ARP Inspection Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 36 Which two advantages of LLDP are used over CDP? (Choose two. It supports topology change notification. It supports vendor-agnostic. It supports FrameRelay . E. IP Source Guard C. D. C. B. On the interface configuration mode. It supports ATM.) (2 advantages of LLDP over CDP) A. Port Security B. DHCP Snooping D.

RSPAN support by default monitors at Layer 2. D. VLANs 1-1001 B. At least one access port must be configured in the RSPAN VLAN. modify or delete on a switch? (Choose two. B.) A. VLANs 2-4094 Correct Answer: CD Section: (none) Explanation Explanation/Reference: . Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 38 Which two VLAN ranges can you add. VLANs 1005-4094 C. The same RSPAN VLAN is used for a RSPAN session on all switches. VLANs 2-1001 E. C.Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 37 Which statement about RSPAN session is true? A. VLANs 1006-4094 D. Only the source switch in a session must support RSPAN.

) (Which of the 2 below answers are related to RSPAN. RSPAN should be a trunk. The information is saved to the running configuration file. C. The information is saved to the vlan.QUESTION 39 Which two statements in relation to RSPAN are true? (Choose two. ??? E. D. B.dat file. RSPAN port will not learn MAC address. C. The information is saved to the vlan. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 41 Which two statements are true in regards to normal and extended range VLANs? (Choose two.) A. B. ??? Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 40 Where does the VLAN information get saved to? A. The information is saved to the vlan.txt file.) . ??? D.conf file.

Normal range VLANs from 1-1005 are stored in vlan. B. VLANs 4094-8030 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 43 Which extended VLAN range are valid and is stored in the startup configuration? A. C. D.dat. Normal range VLANs from 1-1005 are stored in the startup configuration. E. VLANs 1005-2030 C.A.dat configuration file? A. VLANs 1006-4096 B. Extended range VLANs from 1006-4096 are stored in vlan. VLANs 1-1005 D. VLANs 1-1005 B. VLANs 2094-4094 D. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 42 Which normal VLAN range are valid and is stored in the vlan. VLANs 2006-6096 C. Extended range VLANs from 1006-4096 are stored in the startup configuration. Both normal and extended VLANs are stored in vlan.dat file.dat. VLANs 1005-2060 .

If the local device fails to receive a hello from the active router for more than 5 seconds. Correct Answer: BC Section: (none) . C. D. B. If a router with a higher IP address and same HSRP priority as the active router becomes available. The hello and hold timers are set to custom values.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 44 Refer to the exhibit.1. it can become the active router. Which two statements abiout the network environment of the device that generated this output are true? (Choose two. that router becomes the new active router 5 seconds later. The local device has a higher priority setting than the active router.) A.1.1. The virtual IP address if the HSRP group is 10. E.

root guard D. BPDU filtering Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 47 Which two StackWise configuration setting types are applied at the system level? (Choose two. router C.Explanation Explanation/Reference: QUESTION 45 Which type of MAC address can be dropped by a switch that is configured for MAC address filtering? A. PortFast C. CPU-destined Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 46 Which feature prevents from sending BPDUs on a portfast enabled port? A. unicast B.) . BPDU guard B. multicast D.

port-security settings B. 802. VLAN settings C. loop guard B. C. A single device can learn a maximum of three stick MAC addresses.) A.A. It is not supported on PVLAN ports. It is not supported on EtherChannel port-channel interfaces. B. SNMP settings E. It is not supported on destination SPAN ports. root guard . speed/duplex settings D.1k settings Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 48 Which two restrictions of the port security feature are true? (Choose two. Static port MAC address assignments are not supported. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 49 Which feature do you implement so that a physical port enter the loop inconsistent state if it fails to receive BPDUs? A. E. D. loop disable C.

BPDU guard D. promiscuous D. BPDU ignore F. primary B. loop block Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 50 Which feature places a port in an err-disabled state when it receives an unanticipated BPDU? A. flex links E. BPDU filtering Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 51 On which PVLAN type can host ports communicate with promiscuous ports? A. root guard C.D. loop guard B. community C. isolated Correct Answer: C Section: (none) .

The trunk is errdisabled automatically. All VLANs in the trunk are monitored. C. C0. 00:00:0c:07:ac:25 C. 00:00:00c:07:ac:37 Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 54 Which configuration do you apply to a device to place interface GigabitEthernet0/0 info VRRP group 10? .Explanation Explanation/Reference: QUESTION 52 Which statement about the configuration of a trunk port as the source of a SPAN session is true? A. provided the SPAN destination port is a trunk. D. B.00:00:255:00:00 B. All VLANs in the trunk are monitored. C0:00:00:37:00:00 D. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 53 Which virtual MAC address does HSRP group 37 use with default configuration? A. Only VLANs that are configured individually as SPAN sources are monitored.

13.13.255.13.13.2 255.A.254 Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 55 .256.255.13.0 vrrp 10 active C.255.13.255.16.254 255.16.16. interface GigabitEthernet0/0 ip address 172.16.255. interface GigabitEthernet0/0 ip address 172.254 256.0 vrrp 10 ip 172.13.0 vrrp group 10 priority 120 D.0 vrrp 10 ip 172.250.2 255.255.255.255.16.0 standby 10 ip 172.2 265.16.16.16.13.254 255. interface GigabitEthernet0/0 description to Executive Offices A 08-38338 ip address 172. interface GigabitEthernet0/0 ip address 172.255.13.13.0 standby 10 priority 120 standby 10 preempt B.0 vrrp 10 ip 172.2 255.255.255.16.255.13.0 vrrp group 10 ip 172.255.13.16.254 255.255.2 265 255.16. interface GigabitEthernet0/0 ip address 172.255.254 vrrp 10 priority 120 vrrp 10 preempt E.16.2 255.0 standby 10 ip 172.255.0 vrrp 10 priority 120 vrrp 10 preempt F.255. interface GigabitEthernet0/0 description to Executive Offices A 08-38338 ip address 172.

D. B. B. Sources can be ports or VLANs or any combination in the same session E. MAC addresses are associated with a VLAN. C. Ingress SPAN monitors packets received by the source interface before any QoS modifications Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 56 Which statement about the default behavior of a Cisco switch MAC address table is true? A. Spanning Tree uses only the member ports for forwarding. By default.1Q tag that they had on the source port F. . all monitored packets include the IEEE 802. You cannot configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of SPAN source ports and VLANs B. which statement about interaction with the Spanning Tree Protocol is true? A.Which two statements about the monitored traffic in a SPAN session are true? (Choose two. Spanning Tree uses the port channel for forwarding.) A. Egress SPAN monitors packets sent by the source interface before any QoS modifcations D. MAC address filtering is enabled on trunk ports. MAC addresses are aged out of the MAC table after 600 seconds.1Q tag C. all monitored packets are captured without the IEEE 802. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 57 When a Layer 2 EtherChannel is configured. MAC addresses are not learned on extended VLANs. By default.

switchport block unicast Correct Answer: A Section: (none) . VRRP is a Cisco proprietary protocol. one standby router. Spanning Tree does not use port channels in loop prevention. C. D. GLBP. E.C. HSRP is the preferred protocol to be used in multivendor environments. and many listening routers. Spanning Tree uses the port channel and member ports for forwarding. and VRRP are true? (Choose two. VRRP has one master router. switchport port-fast D. B. D. GLBP allows for a maximum of four MAC addresses per group. Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 59 Which command can be used to block a frame with an unknown destination MAC address from being forwarded out of an interface? A. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 58 Which two statements about HSRP. HSRP supports up to 255 groups in the same switch or router. C. It is not forwarded if the destination MAC address is unknown. switchport protected B.) A.

They require Cisco Discovery Protocol. C. Each physical port in the EtherChannel must have the same speed and duplex settings. E. They use an MD5 hash for equal load balancing. to implement port security D. LACP negotiation must be disabled on one device in the EtherChannel. Correct Answer: AC Section: (none) Explanation Explanation/Reference: . to reduce flooding in the network Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 61 Which two statements about manually-configured LACP EtherChannels are true? (Choose two. F. the ports are placed into the errdisabled state. to configure a VLAN as an SVI B. D. B. to free up space in the MAC address table C. If the physical port configurations on the two devices are different. LACP negotiation must be disabled on both devices in the EtherChannel.) A.Explanation Explanation/Reference: QUESTION 60 For which reason does an administrator disable MAC address learning within a VLAN? A.

QUESTION 62 Which two statements correctly describe the benefits of GLBP? (Choose two. . Interfaces Fa0/1 and Fa0/2 cannot communicate via Layer 2 switching. E. Which two statements about the network environment are true? (Choose two.) A. C. It can automatically adjust group weighting when an interface goes down.) A.aaaa MAC address entries must be from the same VLAN. The two aaaa. Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 63 Refer to the exhibit.aaaa. C. Interfaces Fa0/1 and Fa0/3 cannot communicate via Layer 2 switching. It supports up to 128 virtual routers per physical interface. B. D. It can load-share LAN traffic across up to four AVFs in a GLBP group. LAN traffic can be distributed to up to six routers in a GLBP group. It uses dual active AVGs for redundancy. B.

The two aaaa. which two attributes must match across the member ports? (Choose two. Interfaces Fa0/2 and Fa0/3 can communicate via Layer 2 switching.) A. Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 64 When a Layer 2 trunking EtherChannel is configured.D. ??? .) A. ??? D. DHCP Snooping C. allowed VLANs E. trunking mode Correct Answer: DE Section: (none) Explanation Explanation/Reference: QUESTION 65 Which method is used to prevent from ARP poisoning? (The question is about ARP poisoning. spanning-tree cost C. and the method to prevent it.aaaa. Dynamic ARP Inspection B.aaaa MAC address entries must be from different VLANs. E. spanning-tree priority D. interface description B.

Correct Answer: C Section: (none) . C. E. The native VLAN can be changed on a per port basis. Spanning tree is disabled if the switch port establishes an EtherChannel. Which effect of this configuration is true? A.) A. Only one VLAN can be the native VLAN on a device. Spanning tree blocks EtherChannel formation on the device. The native VLAN is untagged over trunks. D. B. B.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 66 Which two statements about native VLANs are true? (Choose two. VLAN 1 and VLAN 1001 are native VLANs by default. The switch port error disables when a port attempts to form an EtherChannel with a port that has a different configuration. Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 67 Refer to the exhibit. The switch port continues to negotiate an EtherChannel even when there are configuration discrepancies between the two ports. D. Cisco Discovery Protocol versions 1 and 2 can carry native VLAN information. C.

SW1(config-if)# ip arp-inspection trust D. root primary B. priority C. cost D. hello-time Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 69 Which command do you enter to enable Dynamic ARP Inspection for VLAN 15? A. SW1(config-vlan)# ip arp inspection trust C. SW1(config)# ip arp inspection vlan 15 Correct Answer: D Section: (none) Explanation Explanation/Reference: . SW1(config-vlan)# ip arp inspection vlan 15 B. diameter E.Explanation Explanation/Reference: QUESTION 68 Which keyword can be applied to the spanning-tree priority command that allows the IT department to adjust the timers based on the number of switches between any two end stations? A.

pdf This example shows how to configure dynamic ARP inspection on Switch A in VLAN 1.QUESTION 70 Which command do you enter to enable Dynamic ARP Inspection for VLAN 15? (If this question asks for two answers. A single device supports up to two sticky MAC addresses. It is not supported on PVLAN ports.) A.cisco. It is not supported on EtherChannel port-channel interfaces. SW1(config-vlan)# ip arp inspection vlan 15 B. It is not supported on destination SPAN ports. B. SW1(config-vlan)# ip arp inspection trust C. SW1(config)# ip arp inspection vlan 15 Correct Answer: CD Section: (none) Explanation Explanation/Reference: Refer page 8 https://www.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_20_se/configuration/guide/3560scg/swdynarp. You would perform a similar procedure on Switch B: Switch(config)# ip arp inspection vlan 1 Switch(config)# interface gigabitethernet0/1 Switch(config-if)# ip arp inspection trust QUESTION 71 Which three restrictions of port security features are true? (Choose three. Correct Answer: ABC Section: (none) Explanation . D. E. C. SW1(config-if)# ip arp-inspection trust D.) A. Static MAC address assignments are not supported.

A secure port cannot be a destination port for Switch Port Analyzer (SPAN).com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec. Virus D.Explanation/Reference: Port Security Guidelines and Restrictions Follow these guidelines when configuring port security: A secure port cannot be a trunk port.html QUESTION 72 Which type of attack does dynamic ARP mitigates? A. DDoS attack C. <-Answer Reference: https://www. ??? Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 73 Which two types of protocols use VLAN 1 as the default? (Choose two. <-Answer A secure port cannot belong to an EtherChannel port-channel interface. ??? E. ??? Correct Answer: AC . <-Answer A secure port and static MAC address configuration are mutually exclusive. STP C. ??? E. Man-in-the-middle B. VTP D.) A.cisco. CDP B.

Only RSPAN supports STP on multiple switches across a campus. B. D. C. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 75 Which benefit of Stackwise is true? A. It supports single-chassis EtherChannel mode option. RSPAN provides more complete monitoring of the traffic on a single switch. Only RSPAN can log traffic on a VLAN that spans multiple switches. It allows multiple switches to operate independently while sharing a single management address.Section: (none) Explanation Explanation/Reference: QUESTION 74 For which reason would you configure RSPAN instead of SPAN on your network? A. It enables a Layer 2 switch to be converted to a Layer 3 switch when additional switches are added to the stack. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 76 . C. Only RSPAN devices can monitor traffic on other device. D. B. It allows multiple switches to be managed by a single management address.

The interface is shut down until the fiber pair is replaced. After the fiber pair is replaced. The interfaces actively tries to fix the damaged fiber link. B. B. What is likely to happen? A. They can be recovered only by resetting the interface. D. One pair of fibre that is connected to Gi0/1 has been damaged. E. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 78 . When a port is error-disabled. When a port is error-disabled. all traffic on the port stops. The interface is prevented from causing spanning-tree loops. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 77 Which two statements about error-disabled ports are true? (Choose two. C. the port LED changes to solid orange.) A. error-disabled ports automatically recover once the issue is resolved. C. the interface recovers within 15 minutes. it may continue to pass management traffic. D.Refer to the exhibit. When a port is error-disabled. By default.

It is most appropriate for ports that provide connectivity to individual workstations or servers. C.593 encapsulation dot1q 593 switchport access vlan 593 . E.) A. SPAN doubles traffic internally. Correct Answer: DE Section: (none) Explanation Explanation/Reference: QUESTION 80 Which configuration do you apply to an interface so that a host can be placed into VLAN 593? A.Which statement describes the result of configuring SPAN on a Cisco device? A. B. It forces the port to skip all spanning-tree states. If not carefully planned. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 79 Which two statements about PortFast are true? (Choose two. interface GigabitEthernet0/0. The port moves immediately to the forwarding state when a device is connected. C. SPAN can lead to loops between source and destination ports. SPAN blocks for normal use on one additional port for each configured source port. D. D. The port is error-disabled if it attempts to move into the listening or learning states. It allows the port to skip the learning state only. SPAN halves the capacity of the source port. B.

B. interface GigabitEthernet0/0 switchport mode access switchport access vlan 593 switchport host Correct Answer: B Section: (none) Explanation Explanation/Reference: . interface GigabitEthernet0/0 switchport mode trunk switchport trunk allowed vlan 593 D. interface GigabitEthernet0/0 switchport trunk encapsulation dot1q switchport trunk native vlan 593 switchport access vlan 593 C.

It only has one single point of management and IP address. The voice VLAN must be on the same VLAN database.Contribute QUESTION 1 A question about voice VLAN with the possibility of two answers.) . The voice VLAN must be on a different VLAN database. It only has one single point of management and MAC address. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 2 A question about the advantage of of VSS. C. D. It only has one multiple point of management and IP address. GLBP and VRRP are valid? (Choose four.MCQs April 2018 . B. The voice VLAN must be configured on a trusted port. D. It only has every single protocol as the point of management to be used. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 3 Which four multicast addresses for HSRP. A. B. The voice VLAN must be configured on an untrusted port.) A. (Choose two.) (Question about the voice VLAN. C.

C.A.0. The port is set to shutdown because UDLD is set to aggressive mode.0.0. The port is set to shutdown because STP.102. F.0.1.0. GLBP uses the multicast IP address of 224. Correct Answer: ABCD Section: (none) Explanation Explanation/Reference: QUESTION 4 EXHIBIT INCLUDED . HSRP version 1 uses the multicast IP address of 224.2. HSRP versions 1 and 2 both use the multicast IP address of 224.0.0.0.0. D.0. 4095 B. The port is set to shutdown error-disabled.0..102. VRRP uses the multicast IP address of 224..18 with IP protocol 112. A. GLBP uses the multicast IP address using the loopback IP address of 127. ??? D. HSRP version 2 uses the multicast IP address of 224. ??? Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 5 Which three of these VLANs are a valid extended VLAN? (Choose three. It shows a picture of 7 times and UDLD is set to aggressive mode.0. B. B. 4094 D. E.A question about UDLD.102.) A. C. 3000 . 4096 C.

It offers better administrative control over which device is allowed to update other devices view of VLAN topology.. B. The functionality of the VLAN environment has been expanded. D. It supports up to VLAN range of 2094. The functionality of the VLAN environment has reduced for improvement. ??? E. Use the ip dhcp snooping information command to enable data. D. Correct Answer: ABC .E. ??? Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 7 Which three new features of VTPv3 are true? (Choose three. E. Unintended and disruptive changes are reduced and availability has increased.) A. 1006 F. 1005 Correct Answer: CDE Section: (none) Explanation Explanation/Reference: QUESTION 6 Which two commands are used to configure a trusted DHCP Option 82 for untrusted-host? (Choose two. Use the ip dhcp snooping information option allow-untrusted command to enable DHCP Option 82. C. Use the ip dhcp snooping information command to enable DHCP Option 82. C.) A.. B.

) A. Two enhancements are most beneficial for today's networks: In addition to supporting the earlier ISL VLAN range from 1 to 1001. It can transfer information based on CDP structure.1Q VLAN range up to 4095. It supports the whole IEEE 802. B. It supports databases other than VLAN. It supports the whole IEEE 802.html QUESTION 8 Which two beneficial features are used for VTPv3? (Choose two. In addition to supporting the concept of normal VLANs.cisco. D. The reduced risk of unintended changes will ease the change process and help speed deployment. Functionality for the VLAN environment has been significantly expanded.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/solution_guide_c78_508010. the new version supports the whole IEEE 802.html QUESTION 9 Which major feature is supported using VTPv3? A. B.1Q VLAN range up to 4095. C. The chance of unintended and disruptive changes is significantly reduced. It can transfer information based on PVLAN structure. It supports databases other than FDDI.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/solution_guide_c78_508010.Section: (none) Explanation Explanation/Reference: Key Benefits of VTP Version 3 Much work has gone into improving the usability of VTP version 3 in three major areas: The new version of VTP offers better administrative control over which device is allowed to update other devices' view of the VLAN topology. Reference: https://www. VTP version 3 can transfer information regarding Private VLAN (PVLAN) structures. Reference: https://www. .1Q VLAN range up to 1005. and availability is increased. Correct Answer: AB Section: (none) Explanation Explanation/Reference: Functionality for the VLAN environment has been significantly expanded.cisco.

0 can be used to centrally manage a Cisco Catalyst 6500 virtual switch as a single entity. Correct Answer: A Section: (none) Explanation Explanation/Reference: The third area of major improvement is support for databases other than VLAN (for example. B. • Single point of management. It supports databases other than DLCI. It supports single point of management. It support Singlechassis EtherChannel. and routing instance for the Cisco Catalyst 6500 virtual switch – Single configuration file and node to manage. Reference: https://www. D. MST). Removes the need to configure redundant switches twice with identical policies. It supports flexible deployment options. – Removes the need for Hot Standby Router Protocol (HSRP). It supports multiple point of management. E. instead of the three IP addresses per VLAN used today. .cisco.) A. It supports databases other than DSCP. reducing switch management overhead by at least 50 percent. C. Virtual Router Redundancy Protocol (VRRP). Correct Answer: ABC Section: (none) Explanation Explanation/Reference: VSS increases operational efficiency by simplifying the network. D.html QUESTION 10 Which three feature advantages are supported in VSS? (Choose three. It supports Multichassis EtherChannel. IP address and routing instance for virtual switches. and Gateway Load Balancing Protocol (GLBP) – CiscoWorks LAN Management System (LMS) 3. MAC address and routing instance for virtual switches.C. – Only one gateway IP address is required per VLAN. IP address. • Multichassis EtherChannel® (MEC) is a Layer 2 multipathing technology that creates simplified loop-free topologies. eliminating the dependency on Spanning Tree Protocol. which can still be activated to protect strictly against any user misconfiguration.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/solution_guide_c78_508010.

Correct Answer: BD Section: (none) Explanation Explanation/Reference: . Configure the no switchport command on the physical interface(s). Configure the switchport mode trunk command on the device.• Flexible deployment options. It uses a specific VLAN to transfer mirrored traffic. D.) A. Configure EtherChannel directly on the interface. Configure the switchport mode access command on the device. SPAN destinations participate in spanning-tree instances.com/c/en/us/products/collateral/switches/catalyst-6500-virtual-switching-system-1440/prod_qas0900aecd806ed74b. E. D. the switches can be located up to 40 km apart. C.html QUESTION 11 Which statement about SPAN are true? A. E. For example. Reference: https://www. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 12 Which two tasks must you perform on a device to ensure that an EtherChannel operates at Layer 3? (Choose two. Configure the channel-group 10 mode on command on the port channel. The underlying physical switches do not have to be colocated.cisco. SPAN destinations also can be SPAN sources. C. B. B. The two physical switches are connected with standard 10 Gigabit Ethernet interfaces and as such can be located any distance based on the distance limitation of the chosen 10 Gigabit Ethernet optics. It mirrors traffic from a source port to a destination port on the same switch only. with X2-10GB-ER 10 Gigabit Ethernet optics. It is an industry-standard protocol for mirroring traffic.

C. Only the source switch in a session must support RSPAN.QUESTION 13 Which two statements about the spanning-tree operation of this switch are true? (Choose two.) A. The same RSPAN VLAN is used for a RSPAN session on all the switches. The spanning-tree mode stp ieee command was entered on this switch. The spanning-tree operation mode for this switch is PVST+.) A. HSRP uses a shared VIP among HSRP group. . D. (Choose two. The spanning-tree operation mode for this switch is PVST. RSPAN supports by default the monitoring of Layer 2 switch protocols. E. ??? Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 15 A question about HSRP with two answers. The spanning-tree operating mode for this switch is IEEE. B. C. D. B. The switch is operating in the default Cisco spanning-tree mode. Correct Answer: DE Section: (none) Explanation Explanation/Reference: QUESTION 14 Which statement about configuring an RSPAN session is true? A.

SW(config)# portchannel etherchannel guard misconfig C.) A. B. LLDP frame contains unicast address within its fields. SW(config-if)# spanning-tree etherchannel guard misconfig . ??? Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 17 Which command do you use to configure EtherChannel guard feature? (How you configure etherchannel guard feature?) A. C. LLDP frame has its own CRC. C. SW(config)# spanning-tree etherchannel guard misconfig B. ??? Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 16 Which two statements about LLDP frames are true? (Choose two. LLDP frame consists of sequence of TLVs. ??? D. LLDP frame sends to multicast address. E. HSRP uses a single address among HSRP group member. D.B. SW(config-if)# portchannel etherchannel guard misconfig D.

C. ??? Correct Answer: C Section: (none) Explanation Explanation/Reference: . the administrator must enter err-disable recovery cause udld command to recover disabled interfaces. A.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 18 A question about root path election. UDLD puts the port in STP inconsistent port mode. load C. A. interface bandwidth B. When a link is repaired. reliability D. interface usage Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 19 EXHIBIT INCLUDED . B. the admistrator must enter udld reset command to recover disabled interfaces. When a link is repaired.A question about UDLD port disable. D.

dat Correct Answer: F Section: (none) Explanation Explanation/Reference: QUESTION 21 Which two commands or combination of commands make native VLAN 99 tagged? (Choose two. FLASH: vlan. encapsulation dot1q tag native vlan 99 E. encapsulation dot1q 99 native Correct Answer: BE Section: (none) Explanation Explanation/Reference: .xml C. vlan dot1q tag native vlan 99 C. vlan dot1q tag native B. FLASH: vlan.txt D. NVRAM: vlan.dat F.xml B.txt E.QUESTION 20 In which place does all VLANs get stored? (In which place all VLAN are stored?) A. NVRAM: vlan. interface fa0/1 switchport trunk native vlan 99 D. NVRAM: vlan.) A. FLASH: vlan.

) . switch(config-if)# spanning-tree loop guard default C. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 23 Which two commands enable loop guard on a Cisco switch? (Choose two. D. switch(config-if)# spanning-tree loopguard E. It detected a peer with a matching duplex. It detected a collision. B. C. switch(config-if)# spanning-tree guard loop B.QUESTION 22 Which two circumstances can cause a port to errdisable? (Choose two. The switch incurred a port security violation. E. switch(config)# spanning-tree loop guard default D. It is connected to a host with an NIC that is unable to recognize.) A. switch(config)# spanning-tree loopguard default Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 24 Which two statements about VTP modes are true? (Choose two.) A. It learned a new MAC address.

E. It supports both homogeneous and mixed stacks. it is enabled for the entire management domain. Private VLANs are supported on devices that run VTP version 2 in transparent mode.) A. When VTP pruning is enabled on a VTP server. C. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 25 Which two statements about Cisco StackWise are true? (Choose two. Private VLANs are supported on devices that run any version of VTP in server mode. Extended VLANs are supported only on devices that run VTP version 3 in client mode. B. destination MAC address C. E. C. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 26 A single server in a company is connected via EtherChannel to a single upstream switch.A. D. D. Extended VLANs are supported only on devices that run VTP version 3 in server mode. source and destination MAC address B. Each stack identifier (or identifies) a stack master and a backup stack master. The LAN base feature set is supported on mixed stacks. B. Stacks running the LAN base feature set support Layer 3 features. It supports multiple switches in a stack. Which EtherChannel load balancing method on the switch makes optimal use of the redundant links as traffic flows from the router to the server? A. source IP address .

source MAC address Correct Answer: A Section: (none) Explanation Explanation/Reference: .D.